Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
USD 510,800.bat.exe

Overview

General Information

Sample name:USD 510,800.bat.exe
Analysis ID:1500269
MD5:6699b6a704f40c24f206f25c3eb801ab
SHA1:25a718491615845ed1529a22799a60b880b62ebc
SHA256:6e16b45647ffa0f8bdf7e97662b51be911fb4470176cbac1b07bd5464cb940ef
Tags:exeRedLineStealer
Infos:

Detection

PureLog Stealer, RedLine, zgRAT
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected zgRAT
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Enables security privileges
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • USD 510,800.bat.exe (PID: 5720 cmdline: "C:\Users\user\Desktop\USD 510,800.bat.exe" MD5: 6699B6A704F40C24F206F25C3EB801AB)
    • USD 510,800.bat.exe (PID: 6400 cmdline: "C:\Users\user\Desktop\USD 510,800.bat.exe" MD5: 6699B6A704F40C24F206F25C3EB801AB)
      • conhost.exe (PID: 6008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • dllhost.exe (PID: 6400 cmdline: C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} MD5: 08EB78E5BE019DF044C26B14703BD1FA)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
NameDescriptionAttributionBlogpost URLsLink
zgRATzgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.2119724895.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
    00000000.00000002.2114514628.0000000004262000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
      00000000.00000002.2114514628.0000000004019000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
        00000000.00000002.2114514628.0000000004095000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
          Process Memory Space: USD 510,800.bat.exe PID: 5720JoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
            Click to see the 1 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.USD 510,800.bat.exe.4283568.4.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
              0.2.USD 510,800.bat.exe.4283568.4.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                0.2.USD 510,800.bat.exe.4283568.4.unpackMALWARE_Win_zgRATDetects zgRATditekSHen
                • 0x43277:$s1: file:///
                • 0x431d3:$s2: {11111-22222-10009-11112}
                • 0x43207:$s3: {11111-22222-50001-00000}
                • 0x40309:$s4: get_Module
                • 0x3ab27:$s5: Reverse
                • 0x3b81f:$s6: BlockCopy
                • 0x3aae6:$s7: ReadByte
                • 0x43289:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
                0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                  0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                    Click to see the 10 entries

                    Sigma Signatures

                    ⊘No Sigma rule has matched

                    Suricata Signatures

                    ⊘No Suricata rule has matched

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Antivirus / Scanner detection for submitted sample
                    Source: USD 510,800.bat.exeAvira: detected
                    Multi AV Scanner detection for submitted file
                    Source: USD 510,800.bat.exeVirustotal: Detection: 35%Perma Link
                    AI detected suspicious sample
                    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                    Machine Learning detection for sample
                    Source: USD 510,800.bat.exeJoe Sandbox ML: detected
                    Source: USD 510,800.bat.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: USD 510,800.bat.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.00000000033FD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.00000000033FD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\ equals www.youtube.com (Youtube)
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.00000000033FD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.00000000033FD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\ equals www.youtube.com (Youtube)
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://cacerts.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crt0
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://crl3.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0H
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://crl4.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://ocsp.digicert.com0
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://ocsp.digicert.com0:
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://ocsp.digicert.com0H
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://ocsp.digicert.com0I
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://ocsp.digicert.com0Q
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://ocsp.msocsp.com0
                    Source: WebCacheV01.dat.7.drString found in binary or memory: http://ocsp.msocsp.com0S
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://www.digicert.com/CPS0
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: http://www.digicert.com/CPS0~
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EL
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003373000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ip.s
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003373000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ip.sb/ip
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://config.edge.skype.com/config/v1/ODSP_Sync_Client/19.043.0304.0013?UpdateRing=Prod&OS=Win&OSV
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003440000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v9/users/
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://fp-afd.azureedge.net/apc/trans.gif?0684adfa5500b3bab63593997d26215c
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://fp-afd.azureedge.net/apc/trans.gif?79b1312614e5ac304828ba5e1fdb4fa3
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?7ae939fc98ce1346dd2e496abdba2d3b
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?9f3db9405f1b2793ad8d8de9770248e4
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?4aec53910de6415b25f2c4faf3f7e54a
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?77290711a5e44a163ac2e666ad7b53fd
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://fp.msedge.net/conf/v1/asgw/fpconfig.min.json
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://fp.msedge.net/conf/v2/asgw/fpconfig.min.json?monitorId=asgw
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-09-17-00-05-23/PreSignInSettingsConfig.json?One
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2023-10-05-06-30-24/PreSignInSettingsConfig.json?One
                    Source: WebCacheV01.dat.7.dr, V01.log.7.drString found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2023-10-05-06-40-12/PreSignInSettingsConfig.json
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/update100.xml?OneDriveUpdate=14d1c105224b3e736c3c
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/741e3e8c607c445262f3add0e58b18f19e0502af.xml?OneDriveUpdate=7fe112
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/ew-preload-inline-2523c8c1505f1172be19.js
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-104bffe9378b8041455c.js
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-35de8a913e.css
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7.css
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bootstrap-5e7af218e953d095fabf.js
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-3a99f64809c6780df035.js
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-994d8943fc9264e2f8d3.css
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-fluent~left-nav-rc.ac5cfbeadfd63fc27ffd.chunk.v7.js
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-forms-group~mru~officeforms-group-forms~officeforms
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7.js
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-mru.2ce72562ad7c0ae7059c.chunk.v7.js
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendor-bundle-ba2888a24179bf152f3d.js
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.169ce481376dceef3ef6.chunk.v7.c
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7.j
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwaunauth-9d8bc214ac.css
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedfontstyles-27fa2598d8.css
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedscripts-939520eada.js
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticpwascripts-30998bff8f.js
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticstylesfabric-35c34b95e3.css
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/hero-image-desktop-f6720a4145.jpg
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/lockup-mslogo-color-78c06e8898.png
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/microsoft-365-logo-01d5ecd01a.png
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-apps-image-46596a6856.png
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-checkmark-image-1999f0bf81.png
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/officehome/thirdpartynotice.html
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_regular.woff2
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_semibold.woff2
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://www.digicert.com/CPS0
                    Source: WebCacheV01.dat.7.drString found in binary or memory: https://www.office.com/
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003565000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: GetRawInputDatamemstr_75896a0d-4

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 3.2.USD 510,800.bat.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    .NET source code contains very large array initializations
                    Source: USD 510,800.bat.exe, Token.csLarge array initialization: : array initializer size 913547
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 0_2_0133DFF40_2_0133DFF4
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 0_2_054800400_2_05480040
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 0_2_054800060_2_05480006
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 0_2_05553D500_2_05553D50
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 0_2_05553D600_2_05553D60
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 3_2_0312745B3_2_0312745B
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 3_2_031274683_2_03127468
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess token adjusted: SecurityJump to behavior
                    Source: USD 510,800.bat.exe, 00000000.00000002.2114514628.0000000004262000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs USD 510,800.bat.exe
                    Source: USD 510,800.bat.exe, 00000000.00000002.2114514628.0000000004262000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameOomiack.exe" vs USD 510,800.bat.exe
                    Source: USD 510,800.bat.exe, 00000000.00000002.2113675143.0000000003011000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs USD 510,800.bat.exe
                    Source: USD 510,800.bat.exe, 00000000.00000000.2101129830.0000000000BFA000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameKhac.exeB vs USD 510,800.bat.exe
                    Source: USD 510,800.bat.exe, 00000000.00000002.2114514628.0000000004095000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameOomiack.exe" vs USD 510,800.bat.exe
                    Source: USD 510,800.bat.exe, 00000000.00000002.2114514628.0000000004095000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs USD 510,800.bat.exe
                    Source: USD 510,800.bat.exe, 00000000.00000002.2117064513.0000000005990000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs USD 510,800.bat.exe
                    Source: USD 510,800.bat.exe, 00000000.00000002.2113675143.000000000305B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs USD 510,800.bat.exe
                    Source: USD 510,800.bat.exe, 00000000.00000002.2118392579.0000000005A50000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs USD 510,800.bat.exe
                    Source: USD 510,800.bat.exe, 00000000.00000002.2111567531.00000000010AE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs USD 510,800.bat.exe
                    Source: USD 510,800.bat.exe, 00000003.00000002.2119724895.0000000000456000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: OriginalFilenameOomiack.exe" vs USD 510,800.bat.exe
                    Source: USD 510,800.bat.exeBinary or memory string: OriginalFilenameKhac.exeB vs USD 510,800.bat.exe
                    Source: USD 510,800.bat.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 3.2.USD 510,800.bat.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: USD 510,800.bat.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, Strings.csCryptographic APIs: 'CreateDecryptor'
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, A2H1lUZ15GsIooGy4G.csCryptographic APIs: 'CreateDecryptor'
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, A2H1lUZ15GsIooGy4G.csCryptographic APIs: 'CreateDecryptor'
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, Strings.csCryptographic APIs: 'CreateDecryptor'
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, A2H1lUZ15GsIooGy4G.csCryptographic APIs: 'CreateDecryptor'
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, A2H1lUZ15GsIooGy4G.csCryptographic APIs: 'CreateDecryptor'
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, Strings.csBase64 encoded string: 'LTw5FwspQj0ZLBEuIycNLzlTBTUkCAgHNQUuRx5JPgAnJCF9HTMNBzpBej8tNicZJCE2MywAVAoYLERc'
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, Strings.csBase64 encoded string: 'LTw5FwspQj0ZLBEuIycNLzlTBTUkCAgHNQUuRx5JPgAnJCF9HTMNBzpBej8tNicZJCE2MywAVAoYLERc'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, tQ7q88JIySVyKBimab.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, iQ03tcc2OTqPJfAISw.csSecurity API names: _0020.SetAccessControl
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, iQ03tcc2OTqPJfAISw.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, iQ03tcc2OTqPJfAISw.csSecurity API names: _0020.AddAccessRule
                    Source: classification engineClassification label: mal100.troj.evad.winEXE@5/4@0/0
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\USD 510,800.bat.exe.logJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeMutant created: NULL
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6008:120:WilError_03
                    Source: USD 510,800.bat.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: USD 510,800.bat.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: USD 510,800.bat.exeVirustotal: Detection: 35%
                    Source: unknownProcess created: C:\Users\user\Desktop\USD 510,800.bat.exe "C:\Users\user\Desktop\USD 510,800.bat.exe"
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess created: C:\Users\user\Desktop\USD 510,800.bat.exe "C:\Users\user\Desktop\USD 510,800.bat.exe"
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess created: C:\Users\user\Desktop\USD 510,800.bat.exe "C:\Users\user\Desktop\USD 510,800.bat.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: dwrite.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: dwrite.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeSection loaded: textshaping.dllJump to behavior
                    Source: C:\Windows\System32\dllhost.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\System32\dllhost.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\System32\dllhost.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\System32\dllhost.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\System32\dllhost.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\System32\dllhost.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\System32\dllhost.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\System32\dllhost.exeSection loaded: esent.dllJump to behavior
                    Source: C:\Windows\System32\dllhost.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\System32\dllhost.exeSection loaded: powrprof.dllJump to behavior
                    Source: C:\Windows\System32\dllhost.exeSection loaded: umpdc.dllJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                    Source: USD 510,800.bat.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                    Source: USD 510,800.bat.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                    Data Obfuscation

                    barindex
                    .NET source code contains method to dynamically call methods (often used by packers)
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, A2H1lUZ15GsIooGy4G.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, A2H1lUZ15GsIooGy4G.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                    .NET source code contains potential unpacker
                    Source: USD 510,800.bat.exe, Form1.cs.Net Code: InitializeComponent
                    Source: 0.2.USD 510,800.bat.exe.5990000.5.raw.unpack, .cs.Net Code: System.Reflection.Assembly.Load(byte[])
                    Source: 0.2.USD 510,800.bat.exe.3038978.1.raw.unpack, .cs.Net Code: System.Reflection.Assembly.Load(byte[])
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, iQ03tcc2OTqPJfAISw.cs.Net Code: hLqftC88FO System.Reflection.Assembly.Load(byte[])
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 0_2_0133EDE0 push eax; retf 0_2_0133EDE1
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 0_2_054876E2 pushfd ; retf 0_2_054876E9
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 0_2_05487686 pushfd ; retf 0_2_0548768D
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 0_2_054876B6 pushfd ; retf 0_2_054876B7
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 0_2_05551B78 pushfd ; ret 0_2_05551B81
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeCode function: 3_2_031201A5 push esp; iretd 3_2_031201B3
                    Source: USD 510,800.bat.exeStatic PE information: section name: .text entropy: 7.988437033653444
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, UserExt.csHigh entropy of concatenated method names: '_003CDomainExists_003Eb__2', 'uGZ3AARU2kaRZCSD349', 'vWjZ1DRWbXNe65HHpQe', 'DomainExists', 'PreCheck', 'ripQSKpjIhEqlMk7vJr', 'r650OrpVX87t9m91xXF', 'crBPB9pceZZsReUclGg', 'seSbVTpnwVS9Ie3T1ot', 'mcCr0rp2Miv4A55EKWQ'
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, SystemInfoHelper.csHigh entropy of concatenated method names: '_003CCloseBrowser_003Eb__1', 'WUQsKHR3RTIx8k4UfWJ', 'j0JLoCRvSewWjI5U271', 'WjlP1dRy5O9eqKCqwYb', 'ShowMessage', 'CloseBrowser', 'Add', 'GetProcessors', 'GetGraphicCards', 'GetBrowsers'
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, FieldRootRoot.csHigh entropy of concatenated method names: 'Field1', 'J7orWnXHYZc3Olrr5iY', 'C2qGIvXmKFwT5QNGx2L', 'i9MBE6XRH5t6ll1JfTQ', 'dsrkmBXABYCcXYO0xop', 'qIirJrXL2Nyokbp5dLX', 'qabHUrX4D9R9dE0M78Q', 'nSvU3RXDs21VC7Vw3dR', 'oqjsXAXlILK1vkN0cI8', 'b65G9vXCyKDhQb8vmWk'
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, CryptoHelper.csHigh entropy of concatenated method names: 'GetDecoded', 'DecryptBlob', 'cryptUnprotectData', 'GetMd5Hash', 'GetHexString', 'c0VUeFpoBTZ1YjTKOYk', 'HPgwO4pMLi2Ijmb9v2u', 'hqEGxmpKioL8tsdhBYN', 'V7S5QKpJsX6waaV4wtT', 'UZ9iWZpGQuSHt7GV85x'
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, BerkeleyDB.csHigh entropy of concatenated method names: 'Extract', 'YPGXHApO1ZkXLYnqRLC', 'fxQdebp3q82H18WBUmT', 'aiMXtQpvmRVijB4xOVk', 'qMaqXlpyfNgnvmmd6uJ', 'bRpJ6Ip5LBgxuWyO2Wu', 'cNkZQqpIlpN4dZsY742'
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, TripleDes.csHigh entropy of concatenated method names: 'ComputeVoid', 'Compute', 'DecryptStringDesCbc', 'DecryptByteDesCbc', 'Ja1O4Glu6mnZ3xW7YIw', 'mUDfPklEDDJoSvxrde3', 'i7PNwalaj9Y2j7B13JB', 'kEmSR6lPHOhhLgWMxTT', 'UJ6Ru8l1shO84oY6evZ', 'JEjWrQl81QCVFOXQKSK'
                    Source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, A2H1lUZ15GsIooGy4G.csHigh entropy of concatenated method names: 'QgSfOIAomjlahH9eGMo', 'KANouAAJy7Yb7rBOoh9', 'LtQPyoxJn7', 'HE4qJIAufHBgctr1G6O', 'QVwfErAELsKNTyrOsSo', 'g38PJ8K3c0', 'AZCPHbxqQi', 'kjCPpoa2Hi', 'zssPO0JXVk', 'wmTPVkxu9Y'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, b9vZDQ2CShfWG9amQb.csHigh entropy of concatenated method names: 'C9bHyKkga2', 'G0SHIdMMLo', 'ieWHfK7Wi2', 'b22HOUhEmU', 'zUXHsBdgvC', 'UhHHB9lyrW', 'xKYHKiIGEH', 'zeeZwgKHnF', 'd5dZD8xYc7', 'AfkZ5Axj0G'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, afeKGa7bO0AALoofVb.csHigh entropy of concatenated method names: 'QrBx9puJQX', 'gykxj3F8EL', 'ToString', 'ab6xO1bkY5', 'hQ4xsfHIwW', 'c1NxuRHXjJ', 'dJ9xBdeAY8', 'cyrxKUkHmc', 'FNUxGXfbds', 'Aomxc0HWbN'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, iQ03tcc2OTqPJfAISw.csHigh entropy of concatenated method names: 'aWwIQk2Gm7', 'BBgIOOTNWg', 'YIWIscZtLi', 'WWuIu85CXO', 'KEvIBYdW1x', 'ckYIKpUEfM', 'JVOIGeKSwX', 'NPgIcDpHgY', 'NXNIA1PjTO', 'uM6I9A3vTk'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, tf234IFyMtim8Ca4lE.csHigh entropy of concatenated method names: 'CCEGOYVHJ6', 'rd6Gu4bAPb', 'g8aGKlpg0f', 'PL2K2ILipE', 's9fKzrsOy3', 'wX4GrVrnFj', 'SqcGyvunBr', 'iYwGeSC2Km', 'nrDGI6s1S7', 'Hp1GfIGp21'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, jYK3Cfvh0ECfW80pCW.csHigh entropy of concatenated method names: 'fQK4JmpCwQ', 'LvJ40QsS3U', 'y5L4VrmDg6', 'caB4EoPbw0', 'mVf4U1iNXU', 'Ulb41ePxyX', 'vvq4FXkQ7P', 'MEc4Skp0hg', 'ccN4NYxCKF', 'bc74YDQCsE'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, Xxxx2hn4ru4MW6ARb8.csHigh entropy of concatenated method names: 'P6iB3kCmun', 'X04B8ucrlX', 'zHiuoZwTJV', 'BleuUP1DID', 'muju16F6qC', 'KwpuqZZvRO', 'WHMuFgdWpt', 'URcuSsL2xM', 'PASuTmcgOM', 'qpsuN4kNDF'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, numrEW5ikObhr6piXJ.csHigh entropy of concatenated method names: 'YoRZVK5vqF', 'CmIZExWOO5', 'KyoZo59Pon', 'leHZU8lSMJ', 'xInZpjd5Lb', 'of5Z1EDcHW', 'Next', 'Next', 'Next', 'NextBytes'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, cUsw8I0YsSq9m1Zqdl.csHigh entropy of concatenated method names: 'yEwugQ0Ddg', 'wEEuheUaUj', 'IyDuJchck2', 'jWJu02mBaw', 'manuR7Ym50', 'TRguMOgWGr', 'zZnuxXbr5c', 'W5HuZqWYFa', 'FFouHCslcn', 'CU0u6y2B0k'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, o0dWdvff6sxgt8XkmW.csHigh entropy of concatenated method names: 'subyGQ7q88', 'dySycVyKBi', 'cYsy9Sq9m1', 'qqdyjl5xxx', 'sARyRb8IwY', 'wUgyMPLnOR', 'UB0GPJnK53hvqN4Ndb', 'FTXkVy5PT83tCRO05M', 'qgSyyV18ET', 'vLoyIeu5Pq'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, lA455Vzxc0349hpxS3.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zCnH4oUGyI', 'FDtHRmKMPh', 'mWWHMWLiTv', 'vYqHxYDq6P', 'it9HZ22UgB', 'HK9HHxUWmk', 'ByJH63XK5R'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, IFtJ1NDcklb9r2DMAb.csHigh entropy of concatenated method names: 'voAZOQnhm6', 'CRZZsh905f', 'LMNZufuhMp', 'EL3ZB3NM08', 'iv5ZKcriyn', 'tA7ZGcwuNv', 'TjwZcAZ23s', 'aejZAP2Hjv', 'j6EZ9P4qyn', 'RpBZjG2yLP'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, B7Q61NexYpHCCnP8bj.csHigh entropy of concatenated method names: 'tPTtUd92v', 'GeXgK9L3X', 'DIbhsnVyv', 'hXD8MWqjm', 'dKl0NC4M4', 'MAAnui4cB', 'GDQNhqKtmr2xJTowxP', 'It5QT8Vql27tpgAJtk', 'ug5Z7w8xj', 'WBj6KMQre'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, tQ7q88JIySVyKBimab.csHigh entropy of concatenated method names: 'Efgspq68JS', 'jLNsdOhpsB', 'dpXsaCLRH0', 'KLXs7EDyYo', 'iA9smBfFRl', 'GmcsiHlhnH', 'oCUswYIDAd', 'KVLsDU0inl', 'EMOs5HQFan', 'Yibs2QCpL2'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, hMhkXFTCIP2GfpRM1D.csHigh entropy of concatenated method names: 'PZZGWyjWHy', 'GsUGPY3B6R', 'SehGt3I9W9', 'im4GgMgy5a', 'jpPG3dau9m', 'pjnGh70efS', 'givG8l8oND', 'ONsGJXWiTM', 'TxvG0B9FfF', 'DyuGnkXZtg'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, AO8wsHyIATntVSU2icM.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'c8X6p44SD7', 'C9a6dqQE6O', 'Pr96a886n4', 'nrk67snTmI', 'W2I6mIXFmv', 'Tpn6iNdC2s', 'ojw6wvRal9'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, qfDQJ1yrgG4rKJAQJTV.csHigh entropy of concatenated method names: 'Wi8HWnvH18', 'xOuHP0Y09C', 'chVHt6WqPV', 'bfMHgRHELc', 'EMgH3xC9aD', 'eNHHh1HnuL', 'LQHH8rUB11', 'e1rHJkTQLd', 'eAkH04CKhn', 'cDFHncURMb'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, dCTlrHpr6AlWHx5h33.csHigh entropy of concatenated method names: 'JxvRNPGSDJ', 'HvDRXfySUV', 'eYpRpZlxab', 'qJCRdjPuhd', 'vYmREY2cjT', 'FEWRo3v0oD', 'TM9RUk7vi6', 'zC2R1DSlLb', 'TRlRqMow63', 'hwlRFxjrnw'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, hbekMmyyvyogqb11gpV.csHigh entropy of concatenated method names: 'ToString', 'qlK6Ibr7ZH', 'SZP6f8gkxX', 'REQ6QAKeqj', 'YKf6O0cIpb', 'uZS6sZxCbe', 'IPK6uXXOFR', 'rZa6Bc5a40', 'Fc4XuCwXbkLu38y0kq7', 'IBXg4LwuRFA3pHwhD5q'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, NrbT3ZaqHXIsvpic3D.csHigh entropy of concatenated method names: 'ToString', 'xNhMYGmPVd', 'NyMMEJf9Di', 'uP6MoyDQii', 'OtSMUmsGcJ', 'PakM1XeZBk', 'VOyMqhJOxL', 'KOfMFf6YfP', 'w6ZMSD04Pp', 'HobMTCmteZ'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, cwYkUgVPLnORDZnXTp.csHigh entropy of concatenated method names: 'p8iKQl9f1v', 'BEmKsqYAOs', 'LxSKBSUWJ2', 'M6TKGIZWux', 'HZxKclITJI', 'cRQBmwrc8Y', 'poTBiQ0734', 'POgBwW737x', 'oeTBDU86S4', 'nD3B55voif'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, BftyFHs0yNvrIK9Uu2.csHigh entropy of concatenated method names: 'Dispose', 'KkYy5pwPcx', 'g62eEfS9DY', 'iMVOOI9pBg', 'aUFy2tJ1Nc', 'vlbyz9r2DM', 'ProcessDialogKey', 'lb4erumrEW', 'UkOeybhr6p', 'VXJeee9vZD'
                    Source: 0.2.USD 510,800.bat.exe.5a50000.6.raw.unpack, WlOS2giiHwnAjKU64u.csHigh entropy of concatenated method names: 'tKLxD1gtKa', 'go4x2AQAMB', 'Hs8ZrmhYIy', 's3OZyZvMn9', 'kT7xYRMARW', 'SJbxXHIavX', 'lRjxvhqDxF', 'l9TxpMm9Cx', 'NcaxdPfsJ8', 'CH3xaS65tH'
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, UserExt.csHigh entropy of concatenated method names: '_003CDomainExists_003Eb__2', 'uGZ3AARU2kaRZCSD349', 'vWjZ1DRWbXNe65HHpQe', 'DomainExists', 'PreCheck', 'ripQSKpjIhEqlMk7vJr', 'r650OrpVX87t9m91xXF', 'crBPB9pceZZsReUclGg', 'seSbVTpnwVS9Ie3T1ot', 'mcCr0rp2Miv4A55EKWQ'
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, SystemInfoHelper.csHigh entropy of concatenated method names: '_003CCloseBrowser_003Eb__1', 'WUQsKHR3RTIx8k4UfWJ', 'j0JLoCRvSewWjI5U271', 'WjlP1dRy5O9eqKCqwYb', 'ShowMessage', 'CloseBrowser', 'Add', 'GetProcessors', 'GetGraphicCards', 'GetBrowsers'
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, FieldRootRoot.csHigh entropy of concatenated method names: 'Field1', 'J7orWnXHYZc3Olrr5iY', 'C2qGIvXmKFwT5QNGx2L', 'i9MBE6XRH5t6ll1JfTQ', 'dsrkmBXABYCcXYO0xop', 'qIirJrXL2Nyokbp5dLX', 'qabHUrX4D9R9dE0M78Q', 'nSvU3RXDs21VC7Vw3dR', 'oqjsXAXlILK1vkN0cI8', 'b65G9vXCyKDhQb8vmWk'
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, CryptoHelper.csHigh entropy of concatenated method names: 'GetDecoded', 'DecryptBlob', 'cryptUnprotectData', 'GetMd5Hash', 'GetHexString', 'c0VUeFpoBTZ1YjTKOYk', 'HPgwO4pMLi2Ijmb9v2u', 'hqEGxmpKioL8tsdhBYN', 'V7S5QKpJsX6waaV4wtT', 'UZ9iWZpGQuSHt7GV85x'
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, BerkeleyDB.csHigh entropy of concatenated method names: 'Extract', 'YPGXHApO1ZkXLYnqRLC', 'fxQdebp3q82H18WBUmT', 'aiMXtQpvmRVijB4xOVk', 'qMaqXlpyfNgnvmmd6uJ', 'bRpJ6Ip5LBgxuWyO2Wu', 'cNkZQqpIlpN4dZsY742'
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, TripleDes.csHigh entropy of concatenated method names: 'ComputeVoid', 'Compute', 'DecryptStringDesCbc', 'DecryptByteDesCbc', 'Ja1O4Glu6mnZ3xW7YIw', 'mUDfPklEDDJoSvxrde3', 'i7PNwalaj9Y2j7B13JB', 'kEmSR6lPHOhhLgWMxTT', 'UJ6Ru8l1shO84oY6evZ', 'JEjWrQl81QCVFOXQKSK'
                    Source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, A2H1lUZ15GsIooGy4G.csHigh entropy of concatenated method names: 'QgSfOIAomjlahH9eGMo', 'KANouAAJy7Yb7rBOoh9', 'LtQPyoxJn7', 'HE4qJIAufHBgctr1G6O', 'QVwfErAELsKNTyrOsSo', 'g38PJ8K3c0', 'AZCPHbxqQi', 'kjCPpoa2Hi', 'zssPO0JXVk', 'wmTPVkxu9Y'
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\dllhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                    Malware Analysis System Evasion

                    barindex
                    Yara detected AntiVM3
                    Source: Yara matchFile source: Process Memory Space: USD 510,800.bat.exe PID: 5720, type: MEMORYSTR
                    Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003440000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \QEMU-GA.EXE`,
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003440000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \QEMU-GA.EXE
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003440000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \QEMU-GA.EXE@\
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeMemory allocated: 1330000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeMemory allocated: 3010000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeMemory allocated: 2E20000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeMemory allocated: 7EA0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeMemory allocated: 7510000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeMemory allocated: 8EA0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeMemory allocated: 9EA0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeMemory allocated: 30E0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeMemory allocated: 3310000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeMemory allocated: 3160000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exe TID: 6500Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exe TID: 7072Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Windows\System32\dllhost.exeFile opened: PhysicalDrive0Jump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003440000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \qemu-ga.exe
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003440000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \qemu-ga.exe`,
                    Source: WebCacheV01.dat.7.drBinary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003440000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \qemu-ga.exe@\
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeMemory allocated: page read and write | page guardJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeProcess created: C:\Users\user\Desktop\USD 510,800.bat.exe "C:\Users\user\Desktop\USD 510,800.bat.exe"Jump to behavior
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003565000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: GetProgmanWindow
                    Source: USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003565000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SetProgmanWindow
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeQueries volume information: C:\Users\user\Desktop\USD 510,800.bat.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeQueries volume information: C:\Users\user\Desktop\USD 510,800.bat.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformationJump to behavior
                    Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformationJump to behavior
                    Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformationJump to behavior
                    Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformationJump to behavior
                    Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformationJump to behavior
                    Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log VolumeInformationJump to behavior
                    Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk VolumeInformationJump to behavior
                    Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformationJump to behavior
                    Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm VolumeInformationJump to behavior
                    Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformationJump to behavior
                    Source: C:\Windows\System32\dllhost.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\USD 510,800.bat.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                    Stealing of Sensitive Information

                    barindex
                    Yara detected PureLog Stealer
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4283568.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4032ec8.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 3.2.USD 510,800.bat.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000003.00000002.2119724895.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.2114514628.0000000004262000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.2114514628.0000000004019000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.2114514628.0000000004095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Yara detected RedLine Stealer
                    Source: Yara matchFile source: Process Memory Space: USD 510,800.bat.exe PID: 6400, type: MEMORYSTR
                    Yara detected zgRAT
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4283568.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4032ec8.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 3.2.USD 510,800.bat.exe.400000.0.unpack, type: UNPACKEDPE

                    Remote Access Functionality

                    barindex
                    Yara detected PureLog Stealer
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4283568.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4032ec8.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 3.2.USD 510,800.bat.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000003.00000002.2119724895.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.2114514628.0000000004262000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.2114514628.0000000004019000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.2114514628.0000000004095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Yara detected RedLine Stealer
                    Source: Yara matchFile source: Process Memory Space: USD 510,800.bat.exe PID: 6400, type: MEMORYSTR
                    Yara detected zgRAT
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4283568.4.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4032ec8.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4283568.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.USD 510,800.bat.exe.4032ec8.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 3.2.USD 510,800.bat.exe.400000.0.unpack, type: UNPACKEDPE

                    Mitre Att&ck Matrix

                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
                    DLL Side-Loading                    		12
                    Process Injection                    		1
                    Masquerading                    		11
                    Input Capture                    		111
                    Security Software Discovery                    		Remote Services11
                    Input Capture                    		1
                    Encrypted Channel                    		Exfiltration Over Other Network MediumAbuse Accessibility Features
                    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
                    DLL Side-Loading                    		1
                    Disable or Modify Tools                    		LSASS Memory1
                    Process Discovery                    		Remote Desktop Protocol11
                    Archive Collected Data                    		Junk DataExfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)41
                    Virtualization/Sandbox Evasion                    		Security Account Manager41
                    Virtualization/Sandbox Evasion                    		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook12
                    Process Injection                    		NTDS22
                    System Information Discovery                    		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                    Deobfuscate/Decode Files or Information                    		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts21
                    Obfuscated Files or Information                    		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items22
                    Software Packing                    		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                    DLL Side-Loading                    		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    USD 510,800.bat.exe35%VirustotalBrowse
                    USD 510,800.bat.exe100%AviraTR/Dropper.MSIL.Gen
                    USD 510,800.bat.exe100%Joe Sandbox ML

                    Dropped Files

                    ⊘No Antivirus matches

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    https://api.ip.sb/ip0%URL Reputationsafe
                    https://api.ip.sb/ip0%URL Reputationsafe
                    https://aefd.nelreports.net/api/report?cat=bingaot0%URL Reputationsafe
                    https://aefd.nelreports.net/api/report?cat=bingth0%URL Reputationsafe
                    https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat0%URL Reputationsafe
                    https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat0%URL Reputationsafe
                    https://aefd.nelreports.net/api/report?cat=wsb0%URL Reputationsafe
                    https://aefd.nelreports.net/api/report?cat=bingrms0%URL Reputationsafe
                    https://aefd.nelreports.net/api/report?cat=bingrms0%URL Reputationsafe
                    https://api.ip.s0%URL Reputationsafe
                    https://aefd.nelreports.net/api/report?cat=bingaotak0%URL Reputationsafe
                    https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg0%URL Reputationsafe
                    https://deff.nelreports.net/api/report?cat=msn0%URL Reputationsafe
                    https://deff.nelreports.net/api/report?cat=msn0%URL Reputationsafe
                    https://www.office.com/0%Avira URL Cloudsafe
                    https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EL0%Avira URL Cloudsafe
                    https://discord.com/api/v9/users/0%Avira URL Cloudsafe
                    https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&0%Avira URL Cloudsafe
                    https://discord.com/api/v9/users/0%VirustotalBrowse
                    https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EL0%VirustotalBrowse
                    https://www.office.com/0%VirustotalBrowse

                    Domains and IPs

                    Contacted Domains

                    ⊘No contacted domains info

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    https://www.office.com/WebCacheV01.dat.7.drfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://api.ip.sb/ipUSD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003373000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=ELWebCacheV01.dat.7.drfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://aefd.nelreports.net/api/report?cat=bingaotWebCacheV01.dat.7.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://aefd.nelreports.net/api/report?cat=bingthWebCacheV01.dat.7.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&platWebCacheV01.dat.7.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    https://discord.com/api/v9/users/USD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003440000.00000004.00000800.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    https://aefd.nelreports.net/api/report?cat=wsbWebCacheV01.dat.7.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://aefd.nelreports.net/api/report?cat=bingrmsWebCacheV01.dat.7.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    https://api.ip.sUSD 510,800.bat.exe, 00000003.00000002.2121646623.0000000003373000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://aefd.nelreports.net/api/report?cat=bingaotakWebCacheV01.dat.7.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svgWebCacheV01.dat.7.drfalse
                    • URL Reputation: safe
                    		unknown
                    https://deff.nelreports.net/api/report?cat=msnWebCacheV01.dat.7.dr, V01.log.7.drfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&WebCacheV01.dat.7.drfalse
                    • Avira URL Cloud: safe
                    		unknown

                    World Map of Contacted IPs

                    ⊘No contacted IP infos

                    General Information

                    Joe Sandbox version:40.0.0 Tourmaline
                    Analysis ID:1500269
                    Start date and time:2024-08-28 06:56:05 +02:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 5m 51s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:10
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Sample name:USD 510,800.bat.exe
                    Detection:MAL
                    Classification:mal100.troj.evad.winEXE@5/4@0/0
                    EGA Information:
                    • Successful, ratio: 100%
                    HCA Information:
                    • Successful, ratio: 98%
                    • Number of executed functions: 107
                    • Number of non-executed functions: 5
                    Cookbook Comments:
                    • Found application associated with file extension: .exe

                    Warnings

                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                    • Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    00:56:54API Interceptor1x Sleep call for process: USD 510,800.bat.exe modified
                    00:57:11API Interceptor1x Sleep call for process: dllhost.exe modified

                    Joe Sandbox View / Context

                    IPs

                    ⊘No context

                    Domains

                    ⊘No context

                    ASNs

                    ⊘No context

                    JA3 Fingerprints

                    ⊘No context

                    Dropped Files

                    ⊘No context

                    Created / dropped Files

                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\USD 510,800.bat.exe.log

                    Download File
                    Process:C:\Users\user\Desktop\USD 510,800.bat.exe
                    File Type:ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):1216
                    Entropy (8bit):5.34331486778365
                    Encrypted:false
                    SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                    MD5:1330C80CAAC9A0FB172F202485E9B1E8
                    SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                    SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                    SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                    Malicious:true
                    Reputation:high, very likely benign file
                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                    C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.log

                    Download File
                    Process:C:\Windows\System32\dllhost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):524288
                    Entropy (8bit):2.2888371872859294
                    Encrypted:false
                    SSDEEP:1536:jG5pG9g1Ui91X2dQlp6gOnrJOnoeOQ2fQdDQX2khHB1eO5o4QOGSvi1Gk:jG5qg1Ui91X2M6tnrQnvu1R5Lfvi
                    MD5:D9B7602B98FEEE4DCCF89D797CF0088C
                    SHA1:87E0BDB591297C898CCE516C04601F9E3C424C8B
                    SHA-256:E96A19E577D59BD1FD07A1BA2D42C071D0735896DF0871FF1A1804590A63EEBE
                    SHA-512:F0492511D6D1D26353C3EEE53F13CCDEA6A6460D5E8F53F57713A09B155D35F3EE29DD61B57B0C830627ADD17C726E6AB10E372A62687D5D15A14F5CE6DD304B
                    Malicious:false
                    Reputation:low
                    Preview:...............+...{o..!...{..........<...T.;....{..................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\..........................................................................................................................................................................................................C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\...........................................................................................................................................................................................................0u.............................................y..............Tz+.#......... ..........Y.......h.z.......x.......gN;....{..................C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.W.e.b.C.a.c.h.e.\.W.e.b.C.a.c.h.e.V.0.1...d.a.t......................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

                    Download File
                    Process:C:\Windows\System32\dllhost.exe
                    File Type:Extensible storage user DataBase, version 0x620, checksum 0x79636fb0, page size 32768, DirtyShutdown, Windows version 10.0
                    Category:dropped
                    Size (bytes):17301504
                    Entropy (8bit):1.0266757776583522
                    Encrypted:false
                    SSDEEP:6144:bvQPYV7AyUO+xBGA611GJxBGA611Gv0M6JWX3XX35X3khTAzhTA/hTATX3t8nqkw:QyUZ3F0TcT0TAitKxK/U5/C4Ago
                    MD5:CDC6627C97FB059D2CEFB8D4C7688353
                    SHA1:F85132AE772E29282D29843FC1DBA7E17138E274
                    SHA-256:4FF32CFF450BB543699A4CFC5F9BC67EBFE856ECC26BB993209D848A21DB94C3
                    SHA-512:242AB6955A53C49D3FA1D1F37A9D3486C6A7BF68CE7A61AEF14DC767FE00FC93C317A68C952B63A75D4C2E3FB4271769504DECBA4E7C95AE2B2928C0EA2FC44D
                    Malicious:false
                    Reputation:low
                    Preview:yco.... .......4.........gN;....{........................&....../...{5..9...|..h.(.........................T.;....{..............................................................................................Y...........eJ......n........................................................................................................... ........+...{o..............................................................................................................................................................................................!...{..................................Gl;..9...|......................9...|...........................#......h.(.....................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm

                    Download File
                    Process:C:\Windows\System32\dllhost.exe
                    File Type:OpenPGP Public Key
                    Category:dropped
                    Size (bytes):16384
                    Entropy (8bit):0.13360064485721254
                    Encrypted:false
                    SSDEEP:6:uXy/uucTr8Z/qyi5+xL9wjXlFkFRFlYC0p23nGC:b/uucUZ/qyi5+ULlePFlYC1
                    MD5:C01B83BBB140AE8F06550B72E0B9BACC
                    SHA1:B2BE4254D09D673B45AA664BD0C995D37230FA25
                    SHA-256:D018753801BF2E6BC4CC74DBDFA79DC26A231B0D1ECAF7957AF660CD143B8A56
                    SHA-512:34832FDEC93656286652C8862E887C25BCBADC5FD410A92674EF59A516DB933D3CA9A50C5B5D08AC8B8477C36095F772E64A4B2EF014317EEA4677429497F831
                    Malicious:false
                    Reputation:low
                    Preview:.4......................................;....{...9...|.../...{5..........9...|.../...{5.Gl;..9...|...................p..9...|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    Static File Info

                    General

                    File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                    Entropy (8bit):7.982566078244851
                    TrID:
                    • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                    • Win32 Executable (generic) a (10002005/4) 49.78%
                    • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                    • Win16/32 Executable Delphi generic (2074/23) 0.01%
                    • Generic Win/DOS Executable (2004/3) 0.01%
                    File name:USD 510,800.bat.exe
                    File size:958'464 bytes
                    MD5:6699b6a704f40c24f206f25c3eb801ab
                    SHA1:25a718491615845ed1529a22799a60b880b62ebc
                    SHA256:6e16b45647ffa0f8bdf7e97662b51be911fb4470176cbac1b07bd5464cb940ef
                    SHA512:35636d99ae479a97f6ff85c12decc2ddda8237168cee599c14814c27e0469393ea69711afd72651937027c733585a0697f5561f32ba1d2c185aaf75509a9973e
                    SSDEEP:12288:B6ETVlXcXDudfTASE7gNsOJQE37c+9eJrv+ojkbHWbZMPWOuJgDQTHlDlA9Ohmie:FMX6u8NsOJj9WdjwHlPW7JkQta9vjNA
                    TLSH:2915230A766997F0E03CCE7498A0965A2272E01B7DD3D7BF8CCB2214AF78B585015D6F
                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..f.................l...2........... ........@.. ....................................@................................

                    File Icon

                    Icon Hash:0733a129e9597117

                    Static PE Info

                    General

                    Entrypoint:0x4e8a0e
                    Entrypoint Section:.text
                    Digitally signed:false
                    Imagebase:0x400000
                    Subsystem:windows gui
                    Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                    Time Stamp:0x66CE9A29 [Wed Aug 28 03:31:53 2024 UTC]
                    TLS Callbacks:
                    CLR (.Net) Version:
                    OS Version Major:4
                    OS Version Minor:0
                    File Version Major:4
                    File Version Minor:0
                    Subsystem Version Major:4
                    Subsystem Version Minor:0
                    Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                    Entrypoint Preview

                    Instruction
                    jmp dword ptr [00402000h]
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al

                    Data Directories

                    NameVirtual AddressVirtual Size Is in Section
                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                    IMAGE_DIRECTORY_ENTRY_IMPORT0xe89b80x53.text
                    IMAGE_DIRECTORY_ENTRY_RESOURCE0xea0000x3000.rsrc
                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                    IMAGE_DIRECTORY_ENTRY_BASERELOC0xee0000xc.reloc
                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                    Sections

                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                    .text0x20000xe6a140xe6c0019a81d6f5d7c2a4336273ad586da6957False0.9852489335048754data7.988437033653444IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    .rsrc0xea0000x30000x300024e40ed6d7b3b5b0f2e9e37d0e5085a3False0.8290201822916666data7.196477814433287IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                    .reloc0xee0000xc0x200303d5ff1a7c74a7fb6653ee6d0ba34bdFalse0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                    Resources

                    NameRVASizeTypeLanguageCountryZLIB Complexity
                    RT_ICON0xea1000x2490PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9995726495726496
                    RT_GROUP_ICON0xec5a00x14data1.05
                    RT_VERSION0xec5c40x348data0.42142857142857143
                    RT_MANIFEST0xec91c0x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                    Imports

                    DLLImport
                    mscoree.dll_CorExeMain

                    Network Behavior

                    UDP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Aug 28, 2024 06:57:13.372917891 CEST53578911.1.1.1192.168.2.6

                    Statistics

                    CPU Usage

                    Click to jump to process

                    Memory Usage

                    Click to jump to process

                    High Level Behavior Distribution

                    Click to dive into process behavior distribution

                    Behavior

                    Click to jump to process

                    System Behavior

                    General

                    Target ID:0
                    Start time:00:56:54
                    Start date:28/08/2024
                    Path:C:\Users\user\Desktop\USD 510,800.bat.exe
                    Wow64 process (32bit):true
                    Commandline:"C:\Users\user\Desktop\USD 510,800.bat.exe"
                    Imagebase:0xb10000
                    File size:958'464 bytes
                    MD5 hash:6699B6A704F40C24F206F25C3EB801AB
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2114514628.0000000004262000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2114514628.0000000004019000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2114514628.0000000004095000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                    Reputation:low
                    Has exited:true

                    General

                    Target ID:3
                    Start time:00:56:55
                    Start date:28/08/2024
                    Path:C:\Users\user\Desktop\USD 510,800.bat.exe
                    Wow64 process (32bit):true
                    Commandline:"C:\Users\user\Desktop\USD 510,800.bat.exe"
                    Imagebase:0xee0000
                    File size:958'464 bytes
                    MD5 hash:6699B6A704F40C24F206F25C3EB801AB
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000003.00000002.2119724895.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                    Reputation:low
                    Has exited:true

                    General

                    Target ID:4
                    Start time:00:56:55
                    Start date:28/08/2024
                    Path:C:\Windows\System32\conhost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Imagebase:0x7ff66e660000
                    File size:862'208 bytes
                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high
                    Has exited:true

                    General

                    Target ID:7
                    Start time:00:57:11
                    Start date:28/08/2024
                    Path:C:\Windows\System32\dllhost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    Imagebase:0x7ff642ec0000
                    File size:21'312 bytes
                    MD5 hash:08EB78E5BE019DF044C26B14703BD1FA
                    Has elevated privileges:false
                    Has administrator privileges:false
                    Programmed in:C, C++ or other language
                    Reputation:moderate
                    Has exited:false

                    Disassembly

                    Reset < >

                      Execution Graph

                      Execution Coverage:7.8%
                      Dynamic/Decrypted Code Coverage:100%
                      Signature Coverage:0%
                      Total number of Nodes:234
                      Total number of Limit Nodes:13
                      execution_graph 41696 5489019 41708 54874a7 41696->41708 41697 54890a2 41698 5489199 41697->41698 41703 548911a 41697->41703 41699 54871a0 CreateWindowExW 41698->41699 41700 548919b 41699->41700 41701 5489183 41710 54891d2 41701->41710 41720 54871a0 41701->41720 41702 54891ab 41707 54891ce 41702->41707 41728 13386df 41702->41728 41732 133606c 41702->41732 41703->41700 41703->41701 41703->41702 41705 548919f 41707->41710 41711 13386df CreateWindowExW 41707->41711 41712 133606c CreateWindowExW 41707->41712 41708->41696 41708->41697 41715 5486a10 41708->41715 41736 5486a00 41708->41736 41711->41710 41712->41710 41716 5486a1b 41715->41716 41718 13386df CreateWindowExW 41716->41718 41719 133606c CreateWindowExW 41716->41719 41717 548ff56 41717->41708 41718->41717 41719->41717 41721 54871ab 41720->41721 41722 54891ce 41721->41722 41724 13386df CreateWindowExW 41721->41724 41725 133606c CreateWindowExW 41721->41725 41723 54891d2 41722->41723 41726 13386df CreateWindowExW 41722->41726 41727 133606c CreateWindowExW 41722->41727 41723->41705 41724->41722 41725->41722 41726->41723 41727->41723 41729 13386aa 41728->41729 41729->41728 41730 13386ea 41729->41730 41740 133d160 41729->41740 41730->41707 41734 1336077 41732->41734 41733 1338a11 41733->41707 41734->41733 41735 133d160 CreateWindowExW 41734->41735 41735->41733 41737 5486a0b 41736->41737 41738 54871a0 CreateWindowExW 41737->41738 41739 548919f 41738->41739 41739->41708 41742 133d191 41740->41742 41741 133d1b5 41741->41730 41742->41741 41744 133d320 41742->41744 41745 133d32d 41744->41745 41747 133d367 41745->41747 41748 133cc58 41745->41748 41747->41741 41749 133cc63 41748->41749 41751 133dc78 41749->41751 41752 133cd84 41749->41752 41753 133cd8f 41752->41753 41754 133606c CreateWindowExW 41753->41754 41755 133dce7 41754->41755 41759 133fa48 41755->41759 41765 133fa60 41755->41765 41756 133dd21 41756->41751 41761 133fb91 41759->41761 41762 133fa91 41759->41762 41760 133fa9d 41760->41756 41761->41756 41762->41760 41771 5480dc8 41762->41771 41775 5480db8 41762->41775 41767 133fa91 41765->41767 41768 133fb91 41765->41768 41766 133fa9d 41766->41756 41767->41766 41769 5480dc8 CreateWindowExW 41767->41769 41770 5480db8 CreateWindowExW 41767->41770 41768->41756 41769->41768 41770->41768 41772 5480df3 41771->41772 41773 5480ea2 41772->41773 41779 5481b90 41772->41779 41773->41773 41776 5480df3 41775->41776 41777 5480ea2 41776->41777 41778 5481b90 CreateWindowExW 41776->41778 41778->41777 41780 5481b9b 41779->41780 41780->41773 41781 5481db3 CreateWindowExW 41780->41781 41782 5481e14 41781->41782 41859 12ed01c 41860 12ed034 41859->41860 41861 12ed08e 41860->41861 41867 5481ea8 41860->41867 41871 5481e97 41860->41871 41875 5480ad4 41860->41875 41884 5482bd0 41860->41884 41893 5482c09 41860->41893 41868 5481ece 41867->41868 41869 5480ad4 CallWindowProcW 41868->41869 41870 5481eef 41869->41870 41870->41861 41872 5481ece 41871->41872 41873 5480ad4 CallWindowProcW 41872->41873 41874 5481eef 41873->41874 41874->41861 41876 5480adf 41875->41876 41877 5482c79 41876->41877 41879 5482c69 41876->41879 41918 5480bfc 41877->41918 41902 5482e6c 41879->41902 41908 5482da0 41879->41908 41913 5482d90 41879->41913 41880 5482c77 41885 5482bd5 41884->41885 41886 5482c79 41885->41886 41888 5482c69 41885->41888 41887 5480bfc CallWindowProcW 41886->41887 41889 5482c77 41887->41889 41890 5482e6c CallWindowProcW 41888->41890 41891 5482d90 CallWindowProcW 41888->41891 41892 5482da0 CallWindowProcW 41888->41892 41890->41889 41891->41889 41892->41889 41894 5482c45 41893->41894 41895 5482c79 41894->41895 41897 5482c69 41894->41897 41896 5480bfc CallWindowProcW 41895->41896 41898 5482c77 41896->41898 41899 5482e6c CallWindowProcW 41897->41899 41900 5482d90 CallWindowProcW 41897->41900 41901 5482da0 CallWindowProcW 41897->41901 41899->41898 41900->41898 41901->41898 41903 5482e2a 41902->41903 41904 5482e7a 41902->41904 41922 5482e48 41903->41922 41925 5482e58 41903->41925 41905 5482e40 41905->41880 41910 5482db4 41908->41910 41909 5482e40 41909->41880 41911 5482e48 CallWindowProcW 41910->41911 41912 5482e58 CallWindowProcW 41910->41912 41911->41909 41912->41909 41915 5482db4 41913->41915 41914 5482e40 41914->41880 41916 5482e48 CallWindowProcW 41915->41916 41917 5482e58 CallWindowProcW 41915->41917 41916->41914 41917->41914 41919 5480c07 41918->41919 41920 548435a CallWindowProcW 41919->41920 41921 5484309 41919->41921 41920->41921 41921->41880 41923 5482e69 41922->41923 41928 5484292 41922->41928 41923->41905 41926 5482e69 41925->41926 41927 5484292 CallWindowProcW 41925->41927 41926->41905 41927->41926 41929 5480bfc CallWindowProcW 41928->41929 41930 54842aa 41929->41930 41930->41923 41816 1334a50 41817 1334a59 41816->41817 41818 1334a5f 41817->41818 41822 1334b48 41817->41822 41827 1334204 41818->41827 41820 1334a7a 41823 1334b6d 41822->41823 41831 1334c58 41823->41831 41835 1334c48 41823->41835 41828 133420f 41827->41828 41843 1335fec 41828->41843 41830 133737d 41830->41820 41833 1334c7f 41831->41833 41832 1334d5c 41832->41832 41833->41832 41839 1334884 41833->41839 41837 1334c7f 41835->41837 41836 1334d5c 41836->41836 41837->41836 41838 1334884 CreateActCtxA 41837->41838 41838->41836 41840 1335ce8 CreateActCtxA 41839->41840 41842 1335dab 41840->41842 41844 1335ff7 41843->41844 41847 133600c 41844->41847 41846 133741d 41846->41830 41848 1336017 41847->41848 41851 133603c 41848->41851 41850 13374fa 41850->41846 41852 1336047 41851->41852 41853 133606c CreateWindowExW 41852->41853 41854 13375ed 41853->41854 41854->41850 41931 133d680 DuplicateHandle 41932 133d716 41931->41932 41855 548752c 41856 5487536 41855->41856 41857 5486a10 CreateWindowExW 41856->41857 41858 548757b 41857->41858 41783 5550600 41787 5550a39 41783->41787 41792 5550a48 41783->41792 41784 555061f 41788 55509f2 41787->41788 41788->41787 41790 13386df CreateWindowExW 41788->41790 41791 133606c CreateWindowExW 41788->41791 41789 5550aac 41789->41784 41790->41789 41791->41789 41793 5550a76 41792->41793 41795 13386df CreateWindowExW 41793->41795 41796 133606c CreateWindowExW 41793->41796 41794 5550aac 41794->41784 41795->41794 41796->41794 41654 133d438 41655 133d47e GetCurrentProcess 41654->41655 41657 133d4d0 GetCurrentThread 41655->41657 41658 133d4c9 41655->41658 41659 133d50d GetCurrentProcess 41657->41659 41660 133d506 41657->41660 41658->41657 41663 133d543 41659->41663 41660->41659 41661 133d56b GetCurrentThreadId 41662 133d59c 41661->41662 41663->41661 41664 133b0b8 41668 133b1b0 41664->41668 41676 133b1a0 41664->41676 41665 133b0c7 41669 133b1c1 41668->41669 41670 133b1e4 41668->41670 41669->41670 41684 133b438 41669->41684 41688 133b448 41669->41688 41670->41665 41671 133b1dc 41671->41670 41672 133b3e8 GetModuleHandleW 41671->41672 41673 133b415 41672->41673 41673->41665 41677 133b1c1 41676->41677 41678 133b1e4 41676->41678 41677->41678 41682 133b438 LoadLibraryExW 41677->41682 41683 133b448 LoadLibraryExW 41677->41683 41678->41665 41679 133b1dc 41679->41678 41680 133b3e8 GetModuleHandleW 41679->41680 41681 133b415 41680->41681 41681->41665 41682->41679 41683->41679 41685 133b43d 41684->41685 41687 133b481 41685->41687 41692 133abf0 41685->41692 41687->41671 41689 133b45c 41688->41689 41690 133b481 41689->41690 41691 133abf0 LoadLibraryExW 41689->41691 41690->41671 41691->41690 41693 133b628 LoadLibraryExW 41692->41693 41695 133b6a1 41693->41695 41695->41687 41797 5487b95 41809 54874a7 41797->41809 41798 54890a2 41799 5489199 41798->41799 41804 548911a 41798->41804 41800 54871a0 CreateWindowExW 41799->41800 41801 548919b 41800->41801 41802 5489183 41805 54871a0 CreateWindowExW 41802->41805 41807 54891d2 41802->41807 41803 54891ab 41813 54891ce 41803->41813 41814 13386df CreateWindowExW 41803->41814 41815 133606c CreateWindowExW 41803->41815 41804->41801 41804->41802 41804->41803 41806 548919f 41805->41806 41808 5486a00 CreateWindowExW 41808->41809 41809->41798 41809->41808 41810 5486a10 CreateWindowExW 41809->41810 41810->41809 41811 13386df CreateWindowExW 41811->41807 41812 133606c CreateWindowExW 41812->41807 41813->41807 41813->41811 41813->41812 41814->41813 41815->41813

                      Executed Functions

                      Function 0133D428 Relevance: 6.2, APIs: 4, Instructions: 152threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • GetCurrentProcess.KERNEL32 ref: 0133D4B6
                      • GetCurrentThread.KERNEL32 ref: 0133D4F3
                      • GetCurrentProcess.KERNEL32 ref: 0133D530
                      • GetCurrentThreadId.KERNEL32 ref: 0133D589
                      Memory Dump Source
                      • Source File: 00000000.00000002.2112328454.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_1330000_USD 510,800.jbxd
                      Similarity
                      • API ID: Current$ProcessThread
                      • String ID:
                      • API String ID: 2063062207-0
                      • Opcode ID: 3ccc7c254f29f4203e0038089a1e9f2533e9f116e9399b955d35867b39cfd5da
                      • Instruction ID: 31512ba41735110c8b668ecad50b29f7d201e2153730acbef113bb2ce91a7b4d
                      • Opcode Fuzzy Hash: 3ccc7c254f29f4203e0038089a1e9f2533e9f116e9399b955d35867b39cfd5da
                      • Instruction Fuzzy Hash: 476137B090134ADFEB54CFA9D948BEEBBF5EF88318F208059D409A73A1D7346944CB65
                      Function 0133D438 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • GetCurrentProcess.KERNEL32 ref: 0133D4B6
                      • GetCurrentThread.KERNEL32 ref: 0133D4F3
                      • GetCurrentProcess.KERNEL32 ref: 0133D530
                      • GetCurrentThreadId.KERNEL32 ref: 0133D589
                      Memory Dump Source
                      • Source File: 00000000.00000002.2112328454.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_1330000_USD 510,800.jbxd
                      Similarity
                      • API ID: Current$ProcessThread
                      • String ID:
                      • API String ID: 2063062207-0
                      • Opcode ID: ec79c7bffbb6084347c5f9a2e5867b720ac1fa735c7d87cf58cd4545126e613e
                      • Instruction ID: a994d81ef7461c27fdffeada08966d33cc78b46c1a2c838fa5365fc98c691914
                      • Opcode Fuzzy Hash: ec79c7bffbb6084347c5f9a2e5867b720ac1fa735c7d87cf58cd4545126e613e
                      • Instruction Fuzzy Hash: FF5157B0901349DFEB54CFA9D948BEEBBF5EF88318F208059D409A73A0D7346944CB69
                      Function 05481B90 Relevance: 1.7, APIs: 1, Instructions: 240COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 769 5481b90-5481b99 770 5481bfb-5481c39 769->770 771 5481b9b-5481bf7 769->771 772 5481c9b-5481cd0 call 5480aa8 770->772 773 5481c3b-5481c91 770->773 771->770 778 5481cd5-5481cd6 772->778 776 5481cf3-5481d56 773->776 777 5481c93-5481c99 773->777 779 5481d58-5481d5e 776->779 780 5481d61-5481d68 776->780 777->772 778->776 779->780 781 5481d6a-5481d70 780->781 782 5481d73-5481e12 CreateWindowExW 780->782 781->782 784 5481e1b-5481e53 782->784 785 5481e14-5481e1a 782->785 789 5481e60 784->789 790 5481e55-5481e58 784->790 785->784 791 5481e61 789->791 790->789 791->791
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116564363.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5480000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 68df957270da1d38ad67beb11c239683849f00948d973da469e2f63848938aac
                      • Instruction ID: 78008b610b385695ae70392096fccf35e2bc2c24d35d8eeae2105cb64d88c120
                      • Opcode Fuzzy Hash: 68df957270da1d38ad67beb11c239683849f00948d973da469e2f63848938aac
                      • Instruction Fuzzy Hash: 2E9138718093899FCB02DFA5C8545DDBFB1FF0A320F1981ABE844AB262D3789846CF51
                      Function 0133B1B0 Relevance: 1.7, APIs: 1, Instructions: 197COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 792 133b1b0-133b1bf 793 133b1c1-133b1ce call 1339bb8 792->793 794 133b1eb-133b1ef 792->794 800 133b1d0 793->800 801 133b1e4 793->801 796 133b203-133b244 794->796 797 133b1f1-133b1fb 794->797 803 133b251-133b25f 796->803 804 133b246-133b24e 796->804 797->796 849 133b1d6 call 133b438 800->849 850 133b1d6 call 133b448 800->850 801->794 805 133b283-133b285 803->805 806 133b261-133b266 803->806 804->803 811 133b288-133b28f 805->811 808 133b271 806->808 809 133b268-133b26f call 133ab94 806->809 807 133b1dc-133b1de 807->801 810 133b320-133b3e0 807->810 813 133b273-133b281 808->813 809->813 842 133b3e2-133b3e5 810->842 843 133b3e8-133b413 GetModuleHandleW 810->843 814 133b291-133b299 811->814 815 133b29c-133b2a3 811->815 813->811 814->815 818 133b2b0-133b2b9 call 133aba4 815->818 819 133b2a5-133b2ad 815->819 823 133b2c6-133b2cb 818->823 824 133b2bb-133b2c3 818->824 819->818 825 133b2e9-133b2ed 823->825 826 133b2cd-133b2d4 823->826 824->823 847 133b2f0 call 133b720 825->847 848 133b2f0 call 133b748 825->848 826->825 828 133b2d6-133b2e6 call 133abb4 call 133abc4 826->828 828->825 831 133b2f3-133b2f6 833 133b319-133b31f 831->833 834 133b2f8-133b316 831->834 834->833 842->843 844 133b415-133b41b 843->844 845 133b41c-133b430 843->845 844->845 847->831 848->831 849->807 850->807
                      APIs
                      • GetModuleHandleW.KERNELBASE(00000000), ref: 0133B406
                      Memory Dump Source
                      • Source File: 00000000.00000002.2112328454.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_1330000_USD 510,800.jbxd
                      Similarity
                      • API ID: HandleModule
                      • String ID:
                      • API String ID: 4139908857-0
                      • Opcode ID: f57d817c10cf0319cc719b863f1d4a51d0be88bba29ee651abd0999787b15a25
                      • Instruction ID: 58fa75e35fb898ab0ab78e93a722af3b466d1bac8fabea7eb2407f677869195e
                      • Opcode Fuzzy Hash: f57d817c10cf0319cc719b863f1d4a51d0be88bba29ee651abd0999787b15a25
                      • Instruction Fuzzy Hash: 83714870A00B058FDB24DF6AD44475ABBF1FF88308F008A2DD48ADBA54D775E905CB95
                      Function 05481CE4 Relevance: 1.6, APIs: 1, Instructions: 120COMMON
                      Download Yara Rule
                      APIs
                      • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05481E02
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116564363.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5480000_USD 510,800.jbxd
                      Similarity
                      • API ID: CreateWindow
                      • String ID:
                      • API String ID: 716092398-0
                      • Opcode ID: 8be74415579fa63ebeb0cc37d44aef0f554e43c45d99ceaf5320fe8230081ebf
                      • Instruction ID: 0f579306e5d6ad915b24025bca3750100553795623ae5b972455ded6932abdff
                      • Opcode Fuzzy Hash: 8be74415579fa63ebeb0cc37d44aef0f554e43c45d99ceaf5320fe8230081ebf
                      • Instruction Fuzzy Hash: 3B51C2B1D00349DFDB14CFA9C884AEEBBB5FF48310F24812AE819AB210D7759846CF90
                      Function 05481CF0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
                      Download Yara Rule
                      APIs
                      • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05481E02
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116564363.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5480000_USD 510,800.jbxd
                      Similarity
                      • API ID: CreateWindow
                      • String ID:
                      • API String ID: 716092398-0
                      • Opcode ID: 773aed2b12f78a0c60ae03b212b552374ad29453615fcc7653acc6bc637149ac
                      • Instruction ID: 2dc29e3694e7a36a749b6ba7ee037355d531501857d54b4a9ddd708785b2a9db
                      • Opcode Fuzzy Hash: 773aed2b12f78a0c60ae03b212b552374ad29453615fcc7653acc6bc637149ac
                      • Instruction Fuzzy Hash: 4541B1B1D00349DFDB14DF99C984ADEBBB5BF48310F24912AE819AB250D7759845CF90
                      Function 05480BFC Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                      Download Yara Rule
                      APIs
                      • CallWindowProcW.USER32(?,?,?,?,?), ref: 05484381
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116564363.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5480000_USD 510,800.jbxd
                      Similarity
                      • API ID: CallProcWindow
                      • String ID:
                      • API String ID: 2714655100-0
                      • Opcode ID: b26f8ef53faf307f01f9c08e94f9cb48e43eac907e1cd0badbd4543ac186a76e
                      • Instruction ID: c43fa87d0319daed60af43e767f525f349e7c9a34c0ce557169cd0e3dad5d102
                      • Opcode Fuzzy Hash: b26f8ef53faf307f01f9c08e94f9cb48e43eac907e1cd0badbd4543ac186a76e
                      • Instruction Fuzzy Hash: 13411AB5A00309DFDB14DF99C848AAEFBF5FF88314F248459D519AB321D374A845CBA0
                      Function 01334884 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                      Download Yara Rule
                      APIs
                      • CreateActCtxA.KERNEL32(?), ref: 01335D99
                      Memory Dump Source
                      • Source File: 00000000.00000002.2112328454.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_1330000_USD 510,800.jbxd
                      Similarity
                      • API ID: Create
                      • String ID:
                      • API String ID: 2289755597-0
                      • Opcode ID: f4c28991b96f446a8cf656074fe48561bd10822e360e8ae5c322bdac6de2170e
                      • Instruction ID: 19c4a02448040cf9de25b27fea4eacd0c8063a7f74ff8767c8ace16df8afc189
                      • Opcode Fuzzy Hash: f4c28991b96f446a8cf656074fe48561bd10822e360e8ae5c322bdac6de2170e
                      • Instruction Fuzzy Hash: B741CF71C0071DCFEB24CFA9C848B8EBBB5BF89704F20816AD408AB255DB756946CF95
                      Function 01335CDC Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                      Download Yara Rule
                      APIs
                      • CreateActCtxA.KERNEL32(?), ref: 01335D99
                      Memory Dump Source
                      • Source File: 00000000.00000002.2112328454.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_1330000_USD 510,800.jbxd
                      Similarity
                      • API ID: Create
                      • String ID:
                      • API String ID: 2289755597-0
                      • Opcode ID: 62be81375388e2df802d9ad820826532633d22e8a70ce69b4b2a0c0b4bdf6fb2
                      • Instruction ID: 01760f85ae573fc0e1b32d702cd4271649dff07fc2f7f8807f3393e2c5f52909
                      • Opcode Fuzzy Hash: 62be81375388e2df802d9ad820826532633d22e8a70ce69b4b2a0c0b4bdf6fb2
                      • Instruction Fuzzy Hash: 9541D071C00719CFEB24CFA9C8487CEBBB5BF88304F20815AD408AB255DB756946CF91
                      Function 0133D678 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                      Download Yara Rule
                      APIs
                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0133D707
                      Memory Dump Source
                      • Source File: 00000000.00000002.2112328454.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_1330000_USD 510,800.jbxd
                      Similarity
                      • API ID: DuplicateHandle
                      • String ID:
                      • API String ID: 3793708945-0
                      • Opcode ID: 0bfe47dd05844235947d08ac75d63adb7aceb5aa4e02bc991af356271431e11d
                      • Instruction ID: 71ed5aa20b2471abc7d6fc47430b184e1a3a950f28c183aad0b439d55701c4ae
                      • Opcode Fuzzy Hash: 0bfe47dd05844235947d08ac75d63adb7aceb5aa4e02bc991af356271431e11d
                      • Instruction Fuzzy Hash: 652103B5D00249EFDB10CFAAD884AEEBFF5EB48320F14801AE914A3350C378A944CF64
                      Function 0133D680 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                      Download Yara Rule
                      APIs
                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0133D707
                      Memory Dump Source
                      • Source File: 00000000.00000002.2112328454.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_1330000_USD 510,800.jbxd
                      Similarity
                      • API ID: DuplicateHandle
                      • String ID:
                      • API String ID: 3793708945-0
                      • Opcode ID: 7230612bddbc50d81ac0084a53407311d54c6011e02142e75721c747c4660fca
                      • Instruction ID: a1924c2359e38e8b8a1319b4155198216afc3a3a93c84b0224096fe70cb5e113
                      • Opcode Fuzzy Hash: 7230612bddbc50d81ac0084a53407311d54c6011e02142e75721c747c4660fca
                      • Instruction Fuzzy Hash: 4321C4B5900249EFDB10CFAAD984ADEBBF9EB48310F14841AE914A7350D378A954CFA5
                      Function 0133ABF0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0133B481,00000800,00000000,00000000), ref: 0133B692
                      Memory Dump Source
                      • Source File: 00000000.00000002.2112328454.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_1330000_USD 510,800.jbxd
                      Similarity
                      • API ID: LibraryLoad
                      • String ID:
                      • API String ID: 1029625771-0
                      • Opcode ID: 8c9088e9b8b7c23bd96672fe71977bf7dac0d9708db5038da9d470a176225630
                      • Instruction ID: b118312d9ed178bae5b9a9e1aac3aae89616847b55df2ee0fbcb1c08b367aae6
                      • Opcode Fuzzy Hash: 8c9088e9b8b7c23bd96672fe71977bf7dac0d9708db5038da9d470a176225630
                      • Instruction Fuzzy Hash: A41117B6904349DFDB10CF9AC444A9EFBF4EF88324F10841AD515A7200C375A545CFA5
                      Function 0133B620 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0133B481,00000800,00000000,00000000), ref: 0133B692
                      Memory Dump Source
                      • Source File: 00000000.00000002.2112328454.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_1330000_USD 510,800.jbxd
                      Similarity
                      • API ID: LibraryLoad
                      • String ID:
                      • API String ID: 1029625771-0
                      • Opcode ID: 8ad8783c1b45ba97e5f92912aa6b70d4eea3248d3645314d53122263da7e9c9e
                      • Instruction ID: d51e550d8be4097e0b2d1cb41d37cb5961ff884ed631844cbe795e711079df94
                      • Opcode Fuzzy Hash: 8ad8783c1b45ba97e5f92912aa6b70d4eea3248d3645314d53122263da7e9c9e
                      • Instruction Fuzzy Hash: C01114B6C00349DFDB10CFAAC844ADEFBF4EB88320F10842AE519A7210C375A545CFA5
                      Function 0133B3A0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleW.KERNELBASE(00000000), ref: 0133B406
                      Memory Dump Source
                      • Source File: 00000000.00000002.2112328454.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_1330000_USD 510,800.jbxd
                      Similarity
                      • API ID: HandleModule
                      • String ID:
                      • API String ID: 4139908857-0
                      • Opcode ID: 039b36aa021d0843cf034af4d0606b55805a9cec8135f56b99d0abdbf6bf5f33
                      • Instruction ID: d64bbe9e7cf5c2b6443c6c0ae8424c13b35a443782e0b1e9fc963835835666d4
                      • Opcode Fuzzy Hash: 039b36aa021d0843cf034af4d0606b55805a9cec8135f56b99d0abdbf6bf5f33
                      • Instruction Fuzzy Hash: 7811DFB6C007498FDB10CF9AC544A9EFBF4EB88224F10842AD919B7210C379A545CFA5
                      Function 05552768 Relevance: 1.3, Strings: 1, Instructions: 62COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID: w
                      • API String ID: 0-476252946
                      • Opcode ID: 2e4ed3c51669ceef5d0c833ee0f8e2d26aa7be5ea0be0ba7345ce0b32d2fc316
                      • Instruction ID: e9e57d451c91db890f397315af1b6dd244c4297de56b7880384f3249e253b69b
                      • Opcode Fuzzy Hash: 2e4ed3c51669ceef5d0c833ee0f8e2d26aa7be5ea0be0ba7345ce0b32d2fc316
                      • Instruction Fuzzy Hash: D421DF39914655CFCB10CFB9C86076ABBA2FF05321F04C567ED669B696C334D860CBA1
                      Function 05550EA9 Relevance: .6, Instructions: 583COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 275c0ee2db512e9ae4c6522b3a8a5ea9105f4c70196a6bef5f2a3ce3e8200f6f
                      • Instruction ID: 71ae1645b83402a57f7146afa009f2aa3bd09696e8de49fbc533d1c8eb274fa9
                      • Opcode Fuzzy Hash: 275c0ee2db512e9ae4c6522b3a8a5ea9105f4c70196a6bef5f2a3ce3e8200f6f
                      • Instruction Fuzzy Hash: BF228130F04648CFDB14DBA9C565BADBFB2BF84320F248566E946AB395DB709C41CB81
                      Function 055513C6 Relevance: .2, Instructions: 233COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: fb3afe79071542f54a15715253428e3bbe5d4f714cba6321d2abbb4fd0a4e0b5
                      • Instruction ID: 7931c7ab63398a1b4856e984215c56facc64e9d88819c1c11e1fcdac23283510
                      • Opcode Fuzzy Hash: fb3afe79071542f54a15715253428e3bbe5d4f714cba6321d2abbb4fd0a4e0b5
                      • Instruction Fuzzy Hash: 50918134E04648DFDB14CAA5C574BADBFB3BF80320F298567E9829B659C7709C45CB81
                      Function 0555CA0A Relevance: .2, Instructions: 197COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: f35c7efeccd4233ecb85b5df6a47a09ca9ae39a7e593d8082eced730ed5e985e
                      • Instruction ID: 46cf8e9e28661531a6ebe99c7fbfc5649a35f48a4e246bb8483b0898f59c1830
                      • Opcode Fuzzy Hash: f35c7efeccd4233ecb85b5df6a47a09ca9ae39a7e593d8082eced730ed5e985e
                      • Instruction Fuzzy Hash: DB815E30A14658CFCB14DFA8C4A1AAEBBF2FF45314F14856AD95AE7345D734AC42CB81
                      Function 0555CAA7 Relevance: .2, Instructions: 177COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 0d461926165c93b13cc4b41db7bf2db61423f3e5486c25629b998c4853d99e7f
                      • Instruction ID: c37d05e1f1442e006a0842e0d68250dbb603cf510753c7f226697146909c1af9
                      • Opcode Fuzzy Hash: 0d461926165c93b13cc4b41db7bf2db61423f3e5486c25629b998c4853d99e7f
                      • Instruction Fuzzy Hash: 2E715C30A14658CFCB04DBA8C4A1AADBBF2FF44314F14856AD95ADB346D734EC42CB81
                      Function 05559CB2 Relevance: .2, Instructions: 171COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: d7e862545113aa5fe17460fc9b2f7c3846f4d220e81310f6dd1c27d008e929d2
                      • Instruction ID: db67e90d5b28b9b4742addd26147dbb78108c5aa90899578935abf29b71d9478
                      • Opcode Fuzzy Hash: d7e862545113aa5fe17460fc9b2f7c3846f4d220e81310f6dd1c27d008e929d2
                      • Instruction Fuzzy Hash: E561C739B003559BD705EB74D895BAEBBB2BF88300F148968E9859B38ACF706C45C790
                      Function 05559CB8 Relevance: .2, Instructions: 169COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 3e57eba8dc895ca283b1edf9e5decd25876b017ec4a2e30cd08b69965feaec40
                      • Instruction ID: c7a089789c43b81be7c60cee8c39e5573595c84d71cbeca0d0b19de983c0796f
                      • Opcode Fuzzy Hash: 3e57eba8dc895ca283b1edf9e5decd25876b017ec4a2e30cd08b69965feaec40
                      • Instruction Fuzzy Hash: 9E51C639B003559BD705EB74D895BAEBBB2BF88300F148968E9859B38ACF706C45C790
                      Function 05554920 Relevance: .2, Instructions: 168COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 5e1bd3268adcb25f25b19f6b0e24f41e629a43aef69a449e668c9deb79f94299
                      • Instruction ID: e41414c1e0e9ee5348a593c84b202783e936bd3c7a2c2594e4d3abe32f4d43a9
                      • Opcode Fuzzy Hash: 5e1bd3268adcb25f25b19f6b0e24f41e629a43aef69a449e668c9deb79f94299
                      • Instruction Fuzzy Hash: C5719F34A01208EFCB14DF68D894DAEBBB6FF48724F114499F901AB361D731E881CB50
                      Function 0555B748 Relevance: .2, Instructions: 165COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 71e6c8bebabc8eed91934a2eb2aa56c487e1a4f57bdd218d00d306ce36eff377
                      • Instruction ID: 196989497b7e386b84957854ffe320021622b1fd2b924f68df1c88a40f26bfc6
                      • Opcode Fuzzy Hash: 71e6c8bebabc8eed91934a2eb2aa56c487e1a4f57bdd218d00d306ce36eff377
                      • Instruction Fuzzy Hash: 4F516A34A01209DFDB14CFA8C8A9ABEBBB6FF44321F109527ED57A7290D735A941CB41
                      Function 05550954 Relevance: .2, Instructions: 155COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: c116a8481777af9a467341cac73fd7ffc8926372e08c3a014d40b8d527302224
                      • Instruction ID: 2c7b00f1d33831f06e2b27600a1264287148bd2fdf73fdfed2a02ffb359c2933
                      • Opcode Fuzzy Hash: c116a8481777af9a467341cac73fd7ffc8926372e08c3a014d40b8d527302224
                      • Instruction Fuzzy Hash: 7A519F71B006068FCB14DBB9D858ABEBBF7FFC5260B55892AE419D7350DE309C018790
                      Function 0555B739 Relevance: .1, Instructions: 149COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 196234f730eb933032ad635089217b7b2850df467540fb740bbfed995d80e468
                      • Instruction ID: b934adb93b54fe32a8c79c59282130de6e15851e2d17f45bd24af92db8d01c70
                      • Opcode Fuzzy Hash: 196234f730eb933032ad635089217b7b2850df467540fb740bbfed995d80e468
                      • Instruction Fuzzy Hash: 7A516C34A00205EFDB14CFA8C8A9ABEBBB2FB44321F108527EC57A7291D775A941CB41
                      Function 05554E00 Relevance: .1, Instructions: 135COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 158bf1d0d4c5cf7c68b672cad4a6e9d42ef94bd8ca7c4aa574f1afaf508e82e3
                      • Instruction ID: c8f84d51491dfac9c80e28adb3e31c16b478ebbbe05507bab6c7f0e7c2debd1a
                      • Opcode Fuzzy Hash: 158bf1d0d4c5cf7c68b672cad4a6e9d42ef94bd8ca7c4aa574f1afaf508e82e3
                      • Instruction Fuzzy Hash: 9051DA75A1060A9FCB04DFA8D9848DDF7B5FF89300B10C65AE915AB325EB30AA55CF90
                      Function 05554DF0 Relevance: .1, Instructions: 128COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: cf10401f65fe568ab9dddfe1e85c02ef5d188a9eb2efe3ddddf9d0f450249607
                      • Instruction ID: 6fa8263117445d5fc5bd5244c26786ea5ceeb05aeb3de3447974148c89a5f78b
                      • Opcode Fuzzy Hash: cf10401f65fe568ab9dddfe1e85c02ef5d188a9eb2efe3ddddf9d0f450249607
                      • Instruction Fuzzy Hash: 7351E775A1060A8FCB04DFA8D9848DDFBF5FF89300B11C65AE515AB325EB30AE45CB90
                      Function 05556148 Relevance: .1, Instructions: 118COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 7921099eaa180ac8fe29c20d5ef91b6f3926f9e9e855af1cbbc40d18c27909a7
                      • Instruction ID: bf7ae5fb7725eca067b1e341dfffdb7bb0535f6e1eff04b7f930f71e4ffc1f0a
                      • Opcode Fuzzy Hash: 7921099eaa180ac8fe29c20d5ef91b6f3926f9e9e855af1cbbc40d18c27909a7
                      • Instruction Fuzzy Hash: 63410A34B042198FDF54EFA8C854BDDBBF1BF89314F514069E905AB3A1CB79A805CB94
                      Function 0555A27C Relevance: .1, Instructions: 100COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 8b77d172f5bf3b23837da72f36099e22f70008ba7dc6715289c98b7930bffbad
                      • Instruction ID: 930fc9fc8a4fd8b7a6ee67df581b54eb0e7a6b7ed421ce0d16de49a06c655dce
                      • Opcode Fuzzy Hash: 8b77d172f5bf3b23837da72f36099e22f70008ba7dc6715289c98b7930bffbad
                      • Instruction Fuzzy Hash: 60316971904209AFCF10CFA9D849ADEBFF9FB49320F10842AE909A7210D775A940CBA1
                      Function 05555E58 Relevance: .1, Instructions: 96COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: d06d808a42530c120f2cc256be7cacdc20df348cef4e9a3e308345bdf4a5dd18
                      • Instruction ID: 2ebfe806decf1da98032ea72b895b38e7859a433d0eae66688e896db31fe8461
                      • Opcode Fuzzy Hash: d06d808a42530c120f2cc256be7cacdc20df348cef4e9a3e308345bdf4a5dd18
                      • Instruction Fuzzy Hash: A2316D71E002069FDB50DFA4C455FBEBBB2FF48314F1484AAE916EB361D739A8018B90
                      Function 05555950 Relevance: .1, Instructions: 96COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: bb462cc2c7c4b1ac6b191538a9c2f88bb8f837cc3ccbe21bb3ffc2641667aef6
                      • Instruction ID: fb637743d81505b84d0d7f218e66d67f330090a6ec63ec55b57a01c049c74210
                      • Opcode Fuzzy Hash: bb462cc2c7c4b1ac6b191538a9c2f88bb8f837cc3ccbe21bb3ffc2641667aef6
                      • Instruction Fuzzy Hash: 5031E1367101018FD714DE28C855BAA7BF6FB88320F1444BAE506DB3A2DA75ED05CB90
                      Function 05559F06 Relevance: .1, Instructions: 91COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 4db06661262e4d07cb8989aa852c058143121b34e3c8afae53dddd4eee3391cb
                      • Instruction ID: 50dcf8fe9d0da4ace27f8d5db278cbfc7cfd46cd9588423cb95ee75b8974c6ba
                      • Opcode Fuzzy Hash: 4db06661262e4d07cb8989aa852c058143121b34e3c8afae53dddd4eee3391cb
                      • Instruction Fuzzy Hash: FE31E775718380CFD7168774D86A36A7FB6AB85211F0548ABF846C7382DD784C01C751
                      Function 0555A19B Relevance: .1, Instructions: 83COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 4bd8e3087acc33a04244ddadc0a99bb0bc5bbd157d85f26c80fa06fa81282321
                      • Instruction ID: 8e8e9531e8916dcc7564b68c7036ad81f61b93baa3e48113e169d77a76fe3aa0
                      • Opcode Fuzzy Hash: 4bd8e3087acc33a04244ddadc0a99bb0bc5bbd157d85f26c80fa06fa81282321
                      • Instruction Fuzzy Hash: 3C21DC2181D3A19EE703AB7CA8753C63F70AF93218F0545DBD9C08A163E7684459EBA6
                      Function 05559F40 Relevance: .1, Instructions: 78COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 8682ce38e3e40dca6d67f978b29cdc3cf0f2dabda3ec576d4ca309bd31e1ee99
                      • Instruction ID: 872bdd6198d90763b4ab69e843836648d44171b40573dcd2081e2eeb6a8c47e1
                      • Opcode Fuzzy Hash: 8682ce38e3e40dca6d67f978b29cdc3cf0f2dabda3ec576d4ca309bd31e1ee99
                      • Instruction Fuzzy Hash: 58217F74B14214CBDB189AB8E46A67E7BAAFBC8221F10493AF907C7384DE758C01C791
                      Function 0555BE78 Relevance: .1, Instructions: 78COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 7c0e85ccc03f2ad65022a092e5d1ee2e0852228c1902a64fad80f22dc751a503
                      • Instruction ID: d45d80483393f0b4874951929fa042d15e286add2469c6509aeb904bef9f27e6
                      • Opcode Fuzzy Hash: 7c0e85ccc03f2ad65022a092e5d1ee2e0852228c1902a64fad80f22dc751a503
                      • Instruction Fuzzy Hash: 4121F531604115CFCB058A68CC29BBABBA6FF45331F098977F957CB2A1C234C8558791
                      Function 05556400 Relevance: .1, Instructions: 76COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 71443182ab5da64527c0bce924aada8f34507ab4b6021f2113c287bcb4be80f3
                      • Instruction ID: e15d556f7d8d492d4e4adf344354c692dbef7c873a92496f48a76d31143b9a92
                      • Opcode Fuzzy Hash: 71443182ab5da64527c0bce924aada8f34507ab4b6021f2113c287bcb4be80f3
                      • Instruction Fuzzy Hash: 5B214C30301201CFDB299B39D8A4B6A77E6FF85625B54846EE906CB761DB72DC42CB50
                      Function 0555D4D0 Relevance: .1, Instructions: 75COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 0f45030681141a820615eec17d8554f97c4af69b1aa6f71ecf9622acb5af81e9
                      • Instruction ID: a1d36f187d5e400e5674424ae139709937f8d2834b546f9ab55a330439de61c5
                      • Opcode Fuzzy Hash: 0f45030681141a820615eec17d8554f97c4af69b1aa6f71ecf9622acb5af81e9
                      • Instruction Fuzzy Hash: 4F218032A04106CBD704DF6DC861BBBFBB6FB84320F548567D916DB361E274EA418B91
                      Function 012DD4C4 Relevance: .1, Instructions: 75COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2111937899.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_12dd000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 1b9e260b8a5f19fb647749a7ca3a97ab0969ece87b879bab78641239c94091fd
                      • Instruction ID: 9ce673dad62da678bb2059b771fc00c9d7c81d0b162161be1bf4ea6f0de69da9
                      • Opcode Fuzzy Hash: 1b9e260b8a5f19fb647749a7ca3a97ab0969ece87b879bab78641239c94091fd
                      • Instruction Fuzzy Hash: 9A214572510648EFDB11DF58E9C0F26BF65FB88318F20C16DE9090B286C336E446CBA2
                      Function 012DD3D8 Relevance: .1, Instructions: 75COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2111937899.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_12dd000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: d596d32577299e8fb928ab3e4cd5c43aa883b961a5093dc90ccc98b93749962f
                      • Instruction ID: f9b04a362b51e4c3760d2fd92358848b51c57536b015eb81b491f7ab5fdd2970
                      • Opcode Fuzzy Hash: d596d32577299e8fb928ab3e4cd5c43aa883b961a5093dc90ccc98b93749962f
                      • Instruction Fuzzy Hash: 41214576510648EFDB01DF94D9C0B66BF65FB88324F20C16CEA090B286C376E446CAA2
                      Function 0555D3B0 Relevance: .1, Instructions: 74COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: ddeaabc5ef4974a8e4d15f0558bbde57011f37481e303a5aaad6fb8fe68e3a47
                      • Instruction ID: ce909125b1221745813b9acb802981b540c07ca48e786a1b32607b7aa4552ab7
                      • Opcode Fuzzy Hash: ddeaabc5ef4974a8e4d15f0558bbde57011f37481e303a5aaad6fb8fe68e3a47
                      • Instruction Fuzzy Hash: CB21F531705304DFE3198B15C865B69BB73FB81721F168167E90ACF296CAB4DC41C791
                      Function 05556410 Relevance: .1, Instructions: 72COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: a61240d9c4c4c91726a3c490cdcb0b7c2825f6cdafe21fa5b018a9009c759b74
                      • Instruction ID: d69a2f309317e080e39f5fb584a8d510ad12b445e3b530f8653f1a07a5cac023
                      • Opcode Fuzzy Hash: a61240d9c4c4c91726a3c490cdcb0b7c2825f6cdafe21fa5b018a9009c759b74
                      • Instruction Fuzzy Hash: E621F930300211CFDB29DB39D4A4A6A77F6BF89625B50846EE907CB361DB72DC46CB51
                      Function 05553050 Relevance: .1, Instructions: 72COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 0940109e2707c3c693dac9fee7ad4a6bcb4258789204dc0af6a2e0c1cd9888cb
                      • Instruction ID: 4596bb541d4d0ec0e24cf63e5f3100368c74c7d8a9b10f22be649a24050d5718
                      • Opcode Fuzzy Hash: 0940109e2707c3c693dac9fee7ad4a6bcb4258789204dc0af6a2e0c1cd9888cb
                      • Instruction Fuzzy Hash: E6213835B00650DFCB249E19D594E7AB3BAFB88624B10882FEA4A87750CB75E8818B54
                      Function 012ED01C Relevance: .1, Instructions: 72COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2111965658.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_12ed000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 520b8bd7ddd1465893f8c8ac22026a7fa18e3f2939f7ea8ea1654a458c913f51
                      • Instruction ID: 558c139c0b924ee207686f610b0896b28d5c85178929f467e4aa780a3065aeca
                      • Opcode Fuzzy Hash: 520b8bd7ddd1465893f8c8ac22026a7fa18e3f2939f7ea8ea1654a458c913f51
                      • Instruction Fuzzy Hash: DD212271614208EFDB15DF68D9C8B26BFA1FB84314F68C56DD90A0B242C37BD847CA61
                      Function 05550A28 Relevance: .1, Instructions: 67COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 4357a7e021e6b604fcb0d086a6234746b9ad716c0ec41993ae48c6a9cdca3cc3
                      • Instruction ID: f128b8de2ea5096bbb5d878ef4a796a4f8a6a1d9363cdfb1f235ca7a55990259
                      • Opcode Fuzzy Hash: 4357a7e021e6b604fcb0d086a6234746b9ad716c0ec41993ae48c6a9cdca3cc3
                      • Instruction Fuzzy Hash: 4731FFB0C01218DFDB21CF99C598B9EBFF5BB48764F25841AE808BB240C7B55845CFA1
                      Function 0555337C Relevance: .1, Instructions: 67COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 8d8e4c94f0be14023df608eb665519a9db1edca6b9b74d38b3d6a38ba0b41618
                      • Instruction ID: 3548996d16ff86d3a3ea24bdd4293267ef31b3a405ace27dfb19533f031082cb
                      • Opcode Fuzzy Hash: 8d8e4c94f0be14023df608eb665519a9db1edca6b9b74d38b3d6a38ba0b41618
                      • Instruction Fuzzy Hash: DB31DDB0C01218DFDB21CF99C599B8EBBF4BB48764F25841AE809BB240C3B55845CBA1
                      Function 055547E1 Relevance: .1, Instructions: 66COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 7b1c71857e22dabfacec5846eb7a6036c286454ff427c6d9dd78c32dd2fcb43b
                      • Instruction ID: d9a3ab6771b380284dbb8501910d970cfd505c04479fef9be0d70eae2fcb6009
                      • Opcode Fuzzy Hash: 7b1c71857e22dabfacec5846eb7a6036c286454ff427c6d9dd78c32dd2fcb43b
                      • Instruction Fuzzy Hash: B5211775B00650DFCB24CE19D594FAAB3BAFF88624F11842EE94A87761DB35EC818B50
                      Function 0555516F Relevance: .1, Instructions: 66COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 6b1a611a93c08fceae7731c2a5436c9a3a0776578265d96fb6e413a46e69b565
                      • Instruction ID: da6b65adb5776e13681f66559edb8b974d2a3affdd2feaac5ba183ae76e2b907
                      • Opcode Fuzzy Hash: 6b1a611a93c08fceae7731c2a5436c9a3a0776578265d96fb6e413a46e69b565
                      • Instruction Fuzzy Hash: A321E871E1020A9FCB04DFADC8849EEFBF5FF98210B10865AE418E7211E7709956CB90
                      Function 0555D3A1 Relevance: .1, Instructions: 64COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 08669920992ddd507894e0bd97d27eb6004ea7c979ae2a7d65fb0ccf2faad0aa
                      • Instruction ID: 2513a15d6dcd5417bb98c52b5d8985fec4d8ea1790d01ae9b59e3afb97265a72
                      • Opcode Fuzzy Hash: 08669920992ddd507894e0bd97d27eb6004ea7c979ae2a7d65fb0ccf2faad0aa
                      • Instruction Fuzzy Hash: 2A212732B04300DFE3148B00C862B69B772FB80722F168677D90A8F295CBB4DD41C781
                      Function 05550944 Relevance: .1, Instructions: 62COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 58232261785f8f9939daf4f23b801ce10f5c44000eb494eb2da3f2adb827ae59
                      • Instruction ID: 13ddbf7fd74ec2354398529725fce049cbd08ef2d397d1cc72c96922200b7c42
                      • Opcode Fuzzy Hash: 58232261785f8f9939daf4f23b801ce10f5c44000eb494eb2da3f2adb827ae59
                      • Instruction Fuzzy Hash: 79116D35B0024A8BCB44EBB99920AFEB7B6BFC9310F10443AC905E7244EB318D02CB91
                      Function 0555BE74 Relevance: .1, Instructions: 62COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 0f6fda2545d2f808141a54fafd090695279e715ea5425070b93e63a5a1fd2a56
                      • Instruction ID: 89735cc6e535edaef921c5660dd0a6c654d24f4cda0480ae853600987f6268f9
                      • Opcode Fuzzy Hash: 0f6fda2545d2f808141a54fafd090695279e715ea5425070b93e63a5a1fd2a56
                      • Instruction Fuzzy Hash: 0911BF316041158BCB048EA8D826BBAB7A6FF48331F098A37F917C62A0C239C8118B91
                      Function 055531C8 Relevance: .1, Instructions: 61COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: eee3e8d1ed3ccea5f8ac8f895788269def4fae5b557cf2afdaf7275785fa0b0b
                      • Instruction ID: 2fb9c69eb617b24a9e6854b3eef38b4fcef886df0b5e4570690295eb4b176720
                      • Opcode Fuzzy Hash: eee3e8d1ed3ccea5f8ac8f895788269def4fae5b557cf2afdaf7275785fa0b0b
                      • Instruction Fuzzy Hash: F911A076B006065B8B14DAA9D8546BFB7FBFFC42A0B65493AE819E3340DF308D0187A0
                      Function 055569C0 Relevance: .1, Instructions: 59COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: abc33bf54d9b8122c225969be2cada9433db680d1b32a28cb826cfb378dfde5e
                      • Instruction ID: 4e7aafdc338720bd9d5394728d4e46a11b84f0a876d389deda9f53d786d9f4a7
                      • Opcode Fuzzy Hash: abc33bf54d9b8122c225969be2cada9433db680d1b32a28cb826cfb378dfde5e
                      • Instruction Fuzzy Hash: 680100B2B042108BC748EB78E8153AF7BE6FBC4210F008439D409C7744EE308D0187E2
                      Function 05555180 Relevance: .1, Instructions: 59COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 3454272e143bd08be7e8e542dd71af306bd8b53f33efbfc84e60a5a64d2628fa
                      • Instruction ID: 85af4aa709ee85a32894b24124efb25dbdccf4aa6cad698e88c5d6ba60bd1093
                      • Opcode Fuzzy Hash: 3454272e143bd08be7e8e542dd71af306bd8b53f33efbfc84e60a5a64d2628fa
                      • Instruction Fuzzy Hash: 7721BD71E1020A9FCB05DFADC8448AFFBF9FF98210B10855AE518E7215E770A955CB90
                      Function 055568CC Relevance: .1, Instructions: 56COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 7883713d6bc1661f99d701a0fd07867dbe61e3f9598c479570204f104626a1b5
                      • Instruction ID: b152f6918f8441acaf74aa49c67f1ddd0bba647d41d7effefc3ad4485430a8f0
                      • Opcode Fuzzy Hash: 7883713d6bc1661f99d701a0fd07867dbe61e3f9598c479570204f104626a1b5
                      • Instruction Fuzzy Hash: 9221F2B5804349DFCB10CF9AD988ADEBBF4FB48320F10841AE919A7200C378A954CFA5
                      Function 012DD4BF Relevance: .1, Instructions: 56COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2111937899.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_12dd000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                      • Instruction ID: c7d4226a1386a519b9a660f60c67cb5fa4aaaca1a1aca06c158d2c812dd47505
                      • Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                      • Instruction Fuzzy Hash: 20112676504684DFCB12CF54D5C0B16BF71FB84314F24C6A9D9090B257C33AD45ACBA2
                      Function 012DD3D3 Relevance: .1, Instructions: 56COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2111937899.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_12dd000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                      • Instruction ID: 40733deddbf31b2cb0e25d09b4c86b8bfb8578c9cb017fd22bdf4cfbeb77d4a3
                      • Opcode Fuzzy Hash: 77fadd82fdc2d56cf39070efea1a70d2bd0433e89b8e3a9964b57efaebe0ac53
                      • Instruction Fuzzy Hash: 5B112676504684DFCB12CF44D5C0B56BF71FB84324F24C2A9D9090B257C33AE45ACBA2
                      Function 05550A39 Relevance: .1, Instructions: 54COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 8e0012b86fda290c33b6f4e4f5ed3052c6f2091d43f8cdafb09c51754d214b3a
                      • Instruction ID: 549175b0139e07f594ce254f79a23f7ca8769e60e6b44ca1cd38861133196204
                      • Opcode Fuzzy Hash: 8e0012b86fda290c33b6f4e4f5ed3052c6f2091d43f8cdafb09c51754d214b3a
                      • Instruction Fuzzy Hash: 191108703042119BE7146628D42A7DAB6E6EBC5318F10C41DD5898F3C2CEFB694A87E1
                      Function 012ED017 Relevance: .1, Instructions: 53COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2111965658.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_12ed000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                      • Instruction ID: 08bd0d434c5613f5cf9a940568cfdea7bf3bd70d3db30449a48d2d70f03c98e9
                      • Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                      • Instruction Fuzzy Hash: 6511BB75504284DFCB12CF54D5D8B15FFA2FB84314F28C6AAD9094B656C33AD40ACBA2
                      Function 055505F1 Relevance: .0, Instructions: 50COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: e783dc8d844e092f1ea4516bcc50f19c06a8c83911a6f7baa21ea05bd1bbec98
                      • Instruction ID: 681dc2ecc77572e99eceb35307a3f9d2d3257c8d017fb0b2281b0812f7f6e52a
                      • Opcode Fuzzy Hash: e783dc8d844e092f1ea4516bcc50f19c06a8c83911a6f7baa21ea05bd1bbec98
                      • Instruction Fuzzy Hash: 69018F31304200DFD7199A68E864BAAB3AAEFC5325F14C57FD94A8B7A0DB71DD428790
                      Function 0555BB1A Relevance: .0, Instructions: 49COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 5a2eadb79f971ec3cee33177ddd265a5dfa3907ed57eb43d2404dea706a05849
                      • Instruction ID: 43e86f9b4bdf760cc5aa31f45678748df35cb2d5db701cf2e233a387ba598b75
                      • Opcode Fuzzy Hash: 5a2eadb79f971ec3cee33177ddd265a5dfa3907ed57eb43d2404dea706a05849
                      • Instruction Fuzzy Hash: 1F0147326082816FDB02CB64DC64AEA7FB5FF46220B0982F7D485CB263D2255C06C710
                      Function 05550A48 Relevance: .0, Instructions: 47COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: e5550cc522eb4efbd7c6c56e294f7175b6e886e4682186cf423bcb4a1ca0649d
                      • Instruction ID: ccd42e93ff9326ff9a634ee05181caa87794a13a93f503f248880bd196fcf2a3
                      • Opcode Fuzzy Hash: e5550cc522eb4efbd7c6c56e294f7175b6e886e4682186cf423bcb4a1ca0649d
                      • Instruction Fuzzy Hash: B101B5703043119BE714A668D4267DBB6E6EBC5718F10841DD5898F3C2CEFB69494BE1
                      Function 05555FB1 Relevance: .0, Instructions: 46COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: c0247375882fc302a6c8ccfcfbf9be7769998c0d95a63c161ff524d8298baf76
                      • Instruction ID: ca40657d296184078a5e20970ad2a13f70157583bc3c8343aa63572873bd5a3d
                      • Opcode Fuzzy Hash: c0247375882fc302a6c8ccfcfbf9be7769998c0d95a63c161ff524d8298baf76
                      • Instruction Fuzzy Hash: 48018F30204280CFC715DB69D864E25B7B6FF86221B55C5BAE90ACB371DB76EC02CB94
                      Function 012DD731 Relevance: .0, Instructions: 45COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2111937899.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_12dd000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: d24b35291dcf2a42a2e9b8d5293f8fa2fa491abab514def0e60da92ab42c4931
                      • Instruction ID: 103d57e41e200c07dcd8b64abf5a4adf318f6295783793bb1ed23ada46e5a361
                      • Opcode Fuzzy Hash: d24b35291dcf2a42a2e9b8d5293f8fa2fa491abab514def0e60da92ab42c4931
                      • Instruction Fuzzy Hash: 4201DB71014789EAF7144BA9CD84B66FFD8EF41764F14C499EE094B2C2C2789844C672
                      Function 055548A0 Relevance: .0, Instructions: 44COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: d97d8aed635d09e1b164a2bcfd7d16f70b26ab7c3b2e20661bc9c3b304c5ac33
                      • Instruction ID: 745d6886c48c061d653226eb4f109ac2d302ab9913b9a76305e776dd26a929d6
                      • Opcode Fuzzy Hash: d97d8aed635d09e1b164a2bcfd7d16f70b26ab7c3b2e20661bc9c3b304c5ac33
                      • Instruction Fuzzy Hash: 86012632704784EBDB218E14CC80BBB7FA6FB89224F08841AE956C6212CB36E804C761
                      Function 05555FC0 Relevance: .0, Instructions: 41COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 9a42691cefbc4aaff9849c4139a1dc060ce7bf693ec72d64bd585e2f7ad3be99
                      • Instruction ID: c9ac4fa69190d0e55019d11f9443c00fb42fcd40f945cc75f1af34b39e4b00bb
                      • Opcode Fuzzy Hash: 9a42691cefbc4aaff9849c4139a1dc060ce7bf693ec72d64bd585e2f7ad3be99
                      • Instruction Fuzzy Hash: C5016D30314240CFC724DA69D860E26B3AAFF85621B64C57AE90AC7260DB75EC028B90
                      Function 055548B0 Relevance: .0, Instructions: 39COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: a649accbe3853bb1ac9741b788024317d2b814dc21e6f6b1218fca8b80622616
                      • Instruction ID: 6a7afba60670b4504ac48b2a9a0f33646aa91dffb5cf9dd9c91df3a838a0151a
                      • Opcode Fuzzy Hash: a649accbe3853bb1ac9741b788024317d2b814dc21e6f6b1218fca8b80622616
                      • Instruction Fuzzy Hash: 57F0F632700654EBDF25CE19C8C0ABF7BA6FB89224F14451AF956C7211CB36EC408750
                      Function 055564D4 Relevance: .0, Instructions: 37COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: d34707d9e8fc27f610ddde84577f3bd0ca78f4d1f1b56e35b06d5deea2221cbd
                      • Instruction ID: cd027d09140cd1e60caa81448b5d6c90b57d5bba99b72a8872af11b9a70b4ffc
                      • Opcode Fuzzy Hash: d34707d9e8fc27f610ddde84577f3bd0ca78f4d1f1b56e35b06d5deea2221cbd
                      • Instruction Fuzzy Hash: ECF0C2353883808FD7658A3888A16693BA0FF4222474540EAD546CF371D761CC02C700
                      Function 012DD730 Relevance: .0, Instructions: 36COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2111937899.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_12dd000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 326dc645874ce38227220cf4c1c8ab9b138b2ebac38cba112fab714ffbab878a
                      • Instruction ID: 2bbf0f7f6dbfef1404bcd21635a8e39a4ced40e0ffaa1c978d23843279eaa08c
                      • Opcode Fuzzy Hash: 326dc645874ce38227220cf4c1c8ab9b138b2ebac38cba112fab714ffbab878a
                      • Instruction Fuzzy Hash: 9FF06271405788AAF7158A19CD84B66FFD8EB91774F18C59AEE084F2C2C2799844CA71
                      Function 0555D1B8 Relevance: .0, Instructions: 35COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 4cd30108e7a2b55f626820150470740d699a8c820d0e71125f66e88c466526e9
                      • Instruction ID: 1584a9579c563ffd9ec0ff1e4fe2421d7d1988828f4f2084cf5cbfb455fd4f01
                      • Opcode Fuzzy Hash: 4cd30108e7a2b55f626820150470740d699a8c820d0e71125f66e88c466526e9
                      • Instruction Fuzzy Hash: 7FF0C71050D3C42FD75357B08C226CA3FB0AF43201B8A81D7E494CB1E7DA28580AC762
                      Function 055558F8 Relevance: .0, Instructions: 35COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 7951e498dff52956869908860d9d2b0d14cdd2dc091335ad1543f921763ae8be
                      • Instruction ID: bfa8be793277c325b177b286b0c8ef122f0a238128e32c3aa2a624278f4cf618
                      • Opcode Fuzzy Hash: 7951e498dff52956869908860d9d2b0d14cdd2dc091335ad1543f921763ae8be
                      • Instruction Fuzzy Hash: 0CF09A323446008FC7164B2DD818BA977BAFF86621F1A40ABE44ACB262CA249C41CB95
                      Function 05550B40 Relevance: .0, Instructions: 31COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 7896b7528de2e2e70054906a9ef5a4b7a12647a763c091c6f280cb93111a4b96
                      • Instruction ID: a7cac90987922e8ab90b846ea2090d45e77f230fd66c1fda79c4bd8b5f045ba3
                      • Opcode Fuzzy Hash: 7896b7528de2e2e70054906a9ef5a4b7a12647a763c091c6f280cb93111a4b96
                      • Instruction Fuzzy Hash: 7EF0F8716047058F9F18CF28E49299977E6FB053687240D6EE85ACF312E7B2E9438B85
                      Function 0555D11A Relevance: .0, Instructions: 30COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 6da87485abb76c8377cd9164ecd711949fe19ef906828bb2f8be026636b449d0
                      • Instruction ID: 08a5ddd56b70782e1888231cee08cd90c0062130072c2faf942c32b92261a922
                      • Opcode Fuzzy Hash: 6da87485abb76c8377cd9164ecd711949fe19ef906828bb2f8be026636b449d0
                      • Instruction Fuzzy Hash: 86F01DB4E0424A9FDB44DFB8C852BAEBFF1BB08210F1589AAD915E7341E7708601CF90
                      Function 0555D128 Relevance: .0, Instructions: 29COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 3aeade0065374238d5408622c0b97c2a0ecf350ba710fc15f63eaff06b433e25
                      • Instruction ID: b098167d08b037c96aff2b3df385860fe76408e3a016ae009bcc4a1f30c5a670
                      • Opcode Fuzzy Hash: 3aeade0065374238d5408622c0b97c2a0ecf350ba710fc15f63eaff06b433e25
                      • Instruction Fuzzy Hash: 4FF0DAB5E0430A9FDB44DFA9D852AAEBBF5FB48210F1049AAD918E7240E77496008FD0
                      Function 055570C9 Relevance: .0, Instructions: 29COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 6a80b8b0eef87478c3cade91333ffbd4ee7b559597e9b0fd9e609e39f1ea4318
                      • Instruction ID: a9f0d9fbb196ff9bc0c8747def5a44c07430985c50c9579df9f4a6f8fd83c65d
                      • Opcode Fuzzy Hash: 6a80b8b0eef87478c3cade91333ffbd4ee7b559597e9b0fd9e609e39f1ea4318
                      • Instruction Fuzzy Hash: B7F0A0342182908FC7158B68D454EA57BE6BF8A110F1980EBE586CB3B2CA60AC00CBA0
                      Function 05554F80 Relevance: .0, Instructions: 28COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 0365fc11b5627bc7e6db1b66b26b183d6316dd2d037c7fea9a56273cd585682b
                      • Instruction ID: c1a2a9a55564f1503e930a41c4fa0dff8b0c614995c3d7c0b2a2d1f9deebdcde
                      • Opcode Fuzzy Hash: 0365fc11b5627bc7e6db1b66b26b183d6316dd2d037c7fea9a56273cd585682b
                      • Instruction Fuzzy Hash: C1F0A735A182198FCB149A6CE8048EE7BB5EFC6215B0542ABE4459B221E7704C9DC7D1
                      Function 05555908 Relevance: .0, Instructions: 28COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: a7496281368f43ab63038872f466f9d7902c740fe3d5645b3ccfc5fce6658593
                      • Instruction ID: 739c44e848a6b8f5df32a59081f819394aa3f3453e14c3dbc8b4f510db3baf50
                      • Opcode Fuzzy Hash: a7496281368f43ab63038872f466f9d7902c740fe3d5645b3ccfc5fce6658593
                      • Instruction Fuzzy Hash: 38F030323546108FC7258A1DD818B6977EABFC4A31F1940BAE40ACB361DA659C41CB94
                      Function 05550B31 Relevance: .0, Instructions: 27COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 055f1cc1edca2508201aa7c89b93d3777b160a9d3c406fd6795ab8f38e4cb560
                      • Instruction ID: bb52b99d3671d6d03acdbe87f0ca19f1e8916d438e1dd32c6126f9970c2447d8
                      • Opcode Fuzzy Hash: 055f1cc1edca2508201aa7c89b93d3777b160a9d3c406fd6795ab8f38e4cb560
                      • Instruction Fuzzy Hash: E5E092316042419BCF14CA28E492AEC3BE2FB45374B140F7DE466CF2A1E766D9438B85
                      Function 055560F0 Relevance: .0, Instructions: 26COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: e24dcf0be196f75cb19383f3c9a1933c62002a60cc452c346f7070489dfcb94c
                      • Instruction ID: 9458db457727dde7f4e226ea59ef05d0f738f98eaa25a57819e7598d37825ffa
                      • Opcode Fuzzy Hash: e24dcf0be196f75cb19383f3c9a1933c62002a60cc452c346f7070489dfcb94c
                      • Instruction Fuzzy Hash: 6AE026B320010247D210926DFC91BCBB3DAEFF0224B048E2AE115CB261EE64A84382E4
                      Function 05554F90 Relevance: .0, Instructions: 24COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 08b60c782d5d0d5c2932b2e51bb26dcde118e8572aad44a0e27eb33c31cf3ecd
                      • Instruction ID: 6ba4bc07a30a3b3d0af75bee9e03a9f8705ea55821dd0fbfb57eeb39fd0af6ed
                      • Opcode Fuzzy Hash: 08b60c782d5d0d5c2932b2e51bb26dcde118e8572aad44a0e27eb33c31cf3ecd
                      • Instruction Fuzzy Hash: E3E0D835A101198FCB00AA6DEC04CDDBBB9EFC6211B01416AE50597230EB709959C7D1
                      Function 0555D0C0 Relevance: .0, Instructions: 24COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: e1fc2ef797ae7dc814d2853dfbdb1740a560cf29f38373caa1396c4382cd4e85
                      • Instruction ID: d3e29abc30b8b84b66af1c3c1efeffc061d43ce819454232b6ecca653a579f11
                      • Opcode Fuzzy Hash: e1fc2ef797ae7dc814d2853dfbdb1740a560cf29f38373caa1396c4382cd4e85
                      • Instruction Fuzzy Hash: 6BE0EDB1D40209AFD740EFB9C94679ABFF0BF08210F10D566D414E7351E7B496058B85
                      Function 055570D8 Relevance: .0, Instructions: 22COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: e8bd2adae8e683af864c85656ca2264075822dce6ced3702152b724a7944d744
                      • Instruction ID: 711f96eb03dfc37b59b2055c38bc046f5c68c0cb67aa4b2f3e8f69a5bd1d4834
                      • Opcode Fuzzy Hash: e8bd2adae8e683af864c85656ca2264075822dce6ced3702152b724a7944d744
                      • Instruction Fuzzy Hash: 56E012343146508FC7149B6DE454AA577E6BB8A551F1444AAE586CB3A1CA65AC008BA0
                      Function 05550E68 Relevance: .0, Instructions: 20COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: a7a1ab805d1caf251af613266ee12fd3b1745f688d2d92f94ef0ec57728cf731
                      • Instruction ID: ca7e2e23f7ed038e4bc5c232feb45e490733c9e6279c1d27f511a6c2791f9341
                      • Opcode Fuzzy Hash: a7a1ab805d1caf251af613266ee12fd3b1745f688d2d92f94ef0ec57728cf731
                      • Instruction Fuzzy Hash: 52E0127078431CABEA345521ED3EF253B5E7788B50F204436B60B6E5E5DA915C408755
                      Function 05550E61 Relevance: .0, Instructions: 19COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 07424629f11f9ae32ab997bbe61a60da4178126c6bf142cd2521f2afd80c4990
                      • Instruction ID: a3b99ff2f4c80a7e132e6cade9300f2faab113e71d378d1184fde4df5a582770
                      • Opcode Fuzzy Hash: 07424629f11f9ae32ab997bbe61a60da4178126c6bf142cd2521f2afd80c4990
                      • Instruction Fuzzy Hash: 62D05B71784349BBEA301911DD2FF253759B744F50F140476B6067D5E1D6925840C655
                      Function 05550600 Relevance: .0, Instructions: 18COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: e557a2b174691a8b30ea2d4953eab38d08693a79fd434ad0c5e65938bc1f181b
                      • Instruction ID: 22b70da274bc4513bfa812123f882cf9d1c8ff8c565d8d01c2e4fa3c6c011227
                      • Opcode Fuzzy Hash: e557a2b174691a8b30ea2d4953eab38d08693a79fd434ad0c5e65938bc1f181b
                      • Instruction Fuzzy Hash: A1D05E357042145BC719664D90117DBB6DE8FCA650F04806FE5098B390C9A59C0046D9
                      Function 055536AA Relevance: .0, Instructions: 18COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: b332a0b5cc4c040df7ad7c7abd87f91437b99de5ced9b00c9d32cbe90c1ad26c
                      • Instruction ID: c73489ab1226deba6109f25fb76ffae8f13978a1a54d73ec1deb0ae551c33269
                      • Opcode Fuzzy Hash: b332a0b5cc4c040df7ad7c7abd87f91437b99de5ced9b00c9d32cbe90c1ad26c
                      • Instruction Fuzzy Hash: A1D01772D0413CA78B10AFA99C055DFFE78EF04A50B428526AA54AB204D3715A20CBC5
                      Function 0555D0D0 Relevance: .0, Instructions: 18COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: d8bc8402021e858b6288e7e404d704eab550196224b71d5f7ddf9c78afa27d7f
                      • Instruction ID: f4f69b5b7c24c23fa08478dd3c818e1080bb3d17aa25fafdd3de21ed1b506a44
                      • Opcode Fuzzy Hash: d8bc8402021e858b6288e7e404d704eab550196224b71d5f7ddf9c78afa27d7f
                      • Instruction Fuzzy Hash: AFE0B6B1D40209DFD740EFB9C915A5EBBF1BF08210F1189AAD419E7211E7B496048F91
                      Function 055547B0 Relevance: .0, Instructions: 16COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: c7062a78c9fc28097ccf206aa28541a43fd552a9c2daf2b80646ccaffbac9e5d
                      • Instruction ID: ec5f42e99f09958c2194877f22dab0ae8d8c072e33d4a6a8bde5c1d6288c8b9f
                      • Opcode Fuzzy Hash: c7062a78c9fc28097ccf206aa28541a43fd552a9c2daf2b80646ccaffbac9e5d
                      • Instruction Fuzzy Hash: 54D05E32240114BFCB026E84D820BEE7F25FB81798F24801AE6845E262D33385139B80
                      Function 055536B0 Relevance: .0, Instructions: 16COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: fcc788c89ca91730e34b729ea8219a5e8389f3dd18a4f57a8284d2c23dda9339
                      • Instruction ID: 2a5892d6725c041080bb75ee383368dda4be032d2ae4fd3f51b35869d404b0f5
                      • Opcode Fuzzy Hash: fcc788c89ca91730e34b729ea8219a5e8389f3dd18a4f57a8284d2c23dda9339
                      • Instruction Fuzzy Hash: 8FD09E72D0013D978B10AFE99C054DFFF79EF05650B418526E915AB100D3715A25DBD1
                      Function 0555D1C8 Relevance: .0, Instructions: 14COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 2bd7f647f3771a00d4c85d2da421d865a0206295cfc8b977b41ea2242325c46e
                      • Instruction ID: ad3c0bae1406c798f23aa70401daed6b8a6cfbcef210c2ac325872382d97b9d9
                      • Opcode Fuzzy Hash: 2bd7f647f3771a00d4c85d2da421d865a0206295cfc8b977b41ea2242325c46e
                      • Instruction Fuzzy Hash: B5D012332141085E4B51EF95E801C5677EDBB686117058423EA04CB424E721F528EB51
                      Function 055547C0 Relevance: .0, Instructions: 10COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 27fbd692e8e33cb7b80dba572c296a2e74ecf0c88acdfbc34d614700cae0779d
                      • Instruction ID: 9758faf9eaad8b3a2d2facea9b9dfa00ad4d9f51ba75e8ceea6463fbf187d8b8
                      • Opcode Fuzzy Hash: 27fbd692e8e33cb7b80dba572c296a2e74ecf0c88acdfbc34d614700cae0779d
                      • Instruction Fuzzy Hash: 14C04C32144208BBCF027E81DC15E5EBF2ABB557A4F148055FB080D161D773E563ABD4
                      Function 0555F410 Relevance: .0, Instructions: 10COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: ecfe3a4834ab2f0b5e0c5056481e90e09b2f9a18cfd71de551825eb51c0bca36
                      • Instruction ID: 01f17e865399cb010bb1c87720a0e55d7415ef6cc3480149c5f8e76775e154d9
                      • Opcode Fuzzy Hash: ecfe3a4834ab2f0b5e0c5056481e90e09b2f9a18cfd71de551825eb51c0bca36
                      • Instruction Fuzzy Hash: 46C08CB2024308CBD21927E0B80E32CBEBC7B40257F504121F909014608FB42404CB51
                      Function 05550934 Relevance: .0, Instructions: 9COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: f3340a3987ab153291e1f8676007e971f286367e5c7ee9f5804ad57da77bdb48
                      • Instruction ID: 4b24b93c10251a70776c831996d5126777004f7a3d565e7f682f9bebeda7f784
                      • Opcode Fuzzy Hash: f3340a3987ab153291e1f8676007e971f286367e5c7ee9f5804ad57da77bdb48
                      • Instruction Fuzzy Hash: 24C09B39144105EEC681EB54C968C6B7FF5FFD6320B40FC57A54847031D631D419D715
                      Function 0555A26C Relevance: .0, Instructions: 8COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 8eb1051310f0e8b58f644af8092195b961cbca77159f227432e7816da859fa55
                      • Instruction ID: 6e5f918d33452d97cd1c18f6214cab403f84cb4536c16a69c2576cdfaac7d7b6
                      • Opcode Fuzzy Hash: 8eb1051310f0e8b58f644af8092195b961cbca77159f227432e7816da859fa55
                      • Instruction Fuzzy Hash: 1AB09225298601A68C01A6B88C6AA3AA8A1FFFB721B50EC07260A00050C4A144A5D157

                      Non-executed Functions

                      Function 05480040 Relevance: .3, Instructions: 315COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116564363.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5480000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: dd17956434994aed11d85c850b1e3a73141ed4ec10149ed812bfe151e5f240a3
                      • Instruction ID: ee9e2194c75b8f4db93d235c4c7d6978700ef841e7355390807c0a0622b62082
                      • Opcode Fuzzy Hash: dd17956434994aed11d85c850b1e3a73141ed4ec10149ed812bfe151e5f240a3
                      • Instruction Fuzzy Hash: 481295B8C217458AD338CF25EA5C1893BE1B74031CB924319D2751E2E9EBB6165FEF44
                      Function 05553D50 Relevance: .3, Instructions: 274COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: e871d01967cd3b6d2f3578ddea45230ce3637067b8e48a3034608bd49aedf4c3
                      • Instruction ID: f27fa804a4c1329319d41d826b808cdded00446c0124d09ef0f10eb89f7c0a95
                      • Opcode Fuzzy Hash: e871d01967cd3b6d2f3578ddea45230ce3637067b8e48a3034608bd49aedf4c3
                      • Instruction Fuzzy Hash: D9D1C431C2075ACACB15EFA4D9916E9BB71FF95300F50879AE10A37220EB746EC5CB91
                      Function 05553D60 Relevance: .3, Instructions: 264COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116776604.0000000005550000.00000040.00000800.00020000.00000000.sdmp, Offset: 05550000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5550000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: f8e42c29d9e5b0a666e921f53a515fbee5906f5d8ceb9466eea07d760d54518a
                      • Instruction ID: 712b5a1cf19e510dbd222c8df2de8af8976f11011d40909da6cc6c1dcb5ea29c
                      • Opcode Fuzzy Hash: f8e42c29d9e5b0a666e921f53a515fbee5906f5d8ceb9466eea07d760d54518a
                      • Instruction Fuzzy Hash: 3ED1B331C2075ACADB14EFA4D9916E9BB71FF95300F50879AE10A37220EB746EC4CB91
                      Function 0133DFF4 Relevance: .3, Instructions: 264COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2112328454.0000000001330000.00000040.00000800.00020000.00000000.sdmp, Offset: 01330000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_1330000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 538feab57b565b93823dd87b8eb3bc59103da3e1508dbae086ba6305f8d83d1e
                      • Instruction ID: c1d61d975a727f6861e4f0b0f3a07c741daa4ff912cb4c5923ead1aa11858815
                      • Opcode Fuzzy Hash: 538feab57b565b93823dd87b8eb3bc59103da3e1508dbae086ba6305f8d83d1e
                      • Instruction Fuzzy Hash: 26A15A32E0021ACFCF19DFB9C88059EBBB6FFC4304B15456AE901AB265DB31E945CB40
                      Function 05480006 Relevance: .2, Instructions: 237COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000000.00000002.2116564363.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_0_2_5480000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 9541f01ad6a2de1169e4633e3f891f7e4dc9f935c6304c9eb9691e6f9be84fbb
                      • Instruction ID: 17124c46296f0129b1180fa58c2359d7865534e6ac718f0573f1cd2d196f6aea
                      • Opcode Fuzzy Hash: 9541f01ad6a2de1169e4633e3f891f7e4dc9f935c6304c9eb9691e6f9be84fbb
                      • Instruction Fuzzy Hash: 8AC159B8C217458BD328CF24E9581893BF1BB81318F524319D2756F2E8EBB9155EEF44

                      Execution Graph

                      Execution Coverage:7.7%
                      Dynamic/Decrypted Code Coverage:100%
                      Signature Coverage:0%
                      Total number of Nodes:93
                      Total number of Limit Nodes:6
                      execution_graph 14600 312c3d0 14601 312c3d1 14600->14601 14604 312c4b7 14601->14604 14602 312c3df 14605 312c4c8 14604->14605 14606 312c4fc 14605->14606 14611 312cb60 14605->14611 14606->14602 14607 312c4f4 14607->14606 14608 312c700 GetModuleHandleW 14607->14608 14609 312c72d 14608->14609 14609->14602 14612 312cb74 14611->14612 14614 312cb99 14612->14614 14615 312b8b8 14612->14615 14614->14607 14616 312cd40 LoadLibraryExW 14615->14616 14618 312cdb9 14616->14618 14618->14614 14619 31246c0 14620 31246c1 14619->14620 14621 31246da 14620->14621 14629 31247f8 14620->14629 14625 312425c 14621->14625 14626 3124267 14625->14626 14634 3127108 14626->14634 14628 31246fc 14630 31247fc 14629->14630 14694 3124908 14630->14694 14698 31248f8 14630->14698 14635 3127113 14634->14635 14638 3127118 14635->14638 14637 312898d 14637->14628 14639 3127123 14638->14639 14641 3128a62 14639->14641 14642 3127148 14639->14642 14641->14637 14643 3127153 14642->14643 14646 3127178 14643->14646 14645 3128b65 14645->14641 14648 3127183 14646->14648 14647 3129d29 14647->14645 14648->14647 14650 312e483 14648->14650 14651 312e48c 14650->14651 14652 312e4d5 14651->14652 14656 312e760 14651->14656 14660 312e7bb 14651->14660 14665 312e75b 14651->14665 14652->14647 14657 312e76d 14656->14657 14658 312e7a7 14657->14658 14669 312ca48 14657->14669 14658->14652 14661 312e788 14660->14661 14664 312e7c2 14660->14664 14662 312e7a7 14661->14662 14663 312ca48 2 API calls 14661->14663 14662->14652 14663->14662 14664->14652 14666 312e760 14665->14666 14667 312ca48 2 API calls 14666->14667 14668 312e7a7 14666->14668 14667->14668 14668->14652 14670 312ca53 14669->14670 14672 312f4c0 14670->14672 14679 312f080 14670->14679 14673 3127178 2 API calls 14672->14673 14675 312f57d 14672->14675 14674 312f52f 14673->14674 14676 312f53e 14674->14676 14686 312f5a8 14674->14686 14690 312f59b 14674->14690 14675->14658 14676->14658 14680 312f08b 14679->14680 14681 3127178 2 API calls 14680->14681 14682 312f52f 14681->14682 14683 312f53e 14682->14683 14684 312f59b KiUserCallbackDispatcher 14682->14684 14685 312f5a8 KiUserCallbackDispatcher 14682->14685 14683->14672 14684->14683 14685->14683 14687 312f5a9 14686->14687 14688 312f6a2 KiUserCallbackDispatcher 14687->14688 14689 312f6a7 14687->14689 14688->14689 14691 312f5a4 14690->14691 14692 312f6a2 KiUserCallbackDispatcher 14691->14692 14693 312f6a7 14691->14693 14692->14693 14696 3124909 14694->14696 14695 3124a0c 14695->14695 14696->14695 14702 312456c 14696->14702 14700 3124900 14698->14700 14699 3124a0c 14699->14699 14700->14699 14701 312456c CreateActCtxA 14700->14701 14701->14699 14703 3125998 CreateActCtxA 14702->14703 14705 3125a5b 14703->14705 14706 312eac0 DuplicateHandle 14707 312eb56 14706->14707 14708 312e878 14709 312e879 GetCurrentProcess 14708->14709 14711 312e910 GetCurrentThread 14709->14711 14712 312e909 14709->14712 14713 312e946 14711->14713 14714 312e94d GetCurrentProcess 14711->14714 14712->14711 14713->14714 14717 312e983 14714->14717 14715 312e9ab GetCurrentThreadId 14716 312e9dc 14715->14716 14717->14715

                      Executed Functions

                      Function 0312E868 Relevance: 6.1, APIs: 4, Instructions: 137threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • GetCurrentProcess.KERNEL32 ref: 0312E8F6
                      • GetCurrentThread.KERNEL32 ref: 0312E933
                      • GetCurrentProcess.KERNEL32 ref: 0312E970
                      • GetCurrentThreadId.KERNEL32 ref: 0312E9C9
                      Memory Dump Source
                      • Source File: 00000003.00000002.2121455649.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_3120000_USD 510,800.jbxd
                      Similarity
                      • API ID: Current$ProcessThread
                      • String ID:
                      • API String ID: 2063062207-0
                      • Opcode ID: 9761311b01c533abed200ac09776a6957cf138454621b1fb3dd3cb43406fc0e5
                      • Instruction ID: 70f947642fda23cf54884ef1675ee92a6a426d9b57afbc034dab1c242cf89d3b
                      • Opcode Fuzzy Hash: 9761311b01c533abed200ac09776a6957cf138454621b1fb3dd3cb43406fc0e5
                      • Instruction Fuzzy Hash: A75165B0900749CFEB44CFAAD548BAEBFF1AB4C300F24845AE549AB360D7759944CB66
                      Function 0312E878 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      APIs
                      • GetCurrentProcess.KERNEL32 ref: 0312E8F6
                      • GetCurrentThread.KERNEL32 ref: 0312E933
                      • GetCurrentProcess.KERNEL32 ref: 0312E970
                      • GetCurrentThreadId.KERNEL32 ref: 0312E9C9
                      Memory Dump Source
                      • Source File: 00000003.00000002.2121455649.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_3120000_USD 510,800.jbxd
                      Similarity
                      • API ID: Current$ProcessThread
                      • String ID:
                      • API String ID: 2063062207-0
                      • Opcode ID: f69da49328361046e9637e670254a9297eb6399d663f37c8a802c46ab0942f19
                      • Instruction ID: 47bacbd578c7f8b88ab89842b3c6b2d2fc61c931c5682e974b1e3fc584d55ae5
                      • Opcode Fuzzy Hash: f69da49328361046e9637e670254a9297eb6399d663f37c8a802c46ab0942f19
                      • Instruction Fuzzy Hash: 075154B0900709CFDB54DFAAD548BAEBBF1AB8C300F248459E549A7360DB746944CB66
                      Function 0312C4B7 Relevance: 1.7, APIs: 1, Instructions: 200COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 51 312c4b7-312c4c6 52 312c4c8-312c4cc 51->52 53 312c4cd-312c4d7 51->53 52->53 54 312c503-312c507 53->54 55 312c4d9-312c4e6 call 312b854 53->55 57 312c51b-312c55c 54->57 58 312c509-312c513 54->58 60 312c4e8-312c4f6 call 312cb60 55->60 61 312c4fc 55->61 64 312c569-312c577 57->64 65 312c55e-312c566 57->65 58->57 60->61 71 312c638-312c6f8 60->71 61->54 66 312c59b-312c59d 64->66 67 312c579-312c57e 64->67 65->64 72 312c5a0-312c5a7 66->72 69 312c580-312c587 call 312b860 67->69 70 312c589 67->70 74 312c58b-312c599 69->74 70->74 103 312c700-312c72b GetModuleHandleW 71->103 104 312c6fa-312c6fd 71->104 75 312c5b4-312c5bb 72->75 76 312c5a9-312c5b1 72->76 74->72 78 312c5c8-312c5d1 call 312b870 75->78 79 312c5bd-312c5c5 75->79 76->75 84 312c5d3-312c5db 78->84 85 312c5de-312c5e3 78->85 79->78 84->85 86 312c601-312c605 85->86 87 312c5e5-312c5ec 85->87 108 312c608 call 312ce30 86->108 109 312c608 call 312ce60 86->109 87->86 89 312c5ee-312c5fe call 312b880 call 312b890 87->89 89->86 92 312c60b-312c60e 94 312c610-312c62e 92->94 95 312c631-312c637 92->95 94->95 105 312c734-312c748 103->105 106 312c72d-312c733 103->106 104->103 106->105 108->92 109->92
                      Memory Dump Source
                      • Source File: 00000003.00000002.2121455649.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_3120000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 8b3bfc7a1bff98a4c9ed0fe00dc3f19915d1090811ee849c18d6795570c4b4f1
                      • Instruction ID: 98f4955757ded51f879100dfe9683005b21b3aece64f1100f18170d29b302652
                      • Opcode Fuzzy Hash: 8b3bfc7a1bff98a4c9ed0fe00dc3f19915d1090811ee849c18d6795570c4b4f1
                      • Instruction Fuzzy Hash: CA814370A00B158FDB24DF29D48479ABBF5FF88300F048A2ED58ADBA40DB34E855CB91
                      Function 0312598C Relevance: 1.6, APIs: 1, Instructions: 98COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 111 312598c-312598e 112 3125990-3125993 111->112 113 3125995 111->113 112->113 114 3125998-3125a59 CreateActCtxA 113->114 116 3125a62-3125abc 114->116 117 3125a5b-3125a61 114->117 124 3125acb-3125acf 116->124 125 3125abe-3125ac1 116->125 117->116 126 3125ae0-3125b10 124->126 127 3125ad1-3125add 124->127 125->124 131 3125ac2-3125aca 126->131 132 3125b12-3125b94 126->132 127->126 131->124
                      APIs
                      • CreateActCtxA.KERNEL32(?), ref: 03125A49
                      Memory Dump Source
                      • Source File: 00000003.00000002.2121455649.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_3120000_USD 510,800.jbxd
                      Similarity
                      • API ID: Create
                      • String ID:
                      • API String ID: 2289755597-0
                      • Opcode ID: 8403efef47c49a502df6c917aa5c0cd63438ebac36c010739f732bc4199d1374
                      • Instruction ID: 89f765daaddf0f4b02bd378e90fc8ed8d93bfdb46c6e5ad08aa3bead13c5b6f3
                      • Opcode Fuzzy Hash: 8403efef47c49a502df6c917aa5c0cd63438ebac36c010739f732bc4199d1374
                      • Instruction Fuzzy Hash: 5A41E270C0072DCBDB24CFA9C88578DFBB6BF89304F64806AD408AB255D7755945CF91
                      Function 0312456C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 134 312456c-3125a59 CreateActCtxA 137 3125a62-3125abc 134->137 138 3125a5b-3125a61 134->138 145 3125acb-3125acf 137->145 146 3125abe-3125ac1 137->146 138->137 147 3125ae0-3125b10 145->147 148 3125ad1-3125add 145->148 146->145 152 3125ac2-3125aca 147->152 153 3125b12-3125b94 147->153 148->147 152->145
                      APIs
                      • CreateActCtxA.KERNEL32(?), ref: 03125A49
                      Memory Dump Source
                      • Source File: 00000003.00000002.2121455649.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_3120000_USD 510,800.jbxd
                      Similarity
                      • API ID: Create
                      • String ID:
                      • API String ID: 2289755597-0
                      • Opcode ID: cb58017d3e9116ce3770fde0a5c5e09c0a8462ffcea97be49b19e0c9351242be
                      • Instruction ID: df2634ec20cbdb1cf46cf9abc7d9dfba348a7d04b04d5ceac29070574b26aeed
                      • Opcode Fuzzy Hash: cb58017d3e9116ce3770fde0a5c5e09c0a8462ffcea97be49b19e0c9351242be
                      • Instruction Fuzzy Hash: 3641E2B0C0072DCBDB24CFA9C885B9EFBB6BF49304F64806AD408AB255DB756945CF91
                      Function 0312EABB Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 155 312eabb 156 312eac0-312eb54 DuplicateHandle 155->156 157 312eb56-312eb5c 156->157 158 312eb5d-312eb7a 156->158 157->158
                      APIs
                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0312EB47
                      Memory Dump Source
                      • Source File: 00000003.00000002.2121455649.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_3120000_USD 510,800.jbxd
                      Similarity
                      • API ID: DuplicateHandle
                      • String ID:
                      • API String ID: 3793708945-0
                      • Opcode ID: 4fd9163a33b6bafd26e389dc708b2a6aa3f7332e2ad09a543e64a11413e538f0
                      • Instruction ID: a276381a2c15ce37b1519dbb817604957a2ea34278e986f862f12a1b6bc8ff27
                      • Opcode Fuzzy Hash: 4fd9163a33b6bafd26e389dc708b2a6aa3f7332e2ad09a543e64a11413e538f0
                      • Instruction Fuzzy Hash: 7221E3B5901249EFDB10CFAAD984ADEFBF8EB48310F14801AE914A3350C378A954CFA5
                      Function 0312EAC0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 161 312eac0-312eb54 DuplicateHandle 162 312eb56-312eb5c 161->162 163 312eb5d-312eb7a 161->163 162->163
                      APIs
                      • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0312EB47
                      Memory Dump Source
                      • Source File: 00000003.00000002.2121455649.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_3120000_USD 510,800.jbxd
                      Similarity
                      • API ID: DuplicateHandle
                      • String ID:
                      • API String ID: 3793708945-0
                      • Opcode ID: 6a3cb4cfe36c36092aae6595abbdf7f567063232f893e4dce1b3016ede3bd7f6
                      • Instruction ID: f0682e6bad0ac69abcab7be8d8c02f5c87a0710169c106af5289e4e9c8c48dc9
                      • Opcode Fuzzy Hash: 6a3cb4cfe36c36092aae6595abbdf7f567063232f893e4dce1b3016ede3bd7f6
                      • Instruction Fuzzy Hash: D821E3B5900249DFDB10CFAAD984ADEFBF8EB48310F14801AE914A3310C378A954CFA5
                      Function 0312B8B8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 166 312b8b8-312cd80 168 312cd82-312cd85 166->168 169 312cd88-312cdb7 LoadLibraryExW 166->169 168->169 170 312cdc0-312cddd 169->170 171 312cdb9-312cdbf 169->171 171->170
                      APIs
                      • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0312CB99,00000800,00000000,00000000), ref: 0312CDAA
                      Memory Dump Source
                      • Source File: 00000003.00000002.2121455649.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_3120000_USD 510,800.jbxd
                      Similarity
                      • API ID: LibraryLoad
                      • String ID:
                      • API String ID: 1029625771-0
                      • Opcode ID: 594ae9b50e8192b5db6e5705ae34ef8127795e743fce9cb8ea1daf56796c9545
                      • Instruction ID: 2a73de589130e7853498f4d0c4cc6b74af986f046548b5a9aaceed1591627454
                      • Opcode Fuzzy Hash: 594ae9b50e8192b5db6e5705ae34ef8127795e743fce9cb8ea1daf56796c9545
                      • Instruction Fuzzy Hash: 9A1103B68007599FDB20CFAAC884A9EFFF4EB88310F14842AD519A7200C379A545CFA5
                      Function 0312CD38 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 174 312cd38-312cd80 176 312cd82-312cd85 174->176 177 312cd88-312cdb7 LoadLibraryExW 174->177 176->177 178 312cdc0-312cddd 177->178 179 312cdb9-312cdbf 177->179 179->178
                      APIs
                      • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0312CB99,00000800,00000000,00000000), ref: 0312CDAA
                      Memory Dump Source
                      • Source File: 00000003.00000002.2121455649.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_3120000_USD 510,800.jbxd
                      Similarity
                      • API ID: LibraryLoad
                      • String ID:
                      • API String ID: 1029625771-0
                      • Opcode ID: 8aa26ac30901e6a9df174067cef04567693af42aee89994f35f844753ddf098b
                      • Instruction ID: 92585cd55a9fb3327bd739e5d80569d7c12fdc64803456dec17f8fddb9be0e4b
                      • Opcode Fuzzy Hash: 8aa26ac30901e6a9df174067cef04567693af42aee89994f35f844753ddf098b
                      • Instruction Fuzzy Hash: 551100B6C002098FDB10CFAAD944BDEFBF4AB88320F14851AD529A7240C379A545CFA5
                      Function 0312C6B8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 182 312c6b8-312c6f8 183 312c700-312c72b GetModuleHandleW 182->183 184 312c6fa-312c6fd 182->184 185 312c734-312c748 183->185 186 312c72d-312c733 183->186 184->183 186->185
                      APIs
                      • GetModuleHandleW.KERNELBASE(00000000), ref: 0312C71E
                      Memory Dump Source
                      • Source File: 00000003.00000002.2121455649.0000000003120000.00000040.00000800.00020000.00000000.sdmp, Offset: 03120000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_3120000_USD 510,800.jbxd
                      Similarity
                      • API ID: HandleModule
                      • String ID:
                      • API String ID: 4139908857-0
                      • Opcode ID: ff4bb6ae797eef99154a392ceeff134a72e438ac2c9305a75d9efac3c1d13171
                      • Instruction ID: af23288b3d9e0ec1d84d767029ae0366c20709ef6726d2e4cc3ebdf20b29935e
                      • Opcode Fuzzy Hash: ff4bb6ae797eef99154a392ceeff134a72e438ac2c9305a75d9efac3c1d13171
                      • Instruction Fuzzy Hash: D411E0B5C00B59CFDB20CF9AD444BDEFBF5AB88324F14842AD519A7210C379A545CFA5
                      Function 0169D01C Relevance: .1, Instructions: 72COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000003.00000002.2120650045.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_169d000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 94528821b5ba00d2d76d847fd3927cb9c47e177606caa3013d7d01a0028ed312
                      • Instruction ID: 474be4760470a621d1f73904c7b33e35bfef8902cf84b1c22cb90dcac08fa34b
                      • Opcode Fuzzy Hash: 94528821b5ba00d2d76d847fd3927cb9c47e177606caa3013d7d01a0028ed312
                      • Instruction Fuzzy Hash: B221D071604204EFDF15DF68D984B26BB69FB84354F20C57DD90A4B386C33AD847CA61
                      Function 0169D1D4 Relevance: .1, Instructions: 72COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000003.00000002.2120650045.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_169d000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 991d0b771ce95590034f4157c3ca46bda82581aabc91c1bd0b5e9a9180968542
                      • Instruction ID: 94cc0502e38d7a21378dba75d10d2cf4b8d57330b94f447d9e4ca1a005855daf
                      • Opcode Fuzzy Hash: 991d0b771ce95590034f4157c3ca46bda82581aabc91c1bd0b5e9a9180968542
                      • Instruction Fuzzy Hash: DD21C275604204EFDF05DFA4D9C0B26BBA9FB84324F24C5BDEA094B396C376D846CA61
                      Function 0169D006 Relevance: .1, Instructions: 61COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000003.00000002.2120650045.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_169d000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 68d4cb949291d75be4b365c67c2f8c205ecc46aabbba137501a7f341aaf29cd2
                      • Instruction ID: 93cc7634394fb5735a0cb18690693196d127e279790d6529843c09eb600e5216
                      • Opcode Fuzzy Hash: 68d4cb949291d75be4b365c67c2f8c205ecc46aabbba137501a7f341aaf29cd2
                      • Instruction Fuzzy Hash: 18218E75508380DFDB02CF64D994B11BFB5EB46314F24C5AAD8498F2A7C33A980ACB62
                      Function 0169D1CF Relevance: .1, Instructions: 53COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000003.00000002.2120650045.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_3_2_169d000_USD 510,800.jbxd
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                      • Instruction ID: 8d512478db9e40835ab0f1316ffc2d34bca12da18bca11557c473557b4422992
                      • Opcode Fuzzy Hash: 42a98d763aa616cafc5cdf308aa0cc1e619621035a6359fb41dac703237424f2
                      • Instruction Fuzzy Hash: 2711BB75904280DFCB02CF54C9C0B15FFA1FB84224F24C6A9D9494B396C33AD40ACB62