Edit tour

Windows Analysis Report
Docs.exe

Overview

General Information

Sample name:	Docs.exe
Analysis ID:	1432055
MD5:	28da32c1cf8ead709f4888f84a697c28
SHA1:	45122f3c46fb3400cc6710a830a259da54b07298
SHA256:	c10f8bc18521b4c90063ae5fc1e0e95e40ed35be3758d90f597d7cc1e3853ade
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Docs.exe (PID: 7388 cmdline: "C:\Users\user\Desktop\Docs.exe" MD5: 28DA32C1CF8EAD709F4888F84A697C28)

Docs.exe (PID: 7576 cmdline: "C:\Users\user\Desktop\Docs.exe" MD5: 28DA32C1CF8EAD709F4888F84A697C28)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alkuwaiti.com", "Username": "electronics@alkuwaiti.com", "Password": "Ele@1804"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2996631078.0000000003461000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2996631078.0000000003461000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2989969989.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2989969989.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1807736148.00000000048A3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1807736148.00000000048A3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Docs.exe PID: 7388	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Docs.exe PID: 7388	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Docs.exe PID: 7388	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Docs.exe PID: 7576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Docs.exe PID: 7576	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Docs.exe.48a3e18.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Docs.exe.48a3e18.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Docs.exe.48a3e18.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316bd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3172f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317b9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3184b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318b5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31927:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319bd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a4d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.Docs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Docs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.Docs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334bd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3352f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335b9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3364b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336b5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33727:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337bd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3384d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Docs.exe.48de838.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Docs.exe.48de838.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Docs.exe.48de838.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316bd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3172f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317b9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3184b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318b5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31927:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319bd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a4d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Docs.exe.48de838.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Docs.exe.48de838.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Docs.exe.48de838.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334bd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dcdd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3352f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd4f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335b9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6ddd9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3364b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de6b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336b5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6ded5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33727:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df47:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337bd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6dfdd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3384d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e06d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Docs.exe.48a3e18.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Docs.exe.48a3e18.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Docs.exe.48a3e18.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334bd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dedd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa86fd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3352f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df4f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa876f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335b9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfd9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa87f9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3364b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e06b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa888b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336b5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0d5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa88f5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33727:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e147:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8967:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337bd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1dd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa89fd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 50.87.219.149, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Docs.exe, Initiated: true, ProcessId: 7576, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Docs.exe

Avira: detected

Found malware configuration

Source: 0.2.Docs.exe.48a3e18.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alkuwaiti.com", "Username": "electronics@alkuwaiti.com", "Password": "Ele@1804"}

Multi AV Scanner detection for submitted file

Source: Docs.exe	ReversingLabs: Detection: 87%
Source: Docs.exe	Virustotal: Detection: 74%			Perma Link

Machine Learning detection for sample

Source: Docs.exe

Joe Sandbox ML: detected

Source: Docs.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: Docs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Docs.exe

Code function: 4x nop then jmp 075D414Ah

0_2_075D37D3

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 50.87.219.149:587

Source: Joe Sandbox View	IP Address: 50.87.219.149 50.87.219.149
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 50.87.219.149:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.alkuwaiti.com

Source: Docs.exe, 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.alkuwaiti.com
Source: Docs.exe, 00000002.00000002.2990281879.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2990281879.00000000014F4000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: Docs.exe, 00000002.00000002.2990281879.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2990281879.00000000014F4000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: Docs.exe, 00000002.00000002.2996631078.0000000003411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Docs.exe	String found in binary or memory: http://weather.yahooapis.com/forecastrss?w=4118
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Docs.exe	String found in binary or memory: http://www.ctvnews.ca/rss/business/ctv-news-business-headlines-1.867648
Source: Docs.exe	String found in binary or memory: http://www.ctvnews.ca/rss/ctvnews-ca-top-stories-public-rss-1.822009
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp, Docs.exe, 00000000.00000002.1810817443.0000000005B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Docs.exe, 00000002.00000002.2990281879.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.3012553587.0000000006BFD000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Docs.exe, 00000002.00000002.2990281879.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.3012553587.0000000006BFD000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Docs.exe	String found in binary or memory: http://xml.weather.yahoo.com/ns/rss/1.0
Source: Docs.exe, 00000000.00000002.1807736148.00000000048A3000.00000004.00000800.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2989969989.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Docs.exe, 00000000.00000002.1807736148.00000000048A3000.00000004.00000800.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2996631078.0000000003411000.00000004.00000800.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2989969989.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Docs.exe, 00000002.00000002.2996631078.0000000003411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Docs.exe, 00000002.00000002.2996631078.0000000003411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49733 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, oAKy.cs	.Net Code: CHgRvKS
Source: 0.2.Docs.exe.48de838.4.raw.unpack, oAKy.cs	.Net Code: CHgRvKS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Docs.exe.48a3e18.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.Docs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Docs.exe.48de838.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Docs.exe.48de838.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.Docs.exe.2bb3bc8.0.raw.unpack, LoginForm.cs

Large array initialization: : array initializer size 33603

Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_0107DDCC	0_2_0107DDCC
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_075302E0	0_2_075302E0
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_075341E8	0_2_075341E8
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07531190	0_2_07531190
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07533ED0	0_2_07533ED0
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_0753F730	0_2_0753F730
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07533491	0_2_07533491
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07538378	0_2_07538378
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07533258	0_2_07533258
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_0753324A	0_2_0753324A
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_075302D2	0_2_075302D2
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_0753F2F8	0_2_0753F2F8
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07535150	0_2_07535150
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_075341D8	0_2_075341D8
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07532030	0_2_07532030
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07532020	0_2_07532020
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_075310A0	0_2_075310A0
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07531E3A	0_2_07531E3A
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07532ED8	0_2_07532ED8
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07533EC1	0_2_07533EC1
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_0753EEC0	0_2_0753EEC0
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07532EE8	0_2_07532EE8
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_0753EEB8	0_2_0753EEB8
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_075368B8	0_2_075368B8
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_075368AA	0_2_075368AA
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_075D1490	0_2_075D1490
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_075D0ACF	0_2_075D0ACF
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_075D0AE0	0_2_075D0AE0
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_075D58B0	0_2_075D58B0
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_017EE6A9	2_2_017EE6A9
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_017E4AA0	2_2_017E4AA0
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_017E3E88	2_2_017E3E88
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_017E41D0	2_2_017E41D0
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_06FA65E8	2_2_06FA65E8
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_06FA5598	2_2_06FA5598
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_06FA7D78	2_2_06FA7D78
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_06FAB230	2_2_06FAB230
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_06FA3048	2_2_06FA3048
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_06FAC198	2_2_06FAC198
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_06FA7698	2_2_06FA7698
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_06FA5CE5	2_2_06FA5CE5
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_06FAE3B0	2_2_06FAE3B0
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_06FA0040	2_2_06FA0040
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_06FA001E	2_2_06FA001E

Source: Docs.exe, 00000000.00000002.1807736148.00000000048A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4548b61d-822f-464b-a714-a9778dc216a9.exe4 vs Docs.exe
Source: Docs.exe, 00000000.00000002.1806967932.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs Docs.exe
Source: Docs.exe, 00000000.00000002.1810375337.00000000054C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs Docs.exe
Source: Docs.exe, 00000000.00000002.1813016713.000000000A1B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Docs.exe
Source: Docs.exe, 00000000.00000002.1806967932.0000000002DC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4548b61d-822f-464b-a714-a9778dc216a9.exe4 vs Docs.exe
Source: Docs.exe, 00000000.00000002.1807736148.000000000453E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Docs.exe
Source: Docs.exe, 00000000.00000002.1805833090.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Docs.exe
Source: Docs.exe, 00000000.00000000.1746093479.000000000073A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamejEhf.exe8 vs Docs.exe
Source: Docs.exe, 00000002.00000002.2990143900.0000000001358000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Docs.exe
Source: Docs.exe, 00000002.00000002.2989969989.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4548b61d-822f-464b-a714-a9778dc216a9.exe4 vs Docs.exe
Source: Docs.exe	Binary or memory string: OriginalFilenamejEhf.exe8 vs Docs.exe

Source: Docs.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Docs.exe.48a3e18.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.Docs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Docs.exe.48de838.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Docs.exe.48de838.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Docs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, ekKu0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, vKf1z6NvS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, ZNAvlD7qmXc.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, U2doU2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, BgffYko.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, HrTdA63.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Docs.exe.48a3e18.3.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Docs.exe.4746900.1.raw.unpack, rAlbc02QxmOsojTQuK.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Docs.exe.4746900.1.raw.unpack, rAlbc02QxmOsojTQuK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Docs.exe.4746900.1.raw.unpack, rAlbc02QxmOsojTQuK.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, cPZCAoVt2erFRDjGhH.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, cPZCAoVt2erFRDjGhH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, cPZCAoVt2erFRDjGhH.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, cPZCAoVt2erFRDjGhH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, rAlbc02QxmOsojTQuK.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, rAlbc02QxmOsojTQuK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, rAlbc02QxmOsojTQuK.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Docs.exe.4746900.1.raw.unpack, cPZCAoVt2erFRDjGhH.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Docs.exe.4746900.1.raw.unpack, cPZCAoVt2erFRDjGhH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, rAlbc02QxmOsojTQuK.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, rAlbc02QxmOsojTQuK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, rAlbc02QxmOsojTQuK.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\Docs.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Docs.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Docs.exe	Mutant created: \Sessions\1\BaseNamedObjects\ecpDFacNifg

Source: Docs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Docs.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\Docs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Docs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Docs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Docs.exe	ReversingLabs: Detection: 87%
Source: Docs.exe	Virustotal: Detection: 74%

Source: unknown	Process created: C:\Users\user\Desktop\Docs.exe "C:\Users\user\Desktop\Docs.exe"
Source: C:\Users\user\Desktop\Docs.exe	Process created: C:\Users\user\Desktop\Docs.exe "C:\Users\user\Desktop\Docs.exe"
Source: C:\Users\user\Desktop\Docs.exe	Process created: C:\Users\user\Desktop\Docs.exe "C:\Users\user\Desktop\Docs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Docs.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Docs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Docs.exe.47c3120.2.raw.unpack, rAlbc02QxmOsojTQuK.cs	.Net Code: cf4GIVPOPP System.Reflection.Assembly.Load(byte[])
Source: 0.2.Docs.exe.4746900.1.raw.unpack, rAlbc02QxmOsojTQuK.cs	.Net Code: cf4GIVPOPP System.Reflection.Assembly.Load(byte[])
Source: 0.2.Docs.exe.2bb3bc8.0.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, rAlbc02QxmOsojTQuK.cs	.Net Code: cf4GIVPOPP System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07530BDD pushad ; retf	0_2_07530BDE
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_07530BE7 pushad ; retf	0_2_07530BE8
Source: C:\Users\user\Desktop\Docs.exe	Code function: 0_2_075D6F7D push FFFFFF8Bh; iretd	0_2_075D6F7F
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_017E0C3D push edi; ret	2_2_017E0CC2
Source: C:\Users\user\Desktop\Docs.exe	Code function: 2_2_017E0C95 push edi; retf	2_2_017E0C3A

Source: Docs.exe

Static PE information: section name: .text entropy: 7.932093151014693

Source: 0.2.Docs.exe.47c3120.2.raw.unpack, RFQph7Gmx5wZmZ2fnD.cs	High entropy of concatenated method names: 'IsPb1PZCAo', 'I2eb2rFRDj', 'wuKbTo2Rp9', 'eIJbjJ5PKi', 'qPXbSbWMvS', 'F7RbRsOcPw', 'cle4mvUrbVXlip4y2F', 'ymHfpHZhJaDABxbXqT', 'q49bbwUlr4', 'exsbPHPkFC'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, yQRNpRmQWNJkutLarT.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'rovngbUMOe', 'qwpnB1ZEj9', 'qFHnz6OZwq', 'UHlP4p6BK3', 'YiWPbg30F3', 'A1uPnUB7yC', 'vORPP6jPlk', 'C2OBvOgSk0hnrTKYkDK'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, qvSi7RisOcPwlZCYlA.cs	High entropy of concatenated method names: 'ie43Jkuxgw', 'phd351c02j', 'YK03uNRTYi', 'isG31HFPAr', 'FIx32H2N6u', 'YIeuXixXdo', 'l8quvB03UP', 'a5NueWb6P1', 'NjFuaxsyp2', 'vEVugviecK'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, shYrPL5uqWC6yJSfE4.cs	High entropy of concatenated method names: 'Dispose', 'enxbgr3Ep6', 'oyvnp1MlRu', 'R0MGGna9Ze', 'faJbBSKSKl', 'bjKbzpJR0g', 'ProcessDialogKey', 'e8hn42Y3mj', 'jQ7nbATt69', 'FUCnnb3vbU'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, xxt5gDZa8BCPWSxVG0.cs	High entropy of concatenated method names: 'ToString', 'PN7RoGZu9R', 'mZSRp7RgiD', 'xABRtnLkWx', 'YqjRLmI94m', 'rXIRKZFFxL', 'H8FRQCPfYJ', 'sKRRCiKjen', 'JoBRqaagWX', 'VrgRrH5uD5'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, P2Y3mjg1Q7ATt69OUC.cs	High entropy of concatenated method names: 'SBvUi5L8vs', 'Dg8UprJOs7', 'QcjUtbYGqt', 'XmnULgp86b', 'p10UNaI4n3', 'QXSUKuu8s0', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, rAlbc02QxmOsojTQuK.cs	High entropy of concatenated method names: 'SVLPJ524Gw', 'pkJP96I9F5', 'zqEP58CYnJ', 'rnWPmuhpqf', 'XGgPuTZBHL', 'aRaP3ZtZLN', 'OLwP1tS1QU', 'egsP2c3MbF', 'UjdP7IlPdA', 'aMCPTEWDOW'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, b3vbUCBrv6R0bcDl26.cs	High entropy of concatenated method names: 'ksJcbdPcBf', 'Ql4cP6BCCy', 'DUdcGTja75', 'Lexc9FIdko', 'UbQc5aOs3L', 'fhwcugq8G7', 'sIGc3j0Eta', 's7iUeBbUG7', 'RDaUaU9d4R', 'fwZUgFxovg'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, bZcaLD0uKo2Rp9JIJJ.cs	High entropy of concatenated method names: 'VdwmsuItXn', 'N32mAQdxM1', 'w15mVBMVte', 'cLum0MOEai', 'F6EmSVMRn3', 'WOsmRW7y5l', 'YfYmMp5exn', 'hBVmUG6ink', 'Ig6mc1ysFd', 'VybmHciAeG'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, tVkAv962ia6mNwDn3y.cs	High entropy of concatenated method names: 'QriMTQfWw5', 'HCxMj2RNh5', 'ToString', 'TMKM9d0815', 'Du4M5EZo18', 'HgLMmvUKqR', 'wlRMu2lnSD', 'gs2M3yM17D', 'X4sM14cSVC', 'd6nM2nncSV'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, gPKii5OvqKVJBMPXbW.cs	High entropy of concatenated method names: 'MUjuwklgAB', 'qEkudQS7Tp', 'AZvmtX8Xpv', 'YI7mLqj0Ly', 'daxmKcUKfu', 'yA5mQidSoN', 'kO3mChb4NG', 'chymqJYe0Y', 'NYsmrcsBJO', 'K67my7S31a'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, orYxNxNLXwG34pPgTX.cs	High entropy of concatenated method names: 'CaeSy0LR4d', 'r1KShKipmv', 'e04SNMmy49', 'ppPSEHIifo', 'hGpSpun9XQ', 'hGpStelelJ', 'sF6SLuHRf3', 'WIMSKEqTrt', 'YmOSQb1VhW', 'LheSCiFK2C'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, jD6LUMbPYWdPHuPYK33.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'cBcHNin0mZ', 'mwCHENio49', 'cuqHZY5iWu', 'wvMH6EOP9Q', 'VtlHXNQmDI', 'RM3HvJkpox', 'KXhHeBTTiR'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, SUe8pgvf60RqW55B9f.cs	High entropy of concatenated method names: 'YS0MalCl39', 'q1iMBHNRJy', 'h1sU4aKkvq', 'kbWUbJsFvv', 'URaMoQYkF0', 'oTBMhepXL8', 'zYnM8pYMPk', 'FFAMNwHHa1', 'VtAMEnGmNd', 'w0rMZpGQf6'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, eJ2ggYnoVUcV3yRKRj.cs	High entropy of concatenated method names: 'sMSIOvhKm', 'WVWs5RTdh', 'M2bALe6nx', 'iCNd5fqlW', 'HaY0rPSjs', 'i08OMxlc2', 'W3OnENGDkEoLrNrx06', 'PXAWMYMO6txLHUAsoE', 'YOrUIuH6R', 'HkVHham4k'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, WJSKSKalbjKpJR0gJ8.cs	High entropy of concatenated method names: 'T7vU9w1FFh', 'HMbU5lCemR', 'rA8UmZTm9P', 'wS0UuTfe6M', 'jSOU3Kglkl', 'jdZU1JbquA', 'Vl9U2nGCoO', 'LcJU7bRvKM', 'ytXUThYVSJ', 'IcOUjmguJM'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, kI7eRSzyL4mxWFQF33.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NuPckmUhdv', 'AiqcSQfpks', 'WjacR5QOD2', 'qf6cMlr7pd', 'EH3cUqcfVx', 'YMKcctgaVO', 'vekcHehKjn'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, cPZCAoVt2erFRDjGhH.cs	High entropy of concatenated method names: 'ALF5N0lCvm', 'F9v5EmZ43U', 'fsS5Zk8l47', 'wvK56MWTWc', 'Yoc5XsZjkk', 'fSX5vMC6MW', 'Ein5edxLc3', 'vQ55aBVpVp', 'AWB5gd7lU3', 'mg95BuHlRc'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, yApeYc8WaNB4HBkP1N.cs	High entropy of concatenated method names: 'gQykVWe2fR', 'EGKk023Omv', 'TmbkiRRxxx', 'RK6kpDrhmn', 'yANkLJNYiS', 'uQLkK5STe5', 'pWAkCowqkJ', 't8dkqA25pM', 'TgkkylljNv', 'WcFkopISbU'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, D6CxCerasCskEeJmWe.cs	High entropy of concatenated method names: 'oUT1FR94nc', 'OgJ1WYMQsy', 'HWL1IvaZEO', 'haX1syuyjD', 'RXY1wY6Fdr', 'RSP1AnR4RT', 'fHf1dsJboJ', 'VkE1VpuQhg', 'lmQ10aU1Nh', 'GOU1O7y2I7'
Source: 0.2.Docs.exe.47c3120.2.raw.unpack, OMn28yb4PnIYjLbooDr.cs	High entropy of concatenated method names: 'cqVcFECcu0', 'rs5cWRtN5n', 'yMPcI5qtGo', 't2lcsKcBQA', 'cE2cwnV1wN', 'nxMcAlS0NS', 'kDScdGgQID', 'LINcV8jNXq', 'GU8c0WrORo', 'hyncOTUBmq'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, RFQph7Gmx5wZmZ2fnD.cs	High entropy of concatenated method names: 'IsPb1PZCAo', 'I2eb2rFRDj', 'wuKbTo2Rp9', 'eIJbjJ5PKi', 'qPXbSbWMvS', 'F7RbRsOcPw', 'cle4mvUrbVXlip4y2F', 'ymHfpHZhJaDABxbXqT', 'q49bbwUlr4', 'exsbPHPkFC'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, yQRNpRmQWNJkutLarT.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'rovngbUMOe', 'qwpnB1ZEj9', 'qFHnz6OZwq', 'UHlP4p6BK3', 'YiWPbg30F3', 'A1uPnUB7yC', 'vORPP6jPlk', 'C2OBvOgSk0hnrTKYkDK'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, qvSi7RisOcPwlZCYlA.cs	High entropy of concatenated method names: 'ie43Jkuxgw', 'phd351c02j', 'YK03uNRTYi', 'isG31HFPAr', 'FIx32H2N6u', 'YIeuXixXdo', 'l8quvB03UP', 'a5NueWb6P1', 'NjFuaxsyp2', 'vEVugviecK'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, shYrPL5uqWC6yJSfE4.cs	High entropy of concatenated method names: 'Dispose', 'enxbgr3Ep6', 'oyvnp1MlRu', 'R0MGGna9Ze', 'faJbBSKSKl', 'bjKbzpJR0g', 'ProcessDialogKey', 'e8hn42Y3mj', 'jQ7nbATt69', 'FUCnnb3vbU'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, xxt5gDZa8BCPWSxVG0.cs	High entropy of concatenated method names: 'ToString', 'PN7RoGZu9R', 'mZSRp7RgiD', 'xABRtnLkWx', 'YqjRLmI94m', 'rXIRKZFFxL', 'H8FRQCPfYJ', 'sKRRCiKjen', 'JoBRqaagWX', 'VrgRrH5uD5'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, P2Y3mjg1Q7ATt69OUC.cs	High entropy of concatenated method names: 'SBvUi5L8vs', 'Dg8UprJOs7', 'QcjUtbYGqt', 'XmnULgp86b', 'p10UNaI4n3', 'QXSUKuu8s0', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, rAlbc02QxmOsojTQuK.cs	High entropy of concatenated method names: 'SVLPJ524Gw', 'pkJP96I9F5', 'zqEP58CYnJ', 'rnWPmuhpqf', 'XGgPuTZBHL', 'aRaP3ZtZLN', 'OLwP1tS1QU', 'egsP2c3MbF', 'UjdP7IlPdA', 'aMCPTEWDOW'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, b3vbUCBrv6R0bcDl26.cs	High entropy of concatenated method names: 'ksJcbdPcBf', 'Ql4cP6BCCy', 'DUdcGTja75', 'Lexc9FIdko', 'UbQc5aOs3L', 'fhwcugq8G7', 'sIGc3j0Eta', 's7iUeBbUG7', 'RDaUaU9d4R', 'fwZUgFxovg'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, bZcaLD0uKo2Rp9JIJJ.cs	High entropy of concatenated method names: 'VdwmsuItXn', 'N32mAQdxM1', 'w15mVBMVte', 'cLum0MOEai', 'F6EmSVMRn3', 'WOsmRW7y5l', 'YfYmMp5exn', 'hBVmUG6ink', 'Ig6mc1ysFd', 'VybmHciAeG'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, tVkAv962ia6mNwDn3y.cs	High entropy of concatenated method names: 'QriMTQfWw5', 'HCxMj2RNh5', 'ToString', 'TMKM9d0815', 'Du4M5EZo18', 'HgLMmvUKqR', 'wlRMu2lnSD', 'gs2M3yM17D', 'X4sM14cSVC', 'd6nM2nncSV'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, gPKii5OvqKVJBMPXbW.cs	High entropy of concatenated method names: 'MUjuwklgAB', 'qEkudQS7Tp', 'AZvmtX8Xpv', 'YI7mLqj0Ly', 'daxmKcUKfu', 'yA5mQidSoN', 'kO3mChb4NG', 'chymqJYe0Y', 'NYsmrcsBJO', 'K67my7S31a'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, orYxNxNLXwG34pPgTX.cs	High entropy of concatenated method names: 'CaeSy0LR4d', 'r1KShKipmv', 'e04SNMmy49', 'ppPSEHIifo', 'hGpSpun9XQ', 'hGpStelelJ', 'sF6SLuHRf3', 'WIMSKEqTrt', 'YmOSQb1VhW', 'LheSCiFK2C'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, jD6LUMbPYWdPHuPYK33.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'cBcHNin0mZ', 'mwCHENio49', 'cuqHZY5iWu', 'wvMH6EOP9Q', 'VtlHXNQmDI', 'RM3HvJkpox', 'KXhHeBTTiR'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, SUe8pgvf60RqW55B9f.cs	High entropy of concatenated method names: 'YS0MalCl39', 'q1iMBHNRJy', 'h1sU4aKkvq', 'kbWUbJsFvv', 'URaMoQYkF0', 'oTBMhepXL8', 'zYnM8pYMPk', 'FFAMNwHHa1', 'VtAMEnGmNd', 'w0rMZpGQf6'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, eJ2ggYnoVUcV3yRKRj.cs	High entropy of concatenated method names: 'sMSIOvhKm', 'WVWs5RTdh', 'M2bALe6nx', 'iCNd5fqlW', 'HaY0rPSjs', 'i08OMxlc2', 'W3OnENGDkEoLrNrx06', 'PXAWMYMO6txLHUAsoE', 'YOrUIuH6R', 'HkVHham4k'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, WJSKSKalbjKpJR0gJ8.cs	High entropy of concatenated method names: 'T7vU9w1FFh', 'HMbU5lCemR', 'rA8UmZTm9P', 'wS0UuTfe6M', 'jSOU3Kglkl', 'jdZU1JbquA', 'Vl9U2nGCoO', 'LcJU7bRvKM', 'ytXUThYVSJ', 'IcOUjmguJM'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, kI7eRSzyL4mxWFQF33.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NuPckmUhdv', 'AiqcSQfpks', 'WjacR5QOD2', 'qf6cMlr7pd', 'EH3cUqcfVx', 'YMKcctgaVO', 'vekcHehKjn'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, cPZCAoVt2erFRDjGhH.cs	High entropy of concatenated method names: 'ALF5N0lCvm', 'F9v5EmZ43U', 'fsS5Zk8l47', 'wvK56MWTWc', 'Yoc5XsZjkk', 'fSX5vMC6MW', 'Ein5edxLc3', 'vQ55aBVpVp', 'AWB5gd7lU3', 'mg95BuHlRc'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, yApeYc8WaNB4HBkP1N.cs	High entropy of concatenated method names: 'gQykVWe2fR', 'EGKk023Omv', 'TmbkiRRxxx', 'RK6kpDrhmn', 'yANkLJNYiS', 'uQLkK5STe5', 'pWAkCowqkJ', 't8dkqA25pM', 'TgkkylljNv', 'WcFkopISbU'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, D6CxCerasCskEeJmWe.cs	High entropy of concatenated method names: 'oUT1FR94nc', 'OgJ1WYMQsy', 'HWL1IvaZEO', 'haX1syuyjD', 'RXY1wY6Fdr', 'RSP1AnR4RT', 'fHf1dsJboJ', 'VkE1VpuQhg', 'lmQ10aU1Nh', 'GOU1O7y2I7'
Source: 0.2.Docs.exe.4746900.1.raw.unpack, OMn28yb4PnIYjLbooDr.cs	High entropy of concatenated method names: 'cqVcFECcu0', 'rs5cWRtN5n', 'yMPcI5qtGo', 't2lcsKcBQA', 'cE2cwnV1wN', 'nxMcAlS0NS', 'kDScdGgQID', 'LINcV8jNXq', 'GU8c0WrORo', 'hyncOTUBmq'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, RFQph7Gmx5wZmZ2fnD.cs	High entropy of concatenated method names: 'IsPb1PZCAo', 'I2eb2rFRDj', 'wuKbTo2Rp9', 'eIJbjJ5PKi', 'qPXbSbWMvS', 'F7RbRsOcPw', 'cle4mvUrbVXlip4y2F', 'ymHfpHZhJaDABxbXqT', 'q49bbwUlr4', 'exsbPHPkFC'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, yQRNpRmQWNJkutLarT.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'rovngbUMOe', 'qwpnB1ZEj9', 'qFHnz6OZwq', 'UHlP4p6BK3', 'YiWPbg30F3', 'A1uPnUB7yC', 'vORPP6jPlk', 'C2OBvOgSk0hnrTKYkDK'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, qvSi7RisOcPwlZCYlA.cs	High entropy of concatenated method names: 'ie43Jkuxgw', 'phd351c02j', 'YK03uNRTYi', 'isG31HFPAr', 'FIx32H2N6u', 'YIeuXixXdo', 'l8quvB03UP', 'a5NueWb6P1', 'NjFuaxsyp2', 'vEVugviecK'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, shYrPL5uqWC6yJSfE4.cs	High entropy of concatenated method names: 'Dispose', 'enxbgr3Ep6', 'oyvnp1MlRu', 'R0MGGna9Ze', 'faJbBSKSKl', 'bjKbzpJR0g', 'ProcessDialogKey', 'e8hn42Y3mj', 'jQ7nbATt69', 'FUCnnb3vbU'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, xxt5gDZa8BCPWSxVG0.cs	High entropy of concatenated method names: 'ToString', 'PN7RoGZu9R', 'mZSRp7RgiD', 'xABRtnLkWx', 'YqjRLmI94m', 'rXIRKZFFxL', 'H8FRQCPfYJ', 'sKRRCiKjen', 'JoBRqaagWX', 'VrgRrH5uD5'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, P2Y3mjg1Q7ATt69OUC.cs	High entropy of concatenated method names: 'SBvUi5L8vs', 'Dg8UprJOs7', 'QcjUtbYGqt', 'XmnULgp86b', 'p10UNaI4n3', 'QXSUKuu8s0', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, rAlbc02QxmOsojTQuK.cs	High entropy of concatenated method names: 'SVLPJ524Gw', 'pkJP96I9F5', 'zqEP58CYnJ', 'rnWPmuhpqf', 'XGgPuTZBHL', 'aRaP3ZtZLN', 'OLwP1tS1QU', 'egsP2c3MbF', 'UjdP7IlPdA', 'aMCPTEWDOW'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, b3vbUCBrv6R0bcDl26.cs	High entropy of concatenated method names: 'ksJcbdPcBf', 'Ql4cP6BCCy', 'DUdcGTja75', 'Lexc9FIdko', 'UbQc5aOs3L', 'fhwcugq8G7', 'sIGc3j0Eta', 's7iUeBbUG7', 'RDaUaU9d4R', 'fwZUgFxovg'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, bZcaLD0uKo2Rp9JIJJ.cs	High entropy of concatenated method names: 'VdwmsuItXn', 'N32mAQdxM1', 'w15mVBMVte', 'cLum0MOEai', 'F6EmSVMRn3', 'WOsmRW7y5l', 'YfYmMp5exn', 'hBVmUG6ink', 'Ig6mc1ysFd', 'VybmHciAeG'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, tVkAv962ia6mNwDn3y.cs	High entropy of concatenated method names: 'QriMTQfWw5', 'HCxMj2RNh5', 'ToString', 'TMKM9d0815', 'Du4M5EZo18', 'HgLMmvUKqR', 'wlRMu2lnSD', 'gs2M3yM17D', 'X4sM14cSVC', 'd6nM2nncSV'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, gPKii5OvqKVJBMPXbW.cs	High entropy of concatenated method names: 'MUjuwklgAB', 'qEkudQS7Tp', 'AZvmtX8Xpv', 'YI7mLqj0Ly', 'daxmKcUKfu', 'yA5mQidSoN', 'kO3mChb4NG', 'chymqJYe0Y', 'NYsmrcsBJO', 'K67my7S31a'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, orYxNxNLXwG34pPgTX.cs	High entropy of concatenated method names: 'CaeSy0LR4d', 'r1KShKipmv', 'e04SNMmy49', 'ppPSEHIifo', 'hGpSpun9XQ', 'hGpStelelJ', 'sF6SLuHRf3', 'WIMSKEqTrt', 'YmOSQb1VhW', 'LheSCiFK2C'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, jD6LUMbPYWdPHuPYK33.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'cBcHNin0mZ', 'mwCHENio49', 'cuqHZY5iWu', 'wvMH6EOP9Q', 'VtlHXNQmDI', 'RM3HvJkpox', 'KXhHeBTTiR'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, SUe8pgvf60RqW55B9f.cs	High entropy of concatenated method names: 'YS0MalCl39', 'q1iMBHNRJy', 'h1sU4aKkvq', 'kbWUbJsFvv', 'URaMoQYkF0', 'oTBMhepXL8', 'zYnM8pYMPk', 'FFAMNwHHa1', 'VtAMEnGmNd', 'w0rMZpGQf6'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, eJ2ggYnoVUcV3yRKRj.cs	High entropy of concatenated method names: 'sMSIOvhKm', 'WVWs5RTdh', 'M2bALe6nx', 'iCNd5fqlW', 'HaY0rPSjs', 'i08OMxlc2', 'W3OnENGDkEoLrNrx06', 'PXAWMYMO6txLHUAsoE', 'YOrUIuH6R', 'HkVHham4k'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, WJSKSKalbjKpJR0gJ8.cs	High entropy of concatenated method names: 'T7vU9w1FFh', 'HMbU5lCemR', 'rA8UmZTm9P', 'wS0UuTfe6M', 'jSOU3Kglkl', 'jdZU1JbquA', 'Vl9U2nGCoO', 'LcJU7bRvKM', 'ytXUThYVSJ', 'IcOUjmguJM'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, kI7eRSzyL4mxWFQF33.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NuPckmUhdv', 'AiqcSQfpks', 'WjacR5QOD2', 'qf6cMlr7pd', 'EH3cUqcfVx', 'YMKcctgaVO', 'vekcHehKjn'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, cPZCAoVt2erFRDjGhH.cs	High entropy of concatenated method names: 'ALF5N0lCvm', 'F9v5EmZ43U', 'fsS5Zk8l47', 'wvK56MWTWc', 'Yoc5XsZjkk', 'fSX5vMC6MW', 'Ein5edxLc3', 'vQ55aBVpVp', 'AWB5gd7lU3', 'mg95BuHlRc'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, yApeYc8WaNB4HBkP1N.cs	High entropy of concatenated method names: 'gQykVWe2fR', 'EGKk023Omv', 'TmbkiRRxxx', 'RK6kpDrhmn', 'yANkLJNYiS', 'uQLkK5STe5', 'pWAkCowqkJ', 't8dkqA25pM', 'TgkkylljNv', 'WcFkopISbU'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, D6CxCerasCskEeJmWe.cs	High entropy of concatenated method names: 'oUT1FR94nc', 'OgJ1WYMQsy', 'HWL1IvaZEO', 'haX1syuyjD', 'RXY1wY6Fdr', 'RSP1AnR4RT', 'fHf1dsJboJ', 'VkE1VpuQhg', 'lmQ10aU1Nh', 'GOU1O7y2I7'
Source: 0.2.Docs.exe.a1b0000.8.raw.unpack, OMn28yb4PnIYjLbooDr.cs	High entropy of concatenated method names: 'cqVcFECcu0', 'rs5cWRtN5n', 'yMPcI5qtGo', 't2lcsKcBQA', 'cE2cwnV1wN', 'nxMcAlS0NS', 'kDScdGgQID', 'LINcV8jNXq', 'GU8c0WrORo', 'hyncOTUBmq'

Source: C:\Users\user\Desktop\Docs.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Docs.exe PID: 7388, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Docs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: 1070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: 2B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: 2890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: 79E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: 89E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: 8B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: 9B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: A230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: B230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: C230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: 17E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: 3410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Memory allocated: 3260000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe	Window / User API: threadDelayed 5431			Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Window / User API: threadDelayed 1839			Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe TID: 7408	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7736	Thread sleep count: 5431 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7736	Thread sleep count: 1839 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -99233s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -98468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -98136s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -97920s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -97590s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -97484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -97375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -97265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -97156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -97047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -96937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -96828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -96718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -96609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -96500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -96390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -96281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -96172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe TID: 7732	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Docs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Docs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 99233	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 98468	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 98136	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 97920	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 97590	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 97484	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 97375	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 97265	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 97156	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 97047	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 96937	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 96828	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 96718	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 96609	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 96500	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 96390	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 96281	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 96172	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Docs.exe, 00000002.00000002.2990281879.000000000152A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Docs.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Docs.exe

Memory written: C:\Users\user\Desktop\Docs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe

Process created: C:\Users\user\Desktop\Docs.exe "C:\Users\user\Desktop\Docs.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Users\user\Desktop\Docs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Users\user\Desktop\Docs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Docs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Docs.exe.48a3e18.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Docs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Docs.exe.48de838.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Docs.exe.48de838.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Docs.exe.48a3e18.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2996631078.0000000003461000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2989969989.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1807736148.00000000048A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Docs.exe PID: 7388, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Docs.exe PID: 7576, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Docs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Docs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Docs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Docs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Docs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.Docs.exe.48a3e18.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Docs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Docs.exe.48de838.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Docs.exe.48de838.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Docs.exe.48a3e18.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2996631078.0000000003461000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2989969989.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1807736148.00000000048A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Docs.exe PID: 7388, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Docs.exe PID: 7576, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Docs.exe.48a3e18.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Docs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Docs.exe.48de838.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Docs.exe.48de838.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Docs.exe.48a3e18.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2996631078.0000000003461000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2989969989.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1807736148.00000000048A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Docs.exe PID: 7388, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Docs.exe PID: 7576, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Docs.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
Docs.exe	75%	Virustotal		Browse
Docs.exe	100%	Avira	HEUR/AGEN.1308740
Docs.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
mail.alkuwaiti.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
http://mail.alkuwaiti.com	0%	Avira URL Cloud	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	Virustotal		Browse
http://mail.alkuwaiti.com	0%	Virustotal		Browse
http://www.founder.com.cn/cn	0%	Virustotal		Browse
http://www.founder.com.cn/cn/cThe	0%	Virustotal		Browse
http://www.zhongyicts.com.cn	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.alkuwaiti.com	50.87.219.149	true	true	0%, Virustotal, Browse	unknown
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.alkuwaiti.com	Docs.exe, 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ctvnews.ca/rss/business/ctv-news-business-headlines-1.867648	Docs.exe	false		high
http://www.fontbureau.com/designers/?	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	Docs.exe, 00000000.00000002.1807736148.00000000048A3000.00000004.00000800.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2989969989.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	Docs.exe, 00000002.00000002.2996631078.0000000003411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.i.lencr.org/0	Docs.exe, 00000002.00000002.2990281879.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2990281879.00000000014F4000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	Docs.exe, 00000000.00000002.1807736148.00000000048A3000.00000004.00000800.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2996631078.0000000003411000.00000004.00000800.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2989969989.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ctvnews.ca/rss/ctvnews-ca-top-stories-public-rss-1.822009	Docs.exe	false		high
http://xml.weather.yahoo.com/ns/rss/1.0	Docs.exe	false		high
http://x1.c.lencr.org/0	Docs.exe, 00000002.00000002.2990281879.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.3012553587.0000000006BFD000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	Docs.exe, 00000002.00000002.2990281879.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.3012553587.0000000006BFD000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://weather.yahooapis.com/forecastrss?w=4118	Docs.exe	false		high
http://r3.o.lencr.org0	Docs.exe, 00000002.00000002.2990281879.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2990281879.00000000014F4000.00000004.00000020.00020000.00000000.sdmp, Docs.exe, 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Docs.exe, 00000002.00000002.2996631078.0000000003411000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Docs.exe, 00000000.00000002.1810847531.0000000006C22000.00000004.00000800.00020000.00000000.sdmp, Docs.exe, 00000000.00000002.1810817443.0000000005B50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
50.87.219.149	mail.alkuwaiti.com	United States		46606	UNIFIEDLAYER-AS-1US	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432055
Start date and time:	2024-04-26 11:08:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Docs.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 166 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:09:16	API Interceptor	37x Sleep call for process: Docs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
50.87.219.149	Ziraat Swift Bildirimi.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.hyperfocusmasterclass.com/gg58/?f0=BXeHzp&3f=5Ix8alVOa82T/DZIfBhrjeSKtZ641IDQQHgZKH1ZvtSurMdm0kyXcXMOnWQHCxpuENZh
50.87.219.149	Ziraat Swift Bildirimi.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.hyperfocusmasterclass.com/gg58/?RZwp=5Ix8alVOa82T/DZIfBhrjeSKtZ641IDQQHgZKH1ZvtSurMdm0kyXcXMOnWQHCxpuENZh&2d6tXz=j8vX
172.67.74.152	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.alkuwaiti.com	SecuriteInfo.com.Win32.MalwareX-gen.3610.30636.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
	Bank slip.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
	PO#240.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
	Shipping Docs.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
	SecuriteInfo.com.W32.MSIL_Kryptik.DWR.gen.Eldorado.6551.17723.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
api.ipify.org	Statement of Account PDF.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Payment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	Payment Swift.doc	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://lide.alosalca.fun/highbox#joeblow@xyz.com	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://asana.wf	Get hash	malicious	Unknown	Browse	172.67.74.152
	o3KyzpE7F4.ps1	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	http://wsj.pm	Get hash	malicious	NetSupport RAT	Browse	104.26.12.205
	16770075581.zip	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	http://www.tbmuae.com/	Get hash	malicious	GRQ Scam	Browse	198.57.149.230
	Statement of Account PDF.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.195.61
	Quotation Order.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.166
	DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.253.239
	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.195.61
	INQ No. HDPE-16-GM-00- PI-INQ-3001.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	162.240.81.18
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	192.232.216.145
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	192.232.216.145
	DOC-Zcns1G_.html	Get hash	malicious	HTMLPhisher	Browse	192.232.216.145
CLOUDFLARENETUS	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	https://deebmpapst.ordineproposal.top/	Get hash	malicious	Unknown	Browse	104.17.2.184
	Statement of Account PDF.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://powerpointmicrosoftoffice.top/	Get hash	malicious	Unknown	Browse	104.17.3.184
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:d35aec95-f365-414c-8371-68e6d7d2ec41	Get hash	malicious	Unknown	Browse	104.17.28.92
	150-425-2024.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Payment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://usigroups-my.sharepoint.com/:o:/p/js/Es3HdUJZlbVJngCJE-Z7JCYBUTZvd1ZCMQwZhhlQoy_hDw?e=mT2aQm	Get hash	malicious	HTMLPhisher	Browse	172.67.144.70
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Statement of Account PDF.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	CHEMICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Payment.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SOA FOR APR 2024 PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	DHL_ES567436735845755676678877988975877.vbs	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	172.67.74.152
	PO-inv-CQV20(92315).exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	a.cmd	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://papajoeschicago.com	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	172.67.74.152
	o3KyzpE7F4.ps1	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\Docs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.885360040283727
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	Docs.exe
File size:	765'952 bytes
MD5:	28da32c1cf8ead709f4888f84a697c28
SHA1:	45122f3c46fb3400cc6710a830a259da54b07298
SHA256:	c10f8bc18521b4c90063ae5fc1e0e95e40ed35be3758d90f597d7cc1e3853ade
SHA512:	6d67f361a2f126e35f31e0ff5298bed2ee36e0262a8d71ec5254277c2ed122d9769bb7cc168d00b47616fd381f625a1a6542854c84d9c7cc184c607312fdef13
SSDEEP:	12288:90K/pbM4nsSz3ITyeYmaNKiz4xrreLpSYHK6rPILRwwAF9:90iM4nuTyVXNDz4xIYGK2Wg9
TLSH:	E3F4226475292732C4BEAFFD4535214063F235621031E74EEE7720CE59E2B84E746BAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|. f..............0..p...0......Z.... ........@.. ....................................@................................

File Icon


Icon Hash:	6dd4d6ccd6d0b24c

Static PE Info

General

Entrypoint:	0x4b805a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6620AC7C [Thu Apr 18 05:15:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb8008	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xba000	0x17d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb6060	0xb7000	ae9d83efb9d569732c0bdfa000ac415b	False	0.9395932056864754	data	7.932093151014693	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xba000	0x17d8	0x2000	ec750b011cc447bc16b980807c25680f	False	0.6085205078125	data	5.79573287972307	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbc000	0xc	0x1000	042375526db1ce8fb6934e0da297d4e5	False	0.0087890625	data	0.016408464515625623	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xba0c8	0x139b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8963937039250847
RT_GROUP_ICON	0xbb474	0x14	data	1.05
RT_VERSION	0xbb498	0x33c	data	0.4214975845410628

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 11:09:20.549547911 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 26, 2024 11:09:20.549606085 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 26, 2024 11:09:20.549781084 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 26, 2024 11:09:20.557881117 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 26, 2024 11:09:20.557900906 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 26, 2024 11:09:20.825259924 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 26, 2024 11:09:20.825352907 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 26, 2024 11:09:20.830579996 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 26, 2024 11:09:20.830596924 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 26, 2024 11:09:20.830882072 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 26, 2024 11:09:20.876080036 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 26, 2024 11:09:20.904191017 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 26, 2024 11:09:20.952114105 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 26, 2024 11:09:21.145210981 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 26, 2024 11:09:21.145282030 CEST	443	49733	172.67.74.152	192.168.2.4
Apr 26, 2024 11:09:21.145344973 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 26, 2024 11:09:21.151221991 CEST	49733	443	192.168.2.4	172.67.74.152
Apr 26, 2024 11:09:21.896614075 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:22.092892885 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:22.092998981 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:22.384306908 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:22.389646053 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:22.586029053 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:22.586282015 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:22.783960104 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:22.784581900 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:22.989820004 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:22.989872932 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:22.989922047 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:22.989974976 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:23.019022942 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:23.215970039 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:23.219171047 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:23.415527105 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:23.422177076 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:23.618886948 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:23.619270086 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:23.856240034 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:25.414894104 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:25.415215969 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:25.611457109 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:25.611517906 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:25.612840891 CEST	587	49736	50.87.219.149	192.168.2.4
Apr 26, 2024 11:09:25.612910986 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:25.617748976 CEST	49736	587	192.168.2.4	50.87.219.149
Apr 26, 2024 11:09:25.813889980 CEST	587	49736	50.87.219.149	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 11:09:20.417000055 CEST	60663	53	192.168.2.4	1.1.1.1
Apr 26, 2024 11:09:20.542772055 CEST	53	60663	1.1.1.1	192.168.2.4
Apr 26, 2024 11:09:21.696875095 CEST	60655	53	192.168.2.4	1.1.1.1
Apr 26, 2024 11:09:21.895638943 CEST	53	60655	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 11:09:20.417000055 CEST	192.168.2.4	1.1.1.1	0xf223	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:09:21.696875095 CEST	192.168.2.4	1.1.1.1	0x683e	Standard query (0)	mail.alkuwaiti.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 11:09:20.542772055 CEST	1.1.1.1	192.168.2.4	0xf223	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:09:20.542772055 CEST	1.1.1.1	192.168.2.4	0xf223	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:09:20.542772055 CEST	1.1.1.1	192.168.2.4	0xf223	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 26, 2024 11:09:21.895638943 CEST	1.1.1.1	192.168.2.4	0x683e	No error (0)	mail.alkuwaiti.com	50.87.219.149	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	172.67.74.152	443	7576	C:\Users\user\Desktop\Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 09:09:20 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-26 09:09:21 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 09:09:21 GMT Content-Type: text/plain Content-Length: 15 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a56ef68d2ba683-MIA
2024-04-26 09:09:21 UTC	15	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 32 30 Data Ascii: 102.129.152.220

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 26, 2024 11:09:22.384306908 CEST	587	49736	50.87.219.149	192.168.2.4	220-box2389.bluehost.com ESMTP Exim 4.96.2 #2 Fri, 26 Apr 2024 03:09:22 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 26, 2024 11:09:22.389646053 CEST	49736	587	192.168.2.4	50.87.219.149	EHLO 320946
Apr 26, 2024 11:09:22.586029053 CEST	587	49736	50.87.219.149	192.168.2.4	250-box2389.bluehost.com Hello 320946 [102.129.152.220] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 26, 2024 11:09:22.586282015 CEST	49736	587	192.168.2.4	50.87.219.149	STARTTLS
Apr 26, 2024 11:09:22.783960104 CEST	587	49736	50.87.219.149	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	11:09:15
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\Docs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Docs.exe"
Imagebase:	0x680000
File size:	765'952 bytes
MD5 hash:	28DA32C1CF8EAD709F4888F84A697C28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1807736148.00000000048A3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1807736148.00000000048A3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:09:19
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\Docs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Docs.exe"
Imagebase:	0xf10000
File size:	765'952 bytes
MD5 hash:	28DA32C1CF8EAD709F4888F84A697C28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2996631078.0000000003461000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2996631078.0000000003461000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2996631078.000000000348B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2989969989.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2989969989.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	190
Total number of Limit Nodes:	15

Executed Functions

Function 075310A0 Relevance: 1.7, Strings: 1, Instructions: 432
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tIh, xrefs: 07531545

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: a0c76207e6429d859a0df46e3c597e68447687fd3c99450ae3dd0a5c573db54b
Instruction ID: a33ab98bbbe1ce65d8dad428de713114b53ee8d17c9ddd78b34d53263a46e05f
Opcode Fuzzy Hash: a0c76207e6429d859a0df46e3c597e68447687fd3c99450ae3dd0a5c573db54b
Instruction Fuzzy Hash: 38F1C0B0915A09DFDB04CFB5D8818EEFBB5FF4A305B10C656E416AB264D7309642CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07531190 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

tIh, xrefs: 07531545

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: tIh
API String ID: 0-443931868
Opcode ID: 84f0997068ae08ead1dcc2b1c2598263ae664c511b2f1cff4419502dc87b7b37
Instruction ID: c235ca5a1e2a403c3c20b12b46774ccc74559a309fab226cc213081b42b7cf43
Opcode Fuzzy Hash: 84f0997068ae08ead1dcc2b1c2598263ae664c511b2f1cff4419502dc87b7b37
Instruction Fuzzy Hash: B6D12CB0D14A0ADFCB04CFAAD5858EEFBB2FF4A301B10D555E412AB264D735A942CF94

Uniqueness

Uniqueness Score: -1.00%

Function 075341E8 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbac9072c3962d97f2ded25f79dc474d90f3c29a0fa8892dc2508b58b84d222c
Instruction ID: 23d76f582cf5342f7c550566b1fdff1333c3330a1a1ffb3f57025b1562863582
Opcode Fuzzy Hash: fbac9072c3962d97f2ded25f79dc474d90f3c29a0fa8892dc2508b58b84d222c
Instruction Fuzzy Hash: 509118B0D15249DFCB48CFE5E584AEDBBB2FB8A300F20A41AE416BB264D7349945CF14

Uniqueness

Uniqueness Score: -1.00%

Function 075341D8 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07af7d5ed37e1cf2b0a9a79081e0fb50f0e98872d152e082db2b1ceb71b08b42
Instruction ID: 1277c6ba7dc1c90d7000f6b485b6d12ff757f4f3e1e28913acf71969e0101f13
Opcode Fuzzy Hash: 07af7d5ed37e1cf2b0a9a79081e0fb50f0e98872d152e082db2b1ceb71b08b42
Instruction Fuzzy Hash: 029118B4D15249DFCB48CFA5E584AEDBBB2FF8A300F20A41AE415BB264D73499458F14

Uniqueness

Uniqueness Score: -1.00%

Function 07533EC1 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690d300bebd260cd13844985be63038bf97c7f2272b4ac3eff60feaac1cb1626
Instruction ID: c52a2ede3257153b2d8711a34992aed02042e6a24cd2e6c6bc86b8f25b3a7bb3
Opcode Fuzzy Hash: 690d300bebd260cd13844985be63038bf97c7f2272b4ac3eff60feaac1cb1626
Instruction Fuzzy Hash: 748112B4E15219CFCF04CFA9D9809EEFBB1FB89300F50995AD801A7264D7399912CB54

Uniqueness

Uniqueness Score: -1.00%

Function 07533ED0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27cec5dd4961f109899b73545d2c447dea610d2e3e71538603acd5b959b200e6
Instruction ID: 5f79d4a80f31d8df91adfa632ad0e6760350f681a570a946898d2b02416d75ff
Opcode Fuzzy Hash: 27cec5dd4961f109899b73545d2c447dea610d2e3e71538603acd5b959b200e6
Instruction Fuzzy Hash: 558101B4E14219CFCF04CFA9D9809EEFBB1FB89300F50A95AD801A7264D7399952CF54

Uniqueness

Uniqueness Score: -1.00%

Function 075302E0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b847a5c670fcb02b106c29ddf447293511fb291d162760676fcc25077943df53
Instruction ID: d30eaee5d0184d36e4ede19267b8bc0537a8148df60dcccc5ee06b237408624b
Opcode Fuzzy Hash: b847a5c670fcb02b106c29ddf447293511fb291d162760676fcc25077943df53
Instruction Fuzzy Hash: 2221EAB1E016188BEB18CFABD9442DEFBF7AFC9310F14C07AD409A6268DB741A45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 075302D2 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0fe709b93d6e7081be97a0d74696b200f00029fc9ecbed22e001f3e87d1166
Instruction ID: d6e9064e10e42ef02daff977c3a9b2a1fe2295d3ae7a0821f8af8f7242c8d9ba
Opcode Fuzzy Hash: 4d0fe709b93d6e7081be97a0d74696b200f00029fc9ecbed22e001f3e87d1166
Instruction Fuzzy Hash: 9121EDB1E016598BDB18CFABD9452DEBFF3AFC9310F14C07AD408AA268DB741A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 075D37D3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167eb770f5630bfb105b7adf0c2f9daaa4a733ce42c4e4e0b48a1d039103b251
Instruction ID: 11e9b6721dae15e19c797599ed80dda108e253ff0b12d5db81417f8b7662bfc6
Opcode Fuzzy Hash: 167eb770f5630bfb105b7adf0c2f9daaa4a733ce42c4e4e0b48a1d039103b251
Instruction Fuzzy Hash: 85C092A6EAE088D689305CCC74010F9F33DF6CB0B6F413862CA1EAB02245308E291BD9

Uniqueness

Uniqueness Score: -1.00%

Function 0107D2B1 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0107D33E
GetCurrentThread.KERNEL32 ref: 0107D37B
GetCurrentProcess.KERNEL32 ref: 0107D3B8
GetCurrentThreadId.KERNEL32 ref: 0107D411

Memory Dump Source

Source File: 00000000.00000002.1806079694.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_Docs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 87b169ed89a2df5fd251385b58a85770be27d6d4673fe7759ab25e45dbaf721b
Instruction ID: dc02e38af1ea3cd08880b0655193fcf846aa3f81fb7f692df9cf317013a0d20e
Opcode Fuzzy Hash: 87b169ed89a2df5fd251385b58a85770be27d6d4673fe7759ab25e45dbaf721b
Instruction Fuzzy Hash: 995137B0D0034A8FDB14DFA9D548BDEBBF1AF88314F20C469E459A72A0DB749984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0107D2C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0107D33E
GetCurrentThread.KERNEL32 ref: 0107D37B
GetCurrentProcess.KERNEL32 ref: 0107D3B8
GetCurrentThreadId.KERNEL32 ref: 0107D411

Memory Dump Source

Source File: 00000000.00000002.1806079694.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_Docs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: fd9d047caa9c385aff6fa4857b9a3090c2fa7baa481c3133bba062a9be83b40b
Instruction ID: 6ef4dadabc26242e80c578195f8bd92dc366a49befca58b9460873eaa0277f8e
Opcode Fuzzy Hash: fd9d047caa9c385aff6fa4857b9a3090c2fa7baa481c3133bba062a9be83b40b
Instruction Fuzzy Hash: 8D5135B0D0024A8FDB14DFA9D548BDEBBF1AF48304F20C469E059A72A0DB74A984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0107B028 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0107B27E

Strings

N, xrefs: 0107B1DB
N, xrefs: 0107B1B6

Memory Dump Source

Source File: 00000000.00000002.1806079694.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_Docs.jbxd

Similarity

API ID: HandleModule
String ID: N$N
API String ID: 4139908857-1044518071
Opcode ID: b0f21819ddd4f52bf90b8dab8d944382c1a9219f3f3b2be19c8f1ad2c33ae59c
Instruction ID: dd2bac0dffb635e0f858c66fe3f7cb3ab8fbcbe396499ec6e90040199729f749
Opcode Fuzzy Hash: b0f21819ddd4f52bf90b8dab8d944382c1a9219f3f3b2be19c8f1ad2c33ae59c
Instruction Fuzzy Hash: B3715370A00B058FE765DF2AD45579ABBF1FF88304F008A29D48AD7B50DB35E945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 07535688 Relevance: 3.9, Strings: 3, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8bq, xrefs: 075357A0
Te^q, xrefs: 075358B3
8bq, xrefs: 0753570A

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: 8bq$8bq$Te^q
API String ID: 0-800215726
Opcode ID: e0e312e7754b8ea70e4779a15bb8dbf576f16d674520324dec416865b9b7faa6
Instruction ID: dd8cd6100098f6d75679f8b34844ccc8e082f794cca75055c9fbfa30e4f952a3
Opcode Fuzzy Hash: e0e312e7754b8ea70e4779a15bb8dbf576f16d674520324dec416865b9b7faa6
Instruction Fuzzy Hash: AB31C0B4B11205DFD7008B69C844AFA7BF2BF85346F24807AD109AB3A1EB79C952C791

Uniqueness

Uniqueness Score: -1.00%

Function 075317D0 Relevance: 2.6, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3H5, xrefs: 07531860
3H5, xrefs: 0753186E

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: 3H5$3H5
API String ID: 0-2752242361
Opcode ID: 33d389a938ea6b602bcd735c42c74c47c3c47c92585191537a76eb635df5fdd0
Instruction ID: e6df79e4b2cb2373ed16872910fc190688a683d81810ba82c9d27ce0128e10e2
Opcode Fuzzy Hash: 33d389a938ea6b602bcd735c42c74c47c3c47c92585191537a76eb635df5fdd0
Instruction Fuzzy Hash: B3214AB0D10A09DFDB44CFA9D5409AEFBF1FF89300F14C56AD508A7264E7309A45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 075D1C04 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 075D1E46

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4edbf852d7c87727e8d57544e5ad2aab6e8fee6ead19414b7e71861513412104
Instruction ID: 29091b5a14b21606cfc5ee3990d37c988057e7dcedefdcec62019c328882edb8
Opcode Fuzzy Hash: 4edbf852d7c87727e8d57544e5ad2aab6e8fee6ead19414b7e71861513412104
Instruction Fuzzy Hash: 2AA15DB1D0061ADFDB20DFA8C8417DDBBB2FF48314F15856AD809A7290DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 075D1C10 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 075D1E46

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 639b80288dbcd1e271b9bfd174985226e9b9d3eba6c31a7f26d06dd45c4ad8d4
Instruction ID: 390c4e43d085c78050c09ad5c9078051e9cf0265a3d95826d6499c061e9aa33f
Opcode Fuzzy Hash: 639b80288dbcd1e271b9bfd174985226e9b9d3eba6c31a7f26d06dd45c4ad8d4
Instruction Fuzzy Hash: 2E914CB1D0061EDFDB20DFA8C8417DDBBB2BF48314F1585AAE809A7290DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 010744C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010759C9

Memory Dump Source

Source File: 00000000.00000002.1806079694.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_Docs.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1b8093705670244176e1965dd04e5569340d3ddbf64e00706bd3c546f37a04fe
Instruction ID: 2427b8c8a86b73194c60a1f4cae879bbe3c9056609a3c2fa6db490076beaf869
Opcode Fuzzy Hash: 1b8093705670244176e1965dd04e5569340d3ddbf64e00706bd3c546f37a04fe
Instruction Fuzzy Hash: CD41E0B0C00719DBDB24DFA9C884ACEBBF5BF49304F2480AAD448AB255DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0107590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010759C9

Memory Dump Source

Source File: 00000000.00000002.1806079694.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_Docs.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: cf12cb53ad7c8be98763ede88dd7aa28c99ee31b40b1fd0a1a5a5aef2377bafa
Instruction ID: 338c70fa47734d9cd97640704b8f3dddb50dc591c13e299447aec3935103e0a1
Opcode Fuzzy Hash: cf12cb53ad7c8be98763ede88dd7aa28c99ee31b40b1fd0a1a5a5aef2377bafa
Instruction Fuzzy Hash: 6941EFB0C00719DFDB24DFA9C884ADEBBF5BF48304F2480AAD448AB251DB755986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 075D4AD0 Relevance: 1.6, APIs: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 075D4B35

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c0120d4fa936dc956c7d90c67fc8d9f8d960fcd647d4bf2c9fb5d3d4a0f9589d
Instruction ID: 4205a819de33b7a844238402834ae9019d639867886ac4fb5406314b6a83b720
Opcode Fuzzy Hash: c0120d4fa936dc956c7d90c67fc8d9f8d960fcd647d4bf2c9fb5d3d4a0f9589d
Instruction Fuzzy Hash: CC3102B5900249DFCB20DF9AD589BDEBFF8FB48324F10841AD958A7240D375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 075D1980 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 075D1A18

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: df4a8f8d77b48126fec723589389150024e9f24da5688468a4fe425e960e1ca7
Instruction ID: cdbeb3d12568e4ced9481f0b940f2050c72091466f40182678a8108abd50495d
Opcode Fuzzy Hash: df4a8f8d77b48126fec723589389150024e9f24da5688468a4fe425e960e1ca7
Instruction Fuzzy Hash: A52148B59002199FCB10DFA9C9857DEBBF5FF48310F10842AE559A7240C7789945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 075D1988 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 075D1A18

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: efb7f08c0c2db154bac139d5f57c577787e6b3598b13d0c8da848c92f0ce7e10
Instruction ID: 74e68b0511b576e3f46b63e7b5c187e5399cd91883d39d52e0ee6056009ad2c1
Opcode Fuzzy Hash: efb7f08c0c2db154bac139d5f57c577787e6b3598b13d0c8da848c92f0ce7e10
Instruction Fuzzy Hash: 712136B590035D9FCB10CFA9C885BDEBBF5FF48310F10842AE958A7250C7789984CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 075D13B0 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 075D1436

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3ce86cc960c86d1015a1ceea5ae6a17ea5f3ff515ff62cfc1161243897311ea3
Instruction ID: 6cc483c020fdeaba027feecbcc22a47de72cca380b9b9c71c6d9f78c23e74683
Opcode Fuzzy Hash: 3ce86cc960c86d1015a1ceea5ae6a17ea5f3ff515ff62cfc1161243897311ea3
Instruction Fuzzy Hash: 1B2165B6D002098FDB20DFA9C5857EEBBF4EF48320F14842AD459A7241DB789985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 075D1A70 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 075D1AF8

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 52710471c48d75d94321bf1ac8a66440ddb0fab555534231465ca9bc9ad90947
Instruction ID: 27f831309d05575a6b1787662a9f8cd022f6fd49ce4f937dd4b789fba38a6f88
Opcode Fuzzy Hash: 52710471c48d75d94321bf1ac8a66440ddb0fab555534231465ca9bc9ad90947
Instruction Fuzzy Hash: 9F214AB19003599FDB10DFA9C840AEEBBF5FF48320F10852AE569A7250C7389941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0107D501 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0107D58F

Memory Dump Source

Source File: 00000000.00000002.1806079694.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_Docs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cac41435bff03b2247bbcbccccaef6409b6e44df52605b86916704a238fa2f45
Instruction ID: bbacb0ceb8d337db00a7e518e6b01b85c70605858ae379a515c2c6c8d61feb46
Opcode Fuzzy Hash: cac41435bff03b2247bbcbccccaef6409b6e44df52605b86916704a238fa2f45
Instruction Fuzzy Hash: EE21E3B59002199FDB10CFAAD584ADEBFF8EB48310F14841AE958A7350D374A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 075D13B8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 075D1436

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: deb565ea88b8ed536f28fada732524f3fefb547f9e99040fdb87b9603a5a2c98
Instruction ID: 8357869c349ad9ac360f4c643ab8ac55c1703ec4d1520c5a090530d62be79c82
Opcode Fuzzy Hash: deb565ea88b8ed536f28fada732524f3fefb547f9e99040fdb87b9603a5a2c98
Instruction Fuzzy Hash: D92118B1D002098FDB10DFAAC4857EEBBF4EF48324F54842AD459A7241D7789985CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 075D1A78 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 075D1AF8

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b51e54d49983789940ee3d1710f887651e5e14986552514c6fa98bf15db98bea
Instruction ID: 430f116a8e2b62783fc53e05999cb7cef47348864cd09540534155fa18910528
Opcode Fuzzy Hash: b51e54d49983789940ee3d1710f887651e5e14986552514c6fa98bf15db98bea
Instruction Fuzzy Hash: 1D2139B19003599FDB10DFAAC884ADEFBF5FF48310F10842AE559A7250C7789944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0107D508 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0107D58F

Memory Dump Source

Source File: 00000000.00000002.1806079694.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_Docs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 99990b8310acc97990ea80b450b238b41a1399c385fc8f8e20b20395aa237c49
Instruction ID: 03e0dc2fedae6160c678687111f0796eb5e1373426ce5500a8baf2d255e72d1d
Opcode Fuzzy Hash: 99990b8310acc97990ea80b450b238b41a1399c385fc8f8e20b20395aa237c49
Instruction Fuzzy Hash: 8D21E4B5D002189FDB10CFAAD584ADEBFF8EB48310F14841AE958A3350D374A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0107ACDC Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0107B2F9,00000800,00000000,00000000), ref: 0107B50A

Memory Dump Source

Source File: 00000000.00000002.1806079694.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_Docs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 23a9b17ec82d999549e49848bf76027da75fa3651f9c809a68d17e42601c3d05
Instruction ID: 7b4dbfec4675c8bf6dddb987acb1f235374b93957fda02e4ed59ae0baf1de3ba
Opcode Fuzzy Hash: 23a9b17ec82d999549e49848bf76027da75fa3651f9c809a68d17e42601c3d05
Instruction Fuzzy Hash: A51126B6D003089FDB20CFAAC448BDEFBF4EB48310F10842AD959A7210C775A545CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 075D18C2 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 075D1936

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e04f490d91bf7c6d2d4173da9b2641675494d44192839fcbb0661ea02089f3f6
Instruction ID: 54ebfed5bd8d0deeac70f894ace4bfe87fb411cb757b66e4d794bcbb0a949198
Opcode Fuzzy Hash: e04f490d91bf7c6d2d4173da9b2641675494d44192839fcbb0661ea02089f3f6
Instruction Fuzzy Hash: 25116AB6900209CFCB10DFA9C8457DEBBF5EF48320F10881AD559A7250C7359545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0107B498 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0107B2F9,00000800,00000000,00000000), ref: 0107B50A

Memory Dump Source

Source File: 00000000.00000002.1806079694.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_Docs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: db1f94bcf0ec2229181ce6832feb0f7d9510824d389fd304b10f1fd7627454d2
Instruction ID: 3d387cd5b6f0953eefb555ebaf630dfc00152381bf0116f007098f899f7d9f89
Opcode Fuzzy Hash: db1f94bcf0ec2229181ce6832feb0f7d9510824d389fd304b10f1fd7627454d2
Instruction Fuzzy Hash: 791114B6D003488FDB20CFAAD544BDEFBF4EB88310F14842AD859A7210C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 075D18C8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 075D1936

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cf5a08b91c08a60a246c65a13bdb06ab99566728666ab7b248bb50aabe4bfafa
Instruction ID: 7407a205e0ff9692fcff1403612c72b21d21944808aa2deb8c6352bf4e51a2a0
Opcode Fuzzy Hash: cf5a08b91c08a60a246c65a13bdb06ab99566728666ab7b248bb50aabe4bfafa
Instruction Fuzzy Hash: 3B113AB59002499FCB10DFA9C844BDEBFF5EF48320F108419D559A7250C7759944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 075D1300 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 075D136A

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 24bc4bd710a218fe44e8e5068e74182accf38e56fd63df483fb36fa7a3b79b11
Instruction ID: 679169e39fa86c22ed93ff5fc25570ad93c1b0202d0fd11d53c08ee60aabef4a
Opcode Fuzzy Hash: 24bc4bd710a218fe44e8e5068e74182accf38e56fd63df483fb36fa7a3b79b11
Instruction Fuzzy Hash: D7116AB5D002098FDB20DFA9C4457DEFBF5EF88324F24841AC559A7250C779A944CF94

Uniqueness

Uniqueness Score: -1.00%

Function 075D1308 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 075D136A

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2858ef5b94aa6f580062d171a9c84e18de03073f124424935673825b28e41d3d
Instruction ID: cf47807709e76e77d3273179e0f0d573b9a9b6fb04a1b68bd3c0f4e9266daf35
Opcode Fuzzy Hash: 2858ef5b94aa6f580062d171a9c84e18de03073f124424935673825b28e41d3d
Instruction Fuzzy Hash: 511136B19002498FCB20DFAEC4457DEFBF5EF88324F20842AD459A7250CB79A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0107B218 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0107B27E

Memory Dump Source

Source File: 00000000.00000002.1806079694.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_Docs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 21642bfb711ce94644a36cf12ab1282b89d1481972860d528dc8781700bea69c
Instruction ID: 7cb6d4caac0bb25be16acd60c38279fd1cb44d093301aabde099f3bdec2008dd
Opcode Fuzzy Hash: 21642bfb711ce94644a36cf12ab1282b89d1481972860d528dc8781700bea69c
Instruction Fuzzy Hash: 4B11E0B6C013498FDB10CF9AD444ADEFBF4EB88324F10846AD969A7610C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 075D4AD8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 075D4B35

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2da558d0ffee5b8b88c72577f9035cd97568fb8473a7a4711c1b2b0266846f9f
Instruction ID: 3188e937194e40e6c4c629bdf54de7cdac0fee2073d1dd943b9faaaad4d231ea
Opcode Fuzzy Hash: 2da558d0ffee5b8b88c72577f9035cd97568fb8473a7a4711c1b2b0266846f9f
Instruction Fuzzy Hash: 6E11D3B58003499FDB10DF9AD489BDEFBF8FB48324F10841AD958A7250C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07535928 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

Te^q, xrefs: 07535A89

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 33e57625a3722393c1eecae53d9a064fb774c98e2ed04fd007e068c4f280038f
Instruction ID: 4cf2760d76c8acf1282b6b7bfd1943f9e5063e716afcc503a8c80fd34685a961
Opcode Fuzzy Hash: 33e57625a3722393c1eecae53d9a064fb774c98e2ed04fd007e068c4f280038f
Instruction Fuzzy Hash: A3517071B002068FCB15DB7998889BEBBF6FFC42207258969E459DB361EB309D058790

Uniqueness

Uniqueness Score: -1.00%

Function 0753CD00 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

r, xrefs: 0753CFE9

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: 92d64dc26d96595cfe2418e8601b65bb56c34ca1ec877b0fca23684679c734af
Instruction ID: 27e9df7c98a14615f093fb6326c7e14217617de8d8345607ed013fd27ef9b87d
Opcode Fuzzy Hash: 92d64dc26d96595cfe2418e8601b65bb56c34ca1ec877b0fca23684679c734af
Instruction Fuzzy Hash: 005109B0D19118DBCB44CFA9D4445EDBBBABF8E301F10D959E419BB2A1CB349941DF60

Uniqueness

Uniqueness Score: -1.00%

Function 0753B280 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0753B527

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 3a9a39a7f33369ce022bc072e3048ae63d09078b92bc20b29621706f7970bb5f
Instruction ID: b8ff09c7ff8f0777adc0eb4cd1fe03b5c296182e31a5896d5a4a9f5a18826671
Opcode Fuzzy Hash: 3a9a39a7f33369ce022bc072e3048ae63d09078b92bc20b29621706f7970bb5f
Instruction Fuzzy Hash: D44103F4E102188BDB14DFAAD9457EDBBF6BF89300F14D42AD409AB2A4DB345945CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0753390F Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

O};5, xrefs: 07533958

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: 7058231d722f5b214313348d26c5e8c9dc0be06b893fe455d5691734bc47915e
Instruction ID: c950626dd45ec0b5bcd932721c256690b7b9eab416651f086da5c5dc84222ea6
Opcode Fuzzy Hash: 7058231d722f5b214313348d26c5e8c9dc0be06b893fe455d5691734bc47915e
Instruction Fuzzy Hash: 3241CEB0A1524AEFCB44CF94E5888AEBFB1FF8A200F60D8D5D055AB3A4D7309A50CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0753CCFD Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

r, xrefs: 0753CFE9

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: 94087d61a3be57b98fe46a503cbffa985f8365a64b63f659e0a26bf7d2bf445c
Instruction ID: dbedc5975438930f74caeac87d57a66bba9061d75db4e1088172bcdf7e3df229
Opcode Fuzzy Hash: 94087d61a3be57b98fe46a503cbffa985f8365a64b63f659e0a26bf7d2bf445c
Instruction Fuzzy Hash: C8313DB4D29214DBCB49CFAAC4444EDBBBABF8E301F00D969E41A772A1C7309501DF60

Uniqueness

Uniqueness Score: -1.00%

Function 0753B350 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0753B527

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 230a2aea59c93658250a4689afde102c77c00c871eb720424e1f11ccee915d63
Instruction ID: fa061808d08e3b4e19eeb1fc5f6cea5306ecf58b0d3321e7f20b8895959d4cf6
Opcode Fuzzy Hash: 230a2aea59c93658250a4689afde102c77c00c871eb720424e1f11ccee915d63
Instruction Fuzzy Hash: 274117F4E152488FDB04DFEAD9446EDBBF6BF89300F24D42AD409AB265EB345905CB40

Uniqueness

Uniqueness Score: -1.00%

Function 07533920 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

O};5, xrefs: 07533958

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: O};5
API String ID: 0-3558557551
Opcode ID: 1e2875bbe5398a2ed7d577663310503140f1e3137f226a14f924ea34fd870c2c
Instruction ID: 9fca5a2fbaae1ecda4218015d3c786d2e520e3cf5e064e57eea8d29286f9021b
Opcode Fuzzy Hash: 1e2875bbe5398a2ed7d577663310503140f1e3137f226a14f924ea34fd870c2c
Instruction Fuzzy Hash: 7C418DB0A25209EFDB44CF99E5888AEBFB1FF89200F60D895D059A7368D7309A50CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0753B360 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0753B527

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 1d6264d92b606d7fcc583c0dc7dce9a7da1d369245d2ca58ecf7d12e1106f7d4
Instruction ID: 4c96d58abe83eb6f77e98e28cae9e3cee208788af468704a7b80cfe9cc03c2bc
Opcode Fuzzy Hash: 1d6264d92b606d7fcc583c0dc7dce9a7da1d369245d2ca58ecf7d12e1106f7d4
Instruction Fuzzy Hash: D631C8B4E152188BDB04DFEAD9446EEBBF6BF89300F14D42AD409AB364DB345945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0753BCD0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

x, xrefs: 0753BCFD

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 42962426be816879e2fe72dfeb4f6c7d75be57df011405cd4adbf769c04a6461
Instruction ID: b8d9b63ff01babd8e76c1c4de018648f1b42c33d21524423526061c5bd38cd3b
Opcode Fuzzy Hash: 42962426be816879e2fe72dfeb4f6c7d75be57df011405cd4adbf769c04a6461
Instruction Fuzzy Hash: 6D316FF4A19245CFCB41CBA8C585AEDBFF0FF4A310F24499AD418A73A2D3309A41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 075317C0 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

3H5, xrefs: 0753186E

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: 3H5
API String ID: 0-3899204960
Opcode ID: b128823d16c6cc201f005aad70e534ee24daa41d55569b4dc9a325362d8652be
Instruction ID: 60751e6fff22b51f59cbd8101b4e3df2b56c3184cc2f6220f7c0b19257934967
Opcode Fuzzy Hash: b128823d16c6cc201f005aad70e534ee24daa41d55569b4dc9a325362d8652be
Instruction Fuzzy Hash: 7F217AB0E11A0ADFDB05CFA9D5405AEFBF1FF8A200F24C5AAD104AB360D7308A45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0753B3F2 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

Te^q, xrefs: 0753B439

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: caa2d10f5698c77e43d9ee32a17cfabd9af6c7db60912ce0e70693169317af47
Instruction ID: 112e254b8aec8f2c15adafa74c0d8faab156cb00321b29719797a5c7380021cf
Opcode Fuzzy Hash: caa2d10f5698c77e43d9ee32a17cfabd9af6c7db60912ce0e70693169317af47
Instruction Fuzzy Hash: 01116A75E002199FCB08DFE9D8849ADBBB2FB88310F10812AE919AB365C735A955DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0753619C Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ce24fd46ae9d0e083a7e55410996ebccdea13c1c533e3ee813e0f5ca69b749
Instruction ID: b0250d7d8232610b01e7e46d1061786b046136d77e62253d4034235cf324b12f
Opcode Fuzzy Hash: 93ce24fd46ae9d0e083a7e55410996ebccdea13c1c533e3ee813e0f5ca69b749
Instruction Fuzzy Hash: 4D51B4B1A05349AFCB11DFA8D8459EEBFF5FF49210F1484AAE805E7222D735D901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07537C0D Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96eec396ffeaea9a88dd58d7fbcb9527cbc9485ec105df975c6d3af06375fbb
Instruction ID: f81e3643ac4990b0c641c814098dbd946b29651485f85f6b177fb4713d0f3419
Opcode Fuzzy Hash: b96eec396ffeaea9a88dd58d7fbcb9527cbc9485ec105df975c6d3af06375fbb
Instruction Fuzzy Hash: 7F519FB0E1020A9BEB049FA8C8907BEB7B2FF48704F108926E551972E5DB349D42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0753BB60 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aea8f142c293b70f320d2b3ab56bb28f11eda6134c9d0f0b8a8e16e6c4ce4696
Instruction ID: aa03d907ca96f321d5672370f91442b1de4f3c60abb488841fa85b6749caab19
Opcode Fuzzy Hash: aea8f142c293b70f320d2b3ab56bb28f11eda6134c9d0f0b8a8e16e6c4ce4696
Instruction Fuzzy Hash: 9B4146F4E19209CBDB08CF9AE4546EEBBF6FF89301F14D02AE409A32A1DB344941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 075337B8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd5432129b44ada03a1aec80cdc04e13a25d73001a32a66a2c49de7aa73fa8db
Instruction ID: 5e92a2137c4d4484418eb94e2358b9f75dd20c787a40b5ae4317938053d050f6
Opcode Fuzzy Hash: cd5432129b44ada03a1aec80cdc04e13a25d73001a32a66a2c49de7aa73fa8db
Instruction Fuzzy Hash: 8D41B1B8919784CFD706CF69E484988BFB0AF8A211F0A80C6D484DB3B3D6349985C712

Uniqueness

Uniqueness Score: -1.00%

Function 07533AA8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafea94a27e937987bc837e21f28955233fce16dc7c9f5da70d37721681059b1
Instruction ID: ea1b9ad8c8c6d0aa4f8ca30d5bbe9e36ccca0653bd5af29115a5f6f36344e8ad
Opcode Fuzzy Hash: dafea94a27e937987bc837e21f28955233fce16dc7c9f5da70d37721681059b1
Instruction Fuzzy Hash: 2F414AB4E1020A9FCB04CF95D8419EEFBB2FF89310F209526E515BB3A4D7719A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07533A98 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15fa12b081e2548b6f096c04e7d2b08e20f449833e82e33d084aff60a92bfd45
Instruction ID: c5850f90ba1d9f020d345adaebb26f3b9b6705e53948837320ba841ad81ae9fa
Opcode Fuzzy Hash: 15fa12b081e2548b6f096c04e7d2b08e20f449833e82e33d084aff60a92bfd45
Instruction Fuzzy Hash: 56418AB4E0020A9FCB04CF95D8419EEBBB2FF89310F24952AD415BB3A0D7709A44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0753BB4F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7991ad2e19ac95edead8f1910e45ebdf6a0024a40fb6d8527dc07ace481ae198
Instruction ID: 563fabbaa0a212f23b39221267d581a67f4b2430978087807279b060c6839c75
Opcode Fuzzy Hash: 7991ad2e19ac95edead8f1910e45ebdf6a0024a40fb6d8527dc07ace481ae198
Instruction Fuzzy Hash: E8316DF4E09209CFDB09CB96E5542EEBBF6FF89301F14D06AE409A72A1DB340941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 07538908 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852c19bdc3106dd17942dcc9aa2a7adeee9ef5f9c844c096596dc5dfa4b06d85
Instruction ID: 4a5c4d999e41d1b08574c58c35336ef4c5ee10f42d331696f987d7229face284
Opcode Fuzzy Hash: 852c19bdc3106dd17942dcc9aa2a7adeee9ef5f9c844c096596dc5dfa4b06d85
Instruction Fuzzy Hash: CF317AB2E1452ACBC7188BA9C8406FEB7B2FF44314F148126F465D72B1D738F841D662

Uniqueness

Uniqueness Score: -1.00%

Function 075387E8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f7a8b1b9a1a418bad7ba96a4ee231f0e9d38e3041598e3ec27c0c052d7ae65
Instruction ID: a5b3fb4e69a3f625b5a41eaeb4d674ab2030d93b0940dff7ac2fb7d8d72bd34e
Opcode Fuzzy Hash: 87f7a8b1b9a1a418bad7ba96a4ee231f0e9d38e3041598e3ec27c0c052d7ae65
Instruction Fuzzy Hash: B321F470B542459FE71C8B1589057A6B7A2BB82B05F64C86BF1058F2A2CA36EC85C761

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805520308.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45bbcd6230670b2e361979a7491d073c97c619922b1b95eed13c5c5fe94dc306
Instruction ID: 09c5c597f165f542d36177be75b1b7270db80f5a7e24e2d37559e73c308c8e66
Opcode Fuzzy Hash: 45bbcd6230670b2e361979a7491d073c97c619922b1b95eed13c5c5fe94dc306
Instruction Fuzzy Hash: EC212271508240DFCB05DF54DDC0B2ABF65FB98328F20C569EC096B296C336D896CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0753E89B Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc5304c73dfb9586ed2bc153f4cf5457ef7d505bc2df9ded1081606bb35d304
Instruction ID: 660baabcb414622082a7e326db6c5af88d550ee8dd3ed5430199b3dd719dc1bb
Opcode Fuzzy Hash: 0fc5304c73dfb9586ed2bc153f4cf5457ef7d505bc2df9ded1081606bb35d304
Instruction Fuzzy Hash: A4312C74A14209CFC700DFA5E59A9ACBBF5FF49308F149665E00A9B3AADB749C44CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805595635.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1d000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef4ce3f0a2f7c63077845dfdac6dabc60fea700f3ffc9c4e91c9dda259d160c
Instruction ID: 61839bca044ae0997616f96b89a26d6b0649ea9a65d08bb5d8c6f5201447fb2d
Opcode Fuzzy Hash: aef4ce3f0a2f7c63077845dfdac6dabc60fea700f3ffc9c4e91c9dda259d160c
Instruction Fuzzy Hash: BD212971508204EFDB05DF54DDC0BA6BBA5FB84318F30C66DD8195B265C336D886CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805595635.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1d000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd20d98d1a94a628e2ad89daa78c8ae46fde52b46f820a6c97621cdaf9c1cc16
Instruction ID: e6829c89f28ddae1079c16fe15ad21d89ffb9bd4cd8dd5931ce59f50b5180aef
Opcode Fuzzy Hash: cd20d98d1a94a628e2ad89daa78c8ae46fde52b46f820a6c97621cdaf9c1cc16
Instruction Fuzzy Hash: 7021F275608200DFCB14DF14D984BA6BBA6FB88318F20C56DD80A5B296C33AD887CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0753C3A5 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17cd5043d798f698e27d31546759bf16059164aaec3cb47213886f857017623e
Instruction ID: 731882cb9815d8fb7f30a1e670e2f6441ea0e84fdbf10b97863b9640ad04aafe
Opcode Fuzzy Hash: 17cd5043d798f698e27d31546759bf16059164aaec3cb47213886f857017623e
Instruction Fuzzy Hash: 172127B4A18259CFDB10CFA4C584AEDBBB6BF4A310F209595D409BB2A1C630AD41CF71

Uniqueness

Uniqueness Score: -1.00%

Function 07535ACC Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91da5c4239701e76db5bf5be78033a8af31f2ceac36942981313d6393a33a172
Instruction ID: 5d175e4466f9700fa8237e4397ef644f7ac3c872d0c70d56a5afb75ee58c59da
Opcode Fuzzy Hash: 91da5c4239701e76db5bf5be78033a8af31f2ceac36942981313d6393a33a172
Instruction Fuzzy Hash: 1C31E0B0D01258DFDB20CFA9C989BCDBBB4BF08314F24845AE405BB250D7B55885CF95

Uniqueness

Uniqueness Score: -1.00%

Function 075387DA Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac45b05dfb53509258eaef4ca62982189c47e7551c9c9ac81a6e1632b9fbe137
Instruction ID: 53c2cc9e45827e051ebe2bbb6f9bccf88ffc79e316d540a33d64fcb3a991e5bb
Opcode Fuzzy Hash: ac45b05dfb53509258eaef4ca62982189c47e7551c9c9ac81a6e1632b9fbe137
Instruction Fuzzy Hash: 2C21D170B05241DFE71C8B15C9057B6B7A2FB82705F54C8ABF1154F2B2CA36E985C761

Uniqueness

Uniqueness Score: -1.00%

Function 07535AD8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68240611fc9eeee74afc0cc1804249f0dc58aa0f6335fc40f4448303b734e64
Instruction ID: adbd7e80351a8bce319e8c3ac6bbc4733d801a97d68171505eca21056e65e198
Opcode Fuzzy Hash: f68240611fc9eeee74afc0cc1804249f0dc58aa0f6335fc40f4448303b734e64
Instruction Fuzzy Hash: 7D21CEB0C112589FDB20CFA9C998BCEBBF4BB08714F24845AE409BB290D7B55885CB95

Uniqueness

Uniqueness Score: -1.00%

Function 07535917 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63857fe28e3a787d8f47bdb84132cab31811892c2637c421305e1b7e56ab9c56
Instruction ID: 3e7720569fb5a514d3ec40d403538e3f191e6bf7857fbd8333ffda8f9c6f4326
Opcode Fuzzy Hash: 63857fe28e3a787d8f47bdb84132cab31811892c2637c421305e1b7e56ab9c56
Instruction Fuzzy Hash: 5511E372B0031A5F8B11EB7998444BFBBFBEFC4260714892AE855D7341EB30CD0187A0

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805595635.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1d000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5825c6d758e1d13bc63352b8c9e7ac253d9a083241403e4d83d42bb2068160f6
Instruction ID: 22c56f20ab42a7dfb13f27a0e6bc4467c639958e5e63e1651520e10f5e8703ed
Opcode Fuzzy Hash: 5825c6d758e1d13bc63352b8c9e7ac253d9a083241403e4d83d42bb2068160f6
Instruction Fuzzy Hash: 1221837550D3808FC702CF24D994755BF71EB46318F28C5DAD8498F2A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 07533848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce68bfc2745b3ac35e652f2811028556908b09df087daa4beed26b913b0e4a7
Instruction ID: 6ba195ee9cdabd97a17307fb27a1f37e62fde66c19c790ea4efc7efc6463f3a3
Opcode Fuzzy Hash: 3ce68bfc2745b3ac35e652f2811028556908b09df087daa4beed26b913b0e4a7
Instruction Fuzzy Hash: A22190B4A11908DFD704DF5AE088999BFF1FF8C310F5280D5E4489B265DB31A9A5CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0753FBC8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538ea3667932a79627d80ab23da0a716c38e5ebe833fc290147e95cfbdddddc1
Instruction ID: c8c939a53530c3229781a85e3eface6c62ea876a90ec0b0a67f1dabc1f470a66
Opcode Fuzzy Hash: 538ea3667932a79627d80ab23da0a716c38e5ebe833fc290147e95cfbdddddc1
Instruction Fuzzy Hash: 6911A3B0F4820D9FDB189E7998506BF7BA6FB84750F048D29E909DB3E0EA309D4087D0

Uniqueness

Uniqueness Score: -1.00%

Function 0753C2B8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37861c21ba9ca8b5fafc6f9e0c949dfa378855235f722243749862081eec60fc
Instruction ID: f75caa137ae91f2a7d9fec23a31c48b41b45a0df2fd3dbceebdd7cf73304f030
Opcode Fuzzy Hash: 37861c21ba9ca8b5fafc6f9e0c949dfa378855235f722243749862081eec60fc
Instruction Fuzzy Hash: 4021F7B1D016188BEB18CF9AD9557DEFFB6AFC9300F04C06AD408B62A4DB7509458FA0

Uniqueness

Uniqueness Score: -1.00%

Function 0753BD10 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd95ee9caf5c830331f029b3cb480d4bdc4135e71267965b5870ea01f0ca451
Instruction ID: 04299b35c9f25c0dc109bc075ad1924145ca32ed61c655722da494f97138f968
Opcode Fuzzy Hash: 2cd95ee9caf5c830331f029b3cb480d4bdc4135e71267965b5870ea01f0ca451
Instruction Fuzzy Hash: 0B21B2F4E15209DFCB80CFA9C181AEEBBF5BB4A300F609859D809A7765D7709A40CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0753E860 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7bc3c0e373c0b5f785300fb0cf415d6052b44894787eb14df9c5335b15b2055
Instruction ID: 5616258d0e069240e7b0426334ff1baf98dadadbbc69cf8b6ae76a0042d7bb46
Opcode Fuzzy Hash: c7bc3c0e373c0b5f785300fb0cf415d6052b44894787eb14df9c5335b15b2055
Instruction Fuzzy Hash: 6321FA74A14209CFC700DF99E59A5ACBBF5FB49304B149665E40A9B3AADB345C45CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0753BE88 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ccb58deabf7f25530f308ab4f18a846b60cf499376f7aeae338d818e35e94d
Instruction ID: 03c5825bc6baf5cf7efb14234265abf203f556849685fe9a257e0033a9814506
Opcode Fuzzy Hash: d2ccb58deabf7f25530f308ab4f18a846b60cf499376f7aeae338d818e35e94d
Instruction Fuzzy Hash: 3A111FB4E09208DFCB05CFA9D4449EDBBB5FF4A310F00D69AE80897321D7319A45DB81

Uniqueness

Uniqueness Score: -1.00%

Function 075361DC Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7567c57bcd42c84826ed5bf349eb8ba9cb11344b353e67dbdf6c8c59990bc1
Instruction ID: 386a81c203a259206b58012ca30becee9847818322d49cb90e114b755ae9debe
Opcode Fuzzy Hash: 3a7567c57bcd42c84826ed5bf349eb8ba9cb11344b353e67dbdf6c8c59990bc1
Instruction Fuzzy Hash: 182127B58043499FCB10CF9AD884ADEBFF4FB49310F14841AE958A7211D378A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805520308.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 11ccf721b183ea25ae79bf024e65870d30a7539c6f012213c827c6b192f4f20b
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: F2110372404280CFCB02CF54D9C4B16BF71FB98328F24C6A9DC091B296C336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 075361E4 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adcaa59b922e2ea5d213dc7e1e11aa6613284007b061f72e374115aa9aed067c
Instruction ID: 7e2a53fe1b97383a619a4904331f5b0762fae78e1ed30a2d9dfd9317c16ae701
Opcode Fuzzy Hash: adcaa59b922e2ea5d213dc7e1e11aa6613284007b061f72e374115aa9aed067c
Instruction Fuzzy Hash: 6C21D3B5D0434D9FCB10DF9AD884ADEBBF4FB49320F14841AE919A7210C379A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0753BDF8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec4e177c97e0bbb564a939f2ff263890f8379ba30c85e9cdc3983d41de863ca
Instruction ID: f13042ce759757505763a0471cb575a4c56baabeb91ea6e3346b4dd4c53d865c
Opcode Fuzzy Hash: 7ec4e177c97e0bbb564a939f2ff263890f8379ba30c85e9cdc3983d41de863ca
Instruction Fuzzy Hash: FD110AB0E19208DFCB04DFA9D581AEDBBF5FF4A310F11969AD418A7226D3309A45DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805595635.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e1d000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: a86d3681f018002109fd5a0f7730aefa8e05aa1bee66a596bc9d1b48906352c9
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: C211BB75508280DFCB02CF54C9C4B55BBA1FB84318F24C6AAD8494B6A6C33AD89ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0753C2C8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607f002b8ffaced1853bac5254d923944bef6d12aaaef0fa8f7f51a9733fdb07
Instruction ID: 3f3dc603d4c0ecf3c5d9fa0a9cbaeb52450d8bac3f409d023d510c70c9f4ba60
Opcode Fuzzy Hash: 607f002b8ffaced1853bac5254d923944bef6d12aaaef0fa8f7f51a9733fdb07
Instruction Fuzzy Hash: 0911B2B1D006188BEB18CF9BD8457DEFAF6AFC8300F14C06AD409762A4DB7509458FA0

Uniqueness

Uniqueness Score: -1.00%

Function 0753E963 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74943796c6da23952cec5cf304b25991fbd7c7437535419b56d15f55cc77284a
Instruction ID: e330af68a61b31b704e66ec1bc7a83d67f16e986d5cb15e576cef4789a765329
Opcode Fuzzy Hash: 74943796c6da23952cec5cf304b25991fbd7c7437535419b56d15f55cc77284a
Instruction Fuzzy Hash: BA212C74A14209CFC700DF99E59A6ADBFF5FB49304F149665E4199B3A6DB345C40CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0753EAD4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60708d7cda1206f44bf3eb1085e4daf8c530977266b61eadc00d2672f6853894
Instruction ID: 6868e200c791e052197ef9142610fd7df9470eeaebe3e848175f673c57be892e
Opcode Fuzzy Hash: 60708d7cda1206f44bf3eb1085e4daf8c530977266b61eadc00d2672f6853894
Instruction Fuzzy Hash: 512108B4A21218CFDB50DF64E98ABAABBB6FF84200F518595E009A7394DF305D85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0753D140 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197ded30b46a6b608f92ae4bdc8a96945484aec0f8c6ff8eacebfbae51ac253d
Instruction ID: c352e5561c209d9d2985c797463f347cb1ed1885058c5e6cdaa680ed8845a88c
Opcode Fuzzy Hash: 197ded30b46a6b608f92ae4bdc8a96945484aec0f8c6ff8eacebfbae51ac253d
Instruction Fuzzy Hash: 14014075618244DFC701DBA4D689AE9BFF5EF4B310F1981C5E4499B2A2C7319E01DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0753BE08 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d9c0a7c0a6482bb1a1f46081721622e637a41c3429acabee685a72046840e3
Instruction ID: 5197813814f1128f8e76ea3c6da94d26d31eb270f4b7f8d8502f5fd252444d10
Opcode Fuzzy Hash: 29d9c0a7c0a6482bb1a1f46081721622e637a41c3429acabee685a72046840e3
Instruction Fuzzy Hash: BB11B7B4E09209DFCB04DFA9C581AEDBBF5FB49310F1096A9D518A7325D7709A419B80

Uniqueness

Uniqueness Score: -1.00%

Function 0753FE59 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4606d8a08cd3e4a5fe40d5fdc7d30d73bc9db8b07e040037ca0a98ffacc1c07b
Instruction ID: f01634654d49cce851500fd34f32b43f30d5036629e70856d9f6b145190e8a3f
Opcode Fuzzy Hash: 4606d8a08cd3e4a5fe40d5fdc7d30d73bc9db8b07e040037ca0a98ffacc1c07b
Instruction Fuzzy Hash: B301F272F001058FCB44DF6CD9C08AE7BE2BBC8214714842AE505D77A9CB31ED069B91

Uniqueness

Uniqueness Score: -1.00%

Function 075318B9 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04752ec562daf363955222fc2afd3534883a8b19f2c275180802ab483a751db8
Instruction ID: 258c3c7853fcd0da7489f20bb742ad7cc96916bcaf76130597d5b37412da1632
Opcode Fuzzy Hash: 04752ec562daf363955222fc2afd3534883a8b19f2c275180802ab483a751db8
Instruction Fuzzy Hash: 80118074A00248AFCB05DFB9D985A9DFFF5EF09310F14C1D5E4449B3A2DA319A41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07536120 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f0b277e9cc429bccb17ded26f3cc931e7ffab2571430fd4e9e0b126066f1cf
Instruction ID: 956a03bcfa2b27f5c991d1cd14dff4e5d12359089d18a8425f6dac2ce69c5600
Opcode Fuzzy Hash: 65f0b277e9cc429bccb17ded26f3cc931e7ffab2571430fd4e9e0b126066f1cf
Instruction Fuzzy Hash: AB01C48245EBE11EE303BBBC99713D57F209F53215F0A00E7D0C48A4B7D548849D83BA

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805520308.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e92136b1d01f381cbf3267322127e97cbcc49faa608adc11732fd93e421c3db
Instruction ID: 39f3ff463de8d28ee247adf7c5829b8dcb96733a637474f3047f5d4c79e3eb09
Opcode Fuzzy Hash: 8e92136b1d01f381cbf3267322127e97cbcc49faa608adc11732fd93e421c3db
Instruction Fuzzy Hash: ED01A77100C3409AE7109EA9CD84BA7BF98DF41328F1CC52BED095A2C6D6799880C771

Uniqueness

Uniqueness Score: -1.00%

Function 0753DF72 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd5152816fedadc32662fe13fe8658125e12f0471110976ee76fe229680cf62
Instruction ID: eed4051acb17e3bbb56c370a05d336826453a436658a506bcc918d205ee024ad
Opcode Fuzzy Hash: bfd5152816fedadc32662fe13fe8658125e12f0471110976ee76fe229680cf62
Instruction Fuzzy Hash: D511A1B4A052499FCB01DFA8D4809EEBFF0FF0A311F248196E850A7391C6349B41DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07535839 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e430738721270dd8617770d38f2fd38e9abe1906772035762dd8f60d44b6a270
Instruction ID: bad6cc28993f434950fb740871352cdb4309e5bf498e3db6466b3c8b56e33301
Opcode Fuzzy Hash: e430738721270dd8617770d38f2fd38e9abe1906772035762dd8f60d44b6a270
Instruction Fuzzy Hash: E9018172F0521A8BDB14EFB8A9015EEFBB0FF89355F10407AC504E6210E7358626CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0753C469 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7426d345af79552102752d34238c8f06a8bcd1ed0cdcca3e0a955a203ec044ff
Instruction ID: f028ac66aadde88bd67aea9a71756a49a7191179f5e5de26d50e63cd85e8a24a
Opcode Fuzzy Hash: 7426d345af79552102752d34238c8f06a8bcd1ed0cdcca3e0a955a203ec044ff
Instruction Fuzzy Hash: B1118378911269CFDB65CF64D944FA8BBB1BF0A201F1041D6E809B73A1DB319E81CF20

Uniqueness

Uniqueness Score: -1.00%

Function 075303C0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c65b539e06a71b965bcbd395986142c73f167d51f9b93c38d380d15fb0195b3
Instruction ID: 0f87651c0a091bec8167828e8af92d4f7cd52b5d4b86b19285e75c8721c322cb
Opcode Fuzzy Hash: 0c65b539e06a71b965bcbd395986142c73f167d51f9b93c38d380d15fb0195b3
Instruction Fuzzy Hash: 8B119274E01258CFCB65CFA9D680A9CBBF2BB48310F1484A9E509A7365DB359A80CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0753D0C7 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1996ae3424b68e95b330dd3106c1bebdb178ea78ae71eac9974f79a129fbc62
Instruction ID: cc464cc68d5eb18ed3e7f9a22bb55cf7edc526e2a260b3f1d4fe77ad485a280b
Opcode Fuzzy Hash: a1996ae3424b68e95b330dd3106c1bebdb178ea78ae71eac9974f79a129fbc62
Instruction Fuzzy Hash: F70128B0A5D348DBC704CBA5D9499F9BBB8BF4A301F14A5A6D4099B262D7308A45DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0753D150 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b545139eb79eb271a6ea8aeeb8b909e1408f6a0d859c5ad94640e84569336190
Instruction ID: 333fe673db0d23b025079f75535786d57dc1d1af89725ec2c685029182ac9eb7
Opcode Fuzzy Hash: b545139eb79eb271a6ea8aeeb8b909e1408f6a0d859c5ad94640e84569336190
Instruction Fuzzy Hash: 4901EC74A14208DFC704DFB8D689AA9BBF5BF4A300F15D494E4099B361DB309E00DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0753D0D8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b0e97f145f799be78ca8ac4f688fb35c53f9e2e3463bd0ee8cfbced32cf784
Instruction ID: 9bcabed176ab93c32e584fb83cd9110b2c5e203c5327795ad59335401fb1594a
Opcode Fuzzy Hash: f6b0e97f145f799be78ca8ac4f688fb35c53f9e2e3463bd0ee8cfbced32cf784
Instruction Fuzzy Hash: DCF03CB0A19308DBCB04DFA9D5459F9BBBDBF8A300F10A5A5E4095B261DB309A45DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0753DF80 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60975e3d07426c73de6fd151f673360e21a6873795f2d5eec71197779d261921
Instruction ID: 73663f2a4a4879d9a1cb6b932aa0e481672807c138e9ee79fa78b4d5f90e6a1e
Opcode Fuzzy Hash: 60975e3d07426c73de6fd151f673360e21a6873795f2d5eec71197779d261921
Instruction Fuzzy Hash: 6401E9B4E012499FCB40DFA8D5859AEBFF4BF48300F208196E854E7351D6349B40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 075372E0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ce6906dbdff0d99304d4ebdabe5af0edc622a472d63ccff19b47d6c06b216f
Instruction ID: fd01dd09b0de9c3bda8d0d983a56c862d547f85edaed649464f026c8f7957097
Opcode Fuzzy Hash: 29ce6906dbdff0d99304d4ebdabe5af0edc622a472d63ccff19b47d6c06b216f
Instruction Fuzzy Hash: 73F0B4726041057FDB09CB98DC418EA7FBAEF45220B0481ABF404C7222D631D900C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1805520308.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e0d000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d39cc17ae7ec9293dcc7610166e586138e8c40ed061f560e7aa3d6a13fdb7126
Instruction ID: 6ad33b026db9c0993c640dd72cab75312c504979c5c1ee416635ce9e415d6e5f
Opcode Fuzzy Hash: d39cc17ae7ec9293dcc7610166e586138e8c40ed061f560e7aa3d6a13fdb7126
Instruction Fuzzy Hash: 0FF068714083449AE7108E59CD88B62FF98EB91734F18C45BED085A2C6C2799844CB71

Uniqueness

Uniqueness Score: -1.00%

Function 07535E8D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fead71098d247ed9b1ebe4ae50ae04ca2c6837ef154a82f3b2476a18ae65a13
Instruction ID: 4b0b7c6a56b0c188ab3e983246df0cc594c7e3b29ce7e407985a997cac297d8a
Opcode Fuzzy Hash: 0fead71098d247ed9b1ebe4ae50ae04ca2c6837ef154a82f3b2476a18ae65a13
Instruction Fuzzy Hash: 6A0121B1904219DEDB14CFA5C5043ED7FF1FF08314F25865AE824AA1A0D7744A54DFD0

Uniqueness

Uniqueness Score: -1.00%

Function 0753EA11 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636fad27d6b79c6485a8236e06642fb5c009ddc7ddb45aac6c6ffb48ccc6a468
Instruction ID: 1ac5bd961ce83b489b9ed07135022cde3f1356d2b3c70981ab431d6b491d7fe0
Opcode Fuzzy Hash: 636fad27d6b79c6485a8236e06642fb5c009ddc7ddb45aac6c6ffb48ccc6a468
Instruction Fuzzy Hash: 36010C78A64208CFCB10DFA4E68A59DBFBAFF89305B218529E405A7395DF705845CF00

Uniqueness

Uniqueness Score: -1.00%

Function 07535F28 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fdedf082cd107eabdd77018a82185a446379088c52d1551953b464293b3f0a
Instruction ID: 76f1ae90e288a86275ebd0060034cf9eb0a4503339c9ec81eb12482d4e5d17b5
Opcode Fuzzy Hash: 77fdedf082cd107eabdd77018a82185a446379088c52d1551953b464293b3f0a
Instruction Fuzzy Hash: 3CF082B6B042545FD304CB7DDC88A6BBBE9EF88224315806AE548DB352DA308C0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 07535E98 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06994c03d0cb3990387a7cd4b1c43e98ff09fe029c156a487422f83785f076c5
Instruction ID: 0be43ba9d09c063721b1fd605a824dc99d1f5323bb83d74bf043ae9219622475
Opcode Fuzzy Hash: 06994c03d0cb3990387a7cd4b1c43e98ff09fe029c156a487422f83785f076c5
Instruction Fuzzy Hash: F201ECB0804219DFDB14CF69C4043EEBBF1BF44350F21866AE824AA2A0E7744A54DFD0

Uniqueness

Uniqueness Score: -1.00%

Function 0753ABD2 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0adba2b44cb6a0f62c99d70664b342536c121cbccc6f8efeba56a3c4f8d595c9
Instruction ID: 3dc46de2cec45085bed83c9ec51c0def9bf3bd1f6bbb8b901618abfcbea16397
Opcode Fuzzy Hash: 0adba2b44cb6a0f62c99d70664b342536c121cbccc6f8efeba56a3c4f8d595c9
Instruction Fuzzy Hash: AAF030B4A5A509CFDB04CA94D9945FCB77AFB8A305F00E9A5E04D97175DB305A88CB01

Uniqueness

Uniqueness Score: -1.00%

Function 075318C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89041ebdc33b264a8d4792fbf046ab342339dff370cb5733a075149112a707bb
Instruction ID: 078a6ba3349eb583aaf780a9b7ad561632d97a07ce4010bb226e74f0c04cbfd5
Opcode Fuzzy Hash: 89041ebdc33b264a8d4792fbf046ab342339dff370cb5733a075149112a707bb
Instruction Fuzzy Hash: A8016278A00208AFDB44DFA9D589A9DFFF5EF48310F15C0A5E808AB365DA309A40DF41

Uniqueness

Uniqueness Score: -1.00%

Function 07535F38 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa48d1396951594ee43b43e08ffb4ed20a33c2ba1d1e8dd34c16eaa35e9a4b96
Instruction ID: 17187e955df90af8676fd739446525fcb859c31f3d75c04fe0bccc60219e8f5f
Opcode Fuzzy Hash: aa48d1396951594ee43b43e08ffb4ed20a33c2ba1d1e8dd34c16eaa35e9a4b96
Instruction Fuzzy Hash: ABE039727041286F93049AAED884D6BBBEEEBCC660311807AF508C7311DA319C0086A0

Uniqueness

Uniqueness Score: -1.00%

Function 0753FB58 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8660989f0fb8ca6c241ba865e06e6a49779f8bf1f1d3a5e6e0266e0c36a67b
Instruction ID: 106703eca7f239cab11456f6c1b9a794bc87c52a237983ede057626d4c278880
Opcode Fuzzy Hash: 2e8660989f0fb8ca6c241ba865e06e6a49779f8bf1f1d3a5e6e0266e0c36a67b
Instruction Fuzzy Hash: 6DF0E270A0424DAFCF11CFA4E9056DDBFF1EF46321F1081C6F854AB2A2D6350A42DB92

Uniqueness

Uniqueness Score: -1.00%

Function 075372F0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef4bb0bd581c9fc1b2e27d6722529226514c640cd08f16c1dc23188d2cf0d85d
Instruction ID: 98d7436537bacfae935ff4e8b9184bf084a61693bb0e879b9733b584c04591e5
Opcode Fuzzy Hash: ef4bb0bd581c9fc1b2e27d6722529226514c640cd08f16c1dc23188d2cf0d85d
Instruction Fuzzy Hash: C8F06572600109BF9F08DF98D841DDEBFEAEF48214B14817AE408D7321E631E9509B94

Uniqueness

Uniqueness Score: -1.00%

Function 0753BB0F Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e0c60120a62ce178431e31446d052f2259ca6d70d958ea96c74508bb1d101b
Instruction ID: b561d0cdadaabd307cda2a428fddf8a1ea1171723ed64e8cd6112944462d4834
Opcode Fuzzy Hash: 62e0c60120a62ce178431e31446d052f2259ca6d70d958ea96c74508bb1d101b
Instruction Fuzzy Hash: E0E09A7124A2849FC30696A4F5261EA3F60EB43226F2441CAE488465A28A370A56C692

Uniqueness

Uniqueness Score: -1.00%

Function 0753BE98 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d41ebf44a5f6c52e9ce7d9feb10151c8c56f8e59837aba256cc0f8e0b006589d
Instruction ID: 8fa556502a48b4c2c54f7a197f2f7a28a935895e8cde00e971de2deda99c44d1
Opcode Fuzzy Hash: d41ebf44a5f6c52e9ce7d9feb10151c8c56f8e59837aba256cc0f8e0b006589d
Instruction Fuzzy Hash: 3CF0A5B4E05208EFCB14DFA8E5459ADBBB5FB49301F1081A9E84493350D7359A50EF94

Uniqueness

Uniqueness Score: -1.00%

Function 0753FB68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 893a59f712c60ecb8a5b7317ba2b6d49475a98bacfaba0d91f119f9ac2e0c65b
Instruction ID: 27877fbcd1a53ae56f4fffd92c38fe2c4fc506daf5d54b77332321e372e5010c
Opcode Fuzzy Hash: 893a59f712c60ecb8a5b7317ba2b6d49475a98bacfaba0d91f119f9ac2e0c65b
Instruction Fuzzy Hash: AEF0C974E1020CEFCB54EFA8E95569DBBF5EF88311F10C0AAE814A7390DA345A50DF81

Uniqueness

Uniqueness Score: -1.00%

Function 07535F81 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe482e25179967c025f97bef03ef6b5234362682048c9c6f3b8b9a09c19eab5
Instruction ID: 07c76a7fd7e4213dd485a3b7640a42a4699eacf3d4324720b6a52fbe96ef30cd
Opcode Fuzzy Hash: afe482e25179967c025f97bef03ef6b5234362682048c9c6f3b8b9a09c19eab5
Instruction Fuzzy Hash: 76E086BB700610AFC7059B48E915E487BA5DF99221B158466F249C73B1DA70DC028B54

Uniqueness

Uniqueness Score: -1.00%

Function 07535F90 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b111e1a36b9ed2393f795d3ede7e07dd67961d154d3c26087fc851348a5aa748
Instruction ID: c0c843213d10b26bd2b8ed7b1035fa3b7701b2a5c974c13113faf9feee8a4403
Opcode Fuzzy Hash: b111e1a36b9ed2393f795d3ede7e07dd67961d154d3c26087fc851348a5aa748
Instruction Fuzzy Hash: A9D01236300514AFC3149A4AE808D46BBA9DFD9721B158066F609C7360CA71EC01C794

Uniqueness

Uniqueness Score: -1.00%

Function 0753C491 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a760100621a1537b937a4832a6c8a527cb218868ea3f8dcc42e6302342b17de4
Instruction ID: 9bc948797d3a2c57c90695c0b8ed8d6b898d47ea96e7d7af87e5bfd796c43e03
Opcode Fuzzy Hash: a760100621a1537b937a4832a6c8a527cb218868ea3f8dcc42e6302342b17de4
Instruction Fuzzy Hash: 6EE08C35A19200CFC7008BA4E84C8E8BB34FF86252B4054E7E81AAE1A2CB314911CF70

Uniqueness

Uniqueness Score: -1.00%

Function 075308DC Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d82a84af0caaee3728b905c76e98ceb4fae0b66edd9f681d11e05b8261baf33
Instruction ID: e666dc1fbcf8bd9c0d7c52032fb2f817a6b0cd15c338b883aa3bd25aabb356a8
Opcode Fuzzy Hash: 7d82a84af0caaee3728b905c76e98ceb4fae0b66edd9f681d11e05b8261baf33
Instruction Fuzzy Hash: 2CE086B4525344CFC718CF60D1458A8BF72FF45701B105899E00BDB6B4C735D881CE54

Uniqueness

Uniqueness Score: -1.00%

Function 0753BB20 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 375d4a2c7fa802a62c1c68737c24c6bedec040df9b7765d80a440de3311aec7b
Instruction ID: 7667871f39922819bb14d22e181f0c95cb920a4ef9113f0d09b42d5eb910010c
Opcode Fuzzy Hash: 375d4a2c7fa802a62c1c68737c24c6bedec040df9b7765d80a440de3311aec7b
Instruction Fuzzy Hash: F4D017B0901208DBCB14EFA4E54959DBFB4BF42306FA082A9E80823290CF315E84DB85

Uniqueness

Uniqueness Score: -1.00%

Function 07530864 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68f844b8701f9598e18bc7b49d616b9f901e22460a136bf61b46ca3c6b29f47
Instruction ID: cfb5427b23d07cd988da6fa48f1950fbe5e541937b8bf96f65b7dae458120c02
Opcode Fuzzy Hash: a68f844b8701f9598e18bc7b49d616b9f901e22460a136bf61b46ca3c6b29f47
Instruction Fuzzy Hash: 9DE08C70921304CFCB54DFA0D449599BB71FF44341B1044A5E81ADF2A8C7368981CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0753A998 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e24c8955eefc5e335a9b0c4123916c5f1b082effceee35a67e9850e5e983e70
Instruction ID: c8c31c87c279c7856e3261ca23b69e92f4fcfede7ee47e48f56a230186009cfa
Opcode Fuzzy Hash: 2e24c8955eefc5e335a9b0c4123916c5f1b082effceee35a67e9850e5e983e70
Instruction Fuzzy Hash: A4C08C7011130987C2142BA4FA0E3643FA8AF40202F54C012F188004B08E604040C6A7

Uniqueness

Uniqueness Score: -1.00%

Function 07535810 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e05f7930f9c6fb26f1d966389146a171e645e3229a90c086d7dca4eb4ee816
Instruction ID: 072ef3dfcb03279cc813d5bff03c73dd8f70d5dbc88c41dca2b07b5c15f13521
Opcode Fuzzy Hash: 05e05f7930f9c6fb26f1d966389146a171e645e3229a90c086d7dca4eb4ee816
Instruction Fuzzy Hash: C3C08CB70BC4821AE3017720CC276806F60FB52209B1940538464C8072E06C407C9A22

Uniqueness

Uniqueness Score: -1.00%

Function 0753EB7B Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec9fb5c556ea2cb4bda84a0cdcb5eff793df76ee24d7e1bed7e76f870c506f6
Instruction ID: 6520b168f29e91b0a50b33852acad5c8b734469efb2c6d9762754bf4c227bb5b
Opcode Fuzzy Hash: bec9fb5c556ea2cb4bda84a0cdcb5eff793df76ee24d7e1bed7e76f870c506f6
Instruction Fuzzy Hash: F2C01270A2010A8FCB00EF54D285298BBB9AB59204B109A1090258239ACF7488469F21

Uniqueness

Uniqueness Score: -1.00%

Function 07530BF8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c6042640e2b67b92bb708c8d6e238b2f5e3e4984f0681deb0caf4bf530e8b6
Instruction ID: 78bf3ad7587ed64e3699eebcd65c2e11091c3a3e1e1d1b69d5ebc99197974deb
Opcode Fuzzy Hash: c9c6042640e2b67b92bb708c8d6e238b2f5e3e4984f0681deb0caf4bf530e8b6
Instruction Fuzzy Hash: 4BC01230826A898BD708CA90C58A0ADBB72FF8A300B208814C006EA1A8D6346541CA10

Uniqueness

Uniqueness Score: -1.00%

Function 0753618C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: debccd342127789ffb062463cbe759651a2ef99a228f3debb89633a72de7180e
Instruction ID: 53fccd8ca717c041bcf6fe6f18543159b26242e75afcb66a78775d652a10ac49
Opcode Fuzzy Hash: debccd342127789ffb062463cbe759651a2ef99a228f3debb89633a72de7180e
Instruction Fuzzy Hash: 00B012E55E4502F3A50123644D84C7BDE00FFF6B10F00CC157709510748522C465F23B

Uniqueness

Uniqueness Score: -1.00%

Function 0753B558 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653cf289eba1770fbe85e861aec51e88a8a0d925ae2cfa7547a8ecd9bbba7023
Instruction ID: eebbc812d312592764208fbfff99f7fa7eab890dcb29faa31064c9e69e65d43e
Opcode Fuzzy Hash: 653cf289eba1770fbe85e861aec51e88a8a0d925ae2cfa7547a8ecd9bbba7023
Instruction Fuzzy Hash: CDB012B855F608CBD6004A44C8F40F036F8FB06A2035C81C0C8682F7529272C500DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07538378 Relevance: 4.0, Strings: 3, Instructions: 253COMMON

Download Yara Rule

Strings

[V~*, xrefs: 075384E4
]\`, xrefs: 075385FA
T+-q, xrefs: 075386B2

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$]\`
API String ID: 0-3978741314
Opcode ID: 7d5a981c1da3e3f4b729768a44ad41ee1981ba4fff03e40693982fb77b648364
Instruction ID: d8c3d176627b7cf0d08bddfb331afe975fb41ec57088cf3fea20c2d2f13b59fa
Opcode Fuzzy Hash: 7d5a981c1da3e3f4b729768a44ad41ee1981ba4fff03e40693982fb77b648364
Instruction Fuzzy Hash: E1B1C8B4E156199FDB08CFEAD5808DEFBF2BF89300F14D526E415AB264D730A9418F64

Uniqueness

Uniqueness Score: -1.00%

Function 075D58B0 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PH^q, xrefs: 075D5A9B
PH^q, xrefs: 075D5B73

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: d8a54d71502190333b78c893eccfd54cb44d25286ee68437152468b48870c185
Instruction ID: de9c355135424a139e54f476c2378c14731ba5ecbf90d34c77260c378a369b35
Opcode Fuzzy Hash: d8a54d71502190333b78c893eccfd54cb44d25286ee68437152468b48870c185
Instruction Fuzzy Hash: E7D1C374A00605CFDB18DF69C598AE9B7F1BF89701F2580A9E406AB371DB31AD45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07531E3A Relevance: 2.6, Strings: 2, Instructions: 110COMMON

Download Yara Rule

Strings

Kk, xrefs: 07531E86
Z;ya, xrefs: 07531EEB

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: Kk$Z;ya
API String ID: 0-687208382
Opcode ID: 8a1996d3ec95dcb455ccd032c31c08fe0942152221301d626347173bfb392372
Instruction ID: 4bb3f70dc5c450a51954ea2925dbf7e326ec71a02bb5f62637bf10a2cddb6a39
Opcode Fuzzy Hash: 8a1996d3ec95dcb455ccd032c31c08fe0942152221301d626347173bfb392372
Instruction Fuzzy Hash: 10415EB0D05A0EDBCB05CBA5D5814EEFFB2FF89340F24C999C405A7265D7349A41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 075D1490 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

]f, xrefs: 075D14EB

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID:
String ID: ]f
API String ID: 0-2286122321
Opcode ID: ddc0b483e2270fc982b4493808f262db54b5e0c6062c748d1c47fb00f70c423c
Instruction ID: 932b063d9586a901ac980639dbeb464d5a6d10f6cf94698f7bfd1f2b81d818d9
Opcode Fuzzy Hash: ddc0b483e2270fc982b4493808f262db54b5e0c6062c748d1c47fb00f70c423c
Instruction Fuzzy Hash: B0E1FAB4E005198FDB14DFA9C5809AEFBF2BF89304F249169E419AB356DB30AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 075D0AE0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe60d585f81f98f6818e00b0a1124d0f0820150763039832fdb4fc6b50eb5d5b
Instruction ID: b0539ab5136c8ae0aef43ad50ba7311770bbb487b468e2e3282c2c491fb822ad
Opcode Fuzzy Hash: fe60d585f81f98f6818e00b0a1124d0f0820150763039832fdb4fc6b50eb5d5b
Instruction Fuzzy Hash: 2CE1D7B4E001198FDB14DFA9C5809AEFBF2BF89304F249169D419AB396DB30AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0753F730 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70476d618a3b2eae5ea4764a9ca397b5035958f2f85da259aff7f4ec53f46f3a
Instruction ID: d946381a2be691171d688a396d219114d486d100e50b2259f5dfc87623262a7b
Opcode Fuzzy Hash: 70476d618a3b2eae5ea4764a9ca397b5035958f2f85da259aff7f4ec53f46f3a
Instruction Fuzzy Hash: 44E1ECB4E001198FDB14DFA9C5809AEFBF2BF89304F249169D418A7396DB30AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0753EEC0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15e157baecca79f1b5d9d036ca58a661ad26c1b2036d028f08b56b608fd649ea
Instruction ID: e248531608cda74256f88c394746f5a8aeeb56c9e485c75bfdf06dae49c842f7
Opcode Fuzzy Hash: 15e157baecca79f1b5d9d036ca58a661ad26c1b2036d028f08b56b608fd649ea
Instruction Fuzzy Hash: BCE1FCB4E001198FDB14DFA9C5809AEFBF2BF89304F249169E419AB356DB35AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0753F2F8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fc97eabb2b795cb76fb9a4e20932ecea8a5a62f0935d46280103c891e746945
Instruction ID: 5d5b906157a59dd8bbe1db6eee740a73f5008512e663d5a17a1122722e81b767
Opcode Fuzzy Hash: 3fc97eabb2b795cb76fb9a4e20932ecea8a5a62f0935d46280103c891e746945
Instruction Fuzzy Hash: CCE1EBB4E001198FDB14DFA9D5809AEFBF2BF89304F249169E418A7396DB35AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 075368AA Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c20654c298c667af68ff20514ed3b4042daf695f40eebdf24aa6828336ac30
Instruction ID: 77b4b38866edbbd82ed69350dfa4d9537b2f557fb2e30467be4c421106469a9d
Opcode Fuzzy Hash: 99c20654c298c667af68ff20514ed3b4042daf695f40eebdf24aa6828336ac30
Instruction Fuzzy Hash: 55D1F53192075A8ACB00EBA4D991A9DF7B1FF95300F10C79AE04937665FB706AC9CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0107DDCC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806079694.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1070000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5aeaac1f650aeb70e03e6dee22ab9ecf51cbeaad3dd7e373fe258d75cb89a0d
Instruction ID: d725407250a6a97fae17479a62c14f86961dbf245acec8c2efdbb00165deea34
Opcode Fuzzy Hash: b5aeaac1f650aeb70e03e6dee22ab9ecf51cbeaad3dd7e373fe258d75cb89a0d
Instruction Fuzzy Hash: AFA16032E002068FCF16DFB8C8805DEBBF2FF98300B1545AAE955AB265DB71E955CB40

Uniqueness

Uniqueness Score: -1.00%

Function 075368B8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297f69bd72c955154fb1c3db13d30ac5662b4f7de553858120067fc8bd5ddca9
Instruction ID: 32fbb8179a39afc9e25fefa8ef965c6df9b2ced58fe6cf2552076acdcf3800b6
Opcode Fuzzy Hash: 297f69bd72c955154fb1c3db13d30ac5662b4f7de553858120067fc8bd5ddca9
Instruction Fuzzy Hash: 7ED1053192075A8ACB00EBA4D991A9DF7B1FF95300F10C79AE04937665FB706AC9CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07532030 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe26e1f9c10106e31071806bb635118e900b6119d882453a200f423f7951780
Instruction ID: a15b15e601999ca9f91ea3fe0abd28c88a9aaa31e716461be0ad72e5d9aa8f9d
Opcode Fuzzy Hash: abe26e1f9c10106e31071806bb635118e900b6119d882453a200f423f7951780
Instruction Fuzzy Hash: 9A81FFB4E14619CFCB44CFA9C98899EFBF2FF89250F14955AE415AB324D330AA46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07532020 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a103f7f3d5adc10af50c4051fac595b956df71268c29fbe028bf91b88f1d1304
Instruction ID: f1dc7b126a530b23bb6dd3e7d480a29fbe78be172dadd1da7957f6b21f4e1561
Opcode Fuzzy Hash: a103f7f3d5adc10af50c4051fac595b956df71268c29fbe028bf91b88f1d1304
Instruction Fuzzy Hash: A581E174E10619CFCB44CFA9C98899EBBF2FF89250F14956AE415EB325D330AA46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07533491 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2775c404558b8cf95aebd7ec9211c41f3a31a851dd6a294a20b88ea33ce2956b
Instruction ID: 6593a74b580c2028a7fc1afe408c2c1f9d425852c2bf3194182bafa25af5129c
Opcode Fuzzy Hash: 2775c404558b8cf95aebd7ec9211c41f3a31a851dd6a294a20b88ea33ce2956b
Instruction Fuzzy Hash: 3861D5B4A26609EFD705CF51F58A099BFB1FF8A301F20D895C085972A8DB398769DB04

Uniqueness

Uniqueness Score: -1.00%

Function 07532ED8 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05fc840a8e2d5003ec6551fee720bdeb38480d219a387f430dbad39ab5b922cc
Instruction ID: a5fcea421f50c48dc2f995fe71c629a263ca25af44cd90288db8975869c36223
Opcode Fuzzy Hash: 05fc840a8e2d5003ec6551fee720bdeb38480d219a387f430dbad39ab5b922cc
Instruction Fuzzy Hash: 255128B1E1560ADFCB04CFA9C5825EEFBB2BF89300F14C466D515A7250D734AA42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 07532EE8 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39de117254c254c163df35e57c97575dc8e0dbc19bf77436cdb8237d82f61955
Instruction ID: c857f6ed6d04d354777ab2e4b1fb15b45111b0bd9193f9bc50ca59ea0d19f28a
Opcode Fuzzy Hash: 39de117254c254c163df35e57c97575dc8e0dbc19bf77436cdb8237d82f61955
Instruction Fuzzy Hash: 956107B0E1560ADFCB04CFAAC5815EEFBB6BF89300F14845AD525AB250D7349A42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 07535150 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a01265ddb010626ff72a09999a250df2cf9e80d5c417a0129205af900311e1e9
Instruction ID: 96694f3d7ec82f075ee811f84291b8f249515213b46dcc3f99a3ee09f36f8b54
Opcode Fuzzy Hash: a01265ddb010626ff72a09999a250df2cf9e80d5c417a0129205af900311e1e9
Instruction Fuzzy Hash: 0A512AB4E1520ADFDB44CFA6D4455EEFBB2BF89310F10A42AE401E7364E7745A518F90

Uniqueness

Uniqueness Score: -1.00%

Function 075D0ACF Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812293767.00000000075D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75d0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7baee0a9eb4087d5554304fe43394da8a604f1cc2fe82b52dbec7a8003ecfb0
Instruction ID: 90355fb817d2b802e54bde2c7448bb6e735f972105ada280cedf9847716a2e03
Opcode Fuzzy Hash: b7baee0a9eb4087d5554304fe43394da8a604f1cc2fe82b52dbec7a8003ecfb0
Instruction Fuzzy Hash: B1511AB4E042198FDB14DFA9C5805EEFBF2BF89304F24816AD418A7256DB359D41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0753EEB8 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499ab6060d7f42ba789b12164ff7fc94248bdab1c775872f7c78bc9738456583
Instruction ID: d3331051558c078181c30658e7d0da6ca99d08a1f514a48478f21a744907d709
Opcode Fuzzy Hash: 499ab6060d7f42ba789b12164ff7fc94248bdab1c775872f7c78bc9738456583
Instruction Fuzzy Hash: 4A51FCB4E002198BDB14DFA9C5815EEFBF2BF89304F248169D418A7356DB359942CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0753324A Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ad372bc463ee539ad9be92ea5e4b6f619b153785a4afb08d318d4ab0a248f2
Instruction ID: faa186bdb0079ff9438ef8a656f4764fb0f59937bb5055c2a2555fb2216a5ede
Opcode Fuzzy Hash: 84ad372bc463ee539ad9be92ea5e4b6f619b153785a4afb08d318d4ab0a248f2
Instruction Fuzzy Hash: 434107B0E0560A9FCB04CFAAC4815EEFBB2BF89310F24D46AD415E7264D7359A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 07533258 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33cedecba96731f1d565590f3b39e90d9591820554d9a550e0de9fdc4a4bae1
Instruction ID: fa66f293ca6eaf56d1f9a02a5216b761077a10ce7dd7f7b5cdfe255866d36f6f
Opcode Fuzzy Hash: b33cedecba96731f1d565590f3b39e90d9591820554d9a550e0de9fdc4a4bae1
Instruction Fuzzy Hash: 3A41D4B0E0560ADBDB48CFAAC4815EEFBF2BF89300F24D42AD415A7254D734AA418F94

Uniqueness

Uniqueness Score: -1.00%

Function 07538218 Relevance: 5.1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

Strings

[V~*, xrefs: 075384E4
]\`, xrefs: 075385FA
[V~*, xrefs: 075384DD
T+-q, xrefs: 075386B2

Memory Dump Source

Source File: 00000000.00000002.1812142170.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7530000_Docs.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$[V~*$]\`
API String ID: 0-1849991408
Opcode ID: 3ff7cd3abd55c4a8e08a3c6cfa78efba2b67168cd03832b295d4bbacb1811c4c
Instruction ID: 037a2f14486998932af7a13eb6f4d99e57e76b2694e9c9028d4e4a53dfd96fcb
Opcode Fuzzy Hash: 3ff7cd3abd55c4a8e08a3c6cfa78efba2b67168cd03832b295d4bbacb1811c4c
Instruction Fuzzy Hash: 39318FB0915609CBDB148FB8C8506FEBBB0FF06304F048927F4659B2A2D27AA955C776

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Docs.exePID: 7576, Parent PID: 7388COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06FA3048 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06FA376B
$^q, xrefs: 06FA372A
$^q, xrefs: 06FA3777
$^q, xrefs: 06FA3753
$^q, xrefs: 06FA3747
$^q, xrefs: 06FA371E

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 476640036daa580789266bdd69e469bb483a0a5cdcb132659d3795ea6efad6e2
Instruction ID: 5cf7775851fc401ad08fc432e5a81593e7a345afc6d25bcaadd15c649d93cdae
Opcode Fuzzy Hash: 476640036daa580789266bdd69e469bb483a0a5cdcb132659d3795ea6efad6e2
Instruction Fuzzy Hash: E8322C71E1071ACFDB54DF75C85459DB7B6FF89300F2086AAD409AB264EB30A986CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06FA7D78 Relevance: 3.0, Strings: 2, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06FA80DB
$^q, xrefs: 06FA80E7

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 1beee47e7ca254dfa13fca2bbfaf35cbfde12f32230a57bec7c5a7dd457c5b18
Instruction ID: ee5e372275a270602c0118f3cae2662e34375cce947dfeb7e872a6966e58fc8c
Opcode Fuzzy Hash: 1beee47e7ca254dfa13fca2bbfaf35cbfde12f32230a57bec7c5a7dd457c5b18
Instruction Fuzzy Hash: FA028A70F003059FDB54DB68D994AAEB7E2EF84344F148429D4199B394EBB5EC82CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06FA5598 Relevance: 1.8, Strings: 1, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06FA5970

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 4ed364d75ebe7099446a995e5b06da12fe741d580a17f831fec27858a06a2d8a
Instruction ID: 8e6fbc95f902bc91dd6482c8409a9bf736e0ca515480f6de23597ce14d835c73
Opcode Fuzzy Hash: 4ed364d75ebe7099446a995e5b06da12fe741d580a17f831fec27858a06a2d8a
Instruction Fuzzy Hash: D222C1B5E003198FDF60DFA4C5846AEBBB2EF89320F248469D459AB344DA35DC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FA65E8 Relevance: .8, Instructions: 822COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc84e3395e99c866f9479c28063134893c2cab9afebffb8758878aea6ab16b19
Instruction ID: 1e0717777229c5a0f3073ef5bfadca1450cd3c3ffba82c4f5c0083ba2e02f64b
Opcode Fuzzy Hash: fc84e3395e99c866f9479c28063134893c2cab9afebffb8758878aea6ab16b19
Instruction Fuzzy Hash: 0962AC74F102049FDB54DB68D584AADB7F2EF88314F188469E40AEB394DB35EC86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FAC198 Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca05ef4e3c69727e1f2496fa854ccd5b6de1d6a83a89e20ee3b0d80e2c6ea43
Instruction ID: 3e05b35ff2a1c58ceda8c830f74fdd057a83d25f0ca97adbae0e7b4ca43ffd52
Opcode Fuzzy Hash: 3ca05ef4e3c69727e1f2496fa854ccd5b6de1d6a83a89e20ee3b0d80e2c6ea43
Instruction Fuzzy Hash: 56328F74F102099FEB55DB68D990AAEB7F2FB88310F108525E405EB394DB35EC86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FAB230 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 575a962db8c99c6699adc35097a9788713be13faff9333f62703dfcb7b51d760
Instruction ID: 12d62a6a7cda9805e3884743d466d55f0753d44ba3c9e0f4bb733023bf34d4ea
Opcode Fuzzy Hash: 575a962db8c99c6699adc35097a9788713be13faff9333f62703dfcb7b51d760
Instruction Fuzzy Hash: AB225FB0E102098FEF64CB6CC5847AEB7B6FB89310F248926D445DB395CA35DC82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06FAACD8 Relevance: 10.4, Strings: 8, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06FAADF9
$^q, xrefs: 06FAAE58
$^q, xrefs: 06FAAE7B
$^q, xrefs: 06FAAEB0
$^q, xrefs: 06FAAE05
$^q, xrefs: 06FAAEA4
$^q, xrefs: 06FAAE87
$^q, xrefs: 06FAAE4C

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 34f436e802731cc59bc3d054f40325ade6ef71250e7a904cef017ba60b2d58be
Instruction ID: 46dbedc34e2dbfe9ded45a46e5958d3f1b1803468da5a41c6aa830cb2b1cdcae
Opcode Fuzzy Hash: 34f436e802731cc59bc3d054f40325ade6ef71250e7a904cef017ba60b2d58be
Instruction Fuzzy Hash: 9AE14C70E1030A8FDB69DF69D9846AEB7B2FF88304F108529D409AB354DB75DC4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FAB658 Relevance: 8.0, Strings: 6, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06FABBF3
$^q, xrefs: 06FABBCB
$^q, xrefs: 06FABB8B
$^q, xrefs: 06FABBBF
$^q, xrefs: 06FABB97
$^q, xrefs: 06FABBFF

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2392861976
Opcode ID: 32368e3805035e64fecf15aba5b2ac91de6523ee13fe999f75f6141b183b4719
Instruction ID: f9c9ede060545204f437115505ca4abcfe45ae276b4b1bb6a108e2935f1c5552
Opcode Fuzzy Hash: 32368e3805035e64fecf15aba5b2ac91de6523ee13fe999f75f6141b183b4719
Instruction Fuzzy Hash: 1B026BB0E1020A8FDFA4CF68D580AADB7B2FB85310F24856AD405EB355DB75DC86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FA9150 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06FA91D2
$^q, xrefs: 06FA91DE
$^q, xrefs: 06FA9197
$^q, xrefs: 06FA91A3

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 8ad014484775402d9bf64d7b353bd43e84c04091229793723ecf391fbbe69862
Instruction ID: 2a003ae8659fa31a86b220706805eb58a189804adb3ee30265605a9b9aa5a0bc
Opcode Fuzzy Hash: 8ad014484775402d9bf64d7b353bd43e84c04091229793723ecf391fbbe69862
Instruction Fuzzy Hash: D9913D70F2021A9FEB54DF65D9507AEB3F6EFC9204F108469C809EB344EE74AD468B91

Uniqueness

Uniqueness Score: -1.00%

Function 06FACF58 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06FAD353
$^q, xrefs: 06FAD34B
$^q, xrefs: 06FAD35F

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: aa5bd08bca1e432c641bb2a9fba49818a1dc111098ea9a73477f234d792e5803
Instruction ID: 8e130c87adadccde3c04b47a6a0d9793c2e74d20ffdb60004ba7654f16e25cdc
Opcode Fuzzy Hash: aa5bd08bca1e432c641bb2a9fba49818a1dc111098ea9a73477f234d792e5803
Instruction Fuzzy Hash: 82624071A0030A8FDB55DB68D594A5DBBF2FF84304F108968D0099F769DB75EC8ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 06FA4B58 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 06FA5265
\Ocq, xrefs: 06FA4D0F
XPcq, xrefs: 06FA4C85

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: fcq$XPcq$\Ocq
API String ID: 0-3575482020
Opcode ID: 3be1146e9541eb40598129c9bd4686bbc050c74547d38ffeeabe3b9471db9c84
Instruction ID: d1aed5afcd841f88d3c9fcc42c5ca2c7c77f1aec18760fd88b8b6fa435e894ad
Opcode Fuzzy Hash: 3be1146e9541eb40598129c9bd4686bbc050c74547d38ffeeabe3b9471db9c84
Instruction Fuzzy Hash: AF616E71E002199FEF559FA8C8547AEBAF7FF88340F208429D10AAB395DB758C45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FA9141 Relevance: 2.7, Strings: 2, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06FA91D2
$^q, xrefs: 06FA9197

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: a79b4198dd5ff806ca4df272e16cb22d2f189d2af8562940bc65415a0cb57139
Instruction ID: 5bcfde0250af316fdee443376b7acddf9188b3b4af948dc38ad4e61e96cbc7e5
Opcode Fuzzy Hash: a79b4198dd5ff806ca4df272e16cb22d2f189d2af8562940bc65415a0cb57139
Instruction Fuzzy Hash: FE511E70F102059FEB54DB74D950BAEB3FAEFC8644F148469C409EB384EE74AC428B95

Uniqueness

Uniqueness Score: -1.00%

Function 017EEB40 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2995885964.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_17e0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3a88cee4fb8c6bd1b92f04c96137008ea06f3e4823b323fe9331c05fa326c1
Instruction ID: 298b53fbdf5e5f5b0ced5092db386524088021af9882ef9c2a588171d0296020
Opcode Fuzzy Hash: 4d3a88cee4fb8c6bd1b92f04c96137008ea06f3e4823b323fe9331c05fa326c1
Instruction Fuzzy Hash: 8D414371D043999FCB14DF79D8046DEBFF5AF89310F14856AD908A7291EB349840CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 017EEC28 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 017EEC8F

Memory Dump Source

Source File: 00000002.00000002.2995885964.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_17e0000_Docs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 8a24c9965820d64f985a2e0d8b36f924e8e431e0bfe38c37803558d2b5db0047
Instruction ID: 3d3d74ec5ea1f0bc9aa3d4b7902a0baf0fafe6b57e00aae55c78594ad6397af3
Opcode Fuzzy Hash: 8a24c9965820d64f985a2e0d8b36f924e8e431e0bfe38c37803558d2b5db0047
Instruction Fuzzy Hash: 0D1120B1C006699FCB10DFAAC548BDEFBF4BF48320F11852AD818A7250D778A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06FA4B48 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

XPcq, xrefs: 06FA4C85

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: XPcq
API String ID: 0-714321711
Opcode ID: 4a82b6640faed8c0196a85cddf99ff93c0746b3fbd72fbeeffacee728324fcf7
Instruction ID: 99b6715158e438ca8890bff884590aa25be9cf78fe103bded2371a419a732645
Opcode Fuzzy Hash: 4a82b6640faed8c0196a85cddf99ff93c0746b3fbd72fbeeffacee728324fcf7
Instruction Fuzzy Hash: 86417D71E002099FDB459FA8C854B9EBBF7FF88700F20842AD105AB395DA748C05DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FADAC5 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06FADC21

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: b031ef8450560f59a1c64b5c5399e770b683ef97a93dc870ee1c0c516dd48710
Instruction ID: 90ffb79bc36a11adbd4a8c979e7da5df5063ab45bde8628c2b846fd9e26d29ff
Opcode Fuzzy Hash: b031ef8450560f59a1c64b5c5399e770b683ef97a93dc870ee1c0c516dd48710
Instruction Fuzzy Hash: 2C41E2B0E003099FDF65DFA4C44469EBBB6FF85340F20492AE405EB240DB74D846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FA21C5 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06FA2313

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 8db20c1e74590b048ca2fe329479ba545fcc1b2f39f681d9a12987257a94d2dc
Instruction ID: 65132f2184f0c4765e273e64b532b18a4b092dda14a89f07ed9e8b1dcd147d43
Opcode Fuzzy Hash: 8db20c1e74590b048ca2fe329479ba545fcc1b2f39f681d9a12987257a94d2dc
Instruction Fuzzy Hash: 9231DE70F103018FEB5A9F74D51466EBAE3AF89200F288428D406DB384EF35DE46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FA21D8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06FA2313

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 10118210653f9ff5229a221e97f05ec9d7cdefbe132eb77fa2db17b45bdcac27
Instruction ID: 4f84a192b663e2180a77d6d3b35b4b62aec6b74eab7757a8ee8cc3c3f2b3f257
Opcode Fuzzy Hash: 10118210653f9ff5229a221e97f05ec9d7cdefbe132eb77fa2db17b45bdcac27
Instruction Fuzzy Hash: 9431DE70B103018FEB599F78D51466EBBE3AF89200F248428D406DB384EF35DE46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06FA2350 Relevance: 1.0, Instructions: 1013COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89573b200770b34775dc2b29801371f42ade1729880f326a7d992aea527de9ec
Instruction ID: 636dd20913fccc8e8dde832c7d84b9a4f34ff8d3b4a6d5dad95c50fcee0349fb
Opcode Fuzzy Hash: 89573b200770b34775dc2b29801371f42ade1729880f326a7d992aea527de9ec
Instruction Fuzzy Hash: EF923574F003048FDB64CB68C584A5DBBF2FB49314F5984A9E849AB365DB35EE85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06FA61E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fda493842464823f80964e6335d7b823a1b08388f4d1140e34a10d1bad9e652
Instruction ID: fc0eb4e9c5d2d65608671e01040a7fb6645829db5dde0c90c96074532859d372
Opcode Fuzzy Hash: 4fda493842464823f80964e6335d7b823a1b08388f4d1140e34a10d1bad9e652
Instruction Fuzzy Hash: 0161BFB1F001114FDF549A7EC88466FAAD7EFC4624B29443AD80EDB364DEA6DD0287C2

Uniqueness

Uniqueness Score: -1.00%

Function 06FA4288 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 624fbb9a1b5e8b99e5f85bd626805666c951d9eb6ee3652718f2b61929f9fa21
Instruction ID: 49ac7f038eaad40f6a97ebef80d404d0223a8b980c93db203dbf162b6c27beab
Opcode Fuzzy Hash: 624fbb9a1b5e8b99e5f85bd626805666c951d9eb6ee3652718f2b61929f9fa21
Instruction Fuzzy Hash: 28813B74F102099FDF54DFA8D4946AEB7F6AF89304F148429D40AEB394EB74EC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06FA45A8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c94836a662abe9d33e4e5ac2eb4ba16faa9cbc215a58f34b7ca996e53424d7
Instruction ID: 093a4f2c069259e362674497661170a08337e171198baae35706a239ed822b55
Opcode Fuzzy Hash: 65c94836a662abe9d33e4e5ac2eb4ba16faa9cbc215a58f34b7ca996e53424d7
Instruction Fuzzy Hash: F5913C74E102198FDF60DF68C890B9DB7B1FF89300F208699D549AB395DB70AA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FA45C0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb79d7931d0371bd796f2960feb9058b19cc0194b9a2dce05671e35737169ac
Instruction ID: 6a7d0b1a940d07a98e2dc58006da72170a2475d766acb047a63156bc12242aa8
Opcode Fuzzy Hash: 0bb79d7931d0371bd796f2960feb9058b19cc0194b9a2dce05671e35737169ac
Instruction Fuzzy Hash: 60912D74E102198BDF60DF68C890B9DF7B1FF89300F208699D549AB355EB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06FAEB18 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524f5fac4386ba184c7f5ad21ccf290ad9197940def8da9748b1859e8bdd835e
Instruction ID: 536219580ea300579750c5b209a65e3b0c6ca4bbd7c17910811b9bade5db151e
Opcode Fuzzy Hash: 524f5fac4386ba184c7f5ad21ccf290ad9197940def8da9748b1859e8bdd835e
Instruction Fuzzy Hash: 94710771A002099FDB54DBA9D994A9EBBF6FF88300F148529E409EB354DB30E846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06FAEB28 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17306b18cafbe5f4a0c73a223b908d74b2745390d5ee6359922366c3f0d7440d
Instruction ID: a014a9f119f899d868f89642343f51fe2791c11d67a5c916af649ef3f5242bab
Opcode Fuzzy Hash: 17306b18cafbe5f4a0c73a223b908d74b2745390d5ee6359922366c3f0d7440d
Instruction Fuzzy Hash: 5D710770A002099FDB54DBA9D994A9EBBF6FF88300F248529D409EB358DB30EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06FAFC91 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27fe41362bd87f0bdca3e17a7a9c6430fbaa742dd6b3d43be0312b3bddb0421
Instruction ID: f16ec7f49b2c786fc72aa23f7c84799000edd350f912518dc2e2cde7397ac969
Opcode Fuzzy Hash: b27fe41362bd87f0bdca3e17a7a9c6430fbaa742dd6b3d43be0312b3bddb0421
Instruction Fuzzy Hash: B351E3B1E022099FDF65EB78E4946ADBBB3FF84315F108879E106DB250DB358846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FAFA40 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8794d764410b656e013ad704c2062bb05909d857843d1044f2d1979b031a1674
Instruction ID: d657d5de033116eef6910a864efcc05a51aa4e97e56bc7fcfa464e404d1aaa55
Opcode Fuzzy Hash: 8794d764410b656e013ad704c2062bb05909d857843d1044f2d1979b031a1674
Instruction Fuzzy Hash: B351C5B0F113059FFF64566CD8A476F366ED789750F20492AE40ADB3E4C969CC8583E2

Uniqueness

Uniqueness Score: -1.00%

Function 06FAFA50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5dffc5759c52b3d942f129f93a4a80849776d7976bffa65fe76ee07e93259f
Instruction ID: fa0c97ec4b120860b81fb75ed66d941ea4cf396db86bc32b341685c346dc5ce0
Opcode Fuzzy Hash: 9c5dffc5759c52b3d942f129f93a4a80849776d7976bffa65fe76ee07e93259f
Instruction Fuzzy Hash: 4F51D5B0F103059FFFA4566CD8A476F266FD789750F204929E40ADB3E4C969CC8583A2

Uniqueness

Uniqueness Score: -1.00%

Function 06FA5408 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca495120f0ab184955641f51e2266b188e203c8a199c5f8fc6f839b8f79d227
Instruction ID: 0764a4d6107837dc1437734dff990b5c78bd1694448d14353bcf65d03aeeda33
Opcode Fuzzy Hash: 5ca495120f0ab184955641f51e2266b188e203c8a199c5f8fc6f839b8f79d227
Instruction Fuzzy Hash: 554148B1E007098FDF60CFADD880AAEFBB6FB84314F10492AE156D7654D330E9598B91

Uniqueness

Uniqueness Score: -1.00%

Function 06FA2088 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be597b19684a619ed2b5801d4917843de129c65bef13e6f5b44198ded033e05
Instruction ID: 6de4a2a56241a157d4aab33649f0ab31eaea125d014da7caf62f7e911413635f
Opcode Fuzzy Hash: 8be597b19684a619ed2b5801d4917843de129c65bef13e6f5b44198ded033e05
Instruction Fuzzy Hash: 6F319074F102099FDB58CFA4D8546AEB7B2EF89340F18C919E916EB340DB71AD42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06FA5588 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c57a5cff18abf01a9af0422ab6e05d7d4896ee6cc50e5aedc3a945a9fc38394e
Instruction ID: a08092852d7a8fd2a6669d81060158ef7b645134dd927a00a88db8d4c89cafb4
Opcode Fuzzy Hash: c57a5cff18abf01a9af0422ab6e05d7d4896ee6cc50e5aedc3a945a9fc38394e
Instruction Fuzzy Hash: 613190B5E003058FDF64CF69C8C0A6EFBB2EB46310F15886AE55ADB752C634E840CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FA2098 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77f295ffe7d6324c16069df1640f31c29075b2c526db8e3f82b8a1762a36a2b
Instruction ID: 25ef34f851fca58399d6f3a6bbe605a534c787420d4f5b8af388a53028d1ca50
Opcode Fuzzy Hash: d77f295ffe7d6324c16069df1640f31c29075b2c526db8e3f82b8a1762a36a2b
Instruction Fuzzy Hash: DC315E70F102099BCB59CFA4D8546AEB7B2FF89300F148929E916EB350DB71ED82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06FA3A88 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72cdf5a1c1a223e1eb10cd5c1474613e5a3d32d71da6d4de4386d86a584a5f17
Instruction ID: 4f358d1e979a915f151e30c62e4ff211ac0ae7fbb182a0b195bfb6fa1477f5d5
Opcode Fuzzy Hash: 72cdf5a1c1a223e1eb10cd5c1474613e5a3d32d71da6d4de4386d86a584a5f17
Instruction Fuzzy Hash: 9B216BB6E102159FEB50DF69D840AEEBBF5EF48750F108029E909E7380E734DD428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06FA3A98 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41fec497fc5b17a4e81b7da26341e794f0d039d1d5e0cbbb83520f7154c992f
Instruction ID: 3654d397fcba9e649a5306fb3f64954aa5a6d7540a136dc9f24961f7a9bab3ee
Opcode Fuzzy Hash: e41fec497fc5b17a4e81b7da26341e794f0d039d1d5e0cbbb83520f7154c992f
Instruction Fuzzy Hash: 0A217CB6E106159FEB50CF69D880AAEBBF6EB48650F108169E905E7380E734DD018B91

Uniqueness

Uniqueness Score: -1.00%

Function 0178D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2992442590.000000000178D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0178D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_178d000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be11f11a323691d7f865e66a9781dd3e1c4df6edb6d229a9e650b34c2a6a01c9
Instruction ID: 2fef6f8e41a654edbf1b30012f45d59720e7012b7c4e8886bf27de56813e080b
Opcode Fuzzy Hash: be11f11a323691d7f865e66a9781dd3e1c4df6edb6d229a9e650b34c2a6a01c9
Instruction Fuzzy Hash: AF210771584204DFDB25EF58C9C4B26FB65FB84314F20C5ADE9494B292C736D447CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06FA3BA8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ed7020fe12dc8d603b601ad9dd8fb706662ca7ff8c39f20bd4b27facfef3cd
Instruction ID: 9db22580ed1f13770e64c90f2294a5bb8ceaa67a0a3f0dd418cf6281ea118bbe
Opcode Fuzzy Hash: e0ed7020fe12dc8d603b601ad9dd8fb706662ca7ff8c39f20bd4b27facfef3cd
Instruction Fuzzy Hash: 5411A132F102285FDF949678CC146AE73EBEBC8254F004539D50AE7340DE65DC028BD2

Uniqueness

Uniqueness Score: -1.00%

Function 06FA41E9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2ca937e446001a9f8ffae8f461c21f0564da83fb3b06c2ff6e90aaa46ad783
Instruction ID: bd6631843134d83f1e9308dd5bffe7a80cbcb2951f8c8345fd5a3fa4c64d2803
Opcode Fuzzy Hash: 4c2ca937e446001a9f8ffae8f461c21f0564da83fb3b06c2ff6e90aaa46ad783
Instruction Fuzzy Hash: CE012B30F042101FDB61D5BDA81476BA7DBDBCA720F14843AE10ECB355DEA5CC464795

Uniqueness

Uniqueness Score: -1.00%

Function 06FAED99 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618cceea5e5901f598e6a2b9a5dd6b50b2d4899b0b47b0055eacb40dd747b356
Instruction ID: 55ef76494b4ef753c13bb82f7fe0f805752a451b851d3b60da1aba1ee3051c53
Opcode Fuzzy Hash: 618cceea5e5901f598e6a2b9a5dd6b50b2d4899b0b47b0055eacb40dd747b356
Instruction Fuzzy Hash: EB01F771F042142FDB65957DE850B6FB7EBDBCA610F148439E50AC7340DA65DC0287D2

Uniqueness

Uniqueness Score: -1.00%

Function 06FA3861 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15e2c4d96bc5c56c3f823a5b97d4655da9b56508a64781ce88c8f8dc6c34d0e2
Instruction ID: 7d0563f6aed5eb29aec37dea6978905a2af9e31d8aa77785f10ac70c8d8e46f5
Opcode Fuzzy Hash: 15e2c4d96bc5c56c3f823a5b97d4655da9b56508a64781ce88c8f8dc6c34d0e2
Instruction Fuzzy Hash: C121C4B5D01259EFCB10DF9AD885ADEFBB8FB48310F10812AE918A7240C375A954CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 06FAA308 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c6e61eb68330a2650c6b5136dda28efa3d1a55bdd05dae826ca819a823ca23
Instruction ID: 3ca786a3fe3ae504fd643d24dadda19c31fea8e88d9d238774ee6e56ff866ea7
Opcode Fuzzy Hash: 63c6e61eb68330a2650c6b5136dda28efa3d1a55bdd05dae826ca819a823ca23
Instruction Fuzzy Hash: 4001F774F003101FD761D63CE851B6F77E6EB8A650F108469E14ACB345DA16DC06C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0178D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2992442590.000000000178D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0178D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_178d000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 2dfd170fe987589aed59ba4e346c960aaf9cee4cd15972f295fc703efbba69c3
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 6711DD75544284CFDB22DF54C9C4B16FFA2FB84314F24C6AAD8494B292C33AD44ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 06FA3B97 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58f02200e0bcedb7c0a5b4ec51726911b258019346f63995d923b858960e8b2
Instruction ID: d50b54c09382285b86b1301761997a171e367c4201dd6e6c92c2dd90abfb708e
Opcode Fuzzy Hash: c58f02200e0bcedb7c0a5b4ec51726911b258019346f63995d923b858960e8b2
Instruction Fuzzy Hash: 1E012432F101241FDB94C579EC20AEF32ABDFC8244F04403AD40AE7280EE648C0687D2

Uniqueness

Uniqueness Score: -1.00%

Function 06FA3868 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4125903a4a07342deed9ede09047da3cf1c0eefe9cf8b7574b3b6348e17e9d
Instruction ID: 21f5812b4d54336f30a1d20c6dd1159164b8d6a92b1ae17fbfae3d3524ed7ac7
Opcode Fuzzy Hash: dc4125903a4a07342deed9ede09047da3cf1c0eefe9cf8b7574b3b6348e17e9d
Instruction Fuzzy Hash: 7811B4B5D01259DFCB00DF9AD885ADEFFB4FB48314F10812AE518A7240D375A554CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06FA41F8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15e1d0d3178be21d95756a8e196a1a70f1c94a22dbaceb6d0e7d9d8bdaa6577c
Instruction ID: 6aef1a9a9648df6d80de54e43dcf2903c3f03760334dfe964bca8ad493be2479
Opcode Fuzzy Hash: 15e1d0d3178be21d95756a8e196a1a70f1c94a22dbaceb6d0e7d9d8bdaa6577c
Instruction Fuzzy Hash: 5701D131F002141BDBA4D9AEA40472BB3DBDBCA720F208439E20EC7354DEA5DC424795

Uniqueness

Uniqueness Score: -1.00%

Function 06FAEDA8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6b37989c9740aeb57cbce794db29153d70723079d3acb25188b952be61d584
Instruction ID: 8588064a9ece4d8d8c7749e317efc876d8b98faec329b348fb7e2fe7a0e56fe1
Opcode Fuzzy Hash: 7f6b37989c9740aeb57cbce794db29153d70723079d3acb25188b952be61d584
Instruction Fuzzy Hash: FE01DC35F002102BCB64AA6DA494B2EA2DBDBC9620F108839E10EC7340EE65DC0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 06FAA318 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279259d403baf67a933a1ec9d265f0df63256126668f31b998badb9ca350315c
Instruction ID: 735a993d7e7a49f4bbaf57868067193e893b4a1c7b5493aa89e4d71f6c7a0aa0
Opcode Fuzzy Hash: 279259d403baf67a933a1ec9d265f0df63256126668f31b998badb9ca350315c
Instruction Fuzzy Hash: 87018174F103141FDB61D66CE85172EB3E6EB8A650F108438E10AC7344EA26DC068781

Uniqueness

Uniqueness Score: -1.00%

Function 06FA6469 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda838198e34289a59e871f97b5248ca2588ffb00666ab34be95bab8d4f9c0c9
Instruction ID: 6d9f4991df9c6c4637d5c5f5c4e53e8c7a4f1dc12346c5c3daa5a76d50dcd603
Opcode Fuzzy Hash: fda838198e34289a59e871f97b5248ca2588ffb00666ab34be95bab8d4f9c0c9
Instruction Fuzzy Hash: 5BE092F2E153086BDF60CE60DD2579A7B5EE702204F2488A1DC04C7182E276D9008791

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06FA7698 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$^q, xrefs: 06FA7788
$^q, xrefs: 06FA7C06
$^q, xrefs: 06FA7BF0
$^q, xrefs: 06FA7BE4
$^q, xrefs: 06FA77B9
$^q, xrefs: 06FA7794
$^q, xrefs: 06FA7BFA
$^q, xrefs: 06FA7B51
$^q, xrefs: 06FA7B45
$^q, xrefs: 06FA77C5

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-2222239885
Opcode ID: 2ffdc605970a5ff01758969a5e8e3aa02eb73ab400f419680cc3713f2208e1b5
Instruction ID: e90042edc68285d0a6f44260900405c3b89af5dab48b62430a51990870efe391
Opcode Fuzzy Hash: 2ffdc605970a5ff01758969a5e8e3aa02eb73ab400f419680cc3713f2208e1b5
Instruction Fuzzy Hash: C2120B74E002198FDB68EF65C954A9EB7F2FF88704F208569D409AB364DB319D86CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06FAA940 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$^q, xrefs: 06FAAA9D
$^q, xrefs: 06FAAAF2
$^q, xrefs: 06FAAA36
$^q, xrefs: 06FAAAC8
$^q, xrefs: 06FAAAFE
$^q, xrefs: 06FAAA91
$^q, xrefs: 06FAAA42
$^q, xrefs: 06FAAABC

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 622d78467d294025a9addc84523808f1ffba799759c9f7acd802c49c79471bd4
Instruction ID: 1316b466e6c6f6ca7e96e8cef5d32ac772252d9b9c412cfbdd5a3f51373bb723
Opcode Fuzzy Hash: 622d78467d294025a9addc84523808f1ffba799759c9f7acd802c49c79471bd4
Instruction Fuzzy Hash: D4912AB0E10309DFEB68DF64DA58B6EB7F6EF88300F108529E4059B294DB759D49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06FA7098 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$^q, xrefs: 06FA75AC
.5vq, xrefs: 06FA70F3
$^q, xrefs: 06FA73E0
$^q, xrefs: 06FA737A
$^q, xrefs: 06FA7534
$^q, xrefs: 06FA73D4
$^q, xrefs: 06FA75A0

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: .5vq$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-390881366
Opcode ID: 49d8298d233cc7ca9a2ffe1884536865004e10f6e44b5bda95c6f918de4d27b0
Instruction ID: 43523d9ae0aa19ca9cac4fc9b359870dabdd00fe67dbb25f32c8d40ca5cdb587
Opcode Fuzzy Hash: 49d8298d233cc7ca9a2ffe1884536865004e10f6e44b5bda95c6f918de4d27b0
Instruction Fuzzy Hash: 67F11B74B10209CFDB59EB68C598A5EBBF6FF88300F208568D4059B368DB75DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FA83D0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$^q, xrefs: 06FA869B
$^q, xrefs: 06FA862A
$^q, xrefs: 06FA8636
$^q, xrefs: 06FA868F

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 41da63c5ef4957a162e5567d98f085747c771e03c10647153c46aeb975f95a84
Instruction ID: c01d60b4f4d80be7b4ec802d640774f0dd9d3119234d2dd66522cb86896a8110
Opcode Fuzzy Hash: 41da63c5ef4957a162e5567d98f085747c771e03c10647153c46aeb975f95a84
Instruction Fuzzy Hash: E9B11870F102098FDB58DB68D58469EBBF6FF88344F248829D4169B358DBB5DC86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06FAACC8 Relevance: 5.2, Strings: 4, Instructions: 171COMMON

Download Yara Rule

Strings

$^q, xrefs: 06FAADF9
$^q, xrefs: 06FAAE7B
$^q, xrefs: 06FAAEA4
$^q, xrefs: 06FAAE4C

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: cc6bc3669e861e0331de7745852821373ef664178e0dceda2c7c46996fbddffe
Instruction ID: d9d7a8fb0465239a16f838566884edc70bd84fafacf2d77e4d62232bb4f99775
Opcode Fuzzy Hash: cc6bc3669e861e0331de7745852821373ef664178e0dceda2c7c46996fbddffe
Instruction Fuzzy Hash: 33518E70E103059FDFA5DB68D9846AEB7F2EB88301F14856AE406DB354DB34EC4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 06FA87E8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$^q, xrefs: 06FA8873
LR^q, xrefs: 06FA88DB
LR^q, xrefs: 06FA892A
$^q, xrefs: 06FA8867

Memory Dump Source

Source File: 00000002.00000002.3013331695.0000000006FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6fa0000_Docs.jbxd

Similarity

API ID:
String ID: LR^q$LR^q$$^q$$^q
API String ID: 0-2454687669
Opcode ID: 193ae69d41d3f7097eb2aec13fc15c45792b7da2736fd751c1a852bf7174a8af
Instruction ID: efebf84e546767d921c12b0a450dffa780466e566a1eff7d35d60567a3263605
Opcode Fuzzy Hash: 193ae69d41d3f7097eb2aec13fc15c45792b7da2736fd751c1a852bf7174a8af
Instruction Fuzzy Hash: 6551CF71F003058FDB58DB78D944A6AB7E2FF88740F108568E4169B3A8DEB0EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Docs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Docs.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
Docs.exe

Function 075310A0 Relevance: 1.7, Strings: 1, Instructions: 432
COMMON

Function 0107D2B1 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 0107D2C0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 0107B028 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197
COMMON

Function 07535688 Relevance: 3.9, Strings: 3, Instructions: 106
COMMON

Function 075317D0 Relevance: 2.6, Strings: 2, Instructions: 63
COMMON

Function 075D1C04 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Function 075D1C10 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 010744C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0107590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre