Edit tour

Windows Analysis Report
autorization Letter.exe

Overview

General Information

Sample name:	autorization Letter.exe
Analysis ID:	1519119
MD5:	457f6cb01c6f3f7922ac201f70111ae5
SHA1:	934e5433fc83af812db461e3e7748c311e19b1bc
SHA256:	ca471400001374bddf5e6ff03db7889cf53bd516fe64209faee8b894b454c3c5
Tags:	AgentTeslaDHLexeuser-cocaman
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

autorization Letter.exe (PID: 6180 cmdline: "C:\Users\user\Desktop\autorization Letter.exe" MD5: 457F6CB01C6F3F7922AC201F70111AE5)

powershell.exe (PID: 528 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1020 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\tIFjYTCo.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 6776 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 3176 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmpF639.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 1576 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

tIFjYTCo.exe (PID: 3440 cmdline: C:\Users\user\AppData\Roaming\tIFjYTCo.exe MD5: 457F6CB01C6F3F7922AC201F70111AE5)

schtasks.exe (PID: 5960 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmp1162.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 6540 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

GUIVTme.exe (PID: 5744 cmdline: "C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 3620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

GUIVTme.exe (PID: 5332 cmdline: "C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 1016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.unitechautomations.com", "Username": "design@unitechautomations.com", "Password": "Unitech@123"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.3346316308.0000000002899000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2202666103.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2202666103.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2204151615.000000000288A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3346316308.0000000002891000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2204151615.0000000002882000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2160081111.0000000004429000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2160081111.0000000004429000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.3346316308.000000000282C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.3346316308.000000000282C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2204151615.0000000002831000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2204151615.0000000002831000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: autorization Letter.exe PID: 6180	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: autorization Letter.exe PID: 6180	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: autorization Letter.exe PID: 6180	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 1576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 1576	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: tIFjYTCo.exe PID: 3440	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegSvcs.exe PID: 6540	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6540	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.autorization Letter.exe.44ec5b8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.autorization Letter.exe.44ec5b8.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.autorization Letter.exe.44ec5b8.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31d64:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31dd6:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31e60:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31ef2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31f5c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31fce:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32064:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x320f4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.autorization Letter.exe.44b1598.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.autorization Letter.exe.44b1598.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.autorization Letter.exe.44b1598.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31d64:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31dd6:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31e60:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31ef2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31f5c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31fce:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32064:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x320f4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33b64:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33bd6:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33c60:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33cf2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33d5c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33dce:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33e64:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33ef4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.autorization Letter.exe.44ec5b8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.autorization Letter.exe.44ec5b8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.autorization Letter.exe.44ec5b8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33b64:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6e984:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33bd6:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6e9f6:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33c60:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ea80:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33cf2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6eb12:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33d5c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6eb7c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33dce:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6ebee:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33e64:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ec84:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33ef4:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6ed14:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.autorization Letter.exe.44b1598.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.autorization Letter.exe.44b1598.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.autorization Letter.exe.44b1598.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33b64:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6eb84:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa99a4:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33bd6:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ebf6:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa9a16:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33c60:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ec80:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa9aa0:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33cf2:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ed12:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa9b32:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33d5c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ed7c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa9b9c:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33dce:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6edee:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa9c0e:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33e64:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ee84:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa9ca4:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\autorization Letter.exe", ParentImage: C:\Users\user\Desktop\autorization Letter.exe, ParentProcessId: 6180, ParentProcessName: autorization Letter.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe", ProcessId: 528, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 1576, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GUIVTme

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmp1162.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmp1162.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\tIFjYTCo.exe, ParentImage: C:\Users\user\AppData\Roaming\tIFjYTCo.exe, ParentProcessId: 3440, ParentProcessName: tIFjYTCo.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmp1162.tmp", ProcessId: 5960, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 192.185.129.60, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 1576, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmpF639.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmpF639.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\autorization Letter.exe", ParentImage: C:\Users\user\Desktop\autorization Letter.exe, ParentProcessId: 6180, ParentProcessName: autorization Letter.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmpF639.tmp", ProcessId: 3176, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\autorization Letter.exe", ParentImage: C:\Users\user\Desktop\autorization Letter.exe, ParentProcessId: 6180, ParentProcessName: autorization Letter.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe", ProcessId: 528, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmpF639.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmpF639.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\autorization Letter.exe", ParentImage: C:\Users\user\Desktop\autorization Letter.exe, ParentProcessId: 6180, ParentProcessName: autorization Letter.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmpF639.tmp", ProcessId: 3176, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE AgentTesla Exfil Via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T07:03:00.331719+0200	2030171	1	A Network Trojan was detected	192.168.2.5	49712	192.185.129.60	587	TCP
2024-09-26T07:03:18.387344+0200	2030171	1	A Network Trojan was detected	192.168.2.5	49711	192.185.129.60	587	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T07:03:14.516239+0200	2855542	1	A Network Trojan was detected	192.168.2.5	49711	192.185.129.60	587	TCP
2024-09-26T07:03:20.151372+0200	2855542	1	A Network Trojan was detected	192.168.2.5	49712	192.185.129.60	587	TCP

ETPRO MALWARE Agent Tesla Exfil via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T07:03:14.516239+0200	2855245	1	A Network Trojan was detected	192.168.2.5	49711	192.185.129.60	587	TCP
2024-09-26T07:03:20.151372+0200	2855245	1	A Network Trojan was detected	192.168.2.5	49712	192.185.129.60	587	TCP

ETPRO MALWARE Win32/Agent Tesla SMTP Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T07:03:00.331719+0200	2839723	1	Malware Command and Control Activity Detected	192.168.2.5	49712	192.185.129.60	587	TCP
2024-09-26T07:03:18.387344+0200	2839723	1	Malware Command and Control Activity Detected	192.168.2.5	49711	192.185.129.60	587	TCP

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T07:03:00.331719+0200	2840032	1	A Network Trojan was detected	192.168.2.5	49712	192.185.129.60	587	TCP
2024-09-26T07:03:18.387344+0200	2840032	1	A Network Trojan was detected	192.168.2.5	49711	192.185.129.60	587	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.unitechautomations.com", "Username": "design@unitechautomations.com", "Password": "Unitech@123"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe

ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: autorization Letter.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: autorization Letter.exe

Joe Sandbox ML: detected

Source: autorization Letter.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: autorization Letter.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: PkJS.pdb source: autorization Letter.exe, tIFjYTCo.exe.1.dr
Source:	Binary string: PkJS.pdbSHA256a source: autorization Letter.exe, tIFjYTCo.exe.1.dr
Source:	Binary string: RegSvcs.pdb, source: GUIVTme.exe, 00000010.00000000.2249012079.0000000000902000.00000002.00000001.01000000.0000000D.sdmp, GUIVTme.exe.9.dr
Source:	Binary string: RegSvcs.pdb source: GUIVTme.exe, 00000010.00000000.2249012079.0000000000902000.00000002.00000001.01000000.0000000D.sdmp, GUIVTme.exe.9.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855245 - Severity 1 - ETPRO MALWARE Agent Tesla Exfil via SMTP : 192.168.2.5:49711 -> 192.185.129.60:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:49711 -> 192.185.129.60:587
Source: Network traffic	Suricata IDS: 2855245 - Severity 1 - ETPRO MALWARE Agent Tesla Exfil via SMTP : 192.168.2.5:49712 -> 192.185.129.60:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:49712 -> 192.185.129.60:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.5:49711 -> 192.185.129.60:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.5:49711 -> 192.185.129.60:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.5:49711 -> 192.185.129.60:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.5:49712 -> 192.185.129.60:587
Source: Network traffic	Suricata IDS: 2839723 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla SMTP Activity : 192.168.2.5:49712 -> 192.185.129.60:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.5:49712 -> 192.185.129.60:587

Source: Joe Sandbox View

IP Address: 192.185.129.60 192.185.129.60

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.unitechautomations.com

Source: autorization Letter.exe, tIFjYTCo.exe.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: autorization Letter.exe, tIFjYTCo.exe.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: RegSvcs.exe, 00000009.00000002.2204151615.000000000288A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3346316308.0000000002899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.unitechautomations.com
Source: autorization Letter.exe, tIFjYTCo.exe.1.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: autorization Letter.exe, 00000001.00000002.2159567789.0000000003475000.00000004.00000800.00020000.00000000.sdmp, tIFjYTCo.exe, 0000000A.00000002.2225613849.000000000272A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: autorization Letter.exe, 00000001.00000002.2160081111.0000000004429000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2202666103.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: autorization Letter.exe, tIFjYTCo.exe.1.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, cPKWk.cs	.Net Code: MPvOvSMQSR
Source: 1.2.autorization Letter.exe.44b1598.1.raw.unpack, cPKWk.cs	.Net Code: MPvOvSMQSR

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.autorization Letter.exe.44ec5b8.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.autorization Letter.exe.44b1598.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.autorization Letter.exe.44b1598.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\autorization Letter.exe	Code function: 1_2_016BD3A4	1_2_016BD3A4
Source: C:\Users\user\Desktop\autorization Letter.exe	Code function: 1_2_079367F8	1_2_079367F8
Source: C:\Users\user\Desktop\autorization Letter.exe	Code function: 1_2_07930006	1_2_07930006
Source: C:\Users\user\Desktop\autorization Letter.exe	Code function: 1_2_07930040	1_2_07930040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00D24200	9_2_00D24200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00D2A4A8	9_2_00D2A4A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00D2D668	9_2_00D2D668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00D29818	9_2_00D29818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00D24AD0	9_2_00D24AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00D23EB8	9_2_00D23EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_00D2A4A5	9_2_00D2A4A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05E1B400	9_2_05E1B400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05E19DCC	9_2_05E19DCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05E2E078	9_2_05E2E078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05E20040	9_2_05E20040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05E2C058	9_2_05E2C058
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05E242B0	9_2_05E242B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05E23258	9_2_05E23258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05E25A38	9_2_05E25A38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05E239B0	9_2_05E239B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 9_2_05E25358	9_2_05E25358
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Code function: 10_2_00D0D3A4	10_2_00D0D3A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_027AA493	14_2_027AA493
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_027A4AD0	14_2_027A4AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_027A3EB8	14_2_027A3EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_027A4200	14_2_027A4200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_027AE86F	14_2_027AE86F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_027A19E8	14_2_027A19E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05E8B400	14_2_05E8B400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05E89BB4	14_2_05E89BB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05E98EDA	14_2_05E98EDA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05E9E060	14_2_05E9E060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05E90040	14_2_05E90040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05E942B0	14_2_05E942B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05E93258	14_2_05E93258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05E95A38	14_2_05E95A38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05E9399B	14_2_05E9399B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05E95358	14_2_05E95358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05E9C318	14_2_05E9C318

Source: autorization Letter.exe

Static PE information: invalid certificate

Source: autorization Letter.exe, 00000001.00000002.2160081111.0000000004429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed04b9152-f33d-48a0-b781-4be8ad9dc338.exe4 vs autorization Letter.exe
Source: autorization Letter.exe, 00000001.00000000.2085689123.0000000000EE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePkJS.exe0 vs autorization Letter.exe
Source: autorization Letter.exe, 00000001.00000002.2159567789.0000000003475000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed04b9152-f33d-48a0-b781-4be8ad9dc338.exe4 vs autorization Letter.exe
Source: autorization Letter.exe, 00000001.00000002.2160081111.0000000004693000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs autorization Letter.exe
Source: autorization Letter.exe, 00000001.00000002.2157399976.00000000016CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs autorization Letter.exe
Source: autorization Letter.exe, 00000001.00000002.2163332817.0000000007860000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs autorization Letter.exe
Source: autorization Letter.exe	Binary or memory string: OriginalFilenamePkJS.exe0 vs autorization Letter.exe

Source: autorization Letter.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.autorization Letter.exe.44ec5b8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.autorization Letter.exe.44b1598.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.autorization Letter.exe.44b1598.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: autorization Letter.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: tIFjYTCo.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, lSFA8pMlGZmCox3ZBB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, poU46SQrMKhRY6KoAP.cs	Security API names: _0020.SetAccessControl
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, poU46SQrMKhRY6KoAP.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, poU46SQrMKhRY6KoAP.cs	Security API names: _0020.AddAccessRule
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, lSFA8pMlGZmCox3ZBB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, poU46SQrMKhRY6KoAP.cs	Security API names: _0020.SetAccessControl
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, poU46SQrMKhRY6KoAP.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, poU46SQrMKhRY6KoAP.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/19@1/1

Source: C:\Users\user\Desktop\autorization Letter.exe

File created: C:\Users\user\AppData\Roaming\tIFjYTCo.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Mutant created: \Sessions\1\BaseNamedObjects\hxHNKsIkb
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1788:120:WilError_03

Source: C:\Users\user\Desktop\autorization Letter.exe

File created: C:\Users\user\AppData\Local\Temp\tmpF639.tmp

Jump to behavior

Source: autorization Letter.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: autorization Letter.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\autorization Letter.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\autorization Letter.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tIFjYTCo.exe.1.dr

Binary or memory string: INSERT INTO Product(Id, Name, Units, Price, CategoryId)VALUES (@id, @name, @units, @price, @idcat); SELECT last_insert_rowid()

Source: autorization Letter.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\autorization Letter.exe

File read: C:\Users\user\Desktop\autorization Letter.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\autorization Letter.exe "C:\Users\user\Desktop\autorization Letter.exe"
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\tIFjYTCo.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmpF639.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tIFjYTCo.exe C:\Users\user\AppData\Roaming\tIFjYTCo.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmp1162.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe "C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe"
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe "C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe"
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe"	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\tIFjYTCo.exe"	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmpF639.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmp1162.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Section loaded: ucrtbase_clr0400.dll

Source: C:\Users\user\Desktop\autorization Letter.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\autorization Letter.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: autorization Letter.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: autorization Letter.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: autorization Letter.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: PkJS.pdb source: autorization Letter.exe, tIFjYTCo.exe.1.dr
Source:	Binary string: PkJS.pdbSHA256a source: autorization Letter.exe, tIFjYTCo.exe.1.dr
Source:	Binary string: RegSvcs.pdb, source: GUIVTme.exe, 00000010.00000000.2249012079.0000000000902000.00000002.00000001.01000000.0000000D.sdmp, GUIVTme.exe.9.dr
Source:	Binary string: RegSvcs.pdb source: GUIVTme.exe, 00000010.00000000.2249012079.0000000000902000.00000002.00000001.01000000.0000000D.sdmp, GUIVTme.exe.9.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: autorization Letter.exe, Form1.cs	.Net Code: InitializeComponent
Source: tIFjYTCo.exe.1.dr, Form1.cs	.Net Code: InitializeComponent
Source: 1.2.autorization Letter.exe.5a60000.4.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, poU46SQrMKhRY6KoAP.cs	.Net Code: FN6kAlCTUA System.Reflection.Assembly.Load(byte[])
Source: 1.2.autorization Letter.exe.34598c4.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, poU46SQrMKhRY6KoAP.cs	.Net Code: FN6kAlCTUA System.Reflection.Assembly.Load(byte[])
Source: 10.2.tIFjYTCo.exe.27098b4.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])

Source: autorization Letter.exe

Static PE information: 0x8BCF3D3C [Sat Apr 30 07:37:32 2044 UTC]

Source: C:\Users\user\Desktop\autorization Letter.exe	Code function: 1_2_016BEE10 pushfd ; iretd	1_2_016BEE11
Source: C:\Users\user\Desktop\autorization Letter.exe	Code function: 1_2_058AC590 push eax; ret	1_2_058AC5A3
Source: C:\Users\user\Desktop\autorization Letter.exe	Code function: 1_2_058AC549 push eax; ret	1_2_058AC5A3
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Code function: 10_2_00D0EE10 pushfd ; iretd	10_2_00D0EE11
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Code function: 10_2_04CEC549 push eax; ret	10_2_04CEC5A3
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Code function: 10_2_04CEC57F push eax; ret	10_2_04CEC5A3
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Code function: 10_2_04CE6600 pushad ; iretd	10_2_04CE660A
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Code function: 10_2_04CE77E1 push edi; iretd	10_2_04CE77EE
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Code function: 10_2_04CEC218 pushfd ; iretd	10_2_04CEC225
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Code function: 10_2_04CEB349 pushad ; iretd	10_2_04CEB355
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Code function: 10_2_04CE18C0 push es; iretd	10_2_04CE18CA
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Code function: 10_2_04CE8925 pushad ; iretd	10_2_04CE892E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 14_2_05E9A349 push 8B038899h; iretd	14_2_05E9A34E

Source: autorization Letter.exe	Static PE information: section name: .text entropy: 7.850552008247241
Source: tIFjYTCo.exe.1.dr	Static PE information: section name: .text entropy: 7.850552008247241

Source: 1.2.autorization Letter.exe.5a60000.4.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 1.2.autorization Letter.exe.5a60000.4.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, yxVmJLNMxItFD4gtlw.cs	High entropy of concatenated method names: 'LJggpU5HQm', 'G0igWpPIdo', 'fT4g6lCPHe', 'FhegRtDhGW', 'JjMg5nycZT', 'NtNgtXnF6s', 'qVugnLKtVv', 'U8CgErDyj8', 'bsqgiXf53X', 'PKegHqfQOH'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, Eqhytk7pjoST4sg0KT.cs	High entropy of concatenated method names: 'dw4baUeBSV', 'cdWbS7FcUb', 'OsIbkJwNOW', 'dSrbTJfcN0', 'XZ5b8FoXu6', 'bHSb23hhRF', 'FldbULRDY0', 'RxgjmXvJhN', 'pP8jrbBxDW', 'ILJjxZFoOf'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, YpTWJpZyAmNmFD026j.cs	High entropy of concatenated method names: 'C3VaZ4pBUS', 'dGgaMMjZy9', 'k5HaLIu74j', 'TugaB9TBP6', 'JU2ag5BGI8', 'TCRaFZtKKG', 'M55VlCUlsEkAvTCDN2', 'vRR09m5KbNajnMMu7M', 'JUBaa5srRO', 'OvsaSso6Hd'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, Ew9Mhe1NCjRAdHx3lS.cs	High entropy of concatenated method names: 'ToString', 'rcAFGBPVa2', 'RBFF5dZJxy', 'XHHFtG5hQU', 'rrmFnbcnjy', 'wvVFEv8wsX', 'JsQFicDayf', 'OKpFHuRXsb', 'vsEFhbW3ox', 'kJ8F3MUUMP'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, iPyZ94TiRa2ebZuHpM.cs	High entropy of concatenated method names: 'kiFZPRI11W', 'ICjZys9s0B', 'AhbZABqTRw', 'bmjZw6IYYQ', 'iq4ZVTwxQa', 'i5KZfJqFcI', 'qu8ZYAbQXD', 'lQIZOwPUtM', 'k96Z0kVbw5', 'DknZNKmMkm'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, md29wrV9kisHjHUXvF.cs	High entropy of concatenated method names: 'X45orGoWqu', 'BsWo1TWg9b', 'mG8j7cMn5r', 'NUajaNAsxq', 'YLooGKXZoR', 'Pn1oWngO8c', 'BNaoIBjKjA', 'vL3o6k42EV', 'o6qoRAA5FM', 'PJQoXO4TZx'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, poU46SQrMKhRY6KoAP.cs	High entropy of concatenated method names: 'bWCSJCf7q9', 'cv6ST6TB7b', 'S0rS8RjYrE', 'W2eSsD7Br1', 'LwvS2ykFr2', 'LifSUNu6is', 'RD9SZLx8Qm', 'kYvSMlmx4L', 'B7gSeaoive', 'IvUSLwsrH2'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, lSFA8pMlGZmCox3ZBB.cs	High entropy of concatenated method names: 'sXB86nBdnv', 'Xq38RWaapL', 'moR8X9FhJQ', 'zM48dEkVUe', 'PtC8qKnVDy', 'VUO84VlBkj', 'vIv8mwrgI0', 'xXa8rpPcLP', 'qrU8xfZSfU', 'GbV81IwvCi'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, tHDLKkJMT8oEx4RQ7t.cs	High entropy of concatenated method names: 'BHpKOTG7oe', 'DblK0bbnyg', 'YfrKvDoxFa', 'gQrK57AmGg', 'IqZKn7VOaW', 'SalKEYvX7q', 'pArKHFRrTx', 'nBLKhU4nBW', 'DNTKpqBI12', 'SyVKGeGAmK'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, fVF3XIqralY1JOMaqw.cs	High entropy of concatenated method names: 'G6hjT4dfqW', 'NTyj8NS2J7', 'mZsjsmuepN', 'U2Uj2xs0Yv', 'c0sjUi0jWn', 'SlWjZOUqxg', 'au0jMoRgTq', 'gvNjeLyhcQ', 'mRfjLX2VwG', 'GsZjBIqB7x'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, QW8J5PzYIbsH5vnDyy.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FvIbKCkiGl', 'NRdbgnvS8w', 'LP5bFnGG8e', 'W6pbo3VYTJ', 'WB5bjCBjUY', 'k8dbbnX3ls', 'NbTb97t94C'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, o9jdmQsGCgTIkNmGv2.cs	High entropy of concatenated method names: 'RJZswhF3tk', 't1EsfDbyks', 'RJ2sOuDKuM', 'X1Hs0xoLwY', 'zBBsgfmg0r', 'sIKsFRdVFR', 'x4PsoYsd7D', 'WWwsjdra5v', 'mnHsbYUQGC', 'aAIs94BSCt'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, nFhELShYqYU65kYU5Q9.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Xpq96wgAFu', 'pbS9RaTesL', 'AQa9XfBmSa', 'Cer9d9cRdX', 'sKR9qF7YYu', 'wpc94k858D', 'Ea49mL0Wmq'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, rN9XSjdhqZcuDiacet.cs	High entropy of concatenated method names: 'Dispose', 'UsCaxPTXbZ', 'fCYl5jJTIL', 'rqtQQpOnsS', 'P0Ua1DNptF', 'vuDazw0Eik', 'ProcessDialogKey', 'wqHl78itUr', 'FEZlaiWrwq', 'DXpllTbkTF'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, tRcBh7FnfYqZ2Ih46n.cs	High entropy of concatenated method names: 'Fw5jvakq8g', 'HZPj5fBsGL', 'tkIjtanFBq', 'hnOjnb0NJw', 'o7kj6tao9C', 'X9ajEX1dI9', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, rT4Z1xKJgfbBPIZRpY.cs	High entropy of concatenated method names: 'hZiUJLy4UO', 'uHfU8DxdL4', 'LIlU2JGTjh', 'd6aUZcXLVp', 'HSwUM4jW6H', 'Qs12qH9rj3', 'qiH24EpDFh', 'S1X2mbddp4', 'gUa2reNCqk', 'N5J2xhwPGo'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, DKZiXxkL622DIf6Iun.cs	High entropy of concatenated method names: 'KmfoLqTUIU', 'FsDoB94veA', 'ToString', 'juooTOMx63', 'Xb6o8yuP6N', 'DXfosh6hgt', 'FSfo2tvxY0', 'EIdoUD7por', 'q11oZ6JP5t', 'GOloM9QKHi'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, ivja7VtTKYMOBOMtQ6.cs	High entropy of concatenated method names: 'nIsASRL9P', 'B19wsfoP5', 'c49f2A9ss', 'NYqYZyWqu', 'dHg0HuCX0', 'HsENeNDcF', 'QhhvibEWC9EDfRv9mE', 'IrDUQro4XMEhJOFwBO', 'GMfjv4baZ', 'Ywi9ihNKm'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, TX5JuTvpNMXGIiq0R2.cs	High entropy of concatenated method names: 'yZRZTPIWlS', 'rU5Zsx0r2G', 'eKHZUu5uF9', 'C3FU1BHIBR', 'AsiUzVaFqF', 'emEZ7iTRfc', 'clSZa0A5kD', 'dODZl4BZSN', 'ifnZSeIgnv', 'Ry8ZkF794r'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, mYX6GjheM6iRDrSYZic.cs	High entropy of concatenated method names: 'S39bPJ9ZaI', 'EFoby6boEh', 'l6qbAJQJJE', 'iE1bw7kTID', 'knJbVbSj6w', 'x5FbfiZj9j', 'nQBbY0O8sg', 'wqubO1RBRf', 'GjCb0GNE77', 'stfbNeSYNp'
Source: 1.2.autorization Letter.exe.7860000.5.raw.unpack, UY6OkZmTbEf4BsBGNk.cs	High entropy of concatenated method names: 'PrW2V2eKTV', 'yfZ2Yd4ILi', 'rZpstMqMXc', 'rTBsnO2QXT', 'jOlsEmjWSy', 'BEksi450wH', 's6DsHBOP4o', 'c9lshqbbI7', 'wDQs3Ripmw', 'P95spyyPIt'
Source: 1.2.autorization Letter.exe.34598c4.0.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 1.2.autorization Letter.exe.34598c4.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, yxVmJLNMxItFD4gtlw.cs	High entropy of concatenated method names: 'LJggpU5HQm', 'G0igWpPIdo', 'fT4g6lCPHe', 'FhegRtDhGW', 'JjMg5nycZT', 'NtNgtXnF6s', 'qVugnLKtVv', 'U8CgErDyj8', 'bsqgiXf53X', 'PKegHqfQOH'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, Eqhytk7pjoST4sg0KT.cs	High entropy of concatenated method names: 'dw4baUeBSV', 'cdWbS7FcUb', 'OsIbkJwNOW', 'dSrbTJfcN0', 'XZ5b8FoXu6', 'bHSb23hhRF', 'FldbULRDY0', 'RxgjmXvJhN', 'pP8jrbBxDW', 'ILJjxZFoOf'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, YpTWJpZyAmNmFD026j.cs	High entropy of concatenated method names: 'C3VaZ4pBUS', 'dGgaMMjZy9', 'k5HaLIu74j', 'TugaB9TBP6', 'JU2ag5BGI8', 'TCRaFZtKKG', 'M55VlCUlsEkAvTCDN2', 'vRR09m5KbNajnMMu7M', 'JUBaa5srRO', 'OvsaSso6Hd'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, Ew9Mhe1NCjRAdHx3lS.cs	High entropy of concatenated method names: 'ToString', 'rcAFGBPVa2', 'RBFF5dZJxy', 'XHHFtG5hQU', 'rrmFnbcnjy', 'wvVFEv8wsX', 'JsQFicDayf', 'OKpFHuRXsb', 'vsEFhbW3ox', 'kJ8F3MUUMP'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, iPyZ94TiRa2ebZuHpM.cs	High entropy of concatenated method names: 'kiFZPRI11W', 'ICjZys9s0B', 'AhbZABqTRw', 'bmjZw6IYYQ', 'iq4ZVTwxQa', 'i5KZfJqFcI', 'qu8ZYAbQXD', 'lQIZOwPUtM', 'k96Z0kVbw5', 'DknZNKmMkm'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, md29wrV9kisHjHUXvF.cs	High entropy of concatenated method names: 'X45orGoWqu', 'BsWo1TWg9b', 'mG8j7cMn5r', 'NUajaNAsxq', 'YLooGKXZoR', 'Pn1oWngO8c', 'BNaoIBjKjA', 'vL3o6k42EV', 'o6qoRAA5FM', 'PJQoXO4TZx'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, poU46SQrMKhRY6KoAP.cs	High entropy of concatenated method names: 'bWCSJCf7q9', 'cv6ST6TB7b', 'S0rS8RjYrE', 'W2eSsD7Br1', 'LwvS2ykFr2', 'LifSUNu6is', 'RD9SZLx8Qm', 'kYvSMlmx4L', 'B7gSeaoive', 'IvUSLwsrH2'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, lSFA8pMlGZmCox3ZBB.cs	High entropy of concatenated method names: 'sXB86nBdnv', 'Xq38RWaapL', 'moR8X9FhJQ', 'zM48dEkVUe', 'PtC8qKnVDy', 'VUO84VlBkj', 'vIv8mwrgI0', 'xXa8rpPcLP', 'qrU8xfZSfU', 'GbV81IwvCi'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, tHDLKkJMT8oEx4RQ7t.cs	High entropy of concatenated method names: 'BHpKOTG7oe', 'DblK0bbnyg', 'YfrKvDoxFa', 'gQrK57AmGg', 'IqZKn7VOaW', 'SalKEYvX7q', 'pArKHFRrTx', 'nBLKhU4nBW', 'DNTKpqBI12', 'SyVKGeGAmK'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, fVF3XIqralY1JOMaqw.cs	High entropy of concatenated method names: 'G6hjT4dfqW', 'NTyj8NS2J7', 'mZsjsmuepN', 'U2Uj2xs0Yv', 'c0sjUi0jWn', 'SlWjZOUqxg', 'au0jMoRgTq', 'gvNjeLyhcQ', 'mRfjLX2VwG', 'GsZjBIqB7x'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, QW8J5PzYIbsH5vnDyy.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'FvIbKCkiGl', 'NRdbgnvS8w', 'LP5bFnGG8e', 'W6pbo3VYTJ', 'WB5bjCBjUY', 'k8dbbnX3ls', 'NbTb97t94C'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, o9jdmQsGCgTIkNmGv2.cs	High entropy of concatenated method names: 'RJZswhF3tk', 't1EsfDbyks', 'RJ2sOuDKuM', 'X1Hs0xoLwY', 'zBBsgfmg0r', 'sIKsFRdVFR', 'x4PsoYsd7D', 'WWwsjdra5v', 'mnHsbYUQGC', 'aAIs94BSCt'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, nFhELShYqYU65kYU5Q9.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Xpq96wgAFu', 'pbS9RaTesL', 'AQa9XfBmSa', 'Cer9d9cRdX', 'sKR9qF7YYu', 'wpc94k858D', 'Ea49mL0Wmq'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, rN9XSjdhqZcuDiacet.cs	High entropy of concatenated method names: 'Dispose', 'UsCaxPTXbZ', 'fCYl5jJTIL', 'rqtQQpOnsS', 'P0Ua1DNptF', 'vuDazw0Eik', 'ProcessDialogKey', 'wqHl78itUr', 'FEZlaiWrwq', 'DXpllTbkTF'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, tRcBh7FnfYqZ2Ih46n.cs	High entropy of concatenated method names: 'Fw5jvakq8g', 'HZPj5fBsGL', 'tkIjtanFBq', 'hnOjnb0NJw', 'o7kj6tao9C', 'X9ajEX1dI9', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, rT4Z1xKJgfbBPIZRpY.cs	High entropy of concatenated method names: 'hZiUJLy4UO', 'uHfU8DxdL4', 'LIlU2JGTjh', 'd6aUZcXLVp', 'HSwUM4jW6H', 'Qs12qH9rj3', 'qiH24EpDFh', 'S1X2mbddp4', 'gUa2reNCqk', 'N5J2xhwPGo'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, DKZiXxkL622DIf6Iun.cs	High entropy of concatenated method names: 'KmfoLqTUIU', 'FsDoB94veA', 'ToString', 'juooTOMx63', 'Xb6o8yuP6N', 'DXfosh6hgt', 'FSfo2tvxY0', 'EIdoUD7por', 'q11oZ6JP5t', 'GOloM9QKHi'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, ivja7VtTKYMOBOMtQ6.cs	High entropy of concatenated method names: 'nIsASRL9P', 'B19wsfoP5', 'c49f2A9ss', 'NYqYZyWqu', 'dHg0HuCX0', 'HsENeNDcF', 'QhhvibEWC9EDfRv9mE', 'IrDUQro4XMEhJOFwBO', 'GMfjv4baZ', 'Ywi9ihNKm'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, TX5JuTvpNMXGIiq0R2.cs	High entropy of concatenated method names: 'yZRZTPIWlS', 'rU5Zsx0r2G', 'eKHZUu5uF9', 'C3FU1BHIBR', 'AsiUzVaFqF', 'emEZ7iTRfc', 'clSZa0A5kD', 'dODZl4BZSN', 'ifnZSeIgnv', 'Ry8ZkF794r'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, mYX6GjheM6iRDrSYZic.cs	High entropy of concatenated method names: 'S39bPJ9ZaI', 'EFoby6boEh', 'l6qbAJQJJE', 'iE1bw7kTID', 'knJbVbSj6w', 'x5FbfiZj9j', 'nQBbY0O8sg', 'wqubO1RBRf', 'GjCb0GNE77', 'stfbNeSYNp'
Source: 1.2.autorization Letter.exe.46b0be0.3.raw.unpack, UY6OkZmTbEf4BsBGNk.cs	High entropy of concatenated method names: 'PrW2V2eKTV', 'yfZ2Yd4ILi', 'rZpstMqMXc', 'rTBsnO2QXT', 'jOlsEmjWSy', 'BEksi450wH', 's6DsHBOP4o', 'c9lshqbbI7', 'wDQs3Ripmw', 'P95spyyPIt'
Source: 10.2.tIFjYTCo.exe.27098b4.0.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 10.2.tIFjYTCo.exe.27098b4.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'

Source: C:\Users\user\Desktop\autorization Letter.exe	File created: C:\Users\user\AppData\Roaming\tIFjYTCo.exe			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File created: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\autorization Letter.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmpF639.tmp"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GUIVTme			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GUIVTme			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe:Zone.Identifier read attributes \| delete

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: autorization Letter.exe PID: 6180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: tIFjYTCo.exe PID: 3440, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\autorization Letter.exe	Memory allocated: 1670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Memory allocated: 3420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Memory allocated: 3240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Memory allocated: 7F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Memory allocated: 8F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Memory allocated: 90C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Memory allocated: A0C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Memory allocated: D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Memory allocated: 26D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Memory allocated: 24D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Memory allocated: 6EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Memory allocated: 7EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Memory allocated: 8070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Memory allocated: 9070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Memory allocated: 1150000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Memory allocated: 2C90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Memory allocated: 2AB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Memory allocated: EF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Memory allocated: 2890000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Memory allocated: 4890000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\autorization Letter.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5301	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2307	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2751	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1091
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2786

Source: C:\Users\user\Desktop\autorization Letter.exe TID: 5084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7092	Thread sleep count: 5301 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4676	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5512	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4592	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7060	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe TID: 7164	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe TID: 1020	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe TID: 4148	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\autorization Letter.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99519	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98814	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98655
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97863
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Thread delayed: delay time: 922337203685477

Source: RegSvcs.exe, 00000009.00000002.2211048894.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll{r
Source: RegSvcs.exe, 0000000E.00000002.3353008996.0000000005AE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: autorization Letter.exe, 00000001.00000002.2157399976.0000000001703000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}g.T

Source: C:\Users\user\Desktop\autorization Letter.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\autorization Letter.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\autorization Letter.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe"
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\tIFjYTCo.exe"
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe"	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\tIFjYTCo.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\autorization Letter.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\autorization Letter.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\autorization Letter.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 87A008	Jump to behavior

Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe"	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\tIFjYTCo.exe"	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmpF639.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmp1162.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\autorization Letter.exe	Queries volume information: C:\Users\user\Desktop\autorization Letter.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\autorization Letter.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Queries volume information: C:\Users\user\AppData\Roaming\tIFjYTCo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tIFjYTCo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation

Source: C:\Users\user\Desktop\autorization Letter.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.autorization Letter.exe.44ec5b8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.autorization Letter.exe.44b1598.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.autorization Letter.exe.44b1598.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.3346316308.0000000002899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2202666103.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2204151615.000000000288A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3346316308.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2204151615.0000000002882000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2160081111.0000000004429000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3346316308.000000000282C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2204151615.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: autorization Letter.exe PID: 6180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6540, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 1.2.autorization Letter.exe.44ec5b8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.autorization Letter.exe.44b1598.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.autorization Letter.exe.44b1598.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2202666103.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2160081111.0000000004429000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3346316308.000000000282C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2204151615.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: autorization Letter.exe PID: 6180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6540, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.autorization Letter.exe.44ec5b8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.autorization Letter.exe.44b1598.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.autorization Letter.exe.44ec5b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.autorization Letter.exe.44b1598.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.3346316308.0000000002899000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2202666103.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2204151615.000000000288A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3346316308.0000000002891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2204151615.0000000002882000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2160081111.0000000004429000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3346316308.000000000282C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2204151615.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: autorization Letter.exe PID: 6180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6540, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Obfuscated Files or Information	1 Credentials in Registry	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
autorization Letter.exe	58%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal
autorization Letter.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\tIFjYTCo.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\tIFjYTCo.exe	58%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal

Source	Detection	Scanner	Label
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://mail.unitechautomations.com	0%	Avira URL Cloud	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.unitechautomations.com	192.185.129.60	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.unitechautomations.com	RegSvcs.exe, 00000009.00000002.2204151615.000000000288A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000E.00000002.3346316308.0000000002899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	autorization Letter.exe, 00000001.00000002.2160081111.0000000004429000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.2202666103.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	autorization Letter.exe, 00000001.00000002.2159567789.0000000003475000.00000004.00000800.00020000.00000000.sdmp, tIFjYTCo.exe, 0000000A.00000002.2225613849.000000000272A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	autorization Letter.exe, tIFjYTCo.exe.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.185.129.60	mail.unitechautomations.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519119
Start date and time:	2024-09-26 07:02:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	autorization Letter.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/19@1/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 288 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target GUIVTme.exe, PID 5332 because it is empty
Execution Graph export aborted for target GUIVTme.exe, PID 5744 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: autorization Letter.exe

Simulations

Behavior and APIs

Time	Type	Description
01:03:04	API Interceptor	1x Sleep call for process: autorization Letter.exe modified
01:03:09	API Interceptor	32x Sleep call for process: powershell.exe modified
01:03:10	API Interceptor	45x Sleep call for process: RegSvcs.exe modified
01:03:12	API Interceptor	1x Sleep call for process: tIFjYTCo.exe modified
07:03:09	Task Scheduler	Run new task: tIFjYTCo path: C:\Users\user\AppData\Roaming\tIFjYTCo.exe
07:03:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GUIVTme C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe
07:03:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GUIVTme C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
192.185.129.60	DAZZILING- ASIA PO.NO4678754.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Payment Copy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	8b1ddf6861f6e9fdd05b7e279bf0e218c41946b5162dc12d7da5cb628c98db27_dump.exe	Get hash	malicious	AgentTesla	Browse
	ISS GLOBAL FORWARDING UAE LLC.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Invoice Checklist.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Total Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	CREDIT NOTE.exe	Get hash	malicious	AgentTesla	Browse
	Total Invoices.exe	Get hash	malicious	AgentTesla	Browse
	CAHKHCM2404009CFS.exe	Get hash	malicious	AgentTesla	Browse
	Booking_BK24-000288_19_Apr_2410_52_34 AM.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.unitechautomations.com	DAZZILING- ASIA PO.NO4678754.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.129.60
	Payment Copy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.129.60
	8b1ddf6861f6e9fdd05b7e279bf0e218c41946b5162dc12d7da5cb628c98db27_dump.exe	Get hash	malicious	AgentTesla	Browse	192.185.129.60
	ISS GLOBAL FORWARDING UAE LLC.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.129.60
	Invoice Checklist.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.129.60
	Total Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.185.129.60
	CREDIT NOTE.exe	Get hash	malicious	AgentTesla	Browse	192.185.129.60
	Total Invoices.exe	Get hash	malicious	AgentTesla	Browse	192.185.129.60
	CAHKHCM2404009CFS.exe	Get hash	malicious	AgentTesla	Browse	192.185.129.60
	Booking_BK24-000288_19_Apr_2410_52_34 AM.exe	Get hash	malicious	AgentTesla	Browse	192.185.129.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	http://www.richfieldkennel.com/SharePointProposalFile/	Get hash	malicious	HTMLPhisher	Browse	192.185.102.120
	https://putefix.dogfriendlytahoe.com/	Get hash	malicious	Unknown	Browse	192.185.24.110
	https://albertanewsprint.dogfriendlytahoe.com/	Get hash	malicious	Unknown	Browse	192.185.24.110
	INDIA - VSL PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	https://dwr.yoh.mybluehost.me/wp-content/plugins/A/sdh/TU17HLK/	Get hash	malicious	Unknown	Browse	50.6.153.157
	https://abre.ai/k8hX	Get hash	malicious	Unknown	Browse	50.6.153.157
	http://nky.beb.mybluehost.me/new/auth/entrar.php	Get hash	malicious	Unknown	Browse	50.6.153.4
	https://turkiyecumhuriyetiziraatbankasi.com/	Get hash	malicious	Unknown	Browse	162.240.37.219
	https://c81df1b32e6c3c5e06e82397233e2695.crimachado.com.br/wehrgiwfbfeifef/djbfhokefbwuwrjow/djhfeokhrwihfekljd/cmVnaXN0cmF0b3JAc3Uuc2U=	Get hash	malicious	HTMLPhisher	Browse	108.179.252.203
	https://aac4b0887827b3598989c48a201d0420.crimachado.com.br/wehrgiwfbfeifef/djbfhokefbwuwrjow/djhfeokhrwihfekljd/bnpheWVkaUBzdGMuY29tLnNh	Get hash	malicious	HTMLPhisher	Browse	108.179.252.203

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe	rMT103SwiftCopyoFPayment.exe	Get hash	malicious	AgentTesla	Browse
	Shipping Document.exe	Get hash	malicious	AgentTesla	Browse
	COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe	Get hash	malicious	AgentTesla	Browse
	DHL- CBJ520818836689.pdf.exe	Get hash	malicious	AgentTesla	Browse
	DHL- CBJ520818836689.exe	Get hash	malicious	AgentTesla	Browse
	Shipping documents.exe	Get hash	malicious	AgentTesla	Browse
	Shipping doc.exe	Get hash	malicious	AgentTesla	Browse
	80c619d931fa4e5c89fe87aac0b6b143.exe	Get hash	malicious	XWorm	Browse
	Rejected Shipping Documents compiled PL pdf.exe	Get hash	malicious	AgentTesla	Browse
	Public Holiday mem_Notice 2024.exe	Get hash	malicious	AgentTesla	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GUIVTme.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	142
Entropy (8bit):	5.090621108356562
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
MD5:	8C0458BB9EA02D50565175E38D577E35
SHA1:	F0B50702CD6470F3C17D637908F83212FDBDB2F2
SHA-256:	C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
SHA-512:	804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\autorization Letter.exe.log

Download File

Process:	C:\Users\user\Desktop\autorization Letter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tIFjYTCo.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\tIFjYTCo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.380285623575084
Encrypted:	false
SSDEEP:	48:+WSU4xympjgs4RIoU99tK8NPZHUl7u1iMuge//8M0Uyus:+LHxvCsIfA2KRHmOugw1s
MD5:	3DE8C237AE45317874CDD4A22928CCED
SHA1:	5FDA59AE6DF07FE8DDAA0D3FDC17D78752C9955A
SHA-256:	C7784FBFD2FC129A8F16665768CA3C17B9BCF080FFD48516E826A6B18F629A06
SHA-512:	BC5397E31BE411D3154A61F270B23B51DF7F7E3812255D5F64CD16E0E62DA4C51BEDE994915055F65F49977D282BF0A5F9C66E0AD8CE869137606B703CC0E042
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11g0nfzk.wjm.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3vlyn5gt.xhc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5cbcryey.s5i.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5cc2xxa3.4ha.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5kk0dmj.pnk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_idf5mf53.ilr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_osp51fi5.hyv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbbwxrea.5tm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp1162.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\tIFjYTCo.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	5.104782811711384
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtOxvn:cgergYrFdOFzOzN33ODOiDdKrsuTCv
MD5:	55D30B34C86EA4E93D9FF780B8C450FA
SHA1:	761F4FE2CE32B3D912A1898D57DBBEBF8F8B005B
SHA-256:	857FA04642FE7003EB7D4AC07216F000A4D1595451F21589F63AFA7790AF15FC
SHA-512:	D807ADBEFA9CDE8D40379113CA36EBF1EC72D43BBD52A11347897C1DB2E8B8B62F5000241759517F2DB1AC29D6E01DD81AF441897AED0D1AA1F56D86B3AE3169
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmpF639.tmp

Download File

Process:	C:\Users\user\Desktop\autorization Letter.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	5.104782811711384
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtOxvn:cgergYrFdOFzOzN33ODOiDdKrsuTCv
MD5:	55D30B34C86EA4E93D9FF780B8C450FA
SHA1:	761F4FE2CE32B3D912A1898D57DBBEBF8F8B005B
SHA-256:	857FA04642FE7003EB7D4AC07216F000A4D1595451F21589F63AFA7790AF15FC
SHA-512:	D807ADBEFA9CDE8D40379113CA36EBF1EC72D43BBD52A11347897C1DB2E8B8B62F5000241759517F2DB1AC29D6E01DD81AF441897AED0D1AA1F56D86B3AE3169
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	45984
Entropy (8bit):	6.16795797263964
Encrypted:	false
SSDEEP:	768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5:	9D352BC46709F0CB5EC974633A0C3C94
SHA1:	1969771B2F022F9A86D77AC4D4D239BECDF08D07
SHA-256:	2C1EEB7097023C784C2BD040A2005A5070ED6F3A4ABF13929377A9E39FAB1390
SHA-512:	13C714244EC56BEEB202279E4109D59C2A43C3CF29F90A374A751C04FD472B45228CA5A0178F41109ED863DBD34E0879E4A21F5E38AE3D89559C57E6BE990A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: rMT103SwiftCopyoFPayment.exe, Detection: malicious, Browse Filename: Shipping Document.exe, Detection: malicious, Browse Filename: COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe, Detection: malicious, Browse Filename: DHL- CBJ520818836689.pdf.exe, Detection: malicious, Browse Filename: DHL- CBJ520818836689.exe, Detection: malicious, Browse Filename: Shipping documents.exe, Detection: malicious, Browse Filename: Shipping doc.exe, Detection: malicious, Browse Filename: 80c619d931fa4e5c89fe87aac0b6b143.exe, Detection: malicious, Browse Filename: Rejected Shipping Documents compiled PL pdf.exe, Detection: malicious, Browse Filename: Public Holiday mem_Notice 2024.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0..d..........V.... ........@.. ..............................s.....`.....................................O.......8............r...A.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........\|...P...........................................r...p(....2.(....(....z..r...p(....(....(......}......{.....s..........0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t........0..(....... ....s$........o%....X..(....-...o&....0...........('......&.........................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

C:\Users\user\AppData\Roaming\tIFjYTCo.exe

Download File

Process:	C:\Users\user\Desktop\autorization Letter.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	841224
Entropy (8bit):	7.631178244358003
Encrypted:	false
SSDEEP:	24576:4nIY7owVZppDU/4p2v213ZYip6rhrCWKjMA:4t7o6Zp9L2v2TYXrhrCWkMA
MD5:	457F6CB01C6F3F7922AC201F70111AE5
SHA1:	934E5433FC83AF812DB461E3E7748C311E19B1BC
SHA-256:	CA471400001374BDDF5E6FF03DB7889CF53BD516FE64209FAEE8B894B454C3C5
SHA-512:	2403C0AB282E085B54AB5689FBAE2328CF16D19BDEC2EDB24E32AD6BAB79BDF2ABA26AA52A48B44F9F573E390636A1401C7F7B30104EDA131D4BEC9776D06A9B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...<=...............0.................. ... ....@.. ....................................@.....................................O.... ...................6..........8...p............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................H........;..h+......-... g................................................s....}.....s....}......}.....(.......(........0..C........r...p(..........+)......{.....o......{....o.....o....&...X....i2...0...........r...p..0............{....o......{....o......{....o......{....o......{....o.......{......(...+...(.....o.....(.....( .....s.........(.............o!...("...&..........n..{......&..(#.......0..\|...........{....o....r...p($.....,...+2.{....o......(%........,...{....

C:\Users\user\AppData\Roaming\tIFjYTCo.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\autorization Letter.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.442398121585593
Encrypted:	false
SSDEEP:	24:zKLXkhDObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0hDQntKKH1MqJC
MD5:	6FB4D27A716A8851BC0505666E7C7A10
SHA1:	AD2A232C6E709223532C4D1AB892303273D8C814
SHA-256:	1DC36F296CE49BDF1D560B527DB06E1E9791C10263459A67EACE706C6DDCDEAE
SHA-512:	3192095C68C6B7AD94212B7BCA0563F2058BCE00C0C439B90F0E96EA2F029A37C2F2B69487591B494C1BA54697FE891E214582E392127CB8C90AB682E0D81ADB
Malicious:	false
Preview:	Microsoft (R) .NET Framework Services Installation Utility Version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.631178244358003
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	autorization Letter.exe
File size:	841'224 bytes
MD5:	457f6cb01c6f3f7922ac201f70111ae5
SHA1:	934e5433fc83af812db461e3e7748c311e19b1bc
SHA256:	ca471400001374bddf5e6ff03db7889cf53bd516fe64209faee8b894b454c3c5
SHA512:	2403c0ab282e085b54ab5689fbae2328cf16d19bdec2edb24e32ad6bab79bdf2aba26aa52a48b44f9f573e390636a1401c7f7b30104eda131d4bec9776d06a9b
SSDEEP:	24576:4nIY7owVZppDU/4p2v213ZYip6rhrCWKjMA:4t7o6Zp9L2v2TYXrhrCWkMA
TLSH:	6805F1A079328843D53B4FBC8823D2B54AB49C4E7113A29B71EC7E373C5928D594B67E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...<=................0.................. ... ....@.. ....................................@................................

File Icon


Icon Hash:	074dd8a2a2ce7107

Static PE Info

General

Entrypoint:	0x4a05ee
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x8BCF3D3C [Sat Apr 30 07:37:32 2044 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 01:00:00 09/11/2021 00:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa059a	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa2000	0x2b488	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xca000	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xce000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9f438	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9e5f4	0x9e600	b6a916eb4bb48054dc07953780c30cb4	False	0.9414401637726914	data	7.850552008247241	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa2000	0x2b488	0x2b600	2339f1b787e9ab0484f1c5ae87ff218d	False	0.22889836995677235	data	5.985036348981686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xce000	0xc	0x200	3a1fc2d10edd7b039ba69dc6c4d84305	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa22b0	0x34a1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9923550805314333
RT_ICON	0xa5754	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.11334733230805631
RT_ICON	0xb5f7c	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.17271915072524702
RT_ICON	0xbf424	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.19371534195933457
RT_ICON	0xc48ac	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.18192017005196032
RT_ICON	0xc8ad4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.2454356846473029
RT_ICON	0xcb07c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.28119136960600377
RT_ICON	0xcc124	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.3639344262295082
RT_ICON	0xccaac	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.44858156028368795
RT_GROUP_ICON	0xccf14	0x84	data	0.7045454545454546
RT_VERSION	0xccf98	0x304	data	0.43523316062176165
RT_MANIFEST	0xcd29c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T07:03:00.331719+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.5	49712	192.185.129.60	587	TCP
2024-09-26T07:03:00.331719+0200	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.5	49712	192.185.129.60	587	TCP
2024-09-26T07:03:00.331719+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.5	49712	192.185.129.60	587	TCP
2024-09-26T07:03:14.516239+0200	2855245	ETPRO MALWARE Agent Tesla Exfil via SMTP	1	192.168.2.5	49711	192.185.129.60	587	TCP
2024-09-26T07:03:14.516239+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49711	192.185.129.60	587	TCP
2024-09-26T07:03:18.387344+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.5	49711	192.185.129.60	587	TCP
2024-09-26T07:03:18.387344+0200	2839723	ETPRO MALWARE Win32/Agent Tesla SMTP Activity	1	192.168.2.5	49711	192.185.129.60	587	TCP
2024-09-26T07:03:18.387344+0200	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.5	49711	192.185.129.60	587	TCP
2024-09-26T07:03:20.151372+0200	2855245	ETPRO MALWARE Agent Tesla Exfil via SMTP	1	192.168.2.5	49712	192.185.129.60	587	TCP
2024-09-26T07:03:20.151372+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49712	192.185.129.60	587	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 07:03:12.377485991 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:12.382375002 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:12.384222031 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:13.070116997 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:13.071027040 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:13.075896025 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:13.247092009 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:13.248347998 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:13.253300905 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:13.414484978 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:13.415596008 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:13.420527935 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:13.787029982 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:13.787302017 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:13.792212009 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:13.962662935 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:13.962903023 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:13.967840910 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:14.343059063 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:14.343246937 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:14.349797964 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:14.515552998 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:14.516191006 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:14.516238928 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:14.516266108 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:14.516287088 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:14.521111012 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:14.521121979 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:14.521246910 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:14.521255970 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:14.805124044 CEST	587	49711	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:14.847150087 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:18.278861046 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:18.283873081 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:18.283981085 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:18.387343884 CEST	49711	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:18.941123009 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:18.941585064 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:18.946443081 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:19.111865997 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:19.112166882 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:19.117064953 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:19.276999950 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:19.277544022 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:19.282440901 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:19.459836960 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:19.460290909 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:19.465195894 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:19.682753086 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:19.682991028 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:19.687942028 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:19.995276928 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:19.995573997 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:20.000436068 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:20.150343895 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:20.151192904 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:20.151371956 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:20.151406050 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:20.151431084 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:03:20.156122923 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:20.156244040 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:20.156296015 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:20.156367064 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:20.422688961 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:03:20.472306967 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:04:58.285280943 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:04:58.290091038 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:04:58.651185989 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:04:58.651284933 CEST	587	49712	192.185.129.60	192.168.2.5
Sep 26, 2024 07:04:58.651356936 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:04:58.651549101 CEST	49712	587	192.168.2.5	192.185.129.60
Sep 26, 2024 07:04:58.656380892 CEST	587	49712	192.185.129.60	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 07:03:12.011574984 CEST	60297	53	192.168.2.5	1.1.1.1
Sep 26, 2024 07:03:12.368562937 CEST	53	60297	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 07:03:12.011574984 CEST	192.168.2.5	1.1.1.1	0x38e5	Standard query (0)	mail.unitechautomations.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 07:03:12.368562937 CEST	1.1.1.1	192.168.2.5	0x38e5	No error (0)	mail.unitechautomations.com		192.185.129.60	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 26, 2024 07:03:13.070116997 CEST	587	49711	192.185.129.60	192.168.2.5	220-cp-ht-2.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 26 Sep 2024 10:33:12 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Sep 26, 2024 07:03:13.071027040 CEST	49711	587	192.168.2.5	192.185.129.60	EHLO 878411
Sep 26, 2024 07:03:13.247092009 CEST	587	49711	192.185.129.60	192.168.2.5	250-cp-ht-2.webhostbox.net Hello 878411 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Sep 26, 2024 07:03:13.248347998 CEST	49711	587	192.168.2.5	192.185.129.60	AUTH login ZGVzaWduQHVuaXRlY2hhdXRvbWF0aW9ucy5jb20=
Sep 26, 2024 07:03:13.414484978 CEST	587	49711	192.185.129.60	192.168.2.5	334 UGFzc3dvcmQ6
Sep 26, 2024 07:03:13.787029982 CEST	587	49711	192.185.129.60	192.168.2.5	235 Authentication succeeded
Sep 26, 2024 07:03:13.787302017 CEST	49711	587	192.168.2.5	192.185.129.60	MAIL FROM:<design@unitechautomations.com>
Sep 26, 2024 07:03:13.962662935 CEST	587	49711	192.185.129.60	192.168.2.5	250 OK
Sep 26, 2024 07:03:13.962903023 CEST	49711	587	192.168.2.5	192.185.129.60	RCPT TO:<overseas1@vestalshipping.com.vn>
Sep 26, 2024 07:03:14.343059063 CEST	587	49711	192.185.129.60	192.168.2.5	250 Accepted
Sep 26, 2024 07:03:14.343246937 CEST	49711	587	192.168.2.5	192.185.129.60	DATA
Sep 26, 2024 07:03:14.515552998 CEST	587	49711	192.185.129.60	192.168.2.5	354 Enter message, ending with "." on a line by itself
Sep 26, 2024 07:03:14.516287088 CEST	49711	587	192.168.2.5	192.185.129.60	.
Sep 26, 2024 07:03:14.805124044 CEST	587	49711	192.185.129.60	192.168.2.5	250 OK id=1stgeo-000KNK-1N
Sep 26, 2024 07:03:18.941123009 CEST	587	49712	192.185.129.60	192.168.2.5	220-cp-ht-2.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 26 Sep 2024 10:33:18 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Sep 26, 2024 07:03:18.941585064 CEST	49712	587	192.168.2.5	192.185.129.60	EHLO 878411
Sep 26, 2024 07:03:19.111865997 CEST	587	49712	192.185.129.60	192.168.2.5	250-cp-ht-2.webhostbox.net Hello 878411 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Sep 26, 2024 07:03:19.112166882 CEST	49712	587	192.168.2.5	192.185.129.60	AUTH login ZGVzaWduQHVuaXRlY2hhdXRvbWF0aW9ucy5jb20=
Sep 26, 2024 07:03:19.276999950 CEST	587	49712	192.185.129.60	192.168.2.5	334 UGFzc3dvcmQ6
Sep 26, 2024 07:03:19.459836960 CEST	587	49712	192.185.129.60	192.168.2.5	235 Authentication succeeded
Sep 26, 2024 07:03:19.460290909 CEST	49712	587	192.168.2.5	192.185.129.60	MAIL FROM:<design@unitechautomations.com>
Sep 26, 2024 07:03:19.682753086 CEST	587	49712	192.185.129.60	192.168.2.5	250 OK
Sep 26, 2024 07:03:19.682991028 CEST	49712	587	192.168.2.5	192.185.129.60	RCPT TO:<overseas1@vestalshipping.com.vn>
Sep 26, 2024 07:03:19.995276928 CEST	587	49712	192.185.129.60	192.168.2.5	250 Accepted
Sep 26, 2024 07:03:19.995573997 CEST	49712	587	192.168.2.5	192.185.129.60	DATA
Sep 26, 2024 07:03:20.150343895 CEST	587	49712	192.185.129.60	192.168.2.5	354 Enter message, ending with "." on a line by itself
Sep 26, 2024 07:03:20.151431084 CEST	49712	587	192.168.2.5	192.185.129.60	.
Sep 26, 2024 07:03:20.422688961 CEST	587	49712	192.185.129.60	192.168.2.5	250 OK id=1stgeu-000KZI-0E
Sep 26, 2024 07:04:58.285280943 CEST	49712	587	192.168.2.5	192.185.129.60	QUIT
Sep 26, 2024 07:04:58.651185989 CEST	587	49712	192.185.129.60	192.168.2.5	221 cp-ht-2.webhostbox.net closing connection

Target ID:	1
Start time:	01:03:04
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\autorization Letter.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\autorization Letter.exe"
Imagebase:	0xe40000
File size:	841'224 bytes
MD5 hash:	457F6CB01C6F3F7922AC201F70111AE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2160081111.0000000004429000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2160081111.0000000004429000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:03:08
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\autorization Letter.exe"
Imagebase:	0xb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:03:08
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:03:08
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\tIFjYTCo.exe"
Imagebase:	0xb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:03:08
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:03:08
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmpF639.tmp"
Imagebase:	0x190000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:03:08
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:03:09
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x610000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2202666103.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2202666103.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2204151615.000000000288A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2204151615.0000000002882000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2204151615.0000000002831000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2204151615.0000000002831000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:03:09
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Roaming\tIFjYTCo.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\tIFjYTCo.exe
Imagebase:	0x1b0000
File size:	841'224 bytes
MD5 hash:	457F6CB01C6F3F7922AC201F70111AE5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:03:11
Start date:	26/09/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:03:15
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tIFjYTCo" /XML "C:\Users\user\AppData\Local\Temp\tmp1162.tmp"
Imagebase:	0x190000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:03:15
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:03:15
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x540000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3346316308.0000000002899000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3346316308.0000000002891000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.3346316308.000000000282C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.3346316308.000000000282C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	01:03:20
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe"
Imagebase:	0x900000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:03:20
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:03:28
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GUIVTme\GUIVTme.exe"
Imagebase:	0x5c0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:03:28
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	195
Total number of Limit Nodes:	17

Executed Functions

Function 016BD468 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 016BD4F6
GetCurrentThread.KERNEL32 ref: 016BD533
GetCurrentProcess.KERNEL32 ref: 016BD570
GetCurrentThreadId.KERNEL32 ref: 016BD5C9

Memory Dump Source

Source File: 00000001.00000002.2157051692.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16b0000_autorization Letter.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ae2045cf7c56e5f01f685c3d9205a4b13d77054534c52c67443612c764fdf0c9
Instruction ID: 907aab05030d866db52570d6fc779efe5686c8339f79226c10de484fe69781e1
Opcode Fuzzy Hash: ae2045cf7c56e5f01f685c3d9205a4b13d77054534c52c67443612c764fdf0c9
Instruction Fuzzy Hash: 965159B09012498FDB54DFA9D988BEEBBF1FF88308F248459D009A7360D7399984CF65

Function 016BD478 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 016BD4F6
GetCurrentThread.KERNEL32 ref: 016BD533
GetCurrentProcess.KERNEL32 ref: 016BD570
GetCurrentThreadId.KERNEL32 ref: 016BD5C9

Memory Dump Source

Source File: 00000001.00000002.2157051692.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16b0000_autorization Letter.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f06ff9eaf7d677f52a7e14f13d025ec7c1e68fcfd3b5819596aa02e0a3e890ec
Instruction ID: d82bce0ecd31db135f51f0ebcc5ccd18d58d5dde1a817f43c96d39c62722f474
Opcode Fuzzy Hash: f06ff9eaf7d677f52a7e14f13d025ec7c1e68fcfd3b5819596aa02e0a3e890ec
Instruction Fuzzy Hash: FE516AB09002098FDB58DFA9D988BEEBBF1FF88308F208459D109A7360D7359984CF65

Function 058A79E0 Relevance: 2.7, Strings: 2, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 058A7A2E
, xrefs: 058A7A27

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: d5fd5bf8601c6d45c1648d82d7cdabdb4f95c125e40484774ea4566d53bd79c0
Instruction ID: 7b5c640410e4afa9a0f305a46f91ba10948b5896c8b240cd2f9a94ebfb0be38d
Opcode Fuzzy Hash: d5fd5bf8601c6d45c1648d82d7cdabdb4f95c125e40484774ea4566d53bd79c0
Instruction Fuzzy Hash: F471C431920701CFEB04EF29D4859457BF1FF89304B4586A8D949AB32AEB71F8D4CB90

Function 058A6554 Relevance: 2.7, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 058A7A2E
, xrefs: 058A7A27

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e883533ba312f367dc9e0fea27c6c4c85da377dc6531b61e2c0d26440cbd083e
Instruction ID: 9e53a7e4e055852b139aa2e5d284e07ef32b00c8f3b20c3f5246acac7c91a094
Opcode Fuzzy Hash: e883533ba312f367dc9e0fea27c6c4c85da377dc6531b61e2c0d26440cbd083e
Instruction Fuzzy Hash: C961B431920701CFEB04EF29D4859557BF1FF89304B4586A8D949AB32AEB71F9D4CB90

Function 058A3830 Relevance: 2.6, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{ m^, xrefs: 058A38FB, 058A3900
4']q, xrefs: 058A3876

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID: 4']q${ m^
API String ID: 0-4065714871
Opcode ID: 84e3d0ccc61cadd517b7e2b24fa1e8c6d8b7c419c26edd72f96a1275c53ae946
Instruction ID: 43a343df527099b5b185b6baa148f701a860893b3737d207f2fedc2ae44e75c6
Opcode Fuzzy Hash: 84e3d0ccc61cadd517b7e2b24fa1e8c6d8b7c419c26edd72f96a1275c53ae946
Instruction Fuzzy Hash: 1321B471A002068FDB05DFB8D9519EE7FBAFF85300F4045A5C541AB264DF759D09CBA2

Function 058A3840 Relevance: 2.6, Strings: 2, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{ m^, xrefs: 058A38FB, 058A3900
4']q, xrefs: 058A3876

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID: 4']q${ m^
API String ID: 0-4065714871
Opcode ID: 9563dd4e5aa20b98cc21af301df74502f64ea537801ff4ccd298965c4484f5b8
Instruction ID: 56051fe6a8bcb43dc4db374fb4f71c39c808736991254158ba7debe9472c591f
Opcode Fuzzy Hash: 9563dd4e5aa20b98cc21af301df74502f64ea537801ff4ccd298965c4484f5b8
Instruction Fuzzy Hash: 23114570E0010A9FDB05EFB8D9519EE7BBAFF84304F404565C501AB264EF75AD49CBA2

Function 079307B4 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 079309F6

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 15f7caaf1d2460b723114380d5b25f56ae2baa9fa5af1bf173c6a1f2ffdc33cc
Instruction ID: 5045f1c77a4775a7cd3bac80aac6ee29ac547728014426a4db90206057f63951
Opcode Fuzzy Hash: 15f7caaf1d2460b723114380d5b25f56ae2baa9fa5af1bf173c6a1f2ffdc33cc
Instruction Fuzzy Hash: 90A16BB1D0021ADFDB24DF68C841BEEBBB6FF48314F148169D818A7290DB759985CF92

Function 079307C0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 079309F6

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fc44bb6b439ddd38b1bd2f85fbdd3c6f34022835e24e4441fafa16971bf30668
Instruction ID: 15527f38b45139e167bb5517c5fc318cd7c1b22202fd5d2f15813026a2720d34
Opcode Fuzzy Hash: fc44bb6b439ddd38b1bd2f85fbdd3c6f34022835e24e4441fafa16971bf30668
Instruction Fuzzy Hash: AD916BB1D0021ACFDB24DF68C841BEEBBB6FF44314F148169D818A7280DB759985CF92

Function 016BADE8 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 016BB03E

Memory Dump Source

Source File: 00000001.00000002.2157051692.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16b0000_autorization Letter.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4df3fff8347a19d9a010a5fc8210c336643a4efcb1edb0213705fffb62e3ab9f
Instruction ID: b526738f3985c7b4344f3e7ca459b31f8525d9a132aae09ba2f696649ff9f895
Opcode Fuzzy Hash: 4df3fff8347a19d9a010a5fc8210c336643a4efcb1edb0213705fffb62e3ab9f
Instruction Fuzzy Hash: FD813470A00B059FD764DF69D88079ABBF6FF88200F008A2DD54AD7B50DB75E886CB95

Function 016B590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016B59C9

Memory Dump Source

Source File: 00000001.00000002.2157051692.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16b0000_autorization Letter.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2b6fe5dea264587ccb3ef29cacf1acbd83134eb3be0a467100202664899e7e3d
Instruction ID: 594128fe8c0f5e21a5042e8d42fff0ce63391ba52664528e2dafb263a85fd914
Opcode Fuzzy Hash: 2b6fe5dea264587ccb3ef29cacf1acbd83134eb3be0a467100202664899e7e3d
Instruction Fuzzy Hash: AD41D1B1C00719CFDB24DFA9C884BDEBBB2BF49304F20816AD509AB255DB755986CF90

Function 016B44D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016B59C9

Memory Dump Source

Source File: 00000001.00000002.2157051692.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16b0000_autorization Letter.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bacb30e7428e0e82b2d6288364109ecd1f5ee2f3aee76e3b50e35d74650d58e2
Instruction ID: 3c95bdfdf85e3d56b8c3124a536af1ad719bf0f77793300726684ada23bef2e0
Opcode Fuzzy Hash: bacb30e7428e0e82b2d6288364109ecd1f5ee2f3aee76e3b50e35d74650d58e2
Instruction Fuzzy Hash: 8F41DFB1C0071DCFDB24DFA9C884ADEBBB5BF49304F20806AD509AB255DB756986CF90

Function 07930530 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 079305C8

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 87996d6218511ec3af11673489660986553daf99ad797cf9681b33d9747b4ca3
Instruction ID: 00276217f291373fcb81027de8d990f2ac2bfb74b4520edbc2ae34a3c8c1a0b1
Opcode Fuzzy Hash: 87996d6218511ec3af11673489660986553daf99ad797cf9681b33d9747b4ca3
Instruction Fuzzy Hash: D8212CB5D003199FCB10DFAAC8847EEBBF5FF48314F10852AE919A7240C7789544CBA0

Function 07930538 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 079305C8

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3c778f315b6c5ea225913a2a0e1a72af9d807787d377be647f03b8edb4562a99
Instruction ID: 558ef7c740ae35832161398affb904984290194ad2bc40c30722dda3f767d448
Opcode Fuzzy Hash: 3c778f315b6c5ea225913a2a0e1a72af9d807787d377be647f03b8edb4562a99
Instruction Fuzzy Hash: 132119B5D003599FCB10DFAAC985BEEBBF5FF48314F10842AE919A7240D7789944CBA1

Function 016BD6B8 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 016BD747

Memory Dump Source

Source File: 00000001.00000002.2157051692.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16b0000_autorization Letter.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ba7a5f664a3bedd4e5bddc47deb05bbba47f7642f7f77642e2ffd1cd7f8e88c8
Instruction ID: 6a0ba1fd719c9b2f7f92fb1f3ad5fd1cd42091d47d41b70273a726d3f867bd0b
Opcode Fuzzy Hash: ba7a5f664a3bedd4e5bddc47deb05bbba47f7642f7f77642e2ffd1cd7f8e88c8
Instruction Fuzzy Hash: 7A21E5B5900248EFDB10CF9AD984AEEBFF4FB48314F14801AE918A7350D379A954CFA5

Function 07930620 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 079306A8

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: bdc908378bf7a306f9929e23feb8e26f06d190039f18b43454c831a56e607851
Instruction ID: 18ff47360f5c7cfbe2400143e7e6d60b4bd7fae045bbc3f0ce04f5faeb1a357c
Opcode Fuzzy Hash: bdc908378bf7a306f9929e23feb8e26f06d190039f18b43454c831a56e607851
Instruction Fuzzy Hash: 3C214AB1D003099FCB10DFA9C9846EEBBF5FF48324F10852AD918A7240D7789541CBA0

Function 07930628 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 079306A8

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 750bfb37f61fc22015913280cda0490d32af5c7fb61ae493c6fda6380781add2
Instruction ID: 003cc7102d9f8aebaf2d23ad3428f2c96b538a427b72c39189b00db4957129bd
Opcode Fuzzy Hash: 750bfb37f61fc22015913280cda0490d32af5c7fb61ae493c6fda6380781add2
Instruction Fuzzy Hash: C5213AB1D003499FCB10DFAAC884AEEFBF5FF48314F50842AE919A7240CB799540CBA1

Function 016BD6C0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 016BD747

Memory Dump Source

Source File: 00000001.00000002.2157051692.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16b0000_autorization Letter.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 68e302e7e0df7b7c75e9d5723c37adbb8dbc1af51f25b051a7e309e24e3ec4dd
Instruction ID: ba4aa16a661d6f787cefb9fb374bac698df8b29da3ba322ce6975a2214db9f04
Opcode Fuzzy Hash: 68e302e7e0df7b7c75e9d5723c37adbb8dbc1af51f25b051a7e309e24e3ec4dd
Instruction Fuzzy Hash: 2521C4B5D002489FDB10CF9AD984AEEBFF9FB48314F14841AE918A7350D379A944CFA5

Function 07930470 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 079304E6

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 797c8dd9cc0cd46b60a9c03ee58961d4f8d3e583ddbe38a23d776639efcb4702
Instruction ID: f8601bda4dc3e2270f9a9a0add79d7f682eabbdcc54b5d8d62c452431c0f5492
Opcode Fuzzy Hash: 797c8dd9cc0cd46b60a9c03ee58961d4f8d3e583ddbe38a23d776639efcb4702
Instruction Fuzzy Hash: C5114AB59002099FDB10DFA9C844BEEBBF5EF89320F108419D519A7290CB359544CBA0

Function 07930478 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 079304E6

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: aef1cb37067b7210fcabe08c28f9c9e82db85ae7654f8efe75c8fa3d2dd3c248
Instruction ID: 9fc002c072f384618e55105656feb837ce9207bbab32518bbe1d62d52804a5c1
Opcode Fuzzy Hash: aef1cb37067b7210fcabe08c28f9c9e82db85ae7654f8efe75c8fa3d2dd3c248
Instruction Fuzzy Hash: F11137B19002499FDB10DFAAC844AEFBFF5EF48314F108419E919A7250CB79A540CFA1

Function 016BAFD8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 016BB03E

Memory Dump Source

Source File: 00000001.00000002.2157051692.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16b0000_autorization Letter.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 830744e7d13a67582298b6f1748d9d479d1e67294e7aa9f0301bf566710be91f
Instruction ID: 0f3c7439dc9add5e16632bc741ce516db74ea1ce118d8faa044e9f89e9a21053
Opcode Fuzzy Hash: 830744e7d13a67582298b6f1748d9d479d1e67294e7aa9f0301bf566710be91f
Instruction Fuzzy Hash: 3B110FB5C002498FDB10CF9AC884AEEFBF4AB88210F10841AD928A7200D379A585CFA1

Function 079315E8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07935185

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b4c920d48b7e093c1abed2b70727fc925a3e7d20ee412454b45e5c083538362a
Instruction ID: a367fefce699a1b8511550ae173abe33fc4e1cd15d9b6123620aa136a0faba32
Opcode Fuzzy Hash: b4c920d48b7e093c1abed2b70727fc925a3e7d20ee412454b45e5c083538362a
Instruction Fuzzy Hash: 851106B58003499FCB10DF99C884BEEBBF8EB48314F108419E918B7200C379A954CFE1

Function 07935120 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07935185

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f665480bcdac1c07064f3e500aee68d3a14d02d660392a9a2513276c3dfed223
Instruction ID: aad19419a5750284cd75eed82ed8385e1997e9f75826f1ba1720ec0a6c49ea73
Opcode Fuzzy Hash: f665480bcdac1c07064f3e500aee68d3a14d02d660392a9a2513276c3dfed223
Instruction Fuzzy Hash: F41106B58003499FCB10CF99C985BDEBBF8EB48314F10885AD558B7240C379A544CFE1

Function 058AD121 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

@, xrefs: 058AD347

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 9ea5a4c81cec4ac97f45057d83acd8e5ca97275f4d6c5d5535277ef29c8f08b5
Instruction ID: 769bf5b2ba350e8b05c2e13d6ceaad0acd102b340bad2cb356472781d54a8a9c
Opcode Fuzzy Hash: 9ea5a4c81cec4ac97f45057d83acd8e5ca97275f4d6c5d5535277ef29c8f08b5
Instruction Fuzzy Hash: 50D11C3591120ACFDF04DFA8C4949EDBBB1FF48315B258655D806AB259EB30BE86CF90

Function 058AD161 Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

, xrefs: 058AD313

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c59cc2808fb8aa74b98cb8a28c09453b0bb3efbd1a0c58b0dfa865a8f38b61fb
Instruction ID: 5d0bee27e05525aafb04db7859704fc496922fec6dab2b93375778a2b7c08297
Opcode Fuzzy Hash: c59cc2808fb8aa74b98cb8a28c09453b0bb3efbd1a0c58b0dfa865a8f38b61fb
Instruction Fuzzy Hash: A4A1DB3591064ACFCF05DFA4C4848DDBBB1FF58315B218655D816AB259EB30AE8ACF90

Function 058A05D0 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

(aq, xrefs: 058A063A

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 4fc5fecd636103b9a3306f95188ffde8d42ee8e9cd23ebd756abd196ca4be688
Instruction ID: 6bfea8b6a394bd2c7ffea1e1841d032791dc4e4fd2d3a18fb766cf173fe40e88
Opcode Fuzzy Hash: 4fc5fecd636103b9a3306f95188ffde8d42ee8e9cd23ebd756abd196ca4be688
Instruction Fuzzy Hash: FA313862B083459FDB19DFB9981857F7FA6AFD5200F1484BAD805C7682EE309C02C7A2

Function 058AD510 Relevance: .7, Instructions: 729COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64dedf7dab02c9a2d511607b6e248d50296fe5edba126cec2ec5aa5e17596af8
Instruction ID: 4d9b89124cdf428658454366dc6e7c029ea1685ffad282a959febaa9c2db3ba3
Opcode Fuzzy Hash: 64dedf7dab02c9a2d511607b6e248d50296fe5edba126cec2ec5aa5e17596af8
Instruction Fuzzy Hash: 63725031910609CFDB15EF68C858AADBBB1FF45305F008299D94AA7265EF30AEC5CF91

Function 058AA4B9 Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abdaef831b17e4989ad77ea93fee1b19d209e1d673e721730d91938674b89fb
Instruction ID: 98f7cae24b8d922aa452fa464713eb346f5aa603f9d5bac69b3fb2ca096c9568
Opcode Fuzzy Hash: 5abdaef831b17e4989ad77ea93fee1b19d209e1d673e721730d91938674b89fb
Instruction Fuzzy Hash: 2742D731E107198BDB25DF68C8846EDB7B2BF89304F158699D859BB211EB30AE85CF50

Function 058AEDE0 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94e7bea59ff36a7320edea0ca113a9f0223f40d14e589a8492b0a522fed189ca
Instruction ID: 056f05255379d554ad20889157d1ce05cb6d5f20f79bae653309388a83b24a83
Opcode Fuzzy Hash: 94e7bea59ff36a7320edea0ca113a9f0223f40d14e589a8492b0a522fed189ca
Instruction Fuzzy Hash: 06222B35A00205CFDB14EF69C898A9DB7B2FF88304F1485A8E94AEB365DB71AD45CF50

Function 058A170C Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae01d220c212f040cfb10bbcc823ef441707ac04607df5801a21ed9acc0d309
Instruction ID: 37523f6ccb893d2b30d3637e09360d5e2710bacd6e0f303c597659cebaf3d341
Opcode Fuzzy Hash: 6ae01d220c212f040cfb10bbcc823ef441707ac04607df5801a21ed9acc0d309
Instruction Fuzzy Hash: C8C16F35B006018FDB08EF79C89869977A2FF88300F15857DD80AAB369EF75AC85CB51

Function 058A16F0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9695cd0c592920e413825c0bdf7a9dc1ce9402469c1ffd35d41e8495d38955
Instruction ID: 279a3d289025f121607c759bdf6adfb99d8347d012b5fa9f75ec94d99becc210
Opcode Fuzzy Hash: 8e9695cd0c592920e413825c0bdf7a9dc1ce9402469c1ffd35d41e8495d38955
Instruction Fuzzy Hash: EEB17335B006018FDB48EF68D89469977A2FF88300F15857DDC0AAB369DF75AC85CB91

Function 058A2258 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a7aaa84fddafb33a53f4b0e52dec7c38c94dc0278dbac984ec8fb4c86d8967
Instruction ID: 9493694531d0367761544e70260b37637058e8342245483fea9c830bdadf475f
Opcode Fuzzy Hash: 40a7aaa84fddafb33a53f4b0e52dec7c38c94dc0278dbac984ec8fb4c86d8967
Instruction Fuzzy Hash: 35B16F35B006018FDB58EF68C89869977A2FF88300F15857DDC0AAB366DF75AC85CB91

Function 058A3EB0 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3391d83a0915eb75661cc66191f189b73f7be671a5bd645aca90eec866dbe36b
Instruction ID: 16186f13783654600cf2d5e7f99f7ff9364b089b43985f422343a7298302ced8
Opcode Fuzzy Hash: 3391d83a0915eb75661cc66191f189b73f7be671a5bd645aca90eec866dbe36b
Instruction Fuzzy Hash: 28710332A04245CFEF15DBA8C8946ADBBB2FF85300F14446ED406DB3A2DB789D4ACB51

Function 058ACEA0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b95c7426acbf4153e34b9b994defdae320da4d1ccc916ed84a2b0d4fa98757d
Instruction ID: 5c5d56bc65686792ee8025bba60f161500707a9c7f6a8fc046e1bf784af26655
Opcode Fuzzy Hash: 9b95c7426acbf4153e34b9b994defdae320da4d1ccc916ed84a2b0d4fa98757d
Instruction Fuzzy Hash: 7291077190060ACFDB41DF68C880999FBF5FF89310B14C79AE819EB255EB30E985CB80

Function 058A5810 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52cd19654d472a1bf88c7a83e72bfe70004bba20701ff58fc954b4e4e66e2ad0
Instruction ID: 9f9c3dd6d19a35a235844c4bf0b99755ebe864db99e1a88d5afa25de15cf2729
Opcode Fuzzy Hash: 52cd19654d472a1bf88c7a83e72bfe70004bba20701ff58fc954b4e4e66e2ad0
Instruction Fuzzy Hash: 8881CE75A11208AFDB15DFA8D884DAEBBB2FF49324B154099F906AB361D731EC81CF50

Function 058AEDD1 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467fbb151cefa2463569fe4eea2ea6ac3b7211aab7f18c1054a684dcbf1ef2f9
Instruction ID: 0427c0f10dd7f06929103d8b4aa3866102374782054d61e305795be49c24359d
Opcode Fuzzy Hash: 467fbb151cefa2463569fe4eea2ea6ac3b7211aab7f18c1054a684dcbf1ef2f9
Instruction Fuzzy Hash: 2A518A316106008FDB14EF29C898B9977F6FF89310F1486B8D946DB3A5DB70AC05CB61

Function 058A69B8 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bace29385e12524434dba85e34aede08179105121f05f9de8141b3a14bbf9c3
Instruction ID: 53077b79a39a4ac2db635e37ca00da5f58e0887027b1fd8fd75ba9a7e11ad829
Opcode Fuzzy Hash: 9bace29385e12524434dba85e34aede08179105121f05f9de8141b3a14bbf9c3
Instruction Fuzzy Hash: 1E510634A10605CFCB04EF68C8989ADBBB6FF89704F1585A9E506DB375EB70AC45CB50

Function 058ACE90 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da37adf61e124acead21bd560cd5cd9d1876c9fa3a5ee95baacec6fd956280eb
Instruction ID: 5cd2e5b2d0f077fdb2923ff16faf286185942ac0e7c7f4e04f6dbe0c5977f740
Opcode Fuzzy Hash: da37adf61e124acead21bd560cd5cd9d1876c9fa3a5ee95baacec6fd956280eb
Instruction Fuzzy Hash: E4512A7191070ACFDB41EF68C880999FBB5FF89310B14C75AE859EB255EB70E985CB80

Function 058A69C8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e36412e389c5695b3b78b5e7e57388ff961b7587fa4f64e903b906f70cad7b
Instruction ID: 1f57911fa8a1517f82c34a66631e0e371afe277cc3306718393765adab5441cb
Opcode Fuzzy Hash: 38e36412e389c5695b3b78b5e7e57388ff961b7587fa4f64e903b906f70cad7b
Instruction Fuzzy Hash: E451F534A10605CFCB04EF68C8989ADBBB6FF89704B1585A9E506DB375EB71EC45CB40

Function 058AAD20 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3912ae0517c841c2b501031437fce156dcee27095036684e6d16a5a742f05330
Instruction ID: 3e780a84a531fc97b60eab97f735ffd20840bee1af94f1ba3d3089a3821d79ce
Opcode Fuzzy Hash: 3912ae0517c841c2b501031437fce156dcee27095036684e6d16a5a742f05330
Instruction Fuzzy Hash: CF5158357006048FEB18DB68D488AAEBBF6FF88614F048569E846DB761EB74EC41CB51

Function 058A0448 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a677901e39eae1d1425ac7b6b52d7bb7ce4c3cdb3b8159f86ba15f9575c39a50
Instruction ID: cc04dfa04fa1724cf62d8999a62770a05cd3aa0be831ab9b79277fc0e64d7e5e
Opcode Fuzzy Hash: a677901e39eae1d1425ac7b6b52d7bb7ce4c3cdb3b8159f86ba15f9575c39a50
Instruction Fuzzy Hash: B731BE31E12218DFDB18DFA4E5589AEBBB2FF89301F118469E842B7291DB31AC55CF50

Function 058A5C70 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68145dd964c76bd77eb4cad1d95c9db79054e5e2abf360b05b2495d5fa2e9192
Instruction ID: 87933ade1bca2b8fcdc2e858ae231d7d9db5f1e3ea2aaba00d9c0034b51015b3
Opcode Fuzzy Hash: 68145dd964c76bd77eb4cad1d95c9db79054e5e2abf360b05b2495d5fa2e9192
Instruction Fuzzy Hash: B0413B31B142989FEB14DB69C898EADBBF6FF49604F1440A9E901EB361DB75DC80CB50

Function 058A8620 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fefafc872fbc84433b17a788a8d1dbecea74a60a647b756bf75ecc76fe63072
Instruction ID: 80b300089dc806a78f3a0a126c393e89ce45eeb8f7f3cbeacadf51aa1e984963
Opcode Fuzzy Hash: 8fefafc872fbc84433b17a788a8d1dbecea74a60a647b756bf75ecc76fe63072
Instruction Fuzzy Hash: E0414B36A006198FEF26DB68E948AADBBB6FF88314F144165D801F7350DB35AD41CFA0

Function 058A4558 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b37b32f9ec4db45b50939578be63eedbc827c1026d21539087ae81709c17fa
Instruction ID: 1706d4f5e1cddd3975cdc4bed1ccbb15bb6bc238dd3779cdec786e8d24bc2c77
Opcode Fuzzy Hash: 37b37b32f9ec4db45b50939578be63eedbc827c1026d21539087ae81709c17fa
Instruction Fuzzy Hash: F7512876A01209AFEF14DF94D594BAEBBB2FF88310F118069E905A7361CBB1AD41CB51

Function 058A5837 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c1a2e8bf410c98b8c05fab865a89d7629a8c16ea7c40cb6297bba21a07a97f
Instruction ID: e6e76546c565f3a3d6f02198cd061121dd1c7bea73260f641a7265164ee8b53a
Opcode Fuzzy Hash: b8c1a2e8bf410c98b8c05fab865a89d7629a8c16ea7c40cb6297bba21a07a97f
Instruction Fuzzy Hash: EF51A239A11204AFDB54DF68D894DAEBBB2FF89320B154498F9069B361DB31EC81CF50

Function 058A3CD8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57cd48870fcf5b55148f9759177954c8c2032134b9e8506a21cdf44dc4a8e0bd
Instruction ID: 1795e70863c7d22de06f11fec7ce121e1e3ccc0ad22441c997e5d8b02c0c0520
Opcode Fuzzy Hash: 57cd48870fcf5b55148f9759177954c8c2032134b9e8506a21cdf44dc4a8e0bd
Instruction Fuzzy Hash: AB41E935A002198FDB54EBA8C894BEDB7B2BF49704F114069E905EB3A1DB39AC41CB64

Function 058A3A38 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d88398e52f352b1f92ee4d4e14747357ca2f9ac84d0282d3006183838c20be
Instruction ID: 923b7572bc54a0447c506081074c65080063b3a07f51e2f0b71cc9000b45977e
Opcode Fuzzy Hash: e9d88398e52f352b1f92ee4d4e14747357ca2f9ac84d0282d3006183838c20be
Instruction Fuzzy Hash: C4417D30A006058FD714DF68D994A9DB7F6FF89305F2088ACD416AB365DB36AC45CB50

Function 058A3A48 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98e33f6bf46870adc2c3c92d2282b8a64c9461c07775f4a8315221dcf42d9f4f
Instruction ID: 99838ebfd124d3d2a55cb28d07a2bd6d4b83435181235e8ae98acb20b45c6fbd
Opcode Fuzzy Hash: 98e33f6bf46870adc2c3c92d2282b8a64c9461c07775f4a8315221dcf42d9f4f
Instruction Fuzzy Hash: 92413B30A002058FDB18EF68D994ADDB7F6FF89305F60846CD41AAB365DB76AC45CB50

Function 058A72C0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee02472dffdcedb3482401700acc4e2b2f34a92cf4643d14a780fa1ba837784
Instruction ID: fab85fe22c26576f7927bd88173172ec4c998f0c440296481f19f16aa7c084e6
Opcode Fuzzy Hash: cee02472dffdcedb3482401700acc4e2b2f34a92cf4643d14a780fa1ba837784
Instruction Fuzzy Hash: 12414632B01219CFDF18DBB9D8846ADBBF2AF48204F144529E906E7391EB749D45CB91

Function 058A70D9 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5846e345de12076342147e243d8fb5ebe5aa249f23167c6151d5f368a89db2
Instruction ID: d4a7e14337bfb2a167b806b21b2d45be65c75c30976326d237834ae7d67c000e
Opcode Fuzzy Hash: 0d5846e345de12076342147e243d8fb5ebe5aa249f23167c6151d5f368a89db2
Instruction Fuzzy Hash: 60417C31A0020A8FCB14EFA9D4449AFBBF6FF89304B144569D80AD7355EB30A946CB91

Function 058AB150 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4e47e335e60801f52c3a966a4ea203d039b391bf91cfa717bdc7045d9e4a61
Instruction ID: 6444c2a389b9f956915490c80a37170baf7f6911a86ac842690b74f3f0b2506a
Opcode Fuzzy Hash: 8a4e47e335e60801f52c3a966a4ea203d039b391bf91cfa717bdc7045d9e4a61
Instruction Fuzzy Hash: 69415E31A10709CFCB04EF78C4949ADBBB6FF89304F008569E515AB365EB71A946CF81

Function 058A4E74 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5447e72503fde36ecbdc056b110c0855b1b6cc95dbd9a039f6e6a8097a0cd554
Instruction ID: e27c29c0d6e4193b036df25ca9c2032b7793f967d7f5afe051d20c6a81ceb988
Opcode Fuzzy Hash: 5447e72503fde36ecbdc056b110c0855b1b6cc95dbd9a039f6e6a8097a0cd554
Instruction Fuzzy Hash: AD413E31A10709CFCB04EF68C4949EDFBB6FF89304F008569E515AB325EB71A946CB81

Function 058A7170 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487c01edc6b61bd2f5c6ccac3bf725d531f8b0003ceeaf9de1a4e1af9b0e5970
Instruction ID: 5792f496eb41f7d473ebed7d6da1d913a6c58d0b3d4772a6b8a53f4174c61eb5
Opcode Fuzzy Hash: 487c01edc6b61bd2f5c6ccac3bf725d531f8b0003ceeaf9de1a4e1af9b0e5970
Instruction Fuzzy Hash: 2A416B31A0070ACFCB14DF69D4944AEBBF2FF893147148A6DD81ADB351EB31A946CB91

Function 058AB049 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ee4f6254919cc17112b756036c5f554e6ff3abc2f7ec11bb7d4a1c128b96c8
Instruction ID: 6b6cb941ebc16c7223e16a61dd8274bb73a2fc49f580c7319c595c597bd21dda
Opcode Fuzzy Hash: 57ee4f6254919cc17112b756036c5f554e6ff3abc2f7ec11bb7d4a1c128b96c8
Instruction Fuzzy Hash: B531A332B102198FDF04EB78D8548DDB7B6FF89224B144669E906AB320EB71AD45CB90

Function 058A8DD9 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4fc020d5ab56e60405e702eb97a50c9deca98d513814c2be756f06e05a26b81
Instruction ID: c79a2c5a1df037c1c934833e7435293e4102ad94b4f2baa5223120d299380e8c
Opcode Fuzzy Hash: a4fc020d5ab56e60405e702eb97a50c9deca98d513814c2be756f06e05a26b81
Instruction Fuzzy Hash: 34411775A1020ADFDB44DF68D88499AFBB5FF49310B14C699E818EB315E730A985CFA0

Function 058A64F4 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18cdf536e3dae7230f9b43e9c38d754b6b9fb119327a5deeeb3d4b7e3fcadd1b
Instruction ID: dd4f6ec18f68f0b520c694cc15f14d27ee8e8b1b011866d987eb8b59b40d21a7
Opcode Fuzzy Hash: 18cdf536e3dae7230f9b43e9c38d754b6b9fb119327a5deeeb3d4b7e3fcadd1b
Instruction Fuzzy Hash: A6318471A00301CBE704EF29D8947557BA2FF98214F088679DC49EB349EF35A894CB60

Function 058A8DE8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716437981989d92c50d7ffdac22af6d0cd3ff32ca35ee3f2ed9ba443814e1c4e
Instruction ID: 7a108f48c91a806e64c708b6d19bfd96ab764fe880ec8b3bb31846dffb072d78
Opcode Fuzzy Hash: 716437981989d92c50d7ffdac22af6d0cd3ff32ca35ee3f2ed9ba443814e1c4e
Instruction Fuzzy Hash: B1410575A0020ADFDB44DF68D88499EFBB5FF88310B14C699E918AB315E730A985CF90

Function 058A77E1 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31842c0be381215a256de37021eca98639af980cc8e03396102bec8a76657024
Instruction ID: afeef6f52920f3ba21c5e64405a2b781fbd014e8baa9d84f66311106d1ca95e3
Opcode Fuzzy Hash: 31842c0be381215a256de37021eca98639af980cc8e03396102bec8a76657024
Instruction Fuzzy Hash: EB31C331A00300CBEB04EF39D8947917BB2FF98214F088679DC09AB349EF34A894CB61

Function 058A9364 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff0a750117fad002928883cdf2cd7078a62720a38f6389f89cb24c60a77c1cf
Instruction ID: 05d76b9807ff91ec72e5f612fdfe53288524c3f107f9dcc392b94b789e6aec58
Opcode Fuzzy Hash: 7ff0a750117fad002928883cdf2cd7078a62720a38f6389f89cb24c60a77c1cf
Instruction Fuzzy Hash: AB21B4333542018FE7149B2CC884AA97BE5FF85710B1984B5E50ACF7A6DB76DC04CB90

Function 058A5CF6 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b02545e49d16d45c445eb71db911ddd6a5e39625b909b881316ff9e649dd78
Instruction ID: 72f778bb2a5c0fef592d0666f5dbcbc59e6acf88f150bcf42115970fc475d358
Opcode Fuzzy Hash: f0b02545e49d16d45c445eb71db911ddd6a5e39625b909b881316ff9e649dd78
Instruction Fuzzy Hash: 653118367152989FEB14DF69C888EAC7BF6BF49705F1400A9E901EB2A1DB75DC80CB10

Function 058A72B1 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df1c818429fdaee42243876a02db6c1e9feacc4f7956dc5b3a7ee65d5de05dc
Instruction ID: e260c9f1a06ecd7251100ab7479e1bd897cf57a00fed7e7c025ceccc265032d2
Opcode Fuzzy Hash: 4df1c818429fdaee42243876a02db6c1e9feacc4f7956dc5b3a7ee65d5de05dc
Instruction Fuzzy Hash: 3B317832E01209DFDB18DBB9D8846ADBBB2EF48204F15442AE906E7391EB70AD41CB51

Function 058A4548 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfa98a277364eb0c599d04c9dfd8c7e9f7a3cd49671904849f22d7fa70b100b
Instruction ID: 4fa7b7357532e45d013582bbbc26475c593a77ed91ee6e6aca862e1542a3b811
Opcode Fuzzy Hash: 6bfa98a277364eb0c599d04c9dfd8c7e9f7a3cd49671904849f22d7fa70b100b
Instruction Fuzzy Hash: 27312779A01209AFEF14CF94D594BAEBBF2FF88310F158069E905A7365C7B1AD40CB91

Function 015DD1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2156624214.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15dd000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1930bf314fe5845c2fec1887298fc5812937e2ba3e33980c8d691afebee7e41
Instruction ID: b7670442497ef9b6d8147883c97544408a9c26cea677d80f2db07855e6ef2e25
Opcode Fuzzy Hash: d1930bf314fe5845c2fec1887298fc5812937e2ba3e33980c8d691afebee7e41
Instruction Fuzzy Hash: CC21C472504244DFDB16DF98D9C4B2ABFB5FB88320F24C569E9090E296C33AD416CBA1

Function 058A2ACB Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e23710b18759731fdcd821ef74b45ebe5814f9aa2b89587847e308ece40b967a
Instruction ID: cda99c8837ff6718be5f8a3600edc4e7e056d5598e4d69ff2ace06b605670f4c
Opcode Fuzzy Hash: e23710b18759731fdcd821ef74b45ebe5814f9aa2b89587847e308ece40b967a
Instruction Fuzzy Hash: 7F31EF32910B09DECB01AF68D854899F7B1FF99340B118B5AE95967221FB30E6D5CB81

Function 058A2AD0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b79d477ea3630ab7cf73d326b96fd7aec00d883b5a7366a0937c41c07c72d5
Instruction ID: b0ed2bda12b9d53129641d368e4e5f270050fa42de556fe4445c53fda4e2d29d
Opcode Fuzzy Hash: f5b79d477ea3630ab7cf73d326b96fd7aec00d883b5a7366a0937c41c07c72d5
Instruction Fuzzy Hash: 1631F032910B09DECB01AF68D854899F7B1FF99340B118B5AE95967221FB30E6D5CB81

Function 058A6FC9 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a83b0578ef415e2c4a1e8507303038e3d2d27d881d1e54357323eafce8505a
Instruction ID: 8aa1277455fd442daa95f5f5cdbe94f3573698133b6e5995fdafdda7c95b88e0
Opcode Fuzzy Hash: 72a83b0578ef415e2c4a1e8507303038e3d2d27d881d1e54357323eafce8505a
Instruction Fuzzy Hash: BF213A313006118FDB689B39C854A6977EAFF85714B1484BDE906CB360DB76EC42CB50

Function 058A6FD8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5d60f01104869071861efc923a390e89520dc63c6fbb42f80f8938f72701d82
Instruction ID: a59cac01e34a062afe95e5d60f1ac1fc19b7273d563113c5a797b8189ddcec08
Opcode Fuzzy Hash: a5d60f01104869071861efc923a390e89520dc63c6fbb42f80f8938f72701d82
Instruction Fuzzy Hash: 5D2129313006018FD768AB3DC854A6A73EAEF85714B5484ADE906CB3B4EBB6DC46CB50

Function 015ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2156743573.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15ed000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8bcc0087f6c7d3b841ac30bf9130555293e82d713972688a03a6ed311ef93a
Instruction ID: 9a2d74957c761628659781f076ceb19499310a31590e1f24736e4fb7dc0243df
Opcode Fuzzy Hash: 6a8bcc0087f6c7d3b841ac30bf9130555293e82d713972688a03a6ed311ef93a
Instruction Fuzzy Hash: 9A210071A04204DFCB19DF68D988B26BFF5FB88314F28C969D90A0F256D33AD406CA61

Function 015ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2156743573.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15ed000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5bba7037e635fd7875e89c1c6d78e7ccb11775886c0062459c3b756efff61f2
Instruction ID: b2e3e94ff4e53a860adca8b1ecd16734c3ffb92c9bade9fa545c5a7d44a15f85
Opcode Fuzzy Hash: f5bba7037e635fd7875e89c1c6d78e7ccb11775886c0062459c3b756efff61f2
Instruction Fuzzy Hash: 1221F575904204DFDB09DFA8D5C8B2ABBF5FB84324F20C9ADD9494F296C33AD406CA61

Function 058AE050 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0188e3231a0a13b0f3e7a1130e72848eab7169a1c3390088c9f9cd9654adbb91
Instruction ID: 4a196aa92da8b46ce4f4f900f4c2ca2be575516539f47ed3cd972878279aee90
Opcode Fuzzy Hash: 0188e3231a0a13b0f3e7a1130e72848eab7169a1c3390088c9f9cd9654adbb91
Instruction Fuzzy Hash: 41215332A106099FDB10EF6CD880999FBB5FF49310B50C66AE958E7200EB31A994CB91

Function 058A6CD0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8437c43e945204fbb02f7d028a71966d8533363b1b0f1e8266ba19015e32f963
Instruction ID: 9f1af038fe4ef3bdd6d694f5cac47938d278443e25126fba7ba46baac88624a7
Opcode Fuzzy Hash: 8437c43e945204fbb02f7d028a71966d8533363b1b0f1e8266ba19015e32f963
Instruction Fuzzy Hash: 1B210732F003964BEB10DF7EC8406BEBBA2EF85560F0C857AC915D7259E7355D018791

Function 058A6D00 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a70591bc1ac9913896e22547112f4bfcd52a4504ccb784befd35cc5504040e
Instruction ID: 9f4fb6c23eb8c92e50b5b37b2af600aa72934c80b17a1e0890a3d06df2a19249
Opcode Fuzzy Hash: 64a70591bc1ac9913896e22547112f4bfcd52a4504ccb784befd35cc5504040e
Instruction Fuzzy Hash: F2119632F007664BEB10DEAA84406BEB7B6FFC4650B08852ED915E7218EA759D4147C1

Function 015ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2156743573.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15ed000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3cc5269bec8a96fccac150a2e4a9ff70860651b73e2ed129a47ba98cfe5d01
Instruction ID: 254dfb741344112e61d0293b62c98a75742c827e83a9347fc92e8032bd78b848
Opcode Fuzzy Hash: 6b3cc5269bec8a96fccac150a2e4a9ff70860651b73e2ed129a47ba98cfe5d01
Instruction Fuzzy Hash: 4B219F755093808FDB07CF24D994715BFB1FB46214F28C5EAD8498F2A7C33A980ACB62

Function 058A64C4 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6149a13c17ac625bf74ddd197a52d74169958c7dc086121d58532576c8410ced
Instruction ID: 455eb0103ac49a313d9b9546ecd948be994ca06362607b5043baad62a3f62639
Opcode Fuzzy Hash: 6149a13c17ac625bf74ddd197a52d74169958c7dc086121d58532576c8410ced
Instruction Fuzzy Hash: 0321B431A00705CFC754EB39C444AAAB3B7EF80310F04886DC45A8B278DF35E88ACB42

Function 058A7708 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdce35969136fdf00552a710b8b222fab38ffc6e44d3d69bb6ac16e9095ea7e7
Instruction ID: 993e373b08512e9314b55f5c89fab46b2c04eb09c5b5b4ae58c8aa37371a15c8
Opcode Fuzzy Hash: bdce35969136fdf00552a710b8b222fab38ffc6e44d3d69bb6ac16e9095ea7e7
Instruction Fuzzy Hash: 6921A231A00705CFC754EB39C444AAAB7B7FF85311F14896DC45A4B278DF35A88ACB42

Function 058A21CF Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ea282a0c08f26e4e758b2b67cad6e6282f6f27dd0f6d82d47c846cb9d76f67
Instruction ID: 7550487a133af047b47550697c911eb23713937fd84bfa36b02e653b0c4c3bcb
Opcode Fuzzy Hash: 99ea282a0c08f26e4e758b2b67cad6e6282f6f27dd0f6d82d47c846cb9d76f67
Instruction Fuzzy Hash: 3B11C8353003104BE726AB38D8547AA7796BF44714F00415DD816CB2EACBA6ED47C7D5

Function 015DD1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2156624214.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15dd000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction ID: 9ea7cedb3e2610d982665d9bc16da2570536f7933ab608baac4a597f09018557
Opcode Fuzzy Hash: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction Fuzzy Hash: AF219076504240DFDB16CF58D9C4B1ABF71FB84324F24C5A9DD450A656C33AD416CBA1

Function 058A9F18 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ff4cdfab41711308600a405402d7a81f011f1130f1310868aad01d8cdc7b23
Instruction ID: 3ab7f980ecf9400d7fa0ddbf1a92ac1e3365efaee24d58b53673f59136a124df
Opcode Fuzzy Hash: 77ff4cdfab41711308600a405402d7a81f011f1130f1310868aad01d8cdc7b23
Instruction Fuzzy Hash: 6D118E333581018FE7248A18DC85BA97BA6FF89310F1981B9E80ADB766DA79DC05CB40

Function 015ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2156743573.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15ed000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: ec03755c698f5b3f5cf45dc61c9b821d85aa85167cf91281ecf00b551ca79186
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: E811BB75904280DFDB06CF54C5C8B19BFB1FB84224F24C6A9D8494F296C33AD40ACB62

Function 058AAD10 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fdef62891797aacde961544f56b9548329faed529bd3998733552da3f36268
Instruction ID: 07c7bb7bb7fd2db7e78c4900d532de8ba01227a37eeca68320857f37ab145ee1
Opcode Fuzzy Hash: 33fdef62891797aacde961544f56b9548329faed529bd3998733552da3f36268
Instruction Fuzzy Hash: E8018C35710604DFDB18DB69E888A5ABBBAFF88614F0084A9F806D7721DB31AC01CB85

Function 058A5EF3 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1452c6ab81e1a2d76bac2c999d0ecbdf7093b70657e5e9cd830909ae9e762d3
Instruction ID: 5fac1e3b74e0956ca1f26dc6b76e9ff4acf8aa5c113ae2e716f107ba99cc3afb
Opcode Fuzzy Hash: d1452c6ab81e1a2d76bac2c999d0ecbdf7093b70657e5e9cd830909ae9e762d3
Instruction Fuzzy Hash: C701A172F0060A8FDF14EF58D445ABEBBB6EF88210F044029E919E7740DB745A41CBA1

Function 058A5EF8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4bfabdc8a79ddc515a77496ad8a1986e486871b03c8c2b42aa8bbd2d257919
Instruction ID: 30ed91c5dd03fdfbc1d3c76330043175c94b33e9b2f955bf116d0240f3cd7243
Opcode Fuzzy Hash: fd4bfabdc8a79ddc515a77496ad8a1986e486871b03c8c2b42aa8bbd2d257919
Instruction Fuzzy Hash: 8E016171F0060A8FDF14EF58D455ABEBBB6EF88610F044029E919D7744DB745A41CBA1

Function 058A0290 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99bb5a0412a8613062c1450c21443d48eb92099f96e2059c7862f7b71123665a
Instruction ID: e06b2ed0d219ba980c3b2d50ed99979c221633525cb21186aab6f7483ee2f677
Opcode Fuzzy Hash: 99bb5a0412a8613062c1450c21443d48eb92099f96e2059c7862f7b71123665a
Instruction Fuzzy Hash: F21106B5904248CFDB10DF9AD588B9EFBF4EB48320F10845AD919A7340D779A944CFA5

Function 058A02E4 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e94853494e45e12aeca9fd12d6380b4e2ada475a61fbf496bfa7964beefb607
Instruction ID: f6a6d5ea4341d132736a3cc8799cbd0c6d407f34d27fd3ad7c3a904562f846e7
Opcode Fuzzy Hash: 5e94853494e45e12aeca9fd12d6380b4e2ada475a61fbf496bfa7964beefb607
Instruction Fuzzy Hash: 271136B1800208CFDB10EF9AC588BAEFBF4EB48310F108419D919A7340C378A944CFA5

Function 058A0BC8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 800b0d0699e4cdd19eaf27809ad156c5b635371ab928d04de89bfcfd3942a0f7
Instruction ID: 6688ec2ae6605c1987ad1e8b9fe8cd89a30bd077217fe953d25578cb25d128d4
Opcode Fuzzy Hash: 800b0d0699e4cdd19eaf27809ad156c5b635371ab928d04de89bfcfd3942a0f7
Instruction Fuzzy Hash: 351113B6C00208DFEB20DF99C589B9EBBF4EB49320F10841AD919A7340C779A944CBA1

Function 015DD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2156624214.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15dd000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636f7f61d5a2a150267db241c7016c4d3e03c28c8537ff977290c8b8c1a56784
Instruction ID: a02b4a8405a515d05ce8b0f059182e74557f4bb62056078a4f971fd42d3a3f7e
Opcode Fuzzy Hash: 636f7f61d5a2a150267db241c7016c4d3e03c28c8537ff977290c8b8c1a56784
Instruction Fuzzy Hash: E101FC310043849AE7308B9DCD84B6ABFECFF45320F14C969ED080E2C6C2799440C771

Function 058AB398 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef9fbe53f6c2d2238bd912e613a6582b3f4fea37a1d8347aa550590cb182918
Instruction ID: 764d78ae5ecfb46f0173aec2027834eee6caebe35a317100a82ab503105deced
Opcode Fuzzy Hash: fef9fbe53f6c2d2238bd912e613a6582b3f4fea37a1d8347aa550590cb182918
Instruction Fuzzy Hash: E9011732604708CFD728EF39C4444AA77F6BF85301B50C56EE9469B260EB71E941CB41

Function 058A9D68 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3f256a652d21eb9f3f17b79f8c1a5bdf7e5f373ce131253afd408ac507b0fb
Instruction ID: 0716d61e9c7d203be383979a0a30299342fbc31ee402bbde9f85dcc8a985752a
Opcode Fuzzy Hash: 8c3f256a652d21eb9f3f17b79f8c1a5bdf7e5f373ce131253afd408ac507b0fb
Instruction Fuzzy Hash: 66F0F6333186101BEB15A63D841C67D63EAAFC9A55F084028ED0ACB3C0DF25CC43C242

Function 058AB758 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 714e9803f01a1972a5d71e245ec33c7cc595f04d65e67060a0c668dbadf01998
Instruction ID: 090254a41c236af917e8b23bb744da74d5ca472539f2f2ec88320e1838b09c24
Opcode Fuzzy Hash: 714e9803f01a1972a5d71e245ec33c7cc595f04d65e67060a0c668dbadf01998
Instruction Fuzzy Hash: C001AD36A047058BD71ABB7898055AEB775FFC5621F004A1EDA559B210EF309982C7D2

Function 058A9344 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dad42836ff78afa27c565ed1ed9fa888749bf7fedd7a84e823a93bb1c76a36
Instruction ID: 9cb4b6cfe36a8a6dbf0cad3f09693c16df8f3209fdc762e93963b2aee2c9306a
Opcode Fuzzy Hash: 05dad42836ff78afa27c565ed1ed9fa888749bf7fedd7a84e823a93bb1c76a36
Instruction Fuzzy Hash: 6FF0B43730C2158BEB289A2E8444A3A72EEAF84E117085429ED4BC7293DFA1DC25C691

Function 058A6C60 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dcc4122b5612e238dab40e92ee383e82f9f2bb78ec505152966ba5c89506fae
Instruction ID: fb1a1fcfa34b73db478c1c685656b9c15e4d9bc7f1a2926ac7aa79b2b357bb6f
Opcode Fuzzy Hash: 6dcc4122b5612e238dab40e92ee383e82f9f2bb78ec505152966ba5c89506fae
Instruction Fuzzy Hash: 430181357242408FCB14DB29D8599697BEAEFCD611B1980ABE50ACB375DF70DC41C7A0

Function 058A9E00 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a1fa18bb09e16140e697a765815d89740d5f6d8e532b10a3e5f21bf4be4f906
Instruction ID: d27f493f92b96859f22dc24becfbb89de7411d63a2561e2d8222eb5bae7164c0
Opcode Fuzzy Hash: 6a1fa18bb09e16140e697a765815d89740d5f6d8e532b10a3e5f21bf4be4f906
Instruction Fuzzy Hash: 96F0BB3730C2108BEB349A1A9444B7933A9AF84D55B086019E85BC7253DF61CC16D791

Function 058A21E0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d0966ca57ddd7893f50ab9714713b6ce52abb6da798a51439f5a77edb8bb5a
Instruction ID: ae3ac2e084fb56174d32f04e138cb2aef7248d09521d47ed877643a4a6d34896
Opcode Fuzzy Hash: a0d0966ca57ddd7893f50ab9714713b6ce52abb6da798a51439f5a77edb8bb5a
Instruction Fuzzy Hash: 87F090393007204BF729667888587AE729A6F88B40F00401CEC07CB3DACFA99C8283D9

Function 058AB7D9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2161eeb4dff4d5bab93a8c23241188956427cb3ef46da495be95f1dbb8c40359
Instruction ID: 97ce3b587c45991fa025416fe5785b0a0b58e6e557d9c8531e9ab0cfdcde3a9f
Opcode Fuzzy Hash: 2161eeb4dff4d5bab93a8c23241188956427cb3ef46da495be95f1dbb8c40359
Instruction Fuzzy Hash: C2F0F6352002008FC7249B59E484AAAB7AFFFC8322F10056DE40A87321DF32EC86C794

Function 058AB768 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c12df46b27289daa222471e2ca6950444ee3944daf32e27b63c952d0462234
Instruction ID: da0b81de558ee6434ce61abb2516b54f84a21dd7e21b29bed28718b7575daad1
Opcode Fuzzy Hash: d7c12df46b27289daa222471e2ca6950444ee3944daf32e27b63c952d0462234
Instruction Fuzzy Hash: F7F0C236B047048BDB1ABB7884054EEB775EFC5621F05496DDE469B200EF30AD81C7D2

Function 058AB391 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef62ecd7bd1209f42d26d5ecb5e796b3e9c23e34871c52294f8f98be205f0f58
Instruction ID: c7bf41a8678d7b989a21cc239c55aefe85d470093922331b7d998ae45108c55a
Opcode Fuzzy Hash: ef62ecd7bd1209f42d26d5ecb5e796b3e9c23e34871c52294f8f98be205f0f58
Instruction Fuzzy Hash: 51012432604B05CFE728EF39C55456A7BF2EF84301B50866EE9469B260EB71EC86CB41

Function 058A8D39 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed7a514d2f8808a716eec00cc4b11165c448e5e7de275cb1ebeb25891acbb9b
Instruction ID: d7fe2bb05f5028168af8a79405ed163e7548c1e3b8351183655f6d8ece8c168d
Opcode Fuzzy Hash: 4ed7a514d2f8808a716eec00cc4b11165c448e5e7de275cb1ebeb25891acbb9b
Instruction Fuzzy Hash: 1F01D675D10609DFCB40EFA8C54599DBBF4EF49200F1185AAE459EB321E7709A84CB91

Function 058ABF78 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2cce4414afc2589360492eed11779759b8f82db44b980fbc6ad26b29c943b3
Instruction ID: c468e4c5c7cb05b90273acccdbf90fec446bced2d8423bb19365f267fef44e21
Opcode Fuzzy Hash: 5f2cce4414afc2589360492eed11779759b8f82db44b980fbc6ad26b29c943b3
Instruction Fuzzy Hash: 4BF054323046154F96149E6EF88486ABBEDFFC4265308453AE60AC7224DE71EC098790

Function 058A0EE0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be182c0bfda138dac6dd92aa4c82150fb18e99b492d436d06573824b0b1ae3b
Instruction ID: 8b12a9307ddbed4c22b13565ea7c310cc0a2992d9591ac1acfb23f333f776d8b
Opcode Fuzzy Hash: 4be182c0bfda138dac6dd92aa4c82150fb18e99b492d436d06573824b0b1ae3b
Instruction Fuzzy Hash: 3601A272D04249DFD724CFA9D449AAFBFF4AB44210F108169E854EB382E7709901DB91

Function 015DD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2156624214.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_15dd000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd567eda44208994ab09bb5d9869ed88d21471521c7b9df70bd3be614afc553f
Instruction ID: 8f77b005c45ea1a8b72134370acf8395b32e7aa5661714c2de1ac6795a54e4b2
Opcode Fuzzy Hash: bd567eda44208994ab09bb5d9869ed88d21471521c7b9df70bd3be614afc553f
Instruction Fuzzy Hash: 91F06271404384AAE7218F5ACCC8B66FFA8EF56634F18C45AED485F2D7C2799844CBB1

Function 058A9D78 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb83b93e69a9b9abc2234aed614044174e05c905bf4708a17c25dec4adf3a17
Instruction ID: b33e1e504403cf0754c2f20f6a6aedc4af3a41f9a4f352463ab85ac23e62c9b1
Opcode Fuzzy Hash: cdb83b93e69a9b9abc2234aed614044174e05c905bf4708a17c25dec4adf3a17
Instruction Fuzzy Hash: 52F05E333186505BAB19AA3D901C53E72AAAFC5A61B184029DD0ACB3D4DF25CC42C696

Function 058ABF68 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04940b593cadc975dd24fac2959aaa5c1e2ce7b3b37ab3c2b7b44475a3a92980
Instruction ID: 029ae31ea68d93de1d7ce2fcc495be62d0a16197a4c8b168e7ab9472b441a741
Opcode Fuzzy Hash: 04940b593cadc975dd24fac2959aaa5c1e2ce7b3b37ab3c2b7b44475a3a92980
Instruction Fuzzy Hash: 31F0BE313406114BD7249B2AE884E5A7BADFF842207480529F906CB334EEB1AC0A8B90

Function 058A02D4 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48afe1ab88e8cc9aeadf9e66e7cae99faa67da1f8ed28003ad84fc84a33c110b
Instruction ID: 62ee907bedffea420ff9a3963f3dd7d1e3200ae95a9f732ff0938837098e7d28
Opcode Fuzzy Hash: 48afe1ab88e8cc9aeadf9e66e7cae99faa67da1f8ed28003ad84fc84a33c110b
Instruction Fuzzy Hash: D1F06DB0E4420ADFEB04DFA9C949A7FBFF5EB08300F104569A909E3341D7309A00CB91

Function 058A8D48 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction ID: 4243ceffdd30f352615e2fe6667d750750fc4abca0ae9b7f9b7c733986b7bd1f
Opcode Fuzzy Hash: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction Fuzzy Hash: 0601B675D00609DFCB40EFACC54589DBBF4FF49210B1185AAE859EB321E770AA44CF91

Function 058ABFD0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83956817f2a9dd5eec28b3337a28fdcc3d328d498f122e9eb4e5408e4a01243f
Instruction ID: ec34bbc6086d556e5a9ad4378b66ae9a4558016b760857267b558e253a5f2b7d
Opcode Fuzzy Hash: 83956817f2a9dd5eec28b3337a28fdcc3d328d498f122e9eb4e5408e4a01243f
Instruction Fuzzy Hash: FEF0FF35214640CFC709DB28D588C49BBE6EF4A70970689A9E40ACB372CB72EC44CF40

Function 058A473C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a94f1c2f53bda7eb3b2da7154a56b923afe2b74d398b85d8c63b9cd55d82260
Instruction ID: 19d89f1cd191d9c0bc52ec794a1d22a37a3b79363fe03610fc4b46ff4ed714ed
Opcode Fuzzy Hash: 6a94f1c2f53bda7eb3b2da7154a56b923afe2b74d398b85d8c63b9cd55d82260
Instruction Fuzzy Hash: 7EF0E237A0914CAFEF02DF80DC54AE97F32FB98301F004096EA4297165C3B18D25DB11

Function 058A6880 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f687c0f1ad7dfce6bfd06c897c3416d3915a46c301bdc1061022f7942fe6a8b4
Instruction ID: 87a05651010de0d4122dbd5e3b6d97c4b22614dae36618f31ea3a53c08ed3461
Opcode Fuzzy Hash: f687c0f1ad7dfce6bfd06c897c3416d3915a46c301bdc1061022f7942fe6a8b4
Instruction Fuzzy Hash: B2E02062F047540FE719917BA8504A67BEF7EC5401308C15ED885C7719E9606D0647C4

Function 058A6890 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 885c0b05f318dceb0860a2faeb48977a94c75d42ec83e3beb58c085f8e44c20e
Instruction ID: 237366b8b8687fd7aea7ae89f4c94786febd7f34bb81309d14ef2057b002fb95
Opcode Fuzzy Hash: 885c0b05f318dceb0860a2faeb48977a94c75d42ec83e3beb58c085f8e44c20e
Instruction Fuzzy Hash: 79E06571B006150B574CE76A984049AB6DBAED8510358C16EC40DCB628ED30984147C4

Function 058A6534 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bea6c8512b44a9cf9f0e0f68e4ec393b6b2a4d3724760c97fdba19427f6aa70
Instruction ID: 0e6fb4f9eedda0a309571e5c171ffb35b53ea7573a0744de973b5246d7aa7351
Opcode Fuzzy Hash: 5bea6c8512b44a9cf9f0e0f68e4ec393b6b2a4d3724760c97fdba19427f6aa70
Instruction Fuzzy Hash: 9BE0C2313597049FC32CDA1CE880C7ABBEEEF883103148979F20AC7220DB60FC088684

Function 058A9D30 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970c82cb5f3510eb5c1ea9909098110980fce6e6b63eb4a2e339434544d5dff4
Instruction ID: 26bfc25bac601377d23faf0cc22762ea60f74c9d5f8070f5e20b5c941db26316
Opcode Fuzzy Hash: 970c82cb5f3510eb5c1ea9909098110980fce6e6b63eb4a2e339434544d5dff4
Instruction Fuzzy Hash: 57E04F35B186108FC718DB5CE480AA677E9AF48311B2586A9F909C7770E760DC1A8784

Function 058A4518 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01acd0b3696e975e34426ede06ab3e2e7e10f7e2dc8ab15ea42c7114e4811f8
Instruction ID: 64c3eaadade6ab0a7f605ed757352370bc987d03339764d10a6937b546653794
Opcode Fuzzy Hash: b01acd0b3696e975e34426ede06ab3e2e7e10f7e2dc8ab15ea42c7114e4811f8
Instruction Fuzzy Hash: FFE04F32644248AFDF028F64D800EE63BB5FF06211B028092F9948B232D272EC21EB61

Function 058A4710 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c906f2a4c90fcb046b71b70daece7abec47f645389eb338a8b78e134cd3fbd6
Instruction ID: 86c831601b2f0422654e1ab3a5e724491f930643142ba7ca9448ed94c1c29307
Opcode Fuzzy Hash: 9c906f2a4c90fcb046b71b70daece7abec47f645389eb338a8b78e134cd3fbd6
Instruction Fuzzy Hash: 3CD0A732300224476F2536B8740847D73CF9A45566344047EF90EC6341DE668C0043C5

Function 058A46F3 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a9ff94ce09f37de5b4a27e4f027f21186b72dba76e20984c86427662d44210
Instruction ID: f352387f488b3a8c2b086ec488e9b7e69bcdfce55d7c059e74a2b9dee9ecbb25
Opcode Fuzzy Hash: 08a9ff94ce09f37de5b4a27e4f027f21186b72dba76e20984c86427662d44210
Instruction Fuzzy Hash: D4E0123AA0110DABEF01DFC0E945BDEBB72FB88315F208011EA01672A4C7724E65DB91

Function 058A0EB0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fbd862b4ff9972398def8de603b96881e29cc7127eee119baea71fae25b5bc6
Instruction ID: 856117afbba9c9b6bfd63da5b946d270fba52ae3f3248db23cc91fc796fb86a6
Opcode Fuzzy Hash: 3fbd862b4ff9972398def8de603b96881e29cc7127eee119baea71fae25b5bc6
Instruction Fuzzy Hash: 80D02323F1831417E70520DC58146F7368E4B86620F190077490DC37859C959C4203F3

Function 058A4700 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a443b698fec4f6e7dba1528a74381c90a11b68ced442db33ad30a449e610976
Instruction ID: fa04727c2b1e0df9a6e0625e37f0e2bc5d2d808e9cd3c8d98f3e08cfa94ed347
Opcode Fuzzy Hash: 2a443b698fec4f6e7dba1528a74381c90a11b68ced442db33ad30a449e610976
Instruction Fuzzy Hash: 37D023313041500F9F31597C7900DFA37FD5E4515A30543BEDC0EC6215D95D4C2457C5

Function 058A70A1 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa01970d21c123f159b90b80bace5260c2fc1aa29724b73053cf2d8f4ab55ea
Instruction ID: fba8b01f542d75a85cb5a23bb376e4939f91f13a9dd6bef32158774c5efada85
Opcode Fuzzy Hash: 2aa01970d21c123f159b90b80bace5260c2fc1aa29724b73053cf2d8f4ab55ea
Instruction Fuzzy Hash: DEE0C235214214DFCB058B68E009D993FE8EF09220B1480BAFC09C7321CF31AC00C7C9

Function 058A70B0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54440c057619b39e78206b242a106ecba630dd39f0dc35df7384da759f73f05d
Instruction ID: ff6f735a14f6b6a152b86efc272511377f0c5fb12c608466c6ec234104ee5593
Opcode Fuzzy Hash: 54440c057619b39e78206b242a106ecba630dd39f0dc35df7384da759f73f05d
Instruction Fuzzy Hash: F9D0C9363101249F9B059B68E508CAA7BEDEB4D6613118066F909C7321CE71EC108BD4

Function 058A6071 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449e675386f93e7636a5df1ba7fb28a7f4525feecd3e14dd7e967169d7b88797
Instruction ID: d1d54f232621eb07c0d029e94f91bd9fe004a9b3600932af385df64ce3aa3df5
Opcode Fuzzy Hash: 449e675386f93e7636a5df1ba7fb28a7f4525feecd3e14dd7e967169d7b88797
Instruction Fuzzy Hash: 88D01276DA97830FE712263598042683EB0AB372D578C00E28010D515FFA194494D322

Function 058A4528 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63055a45eeb4ae8ae8d6e3381b45a0748b663f32349da8a3f0a884f24e2bbca
Instruction ID: 103967bf13f508402a192ef6221732069224ae084a114efb1bafc53f37aadea3
Opcode Fuzzy Hash: c63055a45eeb4ae8ae8d6e3381b45a0748b663f32349da8a3f0a884f24e2bbca
Instruction Fuzzy Hash: BCD0C93614010CEFCB01CF95D844D9A3BBAFF48720F008054FA084B232C332E821EB90

Function 058A4F60 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3631f2d15d6023ecc873328bf911cb2e2f20488e309a7fb33310b66cf784668f
Instruction ID: 23fa2bdbaf5a155ebc697532fb5d70b785f56e3277df76ae959b2ab0cf117374
Opcode Fuzzy Hash: 3631f2d15d6023ecc873328bf911cb2e2f20488e309a7fb33310b66cf784668f
Instruction Fuzzy Hash: B4C080867057C01AEF4755750818444193785CA400FCF94D54C81CE262D0DDCC450321

Function 058A0EC0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b08f306fecc5059d47c7496ca6ab2798b6e5fbfede51ffbfd17f8dd9c15bd7
Instruction ID: 1c9be3a76ee7aa6b49f0faebe9d835d582b482c95b06e4df37bd6c78151e3b26
Opcode Fuzzy Hash: 64b08f306fecc5059d47c7496ca6ab2798b6e5fbfede51ffbfd17f8dd9c15bd7
Instruction Fuzzy Hash: BEB09B2231433D13DA0971DD64146FD728E4785564F000067951DD77415CD59C4103DB

Function 058A46EA Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc304a26ba6a9b8e09db51e88682a954301326f375d2764bec1dfa900b44145
Instruction ID: aaae3fb2ea0c4738b2ab52d8b83c9c30d9afddb35997d4b89c841ed032a14f7b
Opcode Fuzzy Hash: 8fc304a26ba6a9b8e09db51e88682a954301326f375d2764bec1dfa900b44145
Instruction Fuzzy Hash: 69B0923BA0401C89EF008A84B4423EEF760E780269F104023C6119204193B2016496D1

Function 058A4A88 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5850c4b38b810ca4f3d013a0f0b2b06e0d88a926151f3524c0b1e7985c98373c
Instruction ID: 3b97a18c23a5373eb9a9cb3b29cc394b763a148fc36703396ca8ad942de085c3
Opcode Fuzzy Hash: 5850c4b38b810ca4f3d013a0f0b2b06e0d88a926151f3524c0b1e7985c98373c
Instruction Fuzzy Hash: 0AB0121A754905017D04F9390CDC576001B9EC0200BC0EC141D01C012C89ACAC08000A

Non-executed Functions

Function 079367F8 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b34e40c38c8ffc8a6cc00e245f5b0136cee5887393d406b374cd955879a816
Instruction ID: 12b5c534ede09141c160d17cd5f91cfb092a540a736bca00c9dd015e67ac8c36
Opcode Fuzzy Hash: 41b34e40c38c8ffc8a6cc00e245f5b0136cee5887393d406b374cd955879a816
Instruction Fuzzy Hash: BF328BB0B006059FDB14DB79C494BAEB7FAAF88304F1484A9D559EB3A1CB34EC45CB61

Function 07930040 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14194782d0a9585a3fe048f1e886148308a47e5b2079804f440e97ca0297105e
Instruction ID: 0af50e97110ded099647113ce15aca95aad3663e0c815e254b012664001cf949
Opcode Fuzzy Hash: 14194782d0a9585a3fe048f1e886148308a47e5b2079804f440e97ca0297105e
Instruction Fuzzy Hash: FAE108B4E001198FDB14DFA9C5809AEFBB2FF89305F248269D414AB356D735AD41CF61

Function 016BD3A4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2157051692.00000000016B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16b0000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b29609f88b44e184bcef1793128150f8e16c79f3a6fed261bde973e24fe03ae
Instruction ID: 62b4449510532bee1a35a9be40e91717bd43292e167d01bad814d59eb92d99b3
Opcode Fuzzy Hash: 2b29609f88b44e184bcef1793128150f8e16c79f3a6fed261bde973e24fe03ae
Instruction Fuzzy Hash: 82A16C36A102158FCF05DFB8CD905DEBBB2FF89300B1585AAE901AB275DB719996CB40

Function 07930006 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2163554683.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7930000_autorization Letter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872002458dadbe20d227b0004282b49ea4f29dbc79f56bb431408788a508eafe
Instruction ID: fb8530d1765fad62823b6f062edf9b3ef988a31cdc1348d312545ce116f8c91f
Opcode Fuzzy Hash: 872002458dadbe20d227b0004282b49ea4f29dbc79f56bb431408788a508eafe
Instruction Fuzzy Hash: 655150B0E042598FDB15CFA9C9805AEBBF2FF85314F1481AAD418AB256D7349E41CF61

Function 058A7C50 Relevance: 41.7, Strings: 33, Instructions: 438COMMON

Download Yara Rule

Strings

4']q, xrefs: 058A7F85
4']q, xrefs: 058A8157
4']q, xrefs: 058A7D9B
4']q, xrefs: 058A7E04
4']q, xrefs: 058A7FA8
4']q, xrefs: 058A7ED6
4']q, xrefs: 058A7E90
4']q, xrefs: 058A7E6D
4']q, xrefs: 058A8023
4']q, xrefs: 058A7F62
4']q, xrefs: 058A804F
4']q, xrefs: 058A7FCB
4']q, xrefs: 058A80D3
4']q, xrefs: 058A7EF9
4']q, xrefs: 058A7F1C
4']q, xrefs: 058A7EB3
4']q, xrefs: 058A81AF
4']q, xrefs: 058A7D55
4']q, xrefs: 058A8183
4']q, xrefs: 058A80FF
4']q, xrefs: 058A80A7
4']q, xrefs: 058A81DB
4']q, xrefs: 058A8207
4']q, xrefs: 058A7F3F
4']q, xrefs: 058A7E27
4']q, xrefs: 058A7E4A
4']q, xrefs: 058A812B
4']q, xrefs: 058A7FF7
4']q, xrefs: 058A7DE1
4']q, xrefs: 058A7DBE
4']q, xrefs: 058A807B
4']q, xrefs: 058A7D32
4']q, xrefs: 058A7D78

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-2711123852
Opcode ID: 89a94903aaa78b5f19de0bbbe17be32270c3279a610961f03ea7493f18881f3f
Instruction ID: 1c31778c78d2b9ec475bd09839c6a9811a0205be5a422557eb998b8cdfedc6a4
Opcode Fuzzy Hash: 89a94903aaa78b5f19de0bbbe17be32270c3279a610961f03ea7493f18881f3f
Instruction Fuzzy Hash: 0A125470A1021A8FCB5CEF78E990A9D7BB2FF94704F504568C049AB264DF746D85CFA2

Function 058A7C60 Relevance: 41.7, Strings: 33, Instructions: 434COMMON

Download Yara Rule

Strings

4']q, xrefs: 058A7F85
4']q, xrefs: 058A8157
4']q, xrefs: 058A7D9B
4']q, xrefs: 058A7E04
4']q, xrefs: 058A7FA8
4']q, xrefs: 058A7ED6
4']q, xrefs: 058A7E90
4']q, xrefs: 058A7E6D
4']q, xrefs: 058A8023
4']q, xrefs: 058A7F62
4']q, xrefs: 058A804F
4']q, xrefs: 058A7FCB
4']q, xrefs: 058A80D3
4']q, xrefs: 058A7EF9
4']q, xrefs: 058A7F1C
4']q, xrefs: 058A7EB3
4']q, xrefs: 058A81AF
4']q, xrefs: 058A7D55
4']q, xrefs: 058A8183
4']q, xrefs: 058A80FF
4']q, xrefs: 058A80A7
4']q, xrefs: 058A81DB
4']q, xrefs: 058A8207
4']q, xrefs: 058A7F3F
4']q, xrefs: 058A7E27
4']q, xrefs: 058A7E4A
4']q, xrefs: 058A812B
4']q, xrefs: 058A7FF7
4']q, xrefs: 058A7DE1
4']q, xrefs: 058A7DBE
4']q, xrefs: 058A807B
4']q, xrefs: 058A7D32
4']q, xrefs: 058A7D78

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-2711123852
Opcode ID: 5c4d1de71c895733db4a98e73bb73daf4347772f8a311954e4f54abef5dd3f83
Instruction ID: 25a641c259cd0ea0cfcde4623e49084dd71f0f12c208eb2c98e43facf8199677
Opcode Fuzzy Hash: 5c4d1de71c895733db4a98e73bb73daf4347772f8a311954e4f54abef5dd3f83
Instruction Fuzzy Hash: 17124470A1021A8FCB5CEF78E990A9D7BB2FF94704F504568C049AB264DF746D85CFA2

Function 058A26E0 Relevance: 12.7, Strings: 10, Instructions: 183COMMON

Download Yara Rule

Strings

4']q, xrefs: 058A2812
4']q, xrefs: 058A28C1
4']q, xrefs: 058A287B
4']q, xrefs: 058A2835
4']q, xrefs: 058A2858
4']q, xrefs: 058A289E
4']q, xrefs: 058A2907
4']q, xrefs: 058A294D
4']q, xrefs: 058A28E4
4']q, xrefs: 058A292A

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-3121157708
Opcode ID: 8a380f5fef8db3aa1b157153d03fad902c94d635f0f211858eac0d6317b35603
Instruction ID: 46c4c8fa2ec2ed6f7d675bcb27146ad5f3bb5076dbc094698e4945d98ee4a1f6
Opcode Fuzzy Hash: 8a380f5fef8db3aa1b157153d03fad902c94d635f0f211858eac0d6317b35603
Instruction Fuzzy Hash: D5717E31E0020B8FCB18EFB9D8905DDBBB2FF95300F614629D055AB264EB747986CB91

Function 058A26F0 Relevance: 12.7, Strings: 10, Instructions: 172COMMON

Download Yara Rule

Strings

4']q, xrefs: 058A2812
4']q, xrefs: 058A28C1
4']q, xrefs: 058A287B
4']q, xrefs: 058A2835
4']q, xrefs: 058A2858
4']q, xrefs: 058A289E
4']q, xrefs: 058A2907
4']q, xrefs: 058A294D
4']q, xrefs: 058A28E4
4']q, xrefs: 058A292A

Memory Dump Source

Source File: 00000001.00000002.2162504131.00000000058A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_58a0000_autorization Letter.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-3121157708
Opcode ID: 79a2259006f7982b81ad35308c34f4e515a5cf953739763d0d125490a4b93d16
Instruction ID: 1024dbd8e4eadda77cba3af397b822c8b9304a847137137580878e6b919ff4b5
Opcode Fuzzy Hash: 79a2259006f7982b81ad35308c34f4e515a5cf953739763d0d125490a4b93d16
Instruction Fuzzy Hash: 13717F30E0020B8BCB18EFB9D9505DDBBB2FF95700F614618D055AB264DB747985CB91

Analysis Process: RegSvcs.exePID: 1576, Parent PID: 6180COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	142
Total number of Limit Nodes:	15

Executed Functions

Function 05E127FA Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05E1287E
GetCurrentThread.KERNEL32 ref: 05E128BB
GetCurrentProcess.KERNEL32 ref: 05E128F8
GetCurrentThreadId.KERNEL32 ref: 05E12951

Memory Dump Source

Source File: 00000009.00000002.2212452877.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e10000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e845fce9ac1678d79c5db7bea06704b3e78e4559ac87d745196ae798b5dd7aef
Instruction ID: d75f54a8a62fe81be684340a9c70bc6dfc7c34ca57af0c7e185af7921513d232
Opcode Fuzzy Hash: e845fce9ac1678d79c5db7bea06704b3e78e4559ac87d745196ae798b5dd7aef
Instruction Fuzzy Hash: D05156B49002498FDB14DFAAD948BEEBBF1FF88314F24845AE509A7360DB385944CB65

Function 05E12800 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05E1287E
GetCurrentThread.KERNEL32 ref: 05E128BB
GetCurrentProcess.KERNEL32 ref: 05E128F8
GetCurrentThreadId.KERNEL32 ref: 05E12951

Memory Dump Source

Source File: 00000009.00000002.2212452877.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e10000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c787952447c15bfe130b28585f28cdf4a0120d37e016f39ebf921f2008ed260b
Instruction ID: 2e8c1d0e2c55e0b84d1b4e3c01c4bd99d04454caf4139fef700329a0c91881b0
Opcode Fuzzy Hash: c787952447c15bfe130b28585f28cdf4a0120d37e016f39ebf921f2008ed260b
Instruction Fuzzy Hash: 895157B09003498FDB14DFAAD948BDEBBF1FF88314F24805AE509A7360DB345944CB65

Function 05E1AD18 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 05E1AF7E

Memory Dump Source

Source File: 00000009.00000002.2212452877.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e10000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bf67c02840f3cba49532e1053fdd115fd30abece59b8dbd3308486c7b8fee283
Instruction ID: 515a8942cf576930536b9a9d8746012fc13f66fcc0bd84745c715bd1ce926db6
Opcode Fuzzy Hash: bf67c02840f3cba49532e1053fdd115fd30abece59b8dbd3308486c7b8fee283
Instruction Fuzzy Hash: DA815AB0A01B058FD724DF29D0447AABBF5FF88304F00892ED896D7A50D774E845CB98

Function 05E2E510 Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2212567405.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e20000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ccb44f136d6ffc269342f08f19e79c04987780f3947685d45d3b837e02b9a2
Instruction ID: a4274ac28b35084e1d583f172e7f42346ad1fdeed1b15fb639e3ca8c3c5f5787
Opcode Fuzzy Hash: c8ccb44f136d6ffc269342f08f19e79c04987780f3947685d45d3b837e02b9a2
Instruction Fuzzy Hash: FE413571E147658FCB14CF69C8042EEBFF5AF89210F14856AD448A7241EB38D845CBD1

Function 05E1CF04 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05E1D022

Memory Dump Source

Source File: 00000009.00000002.2212452877.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e10000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a226a8a390e15eb80fc840a2b0c141c41c6bb2b608867fd9fb21ba646f473c66
Instruction ID: e4d911477ee708d43590f9a381b709598e5aae1dbf137bf05af711b7d6fcec0f
Opcode Fuzzy Hash: a226a8a390e15eb80fc840a2b0c141c41c6bb2b608867fd9fb21ba646f473c66
Instruction Fuzzy Hash: B851D1B1C00349DFDB14CFA9C984ADEBBB6FF48314F64812AE819AB210D7749885CF95

Function 05E1CF10 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05E1D022

Memory Dump Source

Source File: 00000009.00000002.2212452877.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e10000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 37a99427063c82129c1afa5f86d0995554d7557e61aa077f60d6e0c0f9a25abe
Instruction ID: e01872e18e0b888095bc86bf2986d93a8dc68e1dc43b14b08ec864df86d2d923
Opcode Fuzzy Hash: 37a99427063c82129c1afa5f86d0995554d7557e61aa077f60d6e0c0f9a25abe
Instruction Fuzzy Hash: A841E2B1C00309DFDB14CFA9C984ADEBBB6FF48304F64812AE819AB210D7749885CF94

Function 05E1A18C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05E1F711

Memory Dump Source

Source File: 00000009.00000002.2212452877.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e10000_RegSvcs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 701560f265e3d8425dc5bf344e03d198f8c3dc2f28f704aa86e2fb7e70fee7cd
Instruction ID: 47da82884269dd5ae229f8da0e54a4377cc217466d86153f9a2e32025d6d3801
Opcode Fuzzy Hash: 701560f265e3d8425dc5bf344e03d198f8c3dc2f28f704aa86e2fb7e70fee7cd
Instruction Fuzzy Hash: CE4127B9900205DFDB14CF99C888AAABBF6FF88314F248459D559AB321D774A841CFA4

Function 05E12A40 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05E12ACF

Memory Dump Source

Source File: 00000009.00000002.2212452877.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e10000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8f1dadee99be8bf09e0498d4d5ae7c154b752162aeebf7219654dabce980283f
Instruction ID: d1c6a39ba9e4e677372e2f140b115a4af2e1fdf9282a976f3c6593587b0fe7c4
Opcode Fuzzy Hash: 8f1dadee99be8bf09e0498d4d5ae7c154b752162aeebf7219654dabce980283f
Instruction Fuzzy Hash: 5521E2B5D002489FDB10CFAAD984ADEBBF5FB48310F14841AE958A7250D378A950CFA5

Function 05E12A48 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05E12ACF

Memory Dump Source

Source File: 00000009.00000002.2212452877.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e10000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a5a1883987de540a19fff5d868bdb2021e53a39dfa8db689fdb036cfd28c281c
Instruction ID: cd879dba704fb96e0648a747d102d376c6bc4c6ec4430800fb48d471bd9e0415
Opcode Fuzzy Hash: a5a1883987de540a19fff5d868bdb2021e53a39dfa8db689fdb036cfd28c281c
Instruction Fuzzy Hash: D821C2B5D002489FDB10CFAAD984ADEBBF9FB48310F14841AE958A7350D378A954CFA5

Function 00D27351 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 00D273C8

Memory Dump Source

Source File: 00000009.00000002.2203908369.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: b37cc6775fc2a2d5aa355228f31b7bcaa34f2757f1038301f7782a99b332f53f
Instruction ID: 0f644cd2ba34df6368f90856236b3c952a3148fe778035119c03b9071b882b63
Opcode Fuzzy Hash: b37cc6775fc2a2d5aa355228f31b7bcaa34f2757f1038301f7782a99b332f53f
Instruction Fuzzy Hash: 442147B1C0066A9BCB20DF9AD4456AEFBB4EF48314F14816AD828A7640D778A944CFE5

Function 00D27358 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 00D273C8

Memory Dump Source

Source File: 00000009.00000002.2203908369.0000000000D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d22abf089dc8a92df569b565ecd9f674e29d08045c507bab51007a4f03bae3ad
Instruction ID: 15f82c00ef6a0e44745ec017930e82478b2e3cf051b013850a9eb8885677f5e9
Opcode Fuzzy Hash: d22abf089dc8a92df569b565ecd9f674e29d08045c507bab51007a4f03bae3ad
Instruction Fuzzy Hash: 231147B1C006599BCB10DF9AD544BAEFBF4FF48320F14816AD818A7240D778A940CFE5

Function 05E2D6C4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,05E2E562), ref: 05E2E64F

Memory Dump Source

Source File: 00000009.00000002.2212567405.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e20000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: cfb3196f5454ea6fb3ac98d0db992b860827b08d363b193c71bb8633a60b4aa8
Instruction ID: 728c91f98184a2cc58238d237fd8281e36ecff2ff1eb0d33119e2e99376557eb
Opcode Fuzzy Hash: cfb3196f5454ea6fb3ac98d0db992b860827b08d363b193c71bb8633a60b4aa8
Instruction Fuzzy Hash: 4A1103B1C006699BCB10DF9AC445AEEFBF8EF48314F14816AE918A7240D778A950CFE5

Function 05E2E5E0 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,05E2E562), ref: 05E2E64F

Memory Dump Source

Source File: 00000009.00000002.2212567405.0000000005E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e20000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: cbdb65f9b856470239f0c09fc43c8d7874248f952fceb7d3ea8cfe458061fd82
Instruction ID: 6782f40f882abf0daf7c8e72a9976f8395af920bd23a167ec9e87978f4b7a09d
Opcode Fuzzy Hash: cbdb65f9b856470239f0c09fc43c8d7874248f952fceb7d3ea8cfe458061fd82
Instruction Fuzzy Hash: 0A1142B1C006699BCB10DF9AC545BEEFBB4BF48320F10812AD818B7240D738A940CFA5

Function 05E1AF18 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 05E1AF7E

Memory Dump Source

Source File: 00000009.00000002.2212452877.0000000005E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e10000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5006c753d94efd5652ee06bbe3f41b9b350c01361d6127f7bf2c7bba673c6148
Instruction ID: 7ea817e511077c1c563b5c1ec332140a30c5d5ca10cf0087a1bf16c7fd2b53a9
Opcode Fuzzy Hash: 5006c753d94efd5652ee06bbe3f41b9b350c01361d6127f7bf2c7bba673c6148
Instruction Fuzzy Hash: F71110B5C003498FDB10CF9AC444ADEFBF5EF88324F10842AD869A7200C379A545CFA5

Function 00CCD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2203661039.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ccd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93dfb0b033979247e61bbd8bc579661056997c52e3a7de8886882d111240fde2
Instruction ID: 69f195ed6c97e046ec60a0b4e28a8b510467c5739bb30a03304688397a158e93
Opcode Fuzzy Hash: 93dfb0b033979247e61bbd8bc579661056997c52e3a7de8886882d111240fde2
Instruction Fuzzy Hash: 1121D071604204DFCB14DF28D9C4F26BBA5FB88314F20C5BDE94A4B296C33AD847CA62

Function 00CCD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2203661039.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ccd000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab36d4c3a216d478ff4fd5ac5fbae3ecc547271dbd30c8bb73cb77cb3bedfa53
Instruction ID: 32d6d4d748bfdceb12833aee33b8526f8d40e862054f384d178cf8f31178ec30
Opcode Fuzzy Hash: ab36d4c3a216d478ff4fd5ac5fbae3ecc547271dbd30c8bb73cb77cb3bedfa53
Instruction Fuzzy Hash: EF2183755093808FD702CF24D594B15BF71EB46314F28C5EED8498B6A7C33A980ACB62

Analysis Process: tIFjYTCo.exePID: 3440, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	7

Executed Functions

Function 00D0D468 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D0D4F6
GetCurrentThread.KERNEL32 ref: 00D0D533
GetCurrentProcess.KERNEL32 ref: 00D0D570
GetCurrentThreadId.KERNEL32 ref: 00D0D5C9

Memory Dump Source

Source File: 0000000A.00000002.2224413292.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_tIFjYTCo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6e1774f5d7ed346e64ba4046c81a5c2acd9b671c6e8c5272cb1c2e4e086a5918
Instruction ID: 6cd65a1046ad53632973b73fdd8d939e95f7ed8a7d7ab7cebb8d5482ff8b1299
Opcode Fuzzy Hash: 6e1774f5d7ed346e64ba4046c81a5c2acd9b671c6e8c5272cb1c2e4e086a5918
Instruction Fuzzy Hash: CD518AB09016098FDB14DFA9D9487AEBBF1FF49304F248459D409A73A0C7789944CF65

Function 00D0D478 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D0D4F6
GetCurrentThread.KERNEL32 ref: 00D0D533
GetCurrentProcess.KERNEL32 ref: 00D0D570
GetCurrentThreadId.KERNEL32 ref: 00D0D5C9

Memory Dump Source

Source File: 0000000A.00000002.2224413292.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_tIFjYTCo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cee1a38c29851da9d1c14da273be6234438c8787e019c48dac14297b2eae52dc
Instruction ID: 796cc972378780c716982a13a76548945f9b475cb7b3d1d61e81e109ebe7e704
Opcode Fuzzy Hash: cee1a38c29851da9d1c14da273be6234438c8787e019c48dac14297b2eae52dc
Instruction Fuzzy Hash: 6A5179B09017098FDB14DFA9D948B9EBBF1FF89314F208459E409A73A0D7789984CF65

Function 04CE79E0 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 04CE7A2E
, xrefs: 04CE7A27

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 8569b175186dca47ac55175c36a3f4512a082ac767cb8a514692dd7fc5b1d167
Instruction ID: 9edd6dedbd99ddafbdfe2d5717daffbf302d7e2595820442dbf99bd2ddfc309a
Opcode Fuzzy Hash: 8569b175186dca47ac55175c36a3f4512a082ac767cb8a514692dd7fc5b1d167
Instruction Fuzzy Hash: 0E71F230D10701CFDB41EF29D480964B7F5FF85304B518AA8D959AB31AEB31F898CB80

Function 04CE6554 Relevance: 2.7, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 04CE7A2E
, xrefs: 04CE7A27

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 26e9ab80ec2a2332153c7bc16159963abf56526107f310052c5a780c2c48b1dc
Instruction ID: 8e5cc6a0dda5b1e5f4b8c2a7320c08b2d1498cb8b173648e9db0a394c4c0902d
Opcode Fuzzy Hash: 26e9ab80ec2a2332153c7bc16159963abf56526107f310052c5a780c2c48b1dc
Instruction Fuzzy Hash: D461C330D10701CFDB40EF29D484965B7F9FF85304B518AA8DA59AB31AEB71F898CB80

Function 00D0ADE8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D0B03E

Memory Dump Source

Source File: 0000000A.00000002.2224413292.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_tIFjYTCo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f097e1e1391d1910fe62e13228a5dd4689e948d67cbcadccf560b94ca33cd4bf
Instruction ID: ec611f9f6bc2294909c2b34c785b5b1206a57719b8a31870fe9f27ccb6532edd
Opcode Fuzzy Hash: f097e1e1391d1910fe62e13228a5dd4689e948d67cbcadccf560b94ca33cd4bf
Instruction Fuzzy Hash: 16713470A00B058FD724DF69D45579ABBF5FF88300F048A2DE48AD7A90D775E84ACBA1

Function 00D0590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D059C9

Memory Dump Source

Source File: 0000000A.00000002.2224413292.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_tIFjYTCo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: de4d1df76556dcdbb51e9124d414fac6f79cd921d9aa321aa2bbf3d39bcffc40
Instruction ID: 64dcd1da45d9d1ac5e01f31712be5be3c079f908136879fd32d8cbf42e747318
Opcode Fuzzy Hash: de4d1df76556dcdbb51e9124d414fac6f79cd921d9aa321aa2bbf3d39bcffc40
Instruction Fuzzy Hash: 764114B1C00719CFDB24CFA9C885B8EBBF5BF49304F20815AD418AB255DB75694ACFA0

Function 00D044D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D059C9

Memory Dump Source

Source File: 0000000A.00000002.2224413292.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_tIFjYTCo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 824a227eaea9981a336bff0a5a1932feb6230b514e2df95d77826ca53f0e305f
Instruction ID: ce956644ced77df49d9b7414a65de7c0ee80a4ec96ad361656f43cae9689cd40
Opcode Fuzzy Hash: 824a227eaea9981a336bff0a5a1932feb6230b514e2df95d77826ca53f0e305f
Instruction Fuzzy Hash: AD41F3B0D0071DCBDB24CFA9D844B9EBBF5BF48304F20805AD418AB295DB75694ACFA0

Function 00D0D6B8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D0D747

Memory Dump Source

Source File: 0000000A.00000002.2224413292.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_tIFjYTCo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6279bc4ce9fe00bece264c1a20dc72bb90c207024357e544f0b23b838d3a8696
Instruction ID: 306860f7063081a71a8fd0180eaf5937a194433c6bc83210565aacaa3e961e70
Opcode Fuzzy Hash: 6279bc4ce9fe00bece264c1a20dc72bb90c207024357e544f0b23b838d3a8696
Instruction Fuzzy Hash: 712103B59002489FDB10CFAAD584AEEBFF5FB48324F14845AE958A3351C378A945CF60

Function 00D0D6C0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D0D747

Memory Dump Source

Source File: 0000000A.00000002.2224413292.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_tIFjYTCo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cccff55cb2a8e32263d0a9541ab2de4a186be13ae1def33f7b5666563f26fe05
Instruction ID: 4d77a36d2ac2a883389a399aa80517aaf8b381dab38c0a510dc9942c875b77ad
Opcode Fuzzy Hash: cccff55cb2a8e32263d0a9541ab2de4a186be13ae1def33f7b5666563f26fe05
Instruction Fuzzy Hash: 7221C2B59002489FDB10CFAAD984ADEBBF9FB48310F14841AE918A3350D378A944CFA5

Function 00D0AFD8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D0B03E

Memory Dump Source

Source File: 0000000A.00000002.2224413292.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d00000_tIFjYTCo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e054ac17451d538bebb2d86c8fd83e2658144dcf0e16355518825f5db8149fe3
Instruction ID: 154b349c5d3b7bea79b0ff2b142f484026f2aae499c030c32f3d8f3b0ac5991b
Opcode Fuzzy Hash: e054ac17451d538bebb2d86c8fd83e2658144dcf0e16355518825f5db8149fe3
Instruction Fuzzy Hash: 49110FB5C002498FCB10CF9AD444BDFFBF4AB89324F14841AD528B7240D379A545CFA1

Function 04CED16F Relevance: 1.5, Strings: 1, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 04CED347

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: aad30d8dfdcb3ca259a9eea3ab78967647ccb546d9f9cecdf4538644986d2f6f
Instruction ID: 7ceaf1761ad0c2587e700cab67db69e974c69c615b3ec3347b6201aaad4b36f0
Opcode Fuzzy Hash: aad30d8dfdcb3ca259a9eea3ab78967647ccb546d9f9cecdf4538644986d2f6f
Instruction Fuzzy Hash: AED1FB3590020ACFCF05DFA8C4949EDB7B2FF58314B258655D806A7259E734BE9ACF80

Function 04CE05D0 Relevance: 1.4, Strings: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 04CE063A

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 0ead59856f2bac9c5387f7f7604964fae7090bd4eab167e7b00be7dcdd9a6c9e
Instruction ID: 609babb2ce9f0ec9df97f2667e5f0805a352397f091f35428df4afad471f98ed
Opcode Fuzzy Hash: 0ead59856f2bac9c5387f7f7604964fae7090bd4eab167e7b00be7dcdd9a6c9e
Instruction Fuzzy Hash: 6E214731B082448FD7199F7A94182AF7FEBDBC1214F1084BAD405CB681DE34ED0287A1

Function 04CE3830 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

4']q, xrefs: 04CE3876

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: cf1d2e44b155c4d670853ff9eaa588fd75ed0915b3ed1d73b97f0e1ab06420d3
Instruction ID: 6112ef5b498d2eb331fd2dd9e0bdaac5d96a6bee7e3c39245973ef89245f6c23
Opcode Fuzzy Hash: cf1d2e44b155c4d670853ff9eaa588fd75ed0915b3ed1d73b97f0e1ab06420d3
Instruction Fuzzy Hash: 2E21B370D40205DFCB05EFB8D9509AE7BBAEF80300F004565D105AB169DF38AA49CFA1

Function 04CE3840 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

4']q, xrefs: 04CE3876

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 06523ea5142154e758d57f8935ef67f0a3b5c27d2d0be14866e03a270dd2558e
Instruction ID: 80a9618dd1836704bf6cac72bf69be64897a4a8d438821036d8bdc5b48491363
Opcode Fuzzy Hash: 06523ea5142154e758d57f8935ef67f0a3b5c27d2d0be14866e03a270dd2558e
Instruction Fuzzy Hash: F8119070E401099FCB05EFB9E9519EE7BBAEF84700F004565D1056B269EF38AE49CBA1

Function 04CED510 Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241f819cfc080e9a144de15e239b0606ad522a536ee3ef40db3f54c960415bee
Instruction ID: 9df8d147b6604641f9b72df89accca3b5710961ff81d46b6abae4d06e29721fa
Opcode Fuzzy Hash: 241f819cfc080e9a144de15e239b0606ad522a536ee3ef40db3f54c960415bee
Instruction Fuzzy Hash: A3725F31D00609CFDB15EF68C855AEDB7B1FF45314F008699D54AAB265EB30AAC9CF81

Function 04CEA4C7 Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae62c13d8851b27d82380ee47b5cacc9e2a6a7318dcd5bab35c4909163da1fa4
Instruction ID: 796556b65f95b0210f00fc774503818d957e3be25e8a40120bf38c0117068c20
Opcode Fuzzy Hash: ae62c13d8851b27d82380ee47b5cacc9e2a6a7318dcd5bab35c4909163da1fa4
Instruction Fuzzy Hash: 6542D631E106198FDB14DF69C8846EDF7B2FF89304F1586A9D459BB221EB31AA85CF40

Function 04CEEDE0 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 084ed10853692e82921de15b71533ea4d01382aa09fd114a7563272657c053fc
Instruction ID: 0b70ff0dd3d7b3dc591cdaeb0f6b123a41a5fa8c7d8c55382680868c82ed9260
Opcode Fuzzy Hash: 084ed10853692e82921de15b71533ea4d01382aa09fd114a7563272657c053fc
Instruction Fuzzy Hash: 7D223834A10615CFDB14DF6AC884AACB7B2FF89304F1485A9E50AAB365EB31AD45CF50

Function 04CED63F Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a091adccd5b474eb2be8a8e79068330a9b60b1c9636fd8913ab9c22fc3650e7a
Instruction ID: 4a23622827bdae894d24dc022844f535aaf0b2f2427a3439481ee68fb2e22296
Opcode Fuzzy Hash: a091adccd5b474eb2be8a8e79068330a9b60b1c9636fd8913ab9c22fc3650e7a
Instruction Fuzzy Hash: 75122D31D006098FDB55EF28C8956EDB7B2EF44314F004699D94AA7265EF30AEDACF81

Function 04CE170C Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0465d2f6a268d98ceb3661790178b3ab8ed6db5f92eb3f8b6c792a5a3ddaa2
Instruction ID: b9fe7b7a8bc2cdc20b94cad1867c26ea1f55e40fcd243ad50598910becf47c78
Opcode Fuzzy Hash: 5b0465d2f6a268d98ceb3661790178b3ab8ed6db5f92eb3f8b6c792a5a3ddaa2
Instruction Fuzzy Hash: AAC17234B007018FDB04EF79D8947AA77A2FF88300F558979D80AAB356EF75A855CB50

Function 04CE16F0 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a680993aacdaec68251d5ac917c265ebbfed51fef7614369fd624efb552ea71b
Instruction ID: daf87dbbf7bbff484189485473fddf21ccd874729b6b37351afc3ecd6d49e59d
Opcode Fuzzy Hash: a680993aacdaec68251d5ac917c265ebbfed51fef7614369fd624efb552ea71b
Instruction Fuzzy Hash: 3DB1B235B007008BDB04EF79C8947AA77A2FF84300F558579D80AAB35AEF75A859CB90

Function 04CE2258 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e64479c45e928a74a3b8a3a8a33fd4283ba54ede61abea933c69272bc18311
Instruction ID: 5504b2b02bc15f8c1f16e749a6d95a9d9e0327cc7b347c4223e1bf5142c5d744
Opcode Fuzzy Hash: 82e64479c45e928a74a3b8a3a8a33fd4283ba54ede61abea933c69272bc18311
Instruction Fuzzy Hash: 1AB1A234B007018FDB04EF69C8947A977A2FF84300F5585B9D80AAB396DF75AC59CB90

Function 04CECEA0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56a7de49b85cac4e2bfd24c11084f5734b4d2fea777e88f2bd73051917fc923
Instruction ID: f094d1256f86b3334ee8471c98046b46f9a8ac49f27fd093aebcd719ea515657
Opcode Fuzzy Hash: e56a7de49b85cac4e2bfd24c11084f5734b4d2fea777e88f2bd73051917fc923
Instruction Fuzzy Hash: D491F77590060ACFCB41DFA8C884999FBF5FF49310B14C79AE819EB256E730E985CB80

Function 04CE3EFF Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911e5f407f612f7452299917be7f02c03e4f02acfa9c489e63c01491d9fab9bc
Instruction ID: fb46e55bd5143a23c046e304e5982206faac4a323ab290b67b55e617bc274554
Opcode Fuzzy Hash: 911e5f407f612f7452299917be7f02c03e4f02acfa9c489e63c01491d9fab9bc
Instruction Fuzzy Hash: 3E510430A00245CFCB19EFA9D5546BEBBB3EFC5300F148469D00A97391DF78A946CB45

Function 04CEEDD1 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4b35e189bacc451d6ba65468df3067e9a954c343d8cbb70a6115a461833120
Instruction ID: 4abfbbf8ff3cfd3e93c7fcd09e336c52a140e1ac651dfc640c480de5360aad88
Opcode Fuzzy Hash: fe4b35e189bacc451d6ba65468df3067e9a954c343d8cbb70a6115a461833120
Instruction Fuzzy Hash: 4E619A346106048FDB14EF2AC898BAC77B3FF89314F1446BCD54A9B3A1DB75A909CB60

Function 04CECE90 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ae160df22d630368c77ee152a89d6768bc87b3af740cbd05eff463a11ff60e
Instruction ID: b8856b9b16e9c8d55a33ef1ae475078bb8ef5751e81d9c2c676c7ed446fb86a1
Opcode Fuzzy Hash: 54ae160df22d630368c77ee152a89d6768bc87b3af740cbd05eff463a11ff60e
Instruction Fuzzy Hash: 29611875D0070ACFCB41DF68D884999F7B1FF49320B148796E859EB256E730EA86CB80

Function 04CE69B8 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ff25711a8f7c38b9b0c3d320410a63cd83b27ff223e5437db208f0d46fe1d4
Instruction ID: 02642b5c18700a14bb8b0bd7521272f349a8c77c84258977d0a22de61a01d4c0
Opcode Fuzzy Hash: b9ff25711a8f7c38b9b0c3d320410a63cd83b27ff223e5437db208f0d46fe1d4
Instruction Fuzzy Hash: 36512734A20605CFCB04DF68C8989ADBBB6FF89704B1585A9E506DB371EB70ED45CB40

Function 04CE5810 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd8e96f45d63fc23288eb3bf434411f1d83371bbe4e29972e50a408ebe3ce85
Instruction ID: b26aef504b1a4f4645d795c1a9a0bba695d77c50a044baf870296b5aa9dbad8a
Opcode Fuzzy Hash: 0cd8e96f45d63fc23288eb3bf434411f1d83371bbe4e29972e50a408ebe3ce85
Instruction Fuzzy Hash: 1E517C78A01208EFCB15DF9AD884DAEBBB2FF48324B154498F905AB361D731E981CF50

Function 04CE69C8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa4bf625ad7fea6bdb294902a08975d9aba8c5daff2e4929da223ba7f059e84a
Instruction ID: eccb06e07201fad62e0dd3fc9c3ce243d89cc3b28956b396e21ed00a7b4589ac
Opcode Fuzzy Hash: aa4bf625ad7fea6bdb294902a08975d9aba8c5daff2e4929da223ba7f059e84a
Instruction Fuzzy Hash: 0A51D534A20605CFCB04DF68C8989ADBBB6FF89704B1585A9E506AB371EB71E945CB40

Function 04CEAD20 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4e44cb850b6e5da54e59c02d96f6867d214885e18baf925f8c4ff72ef7e26ae
Instruction ID: 03eac297e89ecdcfc5f52168e8cbcf849a40d276a89571af27d40569fd16e7c0
Opcode Fuzzy Hash: d4e44cb850b6e5da54e59c02d96f6867d214885e18baf925f8c4ff72ef7e26ae
Instruction Fuzzy Hash: 1A5126347006048FCB18DF6AD498ABDB7B6BF88714B088569E4069B361EB75FD41CB51

Function 04CE0448 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be83233be0beed8b9ec41548ed738b6c61f66dcaac7165d315251bbb3e02186d
Instruction ID: 7d22133d7b9520a80d2f3c9f2ad0e173ee359323671ba459807d35abaca014ee
Opcode Fuzzy Hash: be83233be0beed8b9ec41548ed738b6c61f66dcaac7165d315251bbb3e02186d
Instruction Fuzzy Hash: 5131BE30E02228DFDB18DFA2E5945AEBBB2FF89304F108469E44267255CB75AC65CF80

Function 04CE5C70 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0fcd65bd2f573122b60542a4ee355124d5ff407f6fa18692ebd705c5ae3affd
Instruction ID: fc2edd8e5a7689d933264fc25f2deb343eb11162589b66b9cda1f2b0d81eec45
Opcode Fuzzy Hash: a0fcd65bd2f573122b60542a4ee355124d5ff407f6fa18692ebd705c5ae3affd
Instruction Fuzzy Hash: 98414D34B142589FDB14DFAAC994AAD7BF6FF49708F1440A9E505EB361DB71E900CB20

Function 04CE8620 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c745ce309cf11269f1a762ff56f75781758dc203346c547906256f9a28aef694
Instruction ID: 3e7fecf4e533c7688a9c5ea7990b158599a67026890637376dd258bef614c638
Opcode Fuzzy Hash: c745ce309cf11269f1a762ff56f75781758dc203346c547906256f9a28aef694
Instruction Fuzzy Hash: E841A934E01229CFCB15EF6AE940AADBBB6EF88314F144566E800E7354DF34A941CBA0

Function 04CE5837 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 411388c8eb44f06fa29260ffae13dff4aa5a4d5c612e422a59ed98ee4f4e2d04
Instruction ID: 08dfc979d1a737c86b31dc8ae5477711b8b968e84d11103e4f50cc70b838d06f
Opcode Fuzzy Hash: 411388c8eb44f06fa29260ffae13dff4aa5a4d5c612e422a59ed98ee4f4e2d04
Instruction Fuzzy Hash: 3F51C438A11204AFCB54DFA9D494DADBBB2FF49324B154498F9059B361DB31EC82CF50

Function 04CE4558 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12e2c2b404dd16afab33f47a03d516d773883dd9ec59047b54dc585f7a07c93
Instruction ID: b9a16ac34dafbad8132ba43c74820eb89eb30fb6f6208bdbc19b748d23efa3aa
Opcode Fuzzy Hash: d12e2c2b404dd16afab33f47a03d516d773883dd9ec59047b54dc585f7a07c93
Instruction Fuzzy Hash: AB512479A01208EFDB04DF95D594BAEBBB6FF88314F208069E905A7360CB31AE10CF54

Function 04CE3CD8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f42e60808ab8f506833b505386d56ff4f7ffb635aa84e343cf4d11b972f0e94
Instruction ID: d74a7cdb5f5f0d36f1cb03bdbe5f0700b2445d8470c861cdfb4ea4273ef5f2a9
Opcode Fuzzy Hash: 7f42e60808ab8f506833b505386d56ff4f7ffb635aa84e343cf4d11b972f0e94
Instruction Fuzzy Hash: 4741D734A002588FDB14EBA9C854BADB7B2FF49704F114065E905EB3A2DB39E901CBA0

Function 04CE70D9 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: accd6a46d7b62d1ef34b84c8491e894e1217ca781128ba1fd4383cd1bfe85b5d
Instruction ID: db18cad69974612db153c995687be0befea1b8d5e016d569d11bdfa6c67f79b0
Opcode Fuzzy Hash: accd6a46d7b62d1ef34b84c8491e894e1217ca781128ba1fd4383cd1bfe85b5d
Instruction Fuzzy Hash: C2418C71A0070ACFCB14EF79D4948AEBBB2FF85314B104569D50A9B352EB34AE06CBD1

Function 04CE3A48 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e390216c19e12f486af4389327b7f62d2f1115bf3fe7901b77df719bebea5646
Instruction ID: 24d95059ef792367b6ba62ba56db1ec85d344ba6a79dde6bbc6e4b05a54f0986
Opcode Fuzzy Hash: e390216c19e12f486af4389327b7f62d2f1115bf3fe7901b77df719bebea5646
Instruction Fuzzy Hash: B6417030A00244CFCB14EF68D995A9EB7F2EF48300F508468E40AAB366DF75BD45CB61

Function 04CE3A38 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98c1b621715122b5d73318c627968f31d177c9a2f33a08d9750fc8d6965ddfc
Instruction ID: 997d841438a7ca8380a2b150144c9cdd96865570294cd98ce4d06ac9518b3fff
Opcode Fuzzy Hash: b98c1b621715122b5d73318c627968f31d177c9a2f33a08d9750fc8d6965ddfc
Instruction Fuzzy Hash: F0418F30A00244CFC715EF68C595A9EB7F2EF49300F548468D40AAB3A6DB75AD44CB61

Function 04CE72C0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb06c3261e6f3c09f31104f5b1569d4f2e0b4766df006b5162cbd48d771c0a84
Instruction ID: efd4974514d931adb516c236791ec4d994f21f224b19870346f17a28cdc27e63
Opcode Fuzzy Hash: bb06c3261e6f3c09f31104f5b1569d4f2e0b4766df006b5162cbd48d771c0a84
Instruction Fuzzy Hash: 79416A30B01219CFDF58DBBAD9806ADB7F2AF48304F14453AE506E7391EB74A941CB90

Function 04CE7170 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c173fa0791d3598305f1bee32f4292c23c9cdd93e44b7eff0352a4bf7bc5e95
Instruction ID: c5b94be4ad746042a62e096457d8719007d072584aaef54caf3500d19862276e
Opcode Fuzzy Hash: 6c173fa0791d3598305f1bee32f4292c23c9cdd93e44b7eff0352a4bf7bc5e95
Instruction Fuzzy Hash: 7E418D74A0070ACFCB14DF69D4904AEBBB2FF85314750866DD40A9B352EB35EA07CB91

Function 04CEB150 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2971f18c8bd58c3bb59befb31f137cb4e1e1d8e5fa3fea19a90c0f26a9053d
Instruction ID: 04772b0e1bb6d745cc37c6a90d70df452d62ae0442e938eb8719a74acd06a6b4
Opcode Fuzzy Hash: ca2971f18c8bd58c3bb59befb31f137cb4e1e1d8e5fa3fea19a90c0f26a9053d
Instruction Fuzzy Hash: 90413030A10709CFCB14EF78C4549EDBBB6FF89304F008969E515AB325EB71A946CB41

Function 04CE4E74 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f5832e1dbcc5343db69b0771ddaa3506cbde093d408c2e886719a29d738bb2
Instruction ID: 64039e534efb71aa09541561e714409d3294c841838d81144a9bc3e7400df663
Opcode Fuzzy Hash: c9f5832e1dbcc5343db69b0771ddaa3506cbde093d408c2e886719a29d738bb2
Instruction Fuzzy Hash: 8B411F34A10709CFCB04EF68C5949EDBBB6FF89304F008959E515AB325EB71B946CB81

Function 04CE8DD9 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ccfccebf32f6a1ced91ea248a8d786b003a36520d8d285ee1ef8c035dceaaa
Instruction ID: cda74b72ad8aa7fc0e252dc9832c7e3c3ef30f55e8b31a7b811f15f8bfa2dcfb
Opcode Fuzzy Hash: 29ccfccebf32f6a1ced91ea248a8d786b003a36520d8d285ee1ef8c035dceaaa
Instruction Fuzzy Hash: 4441F875A0020ADFCB44DF69D88499AFBB6FF49314B14C699E918AB311E730E985CF90

Function 04CE64F4 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8f81ccb046b5036c4a61ce0ba11e10f4c8fb176d810e962d506e2de81bff1c
Instruction ID: 02ca7e0a70274ea065e66e03a811cd67ec294579cd7e0dade2b2f8d0b4de9b26
Opcode Fuzzy Hash: 0b8f81ccb046b5036c4a61ce0ba11e10f4c8fb176d810e962d506e2de81bff1c
Instruction Fuzzy Hash: A931B531E01200CBEB44EF2AD88476577B6FF98314F098A79D949AB24AEF31B554DB60

Function 04CEB057 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e437dd8efbd1e6323c7ae5f8db399366702065d537877bdcb9241ee43aadc8
Instruction ID: b5c43220cc1d8b69e80e8eebe60cf9e4fde761fecc0028d23907e047a2280c13
Opcode Fuzzy Hash: c7e437dd8efbd1e6323c7ae5f8db399366702065d537877bdcb9241ee43aadc8
Instruction Fuzzy Hash: 4A319131B012199FCF04EF65D8548EDF7B6FF89224B058669E516AB320EB31BD46CB80

Function 04CE8DE8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19390c8a6d26f4181af4bea0cf786c952c78154296b81120fe38be651bd28f42
Instruction ID: 752e46ec4e9aa16e088a97dc1a57c49b99f95652d0f759124d23a4ff2850da6f
Opcode Fuzzy Hash: 19390c8a6d26f4181af4bea0cf786c952c78154296b81120fe38be651bd28f42
Instruction Fuzzy Hash: EB41F775A0020ADFCB40DF69D88499EFBB5FF89310B14C699E918AB311E730E985CF90

Function 04CE581F Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069d2d563e6e007dbc98e38e257442b6f9f03f140deae0233584a44d1495b987
Instruction ID: f2922f39c3fbbddd750c3287a68c5cf32c1cdf6db6b6d81caa54e67fbc4c5d2c
Opcode Fuzzy Hash: 069d2d563e6e007dbc98e38e257442b6f9f03f140deae0233584a44d1495b987
Instruction Fuzzy Hash: 22318138A51204AFCB04DFA9D894DADBBB2FF49714B154099F9069B361DB31ED82CB50

Function 04CE72B1 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296101071cd4fc901e77fdd0d281ded5b01ece540b4d5d5c83c532240ee1a56d
Instruction ID: bd67e61f45b5ae33bf8841a2a920070eafd5377abe470203e25008fd1d59e39c
Opcode Fuzzy Hash: 296101071cd4fc901e77fdd0d281ded5b01ece540b4d5d5c83c532240ee1a56d
Instruction Fuzzy Hash: D031AD31B01209CFDB54DFBAD8846ADBBB2AF49304F14447AE505E7351EB74A941CB41

Function 04CE9364 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6a8854963da5fd61b88c850818869f25fe9bac12e3196cb51ba93785a914e9
Instruction ID: 7d388b7f558e02074d7759948ed4c93f7eb9c4de6ffcce855d7bc8b5e0f8c91c
Opcode Fuzzy Hash: 5b6a8854963da5fd61b88c850818869f25fe9bac12e3196cb51ba93785a914e9
Instruction Fuzzy Hash: E62196323502008FD7149B2EC884ABD7BE6EF85711B1984B5E10ACF3A6DB76EC058B50

Function 04CE5CF6 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 605859903c5900fb4878c44c0a649f7c1959872889557e193348cf18b4f9d28c
Instruction ID: b99961bb7fe06d99af5b9c191227bb7e6eb6753d86f4252018bc67f4a0870fd9
Opcode Fuzzy Hash: 605859903c5900fb4878c44c0a649f7c1959872889557e193348cf18b4f9d28c
Instruction Fuzzy Hash: D33118347142549FDB10DFAAC998AAD7BF6BF49708F5400A9E505DB2A2DB71EE40CB20

Function 04CE77EF Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d4c0f22e4fc84856e5565376576e107479caa925ec294bc02a62d5605d94d1
Instruction ID: bb8b72b06ab7da993e48bb3af15c70a5c5e2d3cdeb8b2379e30ea66c616d2701
Opcode Fuzzy Hash: 17d4c0f22e4fc84856e5565376576e107479caa925ec294bc02a62d5605d94d1
Instruction Fuzzy Hash: 3231B231E013008BEB40EF6AD84476577B6FF98314F498A79D94D6B20AEF31B564DB60

Function 04CE4548 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e68299515bec96a7ced5d44c6f1c46279d8ab4b9f026c1100d6c357393ea983
Instruction ID: 8ea9f783df475f919be3e0057b72652b0458f87e81bb2e08cdcd66dad4aa1a1a
Opcode Fuzzy Hash: 4e68299515bec96a7ced5d44c6f1c46279d8ab4b9f026c1100d6c357393ea983
Instruction Fuzzy Hash: E7311674A01208EFDB14CFA5D594BAEBBB6AF48710F158069E905A7751C771AD00CF58

Function 04CE2AC2 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3861fd6e3b584d6a211651be2f7697ff40eceb6d3d7ab8f555287a492a35dd1e
Instruction ID: e47f1dcb153887a354e83bffacc950d96bd1bb6c26a0c2cd13584f0fac914b2c
Opcode Fuzzy Hash: 3861fd6e3b584d6a211651be2f7697ff40eceb6d3d7ab8f555287a492a35dd1e
Instruction Fuzzy Hash: 29312432D10B49DECB01EF78C8544D9FBB1FF95300B119A9AE5596B122EB30E6D5CB80

Function 04CE6FC9 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c525526da26c4951759ae41975dacd507076d7539cb85f2f21b51b84819aa45
Instruction ID: 4d6aed0cfa9d9a8411338d149cea312d093d53f74bb7f5ca55bb170dae286f5f
Opcode Fuzzy Hash: 2c525526da26c4951759ae41975dacd507076d7539cb85f2f21b51b84819aa45
Instruction Fuzzy Hash: 4C217C303012008FDB24DB7DC854A6977EAEF85714B1484AEE506CB7A2DB76EC02CB51

Function 0078D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2222464934.000000000078D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0078D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_78d000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a425f19abb0c57fe7f82abdd29027e8fbd75c843e5cfa3db3eb753eb2eb414
Instruction ID: 7c7ef438dc7270f204f499d8fa2c5e26ddf9b6d8ead51fc93db254103ba7302d
Opcode Fuzzy Hash: 99a425f19abb0c57fe7f82abdd29027e8fbd75c843e5cfa3db3eb753eb2eb414
Instruction Fuzzy Hash: 332102B1180244DFDB25EF54D980B16BF65FB98324F20C169DD090A296C33AEC06C7A2

Function 0078D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2222464934.000000000078D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0078D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_78d000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d95c880defb40fed57fe03a07a9d38e6927b2fd5107aa57c60647ff9c302364
Instruction ID: c0d13e423bc514df827ee1d7c4cc71c3ba1eadd297dc76eb8b65d7f3ffa65750
Opcode Fuzzy Hash: 2d95c880defb40fed57fe03a07a9d38e6927b2fd5107aa57c60647ff9c302364
Instruction Fuzzy Hash: 85212871580240DFCB25EF14D9C0F26BF65FB98318F20C56AE9090B296C33ADC26D7A1

Function 04CE2AD0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b82f5cb14c87e41eb80b35800c18be4eb36804df29654341dc907d51bceced
Instruction ID: b589effdc4c022045dd3e59d0da42cf9ab18dfaf67c4de072b3f98b64b9adf53
Opcode Fuzzy Hash: 89b82f5cb14c87e41eb80b35800c18be4eb36804df29654341dc907d51bceced
Instruction Fuzzy Hash: BC31FE32D10B0ADACB01EFA8C854899F7B5FF95300B119A5AE95967221FB30E6D5CB80

Function 04CE6FD8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d991bd98fd18acfc1fbb284fd17fd6e92a7fff09e9b23c5aa34e1f1ce497ac9e
Instruction ID: 9d86334ab872321f3d07de48c7e338eb20bab56eb7a686e51327749231a25d2d
Opcode Fuzzy Hash: d991bd98fd18acfc1fbb284fd17fd6e92a7fff09e9b23c5aa34e1f1ce497ac9e
Instruction Fuzzy Hash: F0212C303012009FDB58DB7AC854A2A73EAEF85714B5484A9E506CB3A5DB76EC06CB51

Function 0079D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2222539598.000000000079D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0079D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_79d000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a45e4a93a759cdf9046e6160360d19f3ba88c5be9fbff02a82fbc02341e79b3
Instruction ID: 4a673376336fb3c2b63f64a6950d33490b15aa6a2c72dd702d52bafd7f289807
Opcode Fuzzy Hash: 6a45e4a93a759cdf9046e6160360d19f3ba88c5be9fbff02a82fbc02341e79b3
Instruction Fuzzy Hash: 0221D071604204DFDF24DF28E984B26BB65FB88314F20C569D94A4B296C33EDC06CA61

Function 0079D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2222539598.000000000079D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0079D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_79d000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04d1bde2092f3cbc23f4d3575ed4c132855c2e903cb000604774105393bcf09e
Instruction ID: ee5a4d1fa63092061c138379113b87f849d2effb809583e952c60018b25f45e0
Opcode Fuzzy Hash: 04d1bde2092f3cbc23f4d3575ed4c132855c2e903cb000604774105393bcf09e
Instruction Fuzzy Hash: 2A21F271504204EFDF25DF64E9C0B26BBA5FB88314F20C56DE9094B296C33EDC06CA61

Function 04CEE050 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca38d1fc0ee0c10fe6efc513bf34024cf86126671653f36e3c14a6bc02afd701
Instruction ID: c7fa8de6e5ffbba39b8ef5a29cc7eb06838386c93ae5061c339e25d535f9e83c
Opcode Fuzzy Hash: ca38d1fc0ee0c10fe6efc513bf34024cf86126671653f36e3c14a6bc02afd701
Instruction Fuzzy Hash: A4214235E106099FCB10EF6DD84099DFBB5FF49350B50C26AE958A7204FB31EA98CB91

Function 04CE6D00 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab1a16b4828cd650ee08fb2cd69dcabbe8f861950f4862600a38da56b70f984
Instruction ID: d2eebc54831b79e275841b32f8807402a9bec946978a936fb7933dda119353b7
Opcode Fuzzy Hash: bab1a16b4828cd650ee08fb2cd69dcabbe8f861950f4862600a38da56b70f984
Instruction Fuzzy Hash: 0411C031F107168BDB10AEAAC8412BEB7B2EBD4710F84852AD505A7345EB38EA018BD1

Function 04CE7708 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 805dad5317143ef9e74d323e6e40a48c0708d3057ae549b0ff884745b451e0ba
Instruction ID: 6ae2cdd9176304093ac00094e873a3d309cf58ddb735208d8c2620e30731d6aa
Opcode Fuzzy Hash: 805dad5317143ef9e74d323e6e40a48c0708d3057ae549b0ff884745b451e0ba
Instruction Fuzzy Hash: 6621F030601705CFCB65EB35C440ABAB7B7EF91204F0088ADC04A4B276CF34E88ACB81

Function 04CE6CFE Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11a9be513955f29bd97e4aef44abcde457d8c670fe6335ab678544dc76166f4
Instruction ID: 2948b1fecd4cffbfe80a690588c5980877c8ac7d33bdfba6ed42592ad8e7cc42
Opcode Fuzzy Hash: c11a9be513955f29bd97e4aef44abcde457d8c670fe6335ab678544dc76166f4
Instruction Fuzzy Hash: 3E11A031F106168BDB209EAA88412BFB7B3EBD4710F94853AD515E7745DB38EA028BD1

Function 04CE64C4 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df61934e420ec260d5b0cb954fa739a3621dfdba6768a8846c8ee4027b73a33
Instruction ID: 07d45a897ce688a9e1b8f1cbfa7be16ea13bf0fe5a54343866b06a79c49e1175
Opcode Fuzzy Hash: 6df61934e420ec260d5b0cb954fa739a3621dfdba6768a8846c8ee4027b73a33
Instruction Fuzzy Hash: 0B215931611705CFCB69EB39C440ABAB3A7EF95215F4088ADD05A1B264DF35E88ADB81

Function 04CEB741 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e65d90f09bce8197b7f0400b96e681f94af05ea31209fd33943fcc5bedd776
Instruction ID: ec0c7adb1e2ee79cdfd2a46a0a65d3ef947b71c8845082ac1dcc315a3ffd92cd
Opcode Fuzzy Hash: c8e65d90f09bce8197b7f0400b96e681f94af05ea31209fd33943fcc5bedd776
Instruction Fuzzy Hash: FC1129356057858FCB13AB3688105FDBF76EF82211B1905DFD5849B252EB30B946C7E1

Function 04CE9F18 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1197f9059f048347ac9d6b8960e326253f8c6f24a0141dc9d1eca81948fc5d3
Instruction ID: 67ad1b5430bee81af2de0c8fe36403f7be8937e0bd5d74d8a0e51fd86f440911
Opcode Fuzzy Hash: e1197f9059f048347ac9d6b8960e326253f8c6f24a0141dc9d1eca81948fc5d3
Instruction Fuzzy Hash: A911C2333042014FD7149A2ECC857A97BA7EF8A314B1D80B6E00ACB3A6DA79ED058790

Function 04CE21CF Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da235a6a512ec71ab654d77bd758bfd16039b42c24c8aac4a86ff36c7b33d1db
Instruction ID: 321a517b907e853b34a619b9aa6a6902370290301fb32c0a4011514165c4a82b
Opcode Fuzzy Hash: da235a6a512ec71ab654d77bd758bfd16039b42c24c8aac4a86ff36c7b33d1db
Instruction Fuzzy Hash: 1011EF303003504FDB19AB39D4617AA3B66AF84714F148699E0058F2E7CFB6A907C795

Function 0078D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2222464934.000000000078D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0078D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_78d000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 39b3edabe0e0b0beab562420ff8caddf4fab9632bf27aa5b27049f397c49671e
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 62112672444280CFCB12DF10D5C4B16BF72FB98314F24C6AAD8490B656C33AD86ACBA2

Function 0078D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2222464934.000000000078D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0078D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_78d000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 7baab576fd7e07277a02500283b88c84edcdbfe640753c10657ca12148a67a8a
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: D6112672444280DFCB12DF00D5C4B16BF72FB94324F24C6A9DD090B256C33AE85ACBA2

Function 04CE5EE8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750c2ff681dce797e702062ea2c412ff827caa4969b1243f889c009fe2db928f
Instruction ID: c0dcd0d56dbacffd08f228bd43c50545f7fc75941340432e19f2207658fc9d84
Opcode Fuzzy Hash: 750c2ff681dce797e702062ea2c412ff827caa4969b1243f889c009fe2db928f
Instruction Fuzzy Hash: AD11E071E0060A9FCF15EFA8C8566FEBBB2EF88300F048029E405D7280DB746A16CBC1

Function 04CEAD10 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db7f61e58626aa32e0aec63deaea9c5a38468a4b07d30e5e0489edf84d62c0a
Instruction ID: 933126b04bb95a90cccf402d08f9f944dc65e0d1935558cb14368d0611d77e24
Opcode Fuzzy Hash: 4db7f61e58626aa32e0aec63deaea9c5a38468a4b07d30e5e0489edf84d62c0a
Instruction Fuzzy Hash: 2511C0357046048FCB15CB2AD8849A9BBB7FF89715B1544AAE406D7362DB75FC01CB80

Function 0079D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2222539598.000000000079D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0079D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_79d000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 80372a691ac8fa45f8683fbe80a56fd78580c2253eaa02ac2c475a3c95a8cc38
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: D5118B75504280DFDB16CF14D5C4B15BBA1FB84324F24C6A9D8494B696C33AD84ACB62

Function 0079D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2222539598.000000000079D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0079D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_79d000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 40406bd16864f7b2116ff5ba91b20174b4dcf420f584a1078ff3f30cc1ea0a21
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 39119075504284DFDB15CF18E5C4B15FF61FB48314F24C6A9D8494B656C33AD84ACB62

Function 04CE5EF8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d48e3acca6cf1dbf1c6bd16c0e202087e8e001b8755df08d75a9c1a92105a3
Instruction ID: b57ef9986a22670404f998c78f1650fd7334fd9912f732be21182a4f12a34303
Opcode Fuzzy Hash: 31d48e3acca6cf1dbf1c6bd16c0e202087e8e001b8755df08d75a9c1a92105a3
Instruction Fuzzy Hash: 1701AD31F0060A9BCF14EF99C8456BEBBB2EF88310F048029E509E3380DB746A01CBD5

Function 04CE0BC8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a87f2a862c080e9dd3c9d038d60253caeefbea14739fb11941b4979554320be
Instruction ID: adcf3ffd0d260542694b0d1bec4eb5c55783730b0c72cecc059ed8957a1d6f02
Opcode Fuzzy Hash: 0a87f2a862c080e9dd3c9d038d60253caeefbea14739fb11941b4979554320be
Instruction Fuzzy Hash: 821122B59002098FDB20DF9AD585BDEFBF9EB58324F20845AD518A7340C379A544CFA1

Function 04CE02E4 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 052f29c61ecb6cbdd7fd47ed0e27ce5f6e3ddd55b078ef979e9c6b02c2d1ded1
Instruction ID: 5f34a6284923c7b65e94d427d376b03dcb7dd2fac3a57ef300a998cc63e5b616
Opcode Fuzzy Hash: 052f29c61ecb6cbdd7fd47ed0e27ce5f6e3ddd55b078ef979e9c6b02c2d1ded1
Instruction Fuzzy Hash: 271133B19006088FDB20DF9AD548BAEFBF4FB48324F10845AD518B7340D378A944CFA5

Function 04CE0290 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fad8625267c64fc27eb09eb23c8fe0c471f6e7f35b36e2b36f73138d12dd1d3
Instruction ID: 5c88140ac95f816bb041f5ba2076c78a2c391aa1f7113b556b365dfd38751d17
Opcode Fuzzy Hash: 9fad8625267c64fc27eb09eb23c8fe0c471f6e7f35b36e2b36f73138d12dd1d3
Instruction Fuzzy Hash: FB1133B19002088FDB20DF9AD548BAEFBF4FB48324F10845AD518B7340D378A944CFA5

Function 04CEAD1F Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c292360f9983abec720f7d4fb37868130c6a350c5468b104d5601535085b9032
Instruction ID: a653e97068dab4e70b010f01264f8551f4b6a5bec6cc0049ce62991b35b17c34
Opcode Fuzzy Hash: c292360f9983abec720f7d4fb37868130c6a350c5468b104d5601535085b9032
Instruction Fuzzy Hash: 06017C357006048FCB14DB66D4849A9BBB6FF88725B1084B9E41AD7361DB35AC01CB40

Function 04CEB398 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29b4bf35fb6867c0c9ac473719578ccfac675af8d191d125a300bbc70686e70
Instruction ID: f93d974a60a7daf915654cbc731f390ef0c87079f56f02759cc8eeb5d005515b
Opcode Fuzzy Hash: c29b4bf35fb6867c0c9ac473719578ccfac675af8d191d125a300bbc70686e70
Instruction Fuzzy Hash: D5012931600709CFD728EF3AC4414AA7BB6EF85304B50866EE5469B260EF30F941DB40

Function 04CE9D68 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92289892c775d9b62bc9273a4774e29080ee7b50441b6de68036890c28917905
Instruction ID: c44e174375d84b5a5b4ae4572064ed0f9af2b15bb383c54581bf19a1329c7f11
Opcode Fuzzy Hash: 92289892c775d9b62bc9273a4774e29080ee7b50441b6de68036890c28917905
Instruction Fuzzy Hash: CCF022B13006604BDB19A737D41897D77A78FC5614705402AD409CB3E2CF39EA03C351

Function 04CE6C60 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7df710a48921052ca67593499ddc94474558f872d0ebbfcf3ab1210081fc2e5
Instruction ID: bf153e80dffc40894d7b938ff48354e4f54cef447a390a0bb8478775ece413c2
Opcode Fuzzy Hash: a7df710a48921052ca67593499ddc94474558f872d0ebbfcf3ab1210081fc2e5
Instruction Fuzzy Hash: E70181353502408FCB50CB2AD858A6977EAEFCDA1171980ABE60ACB371CF60EC05C7A1

Function 04CEB7D9 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fcb3c550afa6d4fa85dc8dbbcc669b799f23f7d05031c64d41115e95e36e27
Instruction ID: e9cb00dddf79d08cb56798912096ff1d80d2f0921737bafb3bb6836ba47ecbcd
Opcode Fuzzy Hash: 41fcb3c550afa6d4fa85dc8dbbcc669b799f23f7d05031c64d41115e95e36e27
Instruction Fuzzy Hash: 1B01A9366007408FC7259F2AE484A6AB7B6EF89315B11055EE00987763EF35FC46C7A1

Function 04CE9E00 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab8e8fd4fd66f2e490b9bfb45ab4b079ff53b2da7aab7dc0ccdd4b7f264025a
Instruction ID: acab93db1f7e210b43e6c59828e00ea9f5d3c9911b11f9a34b5ceaade21b9412
Opcode Fuzzy Hash: 3ab8e8fd4fd66f2e490b9bfb45ab4b079ff53b2da7aab7dc0ccdd4b7f264025a
Instruction Fuzzy Hash: F9F0F6B23042108FDB345A238454ABF3BAA5F85A56709406AD11AC7292DF74ED06D7D1

Function 04CE9344 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5193adcf9f874d33203214d1cf4f8880e96e7ee6fa14c0ea3ab3013d98e0b01d
Instruction ID: 2fc4ddb2f3c238fa88a57dbc3fba2b511e0006c273ba01900d73e65472a66917
Opcode Fuzzy Hash: 5193adcf9f874d33203214d1cf4f8880e96e7ee6fa14c0ea3ab3013d98e0b01d
Instruction Fuzzy Hash: FEF0E9713041118BD7289A2BC444A3F32EF9FC4F11709442AE60AC3260DF31FD05D691

Function 04CE8D39 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825f475a3248218a99c378efc6bdcb18ddcb466ffde2dd7bbbaebadc3d290a1a
Instruction ID: 2d6c61a23eb7bc3edae9fdc9febfe32cf0389a39f1ac287b90cb846ffbd223b2
Opcode Fuzzy Hash: 825f475a3248218a99c378efc6bdcb18ddcb466ffde2dd7bbbaebadc3d290a1a
Instruction Fuzzy Hash: 5B011275D00609DFCB40EFA8C5858EDBBF0EF49300B1186AAE458EB322E7309A45CF81

Function 04CE21E0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6ae81bed7abc492619075df1fc150646af490c49ceebdfce621fd38ac751d5
Instruction ID: 61cfd8f1af90969c0cc25e4ecc896bf9e122dfd1c2531acfa9e7dc40db12d62d
Opcode Fuzzy Hash: aa6ae81bed7abc492619075df1fc150646af490c49ceebdfce621fd38ac751d5
Instruction Fuzzy Hash: 5DF090343407204BE6186A7A841577F339BAF88F24F044458E8068B3D3CFB5BD5283EA

Function 04CEB397 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4650c3c0eb5a27f96da14cb0336add572a25958415404ad436b3d7846c91545
Instruction ID: b8ab224e8d866a71fc5eb5ed05c31d856a4a51a45fdd7d3bcf8a97daeb9bfa56
Opcode Fuzzy Hash: e4650c3c0eb5a27f96da14cb0336add572a25958415404ad436b3d7846c91545
Instruction Fuzzy Hash: FA014B30601705CFD324EF7AC4415BA7BB6EF85304B50866EE5469B260EF30F942CB40

Function 04CEBF68 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1528d826dbda26079f0c8d8491bab1074e108b49df33cfc2aebe61db19e0ed
Instruction ID: ce566b45aec43d1bd05a50e9c3a429573094c9029b330f58a23c9554903c05ea
Opcode Fuzzy Hash: de1528d826dbda26079f0c8d8491bab1074e108b49df33cfc2aebe61db19e0ed
Instruction Fuzzy Hash: 53F0F6353043018FCB15AB6AF8449697BBEDF81354300046AE10587266DFA8FD0A8BD4

Function 04CEB768 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30bb783d35b72997b6488cb551c16accd98694cf220a5bc40158995bc5046a1
Instruction ID: e900a143bed06f28a8f31e87f82dcf012db038d0c70d9604a4773d7e16e45753
Opcode Fuzzy Hash: a30bb783d35b72997b6488cb551c16accd98694cf220a5bc40158995bc5046a1
Instruction Fuzzy Hash: FDF06235A017058BDB15BB7984044FEBB76EFC5625F054A6DD94567200EF30BA81CBD1

Function 04CEBF78 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4a76a616a4c3cfa1759ae44fb76ae71c1f86ad275238ee43f7bbcb01afca0a
Instruction ID: 22e70608d39099388f0911faa4a0241a1b3eeb8a1a1cf9768326b6b0346c7102
Opcode Fuzzy Hash: 4e4a76a616a4c3cfa1759ae44fb76ae71c1f86ad275238ee43f7bbcb01afca0a
Instruction Fuzzy Hash: B1F054363406154F9614AA6EF84496AB7AEEFC4265300453AE109C7225DF79ED0A8790

Function 04CE9D78 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e0350be9f6178349228daa996187f6b8cc68f3ab3f098cfe0f1e04436a12a2
Instruction ID: 3448588d5b076e53025e4f21b5688f6b5a06b537287d3036cc2c14e55f7a9d7c
Opcode Fuzzy Hash: 84e0350be9f6178349228daa996187f6b8cc68f3ab3f098cfe0f1e04436a12a2
Instruction Fuzzy Hash: C3F082713105204B9B19AB3BD01867D72D79FC5A54B144039D409CB3E4CF75EE03D795

Function 04CE02CF Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d699df29737e9ce93deebcc92fbd2ba115b2c7234ae50d4353bd2303eff739
Instruction ID: 49c2e0c87ed8cac85e7405364db0071e88b200d945eb7dee2c76ae065f4c71de
Opcode Fuzzy Hash: e9d699df29737e9ce93deebcc92fbd2ba115b2c7234ae50d4353bd2303eff739
Instruction Fuzzy Hash: 2CF04FB0E0421ADFCB10DFAAD945ABEBFF5EB08300F04856AD505E7241E774A6018FE2

Function 04CE02D4 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97548c801309f0fdc454a0ddc915bb17fec36cc77bdac29ffec5bf34fadee742
Instruction ID: 6771d058ba415145f2d19b849666864546444c598fc627185400a9023257cd3f
Opcode Fuzzy Hash: 97548c801309f0fdc454a0ddc915bb17fec36cc77bdac29ffec5bf34fadee742
Instruction Fuzzy Hash: 13F0F9B0E4421A9FDB54DFAAD945A7FBFF5EB48300F00856AA509E3200E774E5148BD1

Function 04CE8D48 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction ID: 4243ceffdd30f352615e2fe6667d750750fc4abca0ae9b7f9b7c733986b7bd1f
Opcode Fuzzy Hash: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction Fuzzy Hash: 0601B675D00609DFCB40EFACC54589DBBF4FF49210B1185AAE859EB321E770AA44CF91

Function 04CE473C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9ba3c4ad14a504e41d651fed72630f51ccd4ddc369bad47d0c79cb50e4d25c
Instruction ID: 0363028ae1422441c5fe0dcfd1f3571016a9bd2f3b72b6832f9a105a7f75ee2f
Opcode Fuzzy Hash: bd9ba3c4ad14a504e41d651fed72630f51ccd4ddc369bad47d0c79cb50e4d25c
Instruction Fuzzy Hash: 3AF0EC37A09048EFDB018F81EC50AED7B32FB58305F084096E642A61A1D772AA25EB51

Function 04CE0EE0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb5c866c33cbc60889a79c33eab35be8799cb11cef16423cfbe8470a24fd757
Instruction ID: 62457be032f0fd419042eb5950ac8a3f2de7ee7081975705131ebe164b1d8271
Opcode Fuzzy Hash: 7bb5c866c33cbc60889a79c33eab35be8799cb11cef16423cfbe8470a24fd757
Instruction Fuzzy Hash: E5F037B0E0020B9FDB44DFAAD546AAEBFF0EB48300F1080AAD114EB240D370A641CF91

Function 04CE6890 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3538dc35b5ebb53cb84a3c034a36ceb67e8e61ef2b65bae0d298a1092c475a74
Instruction ID: 662b05f111f01a37ba8d8cf0c7e197f03d55d54cf9d15c5eb018cf0652a19a47
Opcode Fuzzy Hash: 3538dc35b5ebb53cb84a3c034a36ceb67e8e61ef2b65bae0d298a1092c475a74
Instruction Fuzzy Hash: EAE06D71B40B244B9708FBAEA40086AB6DBEFC8610358C06AE40D87669ED30990287A4

Function 04CEBFDF Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c542c2ce7a3576c91dccf0d950f8721e1e74516feb292d66a5e6dc67515eeb
Instruction ID: 017e0e1a2368c98d6666d61279fe1255ea3263cbb4ad2a39b1687b0b30e44e5b
Opcode Fuzzy Hash: e2c542c2ce7a3576c91dccf0d950f8721e1e74516feb292d66a5e6dc67515eeb
Instruction Fuzzy Hash: BBF0DF35240610CFC718DB28E588D59BBE6EF4AB1971285A9E50ACB332CB72EC45CB80

Function 04CE9D30 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d148d3dfbbfe437b3b5b06af067bbdaaa08061a73e9d04ef1d0fff5fe8a9e2
Instruction ID: aaab3f384de76fbf29359a934edf9c5d4125e44d56703d7725d2b111f45db7fc
Opcode Fuzzy Hash: 38d148d3dfbbfe437b3b5b06af067bbdaaa08061a73e9d04ef1d0fff5fe8a9e2
Instruction Fuzzy Hash: A0E0D8717087108FCB19CB1CE4409A577F69F4930132545E6F404C7775D620ED098781

Function 04CE6880 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b55c728aaae3b2948620f4907766cd1afc74f5b72bc5afd29f2c6969e8a7851
Instruction ID: d1bcc197dbb35660b06e47a97964ba13e5a2534bcfcc8c1e0be09e6c65bdd9b9
Opcode Fuzzy Hash: 7b55c728aaae3b2948620f4907766cd1afc74f5b72bc5afd29f2c6969e8a7851
Instruction Fuzzy Hash: 71E0D8717047510FD7259A79A8518ABBFE6AEC521030881ABD4498B54ADA715D02CB90

Function 04CE6534 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fcf5733ea92b4131095f3da8158ac38de93627350999035bfb51d4aa8c1f319
Instruction ID: c537d36b559979138690c3928c1b75c348c7b5476bb475b772193df317189f7a
Opcode Fuzzy Hash: 3fcf5733ea92b4131095f3da8158ac38de93627350999035bfb51d4aa8c1f319
Instruction Fuzzy Hash: 0DE08C303507249F8328DA1EE880DAAB7EEEF883103148969F109C7220DA60FD088684

Function 04CE70A1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b4e1bf2d17b02f0aaf1b59f03435484da560cb443de8fe4fd3c3cbc490f2cd
Instruction ID: c945982953eb8e9cfe5b3a6f7abf835f9ad208d75f59fdb9731a60da42f3ce9a
Opcode Fuzzy Hash: 53b4e1bf2d17b02f0aaf1b59f03435484da560cb443de8fe4fd3c3cbc490f2cd
Instruction Fuzzy Hash: F4E02BBA7200108FC7014B14E8D98D93FF4DB196203014052F809C7322EA34CD0387D5

Function 04CE4710 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0b3818c2a579436476e5e4424ada21511f48947451a73d30c8a38d41b8ac3f
Instruction ID: bfafa08200c796e6a83c8dc244da6b2373934fcacf5df6746cac89cd9a647701
Opcode Fuzzy Hash: 8c0b3818c2a579436476e5e4424ada21511f48947451a73d30c8a38d41b8ac3f
Instruction Fuzzy Hash: ADD0C731304224475B193BB5791457E779D9BC66AA300047AF50EC3750DF6A995146CD

Function 04CE46F3 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3a1c3708ef8c502f9c2f90f914b2ce06bf2be3d3cc918bb9c5902af0376951
Instruction ID: ba80b657ad03256e462bffb128602b6f7ba3c935f6735999d80ecec3a05db30b
Opcode Fuzzy Hash: 6b3a1c3708ef8c502f9c2f90f914b2ce06bf2be3d3cc918bb9c5902af0376951
Instruction Fuzzy Hash: 23E0123AA01009EBDF00DF80E940BEEBB72FB88325F208011EB0126290C7325A25EB91

Function 04CE4518 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b0259c3fbe4146b80680fea3e938b8fd7f816f3e926e895a96841af0e4e2f3
Instruction ID: b9d422407c8218691c3e2f34b12875e867900797c2e8ad88283257ca09c36067
Opcode Fuzzy Hash: 10b0259c3fbe4146b80680fea3e938b8fd7f816f3e926e895a96841af0e4e2f3
Instruction Fuzzy Hash: 41E04F71044188AFDB02CF64D855DD97F75EF5A310B0640D5F9848B532C332C822DF10

Function 04CE0EB0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4550ec9df01866e8fae012b70e7bc0cfac9238d34c2c62faa15eacb4afaaac
Instruction ID: 205c0232e3f2502e967213a503a866b1b0c9d7fe3f8af5004d49c731387a0d7c
Opcode Fuzzy Hash: ee4550ec9df01866e8fae012b70e7bc0cfac9238d34c2c62faa15eacb4afaaac
Instruction Fuzzy Hash: 2CD0A922A0C62407E606208A94106E936CF8B89928F150076910EC7382C8A6EC8203E6

Function 04CE70B0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea0c2618be7c8f0d1d19d24f8629ab66ebc8090c0cd010befcc5bfe5a751bc1b
Instruction ID: 0b15973c16edc32707917f5547983a42268c0780edf2ceb0ae5f5fac1a655851
Opcode Fuzzy Hash: ea0c2618be7c8f0d1d19d24f8629ab66ebc8090c0cd010befcc5bfe5a751bc1b
Instruction Fuzzy Hash: 1FD0C93A3105249F87049B69E508CA97BE9EB4DA613118066F909C7321CA75DC109BD4

Function 04CE470A Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01599835fa58967f8b09cadb13b17ac92dcbaae8704751f71a93e84655e79434
Instruction ID: 045fbfd3182d6a976fdb512ee357f4b6d11d5aa6b32fdc71c3ad547825979dd1
Opcode Fuzzy Hash: 01599835fa58967f8b09cadb13b17ac92dcbaae8704751f71a93e84655e79434
Instruction Fuzzy Hash: 84C08031314511171B145DA5690197677AC9A462D57000076E50DCA522EB55C95041CD

Function 04CE4528 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63055a45eeb4ae8ae8d6e3381b45a0748b663f32349da8a3f0a884f24e2bbca
Instruction ID: 103967bf13f508402a192ef6221732069224ae084a114efb1bafc53f37aadea3
Opcode Fuzzy Hash: c63055a45eeb4ae8ae8d6e3381b45a0748b663f32349da8a3f0a884f24e2bbca
Instruction Fuzzy Hash: BCD0C93614010CEFCB01CF95D844D9A3BBAFF48720F008054FA084B232C332E821EB90

Function 04CE0EC0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a80fb2336f93d22091b3a00fb61c5f2b78bb126e687796b5a83692a7aa837b
Instruction ID: d12f706fe950f9f3fe5a74806d497847262f24e3a899a609597308e3ff69d731
Opcode Fuzzy Hash: 64a80fb2336f93d22091b3a00fb61c5f2b78bb126e687796b5a83692a7aa837b
Instruction Fuzzy Hash: F2B09B2171413913DA0871DE64106FD72CF8785564F000067951D977415DD59C4143DB

Function 04CE6071 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f71cb1a12df7ec2863ff34caa80562de7472e4791add59532d01511611f41f4b
Instruction ID: a20381450c0844722d876f014d0792d7393b02f0c88038609f3b19b736070a49
Opcode Fuzzy Hash: f71cb1a12df7ec2863ff34caa80562de7472e4791add59532d01511611f41f4b
Instruction Fuzzy Hash: F5C080779646034FF303DE20CD632C07BE4AF5B18078850B3C441CD495E219510D4640

Function 04CE4F60 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a82f300909b807b5bf726ed0bea1e5dbde4a89551248bb76a2d0f8881d56f0f
Instruction ID: 1271798f21d6e1e0a87e1eae287d21cc07c2e035b40280f0c4ea0aca6560d516
Opcode Fuzzy Hash: 0a82f300909b807b5bf726ed0bea1e5dbde4a89551248bb76a2d0f8881d56f0f
Instruction Fuzzy Hash: FFC08C09504A824EE30B923118C08802FE59CCB02078A42F280008B053C16C21465242

Function 04CE46EA Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc304a26ba6a9b8e09db51e88682a954301326f375d2764bec1dfa900b44145
Instruction ID: 9de7ac702d921bb81b30492041e851d75af5e0b5cbf34299d5a2708bb28df354
Opcode Fuzzy Hash: 8fc304a26ba6a9b8e09db51e88682a954301326f375d2764bec1dfa900b44145
Instruction Fuzzy Hash: 1EB0923BA04018C9DB008A86B4417EEF764E780265F104023C2115204193721264AAD1

Function 04CE4A88 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f511607e790221a2f2dcd6e97a8bb3a0d65d62d392e8c090948622415da908e
Instruction ID: 0dfc2720777f63421202845d4fb21847554f92407c627dcfcd9209a5c78d8f7b
Opcode Fuzzy Hash: 3f511607e790221a2f2dcd6e97a8bb3a0d65d62d392e8c090948622415da908e
Instruction Fuzzy Hash: 2FB01254A6410101710CF1371C9843600179EC07047C4FC641200940088A1CF004300D

Non-executed Functions

Function 04CE7C51 Relevance: 41.7, Strings: 33, Instructions: 453COMMON

Download Yara Rule

Strings

4']q, xrefs: 04CE7E04
4']q, xrefs: 04CE8207
4']q, xrefs: 04CE8023
4']q, xrefs: 04CE8183
4']q, xrefs: 04CE7D9B
4']q, xrefs: 04CE80D3
4']q, xrefs: 04CE7D55
4']q, xrefs: 04CE7E6D
4']q, xrefs: 04CE7D78
4']q, xrefs: 04CE7ED6
4']q, xrefs: 04CE7F3F
4']q, xrefs: 04CE7F1C
4']q, xrefs: 04CE7F62
4']q, xrefs: 04CE807B
4']q, xrefs: 04CE804F
4']q, xrefs: 04CE7EF9
4']q, xrefs: 04CE7DE1
4']q, xrefs: 04CE81AF
4']q, xrefs: 04CE7FA8
4']q, xrefs: 04CE81DB
4']q, xrefs: 04CE7FF7
4']q, xrefs: 04CE812B
4']q, xrefs: 04CE7E90
4']q, xrefs: 04CE8157
4']q, xrefs: 04CE7E4A
4']q, xrefs: 04CE7DBE
4']q, xrefs: 04CE80A7
4']q, xrefs: 04CE7F85
4']q, xrefs: 04CE7D32
4']q, xrefs: 04CE7FCB
4']q, xrefs: 04CE7EB3
4']q, xrefs: 04CE7E27
4']q, xrefs: 04CE80FF

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-2711123852
Opcode ID: e97a782109fd537a7fdc7740046f4f7dd4f9fc45bdc1fa288788f964a26b1224
Instruction ID: 077af22f2356f8d02915c7ab50b5cbadf8e03ec4e320f463f06a872f462f6928
Opcode Fuzzy Hash: e97a782109fd537a7fdc7740046f4f7dd4f9fc45bdc1fa288788f964a26b1224
Instruction Fuzzy Hash: 70228030E412098FCB58EF79E891A9D77BAFF40700F1049A8D059AB269DF346D59CFA1

Function 04CE7C60 Relevance: 41.7, Strings: 33, Instructions: 434COMMON

Download Yara Rule

Strings

4']q, xrefs: 04CE7E04
4']q, xrefs: 04CE8207
4']q, xrefs: 04CE8023
4']q, xrefs: 04CE8183
4']q, xrefs: 04CE7D9B
4']q, xrefs: 04CE80D3
4']q, xrefs: 04CE7D55
4']q, xrefs: 04CE7E6D
4']q, xrefs: 04CE7D78
4']q, xrefs: 04CE7ED6
4']q, xrefs: 04CE7F3F
4']q, xrefs: 04CE7F1C
4']q, xrefs: 04CE7F62
4']q, xrefs: 04CE807B
4']q, xrefs: 04CE804F
4']q, xrefs: 04CE7EF9
4']q, xrefs: 04CE7DE1
4']q, xrefs: 04CE81AF
4']q, xrefs: 04CE7FA8
4']q, xrefs: 04CE81DB
4']q, xrefs: 04CE7FF7
4']q, xrefs: 04CE812B
4']q, xrefs: 04CE7E90
4']q, xrefs: 04CE8157
4']q, xrefs: 04CE7E4A
4']q, xrefs: 04CE7DBE
4']q, xrefs: 04CE80A7
4']q, xrefs: 04CE7F85
4']q, xrefs: 04CE7D32
4']q, xrefs: 04CE7FCB
4']q, xrefs: 04CE7EB3
4']q, xrefs: 04CE7E27
4']q, xrefs: 04CE80FF

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-2711123852
Opcode ID: f6d5a447f6b433a77f9778ccdf2a59c389a43c4d13687d409c12cc3777ae6246
Instruction ID: 6f0ccb353e45f9862bade1f1ff3960b3f49223715aaab549c7333df15d1954dc
Opcode Fuzzy Hash: f6d5a447f6b433a77f9778ccdf2a59c389a43c4d13687d409c12cc3777ae6246
Instruction Fuzzy Hash: 5B128030E412098FCB58EF79E890A9D77BAFF40700F104968D059AB269DF386D59CFA5

Function 04CE26E0 Relevance: 12.7, Strings: 10, Instructions: 179COMMON

Download Yara Rule

Strings

4']q, xrefs: 04CE292A
4']q, xrefs: 04CE28C1
4']q, xrefs: 04CE2858
4']q, xrefs: 04CE2812
4']q, xrefs: 04CE294D
4']q, xrefs: 04CE289E
4']q, xrefs: 04CE28E4
4']q, xrefs: 04CE2907
4']q, xrefs: 04CE287B
4']q, xrefs: 04CE2835

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-3121157708
Opcode ID: aba65b16e9ba08ce4d2cbfb35ab771cce4261e70ba11b163a1abc8d34561dbd8
Instruction ID: a30cc6aff2bb7977685d0356acb4dc72951cfe42eacc5830edf63df71a9730b2
Opcode Fuzzy Hash: aba65b16e9ba08ce4d2cbfb35ab771cce4261e70ba11b163a1abc8d34561dbd8
Instruction Fuzzy Hash: 60716F30E0130ACBCB08EFB9D8505DDBBB2FF80700F614A29D059AB255EF74695ACB91

Function 04CE26F0 Relevance: 12.7, Strings: 10, Instructions: 172COMMON

Download Yara Rule

Strings

4']q, xrefs: 04CE292A
4']q, xrefs: 04CE28C1
4']q, xrefs: 04CE2858
4']q, xrefs: 04CE2812
4']q, xrefs: 04CE294D
4']q, xrefs: 04CE289E
4']q, xrefs: 04CE28E4
4']q, xrefs: 04CE2907
4']q, xrefs: 04CE287B
4']q, xrefs: 04CE2835

Memory Dump Source

Source File: 0000000A.00000002.2229102468.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ce0000_tIFjYTCo.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q
API String ID: 0-3121157708
Opcode ID: 398e2c178fd2eb15a9725d76bb6196e141a290dcad947ffbd615cdd10b33876a
Instruction ID: 15a3802ef8b6dec98f1afcd00047c1f8f45c453c704f40daec82396a636c6be0
Opcode Fuzzy Hash: 398e2c178fd2eb15a9725d76bb6196e141a290dcad947ffbd615cdd10b33876a
Instruction Fuzzy Hash: 2E713D30E0130A8BCB08EFB9D8546DDB7B2FF84700F614A28D0596B259EF74695ACB95

Analysis Process: RegSvcs.exePID: 6540, Parent PID: 3440COMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	150
Total number of Limit Nodes:	13

Executed Functions

Function 05E827FA Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05E8287E
GetCurrentThread.KERNEL32 ref: 05E828BB
GetCurrentProcess.KERNEL32 ref: 05E828F8
GetCurrentThreadId.KERNEL32 ref: 05E82951

Memory Dump Source

Source File: 0000000E.00000002.3353745230.0000000005E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5e80000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b407427be0f9e4078a28e4a556d6eba374ab751d445238ffc7e7dc49324dcc65
Instruction ID: 1d45c6f260c714b4abb8aaf9e059c9a608f3c9cd5a3314fdb2a5e063188ccb12
Opcode Fuzzy Hash: b407427be0f9e4078a28e4a556d6eba374ab751d445238ffc7e7dc49324dcc65
Instruction Fuzzy Hash: F95186B49002098FDB14EFAAC549BAEBFF1FF48304F208059E159A7361DB389944CB65

Function 05E82800 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05E8287E
GetCurrentThread.KERNEL32 ref: 05E828BB
GetCurrentProcess.KERNEL32 ref: 05E828F8
GetCurrentThreadId.KERNEL32 ref: 05E82951

Memory Dump Source

Source File: 0000000E.00000002.3353745230.0000000005E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5e80000_RegSvcs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7ffc112836a2aced6fc3c9fc7f454918afaa3b143f381af8e05f512c701f13cb
Instruction ID: 6cf451eec9bbbe8cb6778c443b24704b233bab78e37c0034aba8083fe8fe5093
Opcode Fuzzy Hash: 7ffc112836a2aced6fc3c9fc7f454918afaa3b143f381af8e05f512c701f13cb
Instruction Fuzzy Hash: A05165B49003098FDB14EFAAD549BAEBFF1FF48314F208059E159A7361DB385984CB65

Function 05E8AD18 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 05E8AF7E

Memory Dump Source

Source File: 0000000E.00000002.3353745230.0000000005E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5e80000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b2ee858d7b004651469637a0750f713dcec0aa2b6297d8a88e29666e44152908
Instruction ID: 5af1a8fb32e38b3f2d0a2fabc6092e6886cca29c64d7916e02052f0427049e23
Opcode Fuzzy Hash: b2ee858d7b004651469637a0750f713dcec0aa2b6297d8a88e29666e44152908
Instruction Fuzzy Hash: 39813770A00B058FD724EF29D4457AABBF6FF88318F00992ED48AD7A50DB75E945CB90

Function 05E9E4F8 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3353859012.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5e90000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b867f94df09e49e2f7ac275f9b756a0b3775730e271c70b3277c6deeab3d10ab
Instruction ID: a6f2ae62f7772aa890b1148e129334c2d74e2dd4aaa837d85fddf0f06171213d
Opcode Fuzzy Hash: b867f94df09e49e2f7ac275f9b756a0b3775730e271c70b3277c6deeab3d10ab
Instruction Fuzzy Hash: 20412672E043958FCB08DF69D81069ABFF9EF89210F14856AD548A7281EB789845CBE1

Function 05E8CF04 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05E8D022

Memory Dump Source

Source File: 0000000E.00000002.3353745230.0000000005E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5e80000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 336cb1cb8352844d5f8e1588d2805aa140c1cd7415f3631a4da236b75bcb8c5d
Instruction ID: 254ec14e50ea9be94082a822ced72e94a972ae4f5b1acb932b6a880e348e86ac
Opcode Fuzzy Hash: 336cb1cb8352844d5f8e1588d2805aa140c1cd7415f3631a4da236b75bcb8c5d
Instruction Fuzzy Hash: FA51D0B1D003099FDB14DFA9C984ADEBBB6FF48314F64812AE819AB250D7749845CF90

Function 05E8CF10 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05E8D022

Memory Dump Source

Source File: 0000000E.00000002.3353745230.0000000005E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5e80000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 22fbdca36e9ef0d2a7a544ff44d7b83a693c09f60b557d53a8098cbbe798677f
Instruction ID: 65c1534412cb405574a39eb49dc9082f2c070f808b847b929eb9a7ad4a1ee0ac
Opcode Fuzzy Hash: 22fbdca36e9ef0d2a7a544ff44d7b83a693c09f60b557d53a8098cbbe798677f
Instruction Fuzzy Hash: 9141E0B1D00309DFDB14DF99C984ADEBBB6FF48304F64822AE819AB250D774A845CF90

Function 05E8DE7C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05E8F711

Memory Dump Source

Source File: 0000000E.00000002.3353745230.0000000005E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5e80000_RegSvcs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 9d974e9d826d61950ffd5f73dec6af1a7016d0bedad87becfe33b5a67b18be0c
Instruction ID: 9c0138686c47d210de6c28f25ed667a64d48ad1b0d7c29d4b1781c972dbc80bd
Opcode Fuzzy Hash: 9d974e9d826d61950ffd5f73dec6af1a7016d0bedad87becfe33b5a67b18be0c
Instruction Fuzzy Hash: B24169B9A00205CFDB04DF99C888AAABBF6FF88314F24C549D51DA7321D775A841CFA0

Function 05E82A40 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05E82ACF

Memory Dump Source

Source File: 0000000E.00000002.3353745230.0000000005E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5e80000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 082f834726775e79ac216f1c012e7fee54a7814215567240a435b06625732da3
Instruction ID: f93f78e17229906dfbb804e1e1df90fea817c0c7523c8704511b58ace5602899
Opcode Fuzzy Hash: 082f834726775e79ac216f1c012e7fee54a7814215567240a435b06625732da3
Instruction Fuzzy Hash: BF21E5B5D002489FDB10DF9AD984AEEBBF9FB48310F14845AE958A3210D378A954DFA1

Function 05E82A48 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05E82ACF

Memory Dump Source

Source File: 0000000E.00000002.3353745230.0000000005E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5e80000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c66901d1512866c49c06fec55b9fb21650db52f466521bb0be4bd36210a3e28d
Instruction ID: 2950801f833087f9bca5c3fcb7b6f3af450430a80d9998c513cf4c76a20a82b4
Opcode Fuzzy Hash: c66901d1512866c49c06fec55b9fb21650db52f466521bb0be4bd36210a3e28d
Instruction Fuzzy Hash: A421E4B5D002089FDB10DF9AD984AEEBBF9FF48310F14805AE918A3310D378A940CFA0

Function 027A7351 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 027A73C8

Memory Dump Source

Source File: 0000000E.00000002.3345951905.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_27a0000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0d732af57b8f974be0078e519995067f264b36cfda8bf5fa66c45ffb225c0ba6
Instruction ID: 73bfe803570a5628d0a3541501ff8c1239a34f26a89056f73c0b0ea729910a57
Opcode Fuzzy Hash: 0d732af57b8f974be0078e519995067f264b36cfda8bf5fa66c45ffb225c0ba6
Instruction Fuzzy Hash: C32158B1C0065A8BCB14CF9AC9447EEFBB0EF48320F11826AD818A7240D738A944CFE1

Function 027A7358 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 027A73C8

Memory Dump Source

Source File: 0000000E.00000002.3345951905.00000000027A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_27a0000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c7b843be6a60c71a3a4f464b7d41c040a8d81d820fe933950b67c443371a1a77
Instruction ID: d93d36bfae5dbee22800f32c456d1f91db9fb12a8121a4124b226b523e28994f
Opcode Fuzzy Hash: c7b843be6a60c71a3a4f464b7d41c040a8d81d820fe933950b67c443371a1a77
Instruction Fuzzy Hash: 3C1147B1C006599BCB14DF9AD5447AEFBF4FF48320F11822AD818A7240D738A944CFE1

Function 05E9E5E0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?), ref: 05E9E647

Memory Dump Source

Source File: 0000000E.00000002.3353859012.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5e90000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 34761c97c10a70a0926f1ee332823d170348649e604d9eab16036f424ddf8521
Instruction ID: e7c6814cbbd6985bb33302f6f4c2defa0a960a43ffeb47b11a010fbd39650c20
Opcode Fuzzy Hash: 34761c97c10a70a0926f1ee332823d170348649e604d9eab16036f424ddf8521
Instruction Fuzzy Hash: D2111FB1C0065A9BCB10DF9AC544B9EFBF8BF48320F14812AD918A7240D778A940CFA5

Function 05E8AF18 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 05E8AF7E

Memory Dump Source

Source File: 0000000E.00000002.3353745230.0000000005E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5e80000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1e09f162de345d0cb7f60e3e6466797ecfcfbede7f1468503a3ff6149a508f46
Instruction ID: ed69d8e43ac700dcbe69657d989721127a142a7d56a680187a7dd00d099c7817
Opcode Fuzzy Hash: 1e09f162de345d0cb7f60e3e6466797ecfcfbede7f1468503a3ff6149a508f46
Instruction Fuzzy Hash: 5F1110B6C003498FDB10DF9AC444ADEFBF5EF88324F10842AD859A7200C379A545CFA1

Function 00E2D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3345508769.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e2d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bd0047fbb43175d60939466fedc9184b3c9974b6eaf35803e212215bb893ff
Instruction ID: fc43286e52ca711e96fb5c864155adb86909340d4fa07fb265811ce65ffd7c79
Opcode Fuzzy Hash: 07bd0047fbb43175d60939466fedc9184b3c9974b6eaf35803e212215bb893ff
Instruction Fuzzy Hash: 4A21F571508244DFCB15DF24E984F16BF66FB84314F20C569DA4A5B2A6C33AD807CA61

Function 00E2D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3345508769.0000000000E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e2d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 952eae285d5addbb019417177c045619476d779d0bbc3cbeebfcd32c09e00c51
Instruction ID: 5f425a6a30b1d076647e2c0b8e667d805334a45dc205fe7fda8043b63f1d28c0
Opcode Fuzzy Hash: 952eae285d5addbb019417177c045619476d779d0bbc3cbeebfcd32c09e00c51
Instruction Fuzzy Hash: 4121537550D3808FD712CF24D994B15BF72EB46314F28C5DAD9498B6A7C33A980ACB62

Analysis Process: GUIVTme.exePID: 5744, Parent PID: 1028COMMON

Executed Functions

Function 01151230 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

tP]q, xrefs: 011512F7

Memory Dump Source

Source File: 00000010.00000002.2254523904.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1150000_GUIVTme.jbxd

Similarity

API ID:
String ID: tP]q
API String ID: 0-2175968468
Opcode ID: e2add760856e1124ee2c2bed6d0a6fe400396fa45cff8ed76a68e2e5c23d4f2d
Instruction ID: 0107c379c31139dccdd204e723dad521a3db2ef1ee24e8de26c7b214c147ac67
Opcode Fuzzy Hash: e2add760856e1124ee2c2bed6d0a6fe400396fa45cff8ed76a68e2e5c23d4f2d
Instruction Fuzzy Hash: CF3128747416108FCB69AF38C46895D7BF6AF8A71635608B9E506CF3B2DA35DC42CB80

Function 01151240 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

tP]q, xrefs: 011512F7

Memory Dump Source

Source File: 00000010.00000002.2254523904.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1150000_GUIVTme.jbxd

Similarity

API ID:
String ID: tP]q
API String ID: 0-2175968468
Opcode ID: b58c09199e8fd41d289b712d9e17a67ff3d70731ff56648f644840ffd92688fb
Instruction ID: 2a1fea3edcfc612c0b94de70c70b3e15237e29dfbffcd33328046f5d995816de
Opcode Fuzzy Hash: b58c09199e8fd41d289b712d9e17a67ff3d70731ff56648f644840ffd92688fb
Instruction Fuzzy Hash: 392105347412118FCB6DAB39C55891D7BE6AF8972636508B8E506CF3B5DB36EC42CB80

Function 01151AE0 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

8aq, xrefs: 01151B75

Memory Dump Source

Source File: 00000010.00000002.2254523904.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1150000_GUIVTme.jbxd

Similarity

API ID:
String ID: 8aq
API String ID: 0-538729646
Opcode ID: 42afcc7724f09704e494682f60afa2fedccaa92dd5ddfa944b704daa9facfa83
Instruction ID: 8e98d60bc7b9f98e0759c43ef836258cf9a191b8f94c3c638074bdfb452f4d91
Opcode Fuzzy Hash: 42afcc7724f09704e494682f60afa2fedccaa92dd5ddfa944b704daa9facfa83
Instruction Fuzzy Hash: 1C118434A402046FC755EFB8D494BEE7BB5AF89240F1040A9D649DB395DF349D06CB51

Function 01151340 Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2254523904.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1150000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab29f6cb9a8d06c827d3e33d533f257539eeef340032b01021929004dae80c04
Instruction ID: a805ccb82bca6d65ca3f1b5bed9becd7f37c8de522aeec3d7bbd99811165bb48
Opcode Fuzzy Hash: ab29f6cb9a8d06c827d3e33d533f257539eeef340032b01021929004dae80c04
Instruction Fuzzy Hash: FD227034700206EFD76AEF34D49476A77B7BB88704B118929D896CB389DB36EC46CB41

Function 01150BC0 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2254523904.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1150000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ee0803c9692468574c98f75d1aadc2871e2edc2eb3613b5bd506cf78659a08
Instruction ID: b5e6730592a6b9e909c74de834d57f4b9f98ca1ead8889cbc3d5ba46395bf884
Opcode Fuzzy Hash: 68ee0803c9692468574c98f75d1aadc2871e2edc2eb3613b5bd506cf78659a08
Instruction Fuzzy Hash: B681F434A00341CFDB2AEFB4C45869EBBB2BF88300F15856AE45697365CF35AC85CB40

Function 01151C00 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2254523904.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1150000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17f43afe807f9801d695c71961989601ddee2bc434fc5bec1f8a23460d9f3c0
Instruction ID: 84483af9fe9fa8bdec050cdf640c5c2c499ef448016c7bc112c500e11da3034b
Opcode Fuzzy Hash: e17f43afe807f9801d695c71961989601ddee2bc434fc5bec1f8a23460d9f3c0
Instruction Fuzzy Hash: EE118E76E002469FCB41EFB4D8449EFBBB5FF9920071186AAE519D7221E7709905CB90

Function 01151C10 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2254523904.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1150000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be3b791f0e08c9174b5743fdca46a2d82c5c82c2a7bf1152abcbfc199e4f792
Instruction ID: f7b19ba5c9c6a177efe9d5afb428bb58c497fa6dcb731a025a00a9c0b8d8691c
Opcode Fuzzy Hash: 3be3b791f0e08c9174b5743fdca46a2d82c5c82c2a7bf1152abcbfc199e4f792
Instruction Fuzzy Hash: 8F019235E0020A9FCB40EFB4D84499BFBF5FF8C200711866AE519D7224E730A905CB90

Function 01150F9D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2254523904.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1150000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90ade87f321c051e5b35afd88d77f41f6239ed73f0f056447b0bc52391a13114
Instruction ID: 74b59b867582e84be854a2446efe422f8ef2ef38cfda49f0982d8e1f605ac0e8
Opcode Fuzzy Hash: 90ade87f321c051e5b35afd88d77f41f6239ed73f0f056447b0bc52391a13114
Instruction Fuzzy Hash: EBF01C74940305DFDB29EB74C198B9D7BF0AB08704F150899D812A7261CBB98984CB51

Function 01150898 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2254523904.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1150000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c277fcd5aae4e9f302249b045b7d4831eb52fbcc246c41ce841a1000d4d252
Instruction ID: 83da1d3a39d54464ae4bf74379094861d7ceb455b96abbf04f1f917b432df822
Opcode Fuzzy Hash: 86c277fcd5aae4e9f302249b045b7d4831eb52fbcc246c41ce841a1000d4d252
Instruction Fuzzy Hash: 57E01271C05258AFCF54EFB8A4461DF7BF4AE05350B01857AD99AE3201E3748B05CBD1

Function 011508A8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2254523904.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_1150000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88180a0f8f0cc16c0ca78e62566e501a65a8f4d3622076a75c7036da3f171267
Instruction ID: 84bc54d25636feacd4437f6f1bd0d4a45f0488b0f3e26d324256d7b6b8481d4c
Opcode Fuzzy Hash: 88180a0f8f0cc16c0ca78e62566e501a65a8f4d3622076a75c7036da3f171267
Instruction Fuzzy Hash: 5AD017B1D01229EF8B80EFF899051DEBBF8EE08250B000566D91AE3200E3705B108BE1

Analysis Process: GUIVTme.exePID: 5332, Parent PID: 1028COMMON

Executed Functions

Function 00EF1340 Relevance: 8.0, Strings: 6, Instructions: 524COMMON

Download Yara Rule

Strings

D@, xrefs: 00EF1968
D@, xrefs: 00EF1A64
D@, xrefs: 00EF1A22
D@, xrefs: 00EF19DB
D@, xrefs: 00EF19A3
D@, xrefs: 00EF1A9D

Memory Dump Source

Source File: 00000012.00000002.2332699429.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_ef0000_GUIVTme.jbxd

Similarity

API ID:
String ID: D@$D@$D@$D@$D@$D@
API String ID: 0-3404515598
Opcode ID: 04e15022da3a241d5dac333a646e0b438c1b334946c9f718ff429a1e7ee46a23
Instruction ID: 1e19c1ccbb94ca1c3e94f4df98d5225fae3b42768587fa16ecd2d94b54d7e0c3
Opcode Fuzzy Hash: 04e15022da3a241d5dac333a646e0b438c1b334946c9f718ff429a1e7ee46a23
Instruction Fuzzy Hash: B822703470060ADFDB14EF34D89067A73A2BBCD349B1899ADC516AB399DB31EC46CB41

Function 00EF1AE0 Relevance: 3.8, Strings: 3, Instructions: 66COMMON

Download Yara Rule

Strings

D@, xrefs: 00EF1B1D
D@, xrefs: 00EF1B2F
8aq, xrefs: 00EF1B75

Memory Dump Source

Source File: 00000012.00000002.2332699429.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_ef0000_GUIVTme.jbxd

Similarity

API ID:
String ID: 8aq$D@$D@
API String ID: 0-2975543067
Opcode ID: 181855d65acac2f62fbd71d017891e8b2d032af2f5e021d0f8b2d40a656b9a14
Instruction ID: f65d37dc10f4d113ad23fca2a011c0ef625d8b84e0389dcd520d527ca1bc2464
Opcode Fuzzy Hash: 181855d65acac2f62fbd71d017891e8b2d032af2f5e021d0f8b2d40a656b9a14
Instruction Fuzzy Hash: CB11B935B04208AFC705EF7598516AE7BB5AFC9300F1440E9D60AEB395DE749D06CB92

Function 00EF0CF5 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

D@, xrefs: 00EF0E24

Memory Dump Source

Source File: 00000012.00000002.2332699429.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_ef0000_GUIVTme.jbxd

Similarity

API ID:
String ID: D@
API String ID: 0-2222373746
Opcode ID: a5206dff956e14b8302350476f8b48e93a240398e315c96bf72d86f14564e219
Instruction ID: 2535fe70831e45029b4a033861f37ad2e526468092ab4645432ca77220b11a4e
Opcode Fuzzy Hash: a5206dff956e14b8302350476f8b48e93a240398e315c96bf72d86f14564e219
Instruction Fuzzy Hash: F0718D35A00709CFCB199BB1D4486A9BBF2AFCD300F18896AD5166B2A5DB75AC85CB40

Function 00EF1240 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

tP]q, xrefs: 00EF12F7

Memory Dump Source

Source File: 00000012.00000002.2332699429.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_ef0000_GUIVTme.jbxd

Similarity

API ID:
String ID: tP]q
API String ID: 0-2175968468
Opcode ID: ec8c125589cee4a82ff9885b6a968f7b49a2b9a27a4dc3e99f7701e773e85db0
Instruction ID: d42045dab16b1d2679b00d24d574b7000be6580788c00448ede7233595b48ba9
Opcode Fuzzy Hash: ec8c125589cee4a82ff9885b6a968f7b49a2b9a27a4dc3e99f7701e773e85db0
Instruction Fuzzy Hash: 612139343412108FCB59AF39C15882D7BE6AF8971A36508B8E506CF3B5DE35DC42CB81

Function 00EF1B68 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

8aq, xrefs: 00EF1B75

Memory Dump Source

Source File: 00000012.00000002.2332699429.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_ef0000_GUIVTme.jbxd

Similarity

API ID:
String ID: 8aq
API String ID: 0-538729646
Opcode ID: 09f7449fce5a152d3b6bcca5ea2131f4ab36f587b006f8b0b60eef8aa83e35e2
Instruction ID: a496dfdcb00f1bc8c5b42c59ef64108c3f3bb15bb574dd42e147a57f8c9a6ba5
Opcode Fuzzy Hash: 09f7449fce5a152d3b6bcca5ea2131f4ab36f587b006f8b0b60eef8aa83e35e2
Instruction Fuzzy Hash: 0AE0C230240708ABC605BB79A450A6973DEABCC354B0405B9D60AAB288EEA89D0643E6

Function 00EF1C10 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2332699429.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_ef0000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db08a9e78f7d4195de93a6f104a75f6db2955c066dc59b1f4de37794c201309a
Instruction ID: f0b9581ac8cbc15abf1c4e1ba15e7441b4045bee4eaa2651e3d921a70236ef0f
Opcode Fuzzy Hash: db08a9e78f7d4195de93a6f104a75f6db2955c066dc59b1f4de37794c201309a
Instruction Fuzzy Hash: 9E01B136E0020A9FCB00EFB4D8408AFFBF5FF8C30071086AAE51997224E771A915CB90

Function 00EF0F9D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2332699429.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_ef0000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a3d8d29bc6bf7970e3144960c77a6fd182695687f027d128c732238ea98b05
Instruction ID: 8e3b7ade040d73c60d19d339c96024162bae86e8ecad62e278c30ddf67a06ccd
Opcode Fuzzy Hash: c1a3d8d29bc6bf7970e3144960c77a6fd182695687f027d128c732238ea98b05
Instruction Fuzzy Hash: B7F01C75A40319CFDB14EB74C5587AD7BF0AB48704F241898D502BB2A0CBB49C84CB51

Function 00EF08A8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2332699429.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_ef0000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032af2529e5ddfc6446e7422f3f17b56b922cfd8c19e4727723594e6200adc77
Instruction ID: 10bfd3c18fdf7b6dafd63a2640f5bbbe578c38f1393ea8c41e08a0e8b8060640
Opcode Fuzzy Hash: 032af2529e5ddfc6446e7422f3f17b56b922cfd8c19e4727723594e6200adc77
Instruction Fuzzy Hash: 43D067B1D0121DAF8B40EFB999051EEBBF8FE49250B104566D919F7201E6705A148BD1

Function 00EF1AE5 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2332699429.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_ef0000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd26b4fe28a0e4bade1c8c7731468f7fe25fac3ffd446caa205c80252a1175a5
Instruction ID: ba2cfe7249185ef3e66239895322c210c8d16e11494babda861336c81a8efe46
Opcode Fuzzy Hash: dd26b4fe28a0e4bade1c8c7731468f7fe25fac3ffd446caa205c80252a1175a5
Instruction Fuzzy Hash: F1D0A735340204CF8710DF28E544C953774EB4E71032040D9E524CB251E761DD10CB41

Function 00EF08AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2332699429.0000000000EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_ef0000_GUIVTme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5579e8a945af91d0cb57ebb35d79a83d09a145130539751154c3a17b503073a9
Instruction ID: 8f448c3660baf21c1cbe72806f0f22a7a968a99a4d8abea06e9af8c4bd8da1e1
Opcode Fuzzy Hash: 5579e8a945af91d0cb57ebb35d79a83d09a145130539751154c3a17b503073a9
Instruction Fuzzy Hash: 52D0A771D00219DECF108BB858040DCBFF0EA492B07140395D515F7640E3751601CB80

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report autorization Letter.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GUIVTme.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\autorization Letter.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tIFjYTCo.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11g0nfzk.wjm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3vlyn5gt.xhc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5cbcryey.s5i.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5cc2xxa3.4ha.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5kk0dmj.pnk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_idf5mf53.ilr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_osp51fi5.hyv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbbwxrea.5tm.ps1

C:\Users\user\AppData\Local\Temp\tmp1162.tmp

Windows Analysis Report
autorization Letter.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre