Play interactive tour

Edit tour

Windows Analysis Report KkPVouLuOx

Overview

General Information

Sample Name:	KkPVouLuOx (renamed file extension from none to exe)
Analysis ID:	458889
MD5:	f935b6c7f24be477a23044fa9a9dc9a5
SHA1:	e67fb9bcf9975e0c6c4122ec7b25e61de6d1ba24
SHA256:	4827c1bdf5000cc8fc280fa631d36c752d0cdd7b0b357671ef1ebc46a11c440f
Tags:	32exe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: MSBuild connects to smtp port

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

KkPVouLuOx.exe (PID: 1336 cmdline: 'C:\Users\user\Desktop\KkPVouLuOx.exe' MD5: F935B6C7F24BE477A23044FA9A9DC9A5)

MSBuild.exe (PID: 1068 cmdline: 'C:\Users\user\Desktop\KkPVouLuOx.exe' MD5: D621FD77BD585874F9686D3A76462EF1)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "info@karsanmax.com", "Password": "erk#bmc2007", "Host": "mail.karsanmax.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.499202518.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.499202518.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.240535528.0000000002AF0000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.240535528.0000000002AF0000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: KkPVouLuOx.exe PID: 1336	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 1068	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 1068	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.KkPVouLuOx.exe.2af0000.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.KkPVouLuOx.exe.2af0000.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.KkPVouLuOx.exe.2af0000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.KkPVouLuOx.exe.2af0000.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Sigma Overview

Networking:

Sigma detected: MSBuild connects to smtp port

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 67.20.76.71, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 1068, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49733

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.KkPVouLuOx.exe.2af0000.2.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "info@karsanmax.com", "Password": "erk#bmc2007", "Host": "mail.karsanmax.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: KkPVouLuOx.exe

ReversingLabs: Detection: 52%

Machine Learning detection for sample

Show sources

Source: KkPVouLuOx.exe

Joe Sandbox ML: detected

Source: 2.2.MSBuild.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: KkPVouLuOx.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: KkPVouLuOx.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: KkPVouLuOx.exe, 00000000.00000003.236887920.0000000002B90000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: KkPVouLuOx.exe, 00000000.00000003.236887920.0000000002B90000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\KkPVouLuOx.exe

Code function: 0_2_003AA41D FindFirstFileExW,

0_2_003AA41D

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49733 -> 67.20.76.71:587

Source: global traffic

TCP traffic: 192.168.2.5:49733 -> 67.20.76.71:587

Source: Joe Sandbox View

IP Address: 67.20.76.71 67.20.76.71

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: global traffic

TCP traffic: 192.168.2.5:49733 -> 67.20.76.71:587

Source: unknown

DNS traffic detected: queries for: mail.karsanmax.com

Source: MSBuild.exe, 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: MSBuild.exe, 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: MSBuild.exe, 00000002.00000002.505310278.0000000003825000.00000004.00000001.sdmp	String found in binary or memory: http://mail.karsanmax.com
Source: MSBuild.exe, 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp	String found in binary or memory: http://myRZFP.com
Source: KkPVouLuOx.exe, 00000000.00000002.240535528.0000000002AF0000.00000040.00000001.sdmp, MSBuild.exe, 00000002.00000002.499202518.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: MSBuild.exe, 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: MSBuild.exe, 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp	String found in binary or memory: https://yE6yjauUrbNMVyVX.com

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a global keyboard hook

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_003A8456	0_2_003A8456
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_003A8BC9	0_2_003A8BC9
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_00396C20	0_2_00396C20
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_00399420	0_2_00399420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01457EC0	2_2_01457EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0145E0D8	2_2_0145E0D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01459148	2_2_01459148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016BAB30	2_2_016BAB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016B1BE0	2_2_016B1BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016BAD50	2_2_016BAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016B4D38	2_2_016B4D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016B7DC0	2_2_016B7DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016B2E88	2_2_016B2E88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016B42C8	2_2_016B42C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016BBB70	2_2_016BBB70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016BBC20	2_2_016BBC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016E5B18	2_2_016E5B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016EC0B8	2_2_016EC0B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016EB3D5	2_2_016EB3D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016EB531	2_2_016EB531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016EB4CF	2_2_016EB4CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016EB487	2_2_016EB487
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016EB7DE	2_2_016EB7DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_032847A0	2_2_032847A0

Source: KkPVouLuOx.exe, 00000000.00000003.232733016.0000000002DFF000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs KkPVouLuOx.exe
Source: KkPVouLuOx.exe, 00000000.00000002.240535528.0000000002AF0000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameFLQsqxQVGqhcqKgsCJFGvvBdNseuTyWeUb.exe4 vs KkPVouLuOx.exe

Source: KkPVouLuOx.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@3/0@1/1

Source: C:\Users\user\Desktop\KkPVouLuOx.exe

Command line argument: n:

0_2_003AE5C0

Source: KkPVouLuOx.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\KkPVouLuOx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: KkPVouLuOx.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\KkPVouLuOx.exe

File read: C:\Users\user\Desktop\KkPVouLuOx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\KkPVouLuOx.exe 'C:\Users\user\Desktop\KkPVouLuOx.exe'
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 'C:\Users\user\Desktop\KkPVouLuOx.exe'
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 'C:\Users\user\Desktop\KkPVouLuOx.exe'	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: KkPVouLuOx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: KkPVouLuOx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: KkPVouLuOx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: KkPVouLuOx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: KkPVouLuOx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: KkPVouLuOx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: KkPVouLuOx.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: KkPVouLuOx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: KkPVouLuOx.exe, 00000000.00000003.236887920.0000000002B90000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: KkPVouLuOx.exe, 00000000.00000003.236887920.0000000002B90000.00000004.00000001.sdmp

Source: KkPVouLuOx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: KkPVouLuOx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: KkPVouLuOx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: KkPVouLuOx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: KkPVouLuOx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_003920E8 push ss; retn 0038h	0_2_003920E5
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_00392100 push edx; retn 0038h	0_2_00392101
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_003901F4 push 72003893h; retf	0_2_0039023D
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_00392230 push es; ret	0_2_00392231
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_0039226C pushfd ; ret	0_2_0039226D
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_00390251 push 72003893h; retf	0_2_0039023D
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_00392250 push esi; ret	0_2_00392251
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_00392254 pushad ; ret	0_2_00392255
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_0038D38C push ds; retf	0_2_0038D38D
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_00391F77 push ss; retn 0038h	0_2_003920E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01453D78 pushad ; retf	2_2_01453D79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01453D7B push esp; retf	2_2_01453D81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_016B9493 push 8BFFFFFFh; retf	2_2_016B94A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1350			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 8496			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2964	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5472	Thread sleep count: 1350 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5472	Thread sleep count: 8496 > 30	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\KkPVouLuOx.exe

Code function: 0_2_003AA41D FindFirstFileExW,

0_2_003AA41D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: MSBuild.exe, 00000002.00000002.508724569.00000000063E0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: MSBuild.exe, 00000002.00000002.508724569.00000000063E0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: MSBuild.exe, 00000002.00000002.508724569.00000000063E0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: MSBuild.exe, 00000002.00000002.508915956.0000000006509000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlllter-0000
Source: MSBuild.exe, 00000002.00000002.508724569.00000000063E0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_016B0878 LdrInitializeThunk,

2_2_016B0878

Source: C:\Users\user\Desktop\KkPVouLuOx.exe

Code function: 0_2_003A2195 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_003A2195

Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_003AAF80 mov eax, dword ptr fs:[00000030h]		0_2_003AAF80
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_003A5DA4 mov eax, dword ptr fs:[00000030h]		0_2_003A5DA4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_003A2195 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003A2195
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_003A23F7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003A23F7
Source: C:\Users\user\Desktop\KkPVouLuOx.exe	Code function: 0_2_003A48DC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003A48DC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\KkPVouLuOx.exe

Section loaded: unknown target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\KkPVouLuOx.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 'C:\Users\user\Desktop\KkPVouLuOx.exe'

Jump to behavior

Source: MSBuild.exe, 00000002.00000002.502443522.0000000001CF0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: MSBuild.exe, 00000002.00000002.502443522.0000000001CF0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: MSBuild.exe, 00000002.00000002.502443522.0000000001CF0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: MSBuild.exe, 00000002.00000002.502443522.0000000001CF0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: MSBuild.exe, 00000002.00000002.502443522.0000000001CF0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\KkPVouLuOx.exe

Code function: 0_2_003A1EB4 cpuid

0_2_003A1EB4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\KkPVouLuOx.exe

Code function: 0_2_003A2085 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_003A2085

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.KkPVouLuOx.exe.2af0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.KkPVouLuOx.exe.2af0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.499202518.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.240535528.0000000002AF0000.00000040.00000001.sdmp, type: MEMORY

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.KkPVouLuOx.exe.2af0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.KkPVouLuOx.exe.2af0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.499202518.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.240535528.0000000002AF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KkPVouLuOx.exe PID: 1336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1068, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1068, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.KkPVouLuOx.exe.2af0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.KkPVouLuOx.exe.2af0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.499202518.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.240535528.0000000002AF0000.00000040.00000001.sdmp, type: MEMORY

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0.2.KkPVouLuOx.exe.2af0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.KkPVouLuOx.exe.2af0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.499202518.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.240535528.0000000002AF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KkPVouLuOx.exe PID: 1336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1068, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	Path Interception	Process Injection112	Disable or Modify Tools1	OS Credential Dumping2	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Obfuscated Files or Information1	Input Capture11	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Software Packing1	Credentials in Registry1	System Information Discovery125	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion131	NTDS	Query Registry1	Distributed Component Object Model	Input Capture11	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection112	LSA Secrets	Security Software Discovery121	SSH	Clipboard Data1	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Virtualization/Sandbox Evasion131	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
KkPVouLuOx.exe	52%	ReversingLabs	Win32.Backdoor.Androm
KkPVouLuOx.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.2.MSBuild.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
https://yE6yjauUrbNMVyVX.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://mail.karsanmax.com	0%	Avira URL Cloud	safe
http://myRZFP.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.karsanmax.com	67.20.76.71	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	MSBuild.exe, 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	MSBuild.exe, 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://yE6yjauUrbNMVyVX.com	MSBuild.exe, 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	MSBuild.exe, 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	KkPVouLuOx.exe, 00000000.00000002.240535528.0000000002AF0000.00000040.00000001.sdmp, MSBuild.exe, 00000002.00000002.499202518.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
http://mail.karsanmax.com	MSBuild.exe, 00000002.00000002.505310278.0000000003825000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://myRZFP.com	MSBuild.exe, 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
67.20.76.71	mail.karsanmax.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	458889
Start date:	03.08.2021
Start time:	20:45:17
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	KkPVouLuOx (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 94% Number of executed functions: 70 Number of non-executed functions: 38
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 52.147.198.201, 23.211.6.115, 23.211.4.86, 204.79.197.200, 13.107.21.200, 93.184.220.29, 51.103.5.159, 20.82.210.154, 40.112.88.60, 205.185.216.42, 205.185.216.10, 80.67.82.235, 80.67.82.211, 51.103.5.186, 20.82.209.183 Excluded domains from analysis (whitelisted): cs9.wac.phicdn.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, vip1-par02p.wns.notify.trafficmanager.net, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, ocsp.digicert.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, client.wns.windows.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/458889/sample/KkPVouLuOx.exe

Simulations

Behavior and APIs

Time	Type	Description
20:46:27	API Interceptor	797x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
67.20.76.71	hD72Gd3THG.exe	Get hash	malicious	Browse
	Km7WgQYB5X.exe	Get hash	malicious	Browse
	TTclQDZx6S.exe	Get hash	malicious	Browse
	x7aL4x1RJH.exe	Get hash	malicious	Browse
	SKM_59922543567477363.exe	Get hash	malicious	Browse
	d6U17S2KY1.exe	Get hash	malicious	Browse
	abc8a77f_by_Libranalysis.xlsx	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
mail.karsanmax.com	hD72Gd3THG.exe	Get hash	malicious	Browse	67.20.76.71
	Km7WgQYB5X.exe	Get hash	malicious	Browse	67.20.76.71
	TTclQDZx6S.exe	Get hash	malicious	Browse	67.20.76.71
	x7aL4x1RJH.exe	Get hash	malicious	Browse	67.20.76.71
	SKM_59922543567477363.exe	Get hash	malicious	Browse	67.20.76.71
	d6U17S2KY1.exe	Get hash	malicious	Browse	67.20.76.71
	abc8a77f_by_Libranalysis.xlsx	Get hash	malicious	Browse	67.20.76.71

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
UNIFIEDLAYER-AS-1US	Nouveau bon de commande. 3007021_pdf.exe	Get hash	malicious	Browse	162.241.218.97
	wuxvGLNrxG.jar	Get hash	malicious	Browse	162.241.216.53
	Amaury.vanvinckenroye-AudioMessage_520498.htm	Get hash	malicious	Browse	192.185.138.88
	transferred $95,934.55 pdf.exe	Get hash	malicious	Browse	50.87.146.49
	rL3Wx4zKD4.exe	Get hash	malicious	Browse	74.220.199.6
	hD72Gd3THG.exe	Get hash	malicious	Browse	67.20.76.71
	Products Order38899999.exe	Get hash	malicious	Browse	50.87.146.199
	ORDER_0009_PDF.exe	Get hash	malicious	Browse	74.220.199.6
	WWTLJo3vxn.exe	Get hash	malicious	Browse	192.254.235.241
	INV. 736392 Scan pdf.exe	Get hash	malicious	Browse	192.185.164.148
	7nNtjBvhrm	Get hash	malicious	Browse	142.7.147.90
	Purchase Requirements.exe	Get hash	malicious	Browse	192.185.0.218
	#Ud83d#Udda8 FaxMail dir -INV 000087.html	Get hash	malicious	Browse	162.241.217.69
	Products Order.exe	Get hash	malicious	Browse	50.87.146.199
	zerYOlEkZR.exe	Get hash	malicious	Browse	192.254.235.241
	PO-K-128 IAN 340854.exe	Get hash	malicious	Browse	192.185.90.36
	csa customers.xlsx	Get hash	malicious	Browse	162.241.217.138
	ENXcmU1LzQ.exe	Get hash	malicious	Browse	108.167.158.96
	Payment For Invoice 321-1005703.exe	Get hash	malicious	Browse	192.185.0.218
	Medical Equipment Order 2021.PDF.exe	Get hash	malicious	Browse	74.220.199.6

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.697524956503366
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	KkPVouLuOx.exe
File size:	701859
MD5:	f935b6c7f24be477a23044fa9a9dc9a5
SHA1:	e67fb9bcf9975e0c6c4122ec7b25e61de6d1ba24
SHA256:	4827c1bdf5000cc8fc280fa631d36c752d0cdd7b0b357671ef1ebc46a11c440f
SHA512:	4b9587402b0f2e99af2aeec67307db55c0323228b8e863506f52b7d8d612aa3fdef4104ded5f5adbff7c546a2e91f558c45080f45b80fbf51ee98baeefc9dd34
SSDEEP:	12288:8Bszn2zd6HX+qs+WWhRmmXikb0iTvDcicTB4vs8w:2mnAd6OqszYRmsXb0iTrcVyvs8w
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.q.+.q.+.q.?.r.>.q.?.t...q.?.u.1.q.y.u.:.q.y.r.8.q.y.t.g.q.?.p.".q.+.p...q.}.t.".q.}....q.+....q.}.s.*.q.Rich+.q........

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x421b51
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6107AE4D [Mon Aug 2 08:35:25 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	457e32d3dd9c9bc4442beae8353acab7

Entrypoint Preview

Instruction
call 00007F1A10DB6E61h
jmp 00007F1A10DB675Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F1A10DB68FBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F1A10DB68ECh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F1A10DB68EEh
add edx, 28h
cmp edx, esi
jne 00007F1A10DB68CCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F1A10DB68DBh
push esi
call 00007F1A10DB712Bh
test eax, eax
je 00007F1A10DB6902h
mov eax, dword ptr fs:[00000018h]
mov esi, 0046DD88h
mov edx, dword ptr [eax+04h]
jmp 00007F1A10DB68E6h
cmp edx, eax
je 00007F1A10DB68F2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F1A10DB68D2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F1A10DB68E9h
mov byte ptr [0046DD8Ch], 00000001h
call 00007F1A10DB6BB3h
call 00007F1A10DB8128h
test al, al
jne 00007F1A10DB68E6h
xor al, al
pop ebp
ret
call 00007F1A10DBB173h
test al, al
jne 00007F1A10DB68ECh
push 00000000h
call 00007F1A10DB812Fh
pop ecx
jmp 00007F1A10DB68CBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0046DD8Dh], 00000000h
je 00007F1A10DB68E6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6c114	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6f000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x70000	0x71b4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6ac40	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6ac78	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2f000	0x178	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2decd	0x2e000	False	0.429135529891	data	6.47060887699	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x2f000	0x3d990	0x3da00	False	0.239509381339	data	4.02626823318	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6d000	0x197c	0xc00	False	0.172200520833	DOS executable (block device driver)	2.33132620221	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x6f000	0x1e0	0x200	False	0.53125	data	4.71767883295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x70000	0x71b4	0x7200	False	0.361430921053	data	6.51486029072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x6f060	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.dll	FormatMessageW, VirtualProtect, CreateFileW, CloseHandle, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, HeapSize, SetFilePointerEx, GetProcessHeap, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, HeapReAlloc, LCMapStringW, GetFileType, HeapAlloc, HeapFree, GetModuleHandleExW, ExitProcess, GetModuleFileNameW, WriteFile, GetStdHandle, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, GetCPInfo, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, GetCurrentProcess, TerminateProcess, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, WriteConsoleW
USER32.dll	MessageBoxW, GrayStringA, GetDC, TranslateMessage, DispatchMessageW, PeekMessageW, DefWindowProcW, PostQuitMessage, UnregisterClassW, RegisterClassExW, CreateWindowExW, ShowWindow, SetCapture, ReleaseCapture, LoadImageW, LoadCursorW, SetWindowLongW, GetWindowLongW, AdjustWindowRect, UpdateWindow
d3d11.dll	D3D11CreateDeviceAndSwapChain
gdiplus.dll	GdiplusStartup, GdiplusShutdown

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
08/03/21-20:48:01.386134	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49733	587	192.168.2.5	67.20.76.71

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 3, 2021 20:47:59.180735111 CEST	49733	587	192.168.2.5	67.20.76.71
Aug 3, 2021 20:47:59.335941076 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:47:59.336484909 CEST	49733	587	192.168.2.5	67.20.76.71
Aug 3, 2021 20:48:00.223691940 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:48:00.224028111 CEST	49733	587	192.168.2.5	67.20.76.71
Aug 3, 2021 20:48:00.380319118 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:48:00.382541895 CEST	49733	587	192.168.2.5	67.20.76.71
Aug 3, 2021 20:48:00.538202047 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:48:00.539336920 CEST	49733	587	192.168.2.5	67.20.76.71
Aug 3, 2021 20:48:00.737019062 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:48:00.820116043 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:48:00.821441889 CEST	49733	587	192.168.2.5	67.20.76.71
Aug 3, 2021 20:48:00.976672888 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:48:00.977463961 CEST	49733	587	192.168.2.5	67.20.76.71
Aug 3, 2021 20:48:01.172928095 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:48:01.225188971 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:48:01.225790977 CEST	49733	587	192.168.2.5	67.20.76.71
Aug 3, 2021 20:48:01.382695913 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:48:01.383013010 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:48:01.386133909 CEST	49733	587	192.168.2.5	67.20.76.71
Aug 3, 2021 20:48:01.386166096 CEST	49733	587	192.168.2.5	67.20.76.71
Aug 3, 2021 20:48:01.386171103 CEST	49733	587	192.168.2.5	67.20.76.71
Aug 3, 2021 20:48:01.386173964 CEST	49733	587	192.168.2.5	67.20.76.71
Aug 3, 2021 20:48:01.552105904 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:48:01.552540064 CEST	587	49733	67.20.76.71	192.168.2.5
Aug 3, 2021 20:48:01.600238085 CEST	49733	587	192.168.2.5	67.20.76.71

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 3, 2021 20:46:01.546152115 CEST	61805	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:01.578376055 CEST	53	61805	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:02.198097944 CEST	54795	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:02.230469942 CEST	53	54795	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:02.833364010 CEST	49557	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:02.860920906 CEST	53	49557	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:03.475969076 CEST	61733	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:03.511287928 CEST	53	61733	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:04.457977057 CEST	65447	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:04.494594097 CEST	53	65447	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:04.576930046 CEST	52441	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:04.603420019 CEST	53	52441	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:05.429595947 CEST	62176	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:05.454560995 CEST	53	62176	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:06.241441011 CEST	59596	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:06.274204969 CEST	53	59596	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:07.072560072 CEST	65296	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:07.105882883 CEST	53	65296	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:07.864593983 CEST	63183	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:07.895503044 CEST	53	63183	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:09.050190926 CEST	60151	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:09.085894108 CEST	53	60151	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:27.301176071 CEST	56969	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:27.336886883 CEST	53	56969	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:27.338161945 CEST	55161	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:27.370637894 CEST	53	55161	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:33.814949036 CEST	54757	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:33.847826004 CEST	53	54757	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:34.438359022 CEST	49992	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:34.466367960 CEST	53	49992	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:35.809518099 CEST	60075	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:35.850656033 CEST	53	60075	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:53.930489063 CEST	55016	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:53.971849918 CEST	53	55016	8.8.8.8	192.168.2.5
Aug 3, 2021 20:46:56.022614956 CEST	64345	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:46:56.055080891 CEST	53	64345	8.8.8.8	192.168.2.5
Aug 3, 2021 20:47:11.259069920 CEST	57128	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:47:11.294507980 CEST	53	57128	8.8.8.8	192.168.2.5
Aug 3, 2021 20:47:15.079591036 CEST	54791	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:47:15.119142056 CEST	53	54791	8.8.8.8	192.168.2.5
Aug 3, 2021 20:47:34.610894918 CEST	50463	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:47:34.643579960 CEST	53	50463	8.8.8.8	192.168.2.5
Aug 3, 2021 20:47:36.613771915 CEST	50394	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:47:36.649724960 CEST	53	50394	8.8.8.8	192.168.2.5
Aug 3, 2021 20:47:38.585107088 CEST	58530	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:47:38.620584011 CEST	53	58530	8.8.8.8	192.168.2.5
Aug 3, 2021 20:47:58.924449921 CEST	53813	53	192.168.2.5	8.8.8.8
Aug 3, 2021 20:47:59.061328888 CEST	53	53813	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 3, 2021 20:47:58.924449921 CEST	192.168.2.5	8.8.8.8	0x4115	Standard query (0)	mail.karsanmax.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 3, 2021 20:47:59.061328888 CEST	8.8.8.8	192.168.2.5	0x4115	No error (0)	mail.karsanmax.com		67.20.76.71	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Aug 3, 2021 20:48:00.223691940 CEST	587	49733	67.20.76.71	192.168.2.5	220-host2007.hostmonster.com ESMTP Exim 4.94.2 #2 Tue, 03 Aug 2021 12:48:00 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Aug 3, 2021 20:48:00.224028111 CEST	49733	587	192.168.2.5	67.20.76.71	EHLO 138727
Aug 3, 2021 20:48:00.380319118 CEST	587	49733	67.20.76.71	192.168.2.5	250-host2007.hostmonster.com Hello 138727 [84.17.52.25] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Aug 3, 2021 20:48:00.382541895 CEST	49733	587	192.168.2.5	67.20.76.71	AUTH login aW5mb0BrYXJzYW5tYXguY29t
Aug 3, 2021 20:48:00.538202047 CEST	587	49733	67.20.76.71	192.168.2.5	334 UGFzc3dvcmQ6
Aug 3, 2021 20:48:00.820116043 CEST	587	49733	67.20.76.71	192.168.2.5	235 Authentication succeeded
Aug 3, 2021 20:48:00.821441889 CEST	49733	587	192.168.2.5	67.20.76.71	MAIL FROM:<info@karsanmax.com>
Aug 3, 2021 20:48:00.976672888 CEST	587	49733	67.20.76.71	192.168.2.5	250 OK
Aug 3, 2021 20:48:00.977463961 CEST	49733	587	192.168.2.5	67.20.76.71	RCPT TO:<ginzza.kw@gmail.com>
Aug 3, 2021 20:48:01.225188971 CEST	587	49733	67.20.76.71	192.168.2.5	250 Accepted
Aug 3, 2021 20:48:01.225790977 CEST	49733	587	192.168.2.5	67.20.76.71	DATA
Aug 3, 2021 20:48:01.383013010 CEST	587	49733	67.20.76.71	192.168.2.5	354 Enter message, ending with "." on a line by itself
Aug 3, 2021 20:48:01.386173964 CEST	49733	587	192.168.2.5	67.20.76.71	.
Aug 3, 2021 20:48:01.552540064 CEST	587	49733	67.20.76.71	192.168.2.5	250 OK id=1mAzSL-000X1t-9s

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: KkPVouLuOx.exe PID: 1336 Parent PID: 5728

General

Start time:	20:46:09
Start date:	03/08/2021
Path:	C:\Users\user\Desktop\KkPVouLuOx.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\KkPVouLuOx.exe'
Imagebase:	0x380000
File size:	701859 bytes
MD5 hash:	F935B6C7F24BE477A23044FA9A9DC9A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.240535528.0000000002AF0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.240535528.0000000002AF0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: MSBuild.exe PID: 1068 Parent PID: 1336

General

Start time:	20:46:09
Start date:	03/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\KkPVouLuOx.exe'
Imagebase:	0xfd0000
File size:	261728 bytes
MD5 hash:	D621FD77BD585874F9686D3A76462EF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.499202518.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000002.00000002.499202518.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.502987084.00000000034C1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: KkPVouLuOx.exe PID: 1336 Parent PID: 5728 KkPVouLuOx.exeCOMMON

Executed Functions

Function 0039E7C0, Relevance: 345.5, APIs: 3, Strings: 194, Instructions: 735memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(000000E9,0000028B,00000040,?), ref: 0039F88D
GetDC.USER32(00000000), ref: 0039F8AF
GrayStringA.USER32(00000000), ref: 0039F8B6

Part of subcall function 003A0130: LoadImageW.USER32 ref: 003A01F9
Part of subcall function 003A0130: LoadImageW.USER32 ref: 003A0210
Part of subcall function 003A0130: LoadCursorW.USER32(00000000,00007F00), ref: 003A0220
Part of subcall function 003A0130: RegisterClassExW.USER32 ref: 003A022D
Part of subcall function 003A0130: AdjustWindowRect.USER32 ref: 003A0263

Part of subcall function 003A08C0: PeekMessageW.USER32 ref: 003A08D5
Part of subcall function 003A08C0: TranslateMessage.USER32(?), ref: 003A08E3
Part of subcall function 003A08C0: DispatchMessageW.USER32 ref: 003A08ED

Strings

0, xrefs: 0039F131
r, xrefs: 0039EB49
E, xrefs: 0039F456
V, xrefs: 0039EDCD
2, xrefs: 0039EEB4
Q, xrefs: 0039E943
V, xrefs: 0039EE91
u, xrefs: 0039F353
@, xrefs: 0039ECC3
P, xrefs: 0039F5C9
D, xrefs: 0039E9A5
C, xrefs: 0039F785
], xrefs: 0039F7D5
h, xrefs: 0039F41E
S, xrefs: 0039EC37
u, xrefs: 0039F84D
U, xrefs: 0039F30D
P, xrefs: 0039F2D5
i, xrefs: 0039ED33
h, xrefs: 0039EFE8
u, xrefs: 0039F410
@, xrefs: 0039EA2A
@, xrefs: 0039EC92
W, xrefs: 0039EC45
j, xrefs: 0039EFDA
V, xrefs: 0039ED72
_, xrefs: 0039F624
F, xrefs: 0039EB2D
U, xrefs: 0039F368
], xrefs: 0039F859
x, xrefs: 0039E9B3
^, xrefs: 0039EDBF
P, xrefs: 0039EAC4
(, xrefs: 0039EEDE
x, xrefs: 0039F54B
<, xrefs: 0039F250
_, xrefs: 0039EB65
(, xrefs: 0039F2F1
$, xrefs: 0039EC1B
U, xrefs: 0039F7ED
Y, xrefs: 0039F7BD
E, xrefs: 0039EA77
0, xrefs: 0039F3C3
t, xrefs: 0039EA93
E, xrefs: 0039EEEC
h, xrefs: 0039ECED
P, xrefs: 0039F1CB
P, xrefs: 0039F035
E, xrefs: 0039EDDB
j, xrefs: 0039EFC5
3, xrefs: 0039E97B
;, xrefs: 0039EB34
U, xrefs: 0039EB1F
G, xrefs: 0039E990
3, xrefs: 0039ECDF
V, xrefs: 0039F1D9
u, xrefs: 0039EB3B
p, xrefs: 0039EBC0
4, xrefs: 0039F5C2
W, xrefs: 0039F1D2
^, xrefs: 0039F855
h, xrefs: 0039F4AA
V, xrefs: 0039EE2F
h, xrefs: 0039EE6E
+, xrefs: 0039F3E6
S, xrefs: 0039F1AF
*, xrefs: 0039F771
W, xrefs: 0039F4F0
E, xrefs: 0039EE9F
U, xrefs: 0039EA4D
;, xrefs: 0039EAF5
A, xrefs: 0039F83D
h, xrefs: 0039EE0C
E, xrefs: 0039F058
U, xrefs: 0039E808
E, xrefs: 0039F1BD
Q, xrefs: 0039F536
], xrefs: 0039E920
V, xrefs: 0039F811
E, xrefs: 0039EE3D
@, xrefs: 0039EE52
W, xrefs: 0039E85C
', xrefs: 0039ED5D
U, xrefs: 0039F4E2
u, xrefs: 0039F1E7
, xrefs: 0039E9D6
S, xrefs: 0039F14D
u, xrefs: 0039F7AD
F, xrefs: 0039E8A2
h, xrefs: 0039F123
*, xrefs: 0039F6B7
H, xrefs: 0039EA07
j, xrefs: 0039F376
@, xrefs: 0039EC7D
u, xrefs: 0039E904
>, xrefs: 0039E8E1
F, xrefs: 0039F249
+, xrefs: 0039F821
0, xrefs: 0039EC5A
r, xrefs: 0039F7A1
], xrefs: 0039EB88
(, xrefs: 0039F337
\, xrefs: 0039ED8E
U, xrefs: 0039F3FB
^, xrefs: 0039E919
U, xrefs: 0039F7DD
h, xrefs: 0039F3B5
S, xrefs: 0039E951
U, xrefs: 0039F1FC
S, xrefs: 0039F4D4
+, xrefs: 0039F3A7
U, xrefs: 0039F043
T, xrefs: 0039F28F
S, xrefs: 0039EF4E
[, xrefs: 0039EB73
E, xrefs: 0039EF7F
<, xrefs: 0039E997
d, xrefs: 0039EC4C
3, xrefs: 0039EB57
V, xrefs: 0039F441
+, xrefs: 0039EDB1
H, xrefs: 0039F273
G, xrefs: 0039F6D9
U, xrefs: 0039F56E
7, xrefs: 0039EE28
W, xrefs: 0039E95F
M, xrefs: 0039EA62
k, xrefs: 0039EE83
t, xrefs: 0039F2B9
0, xrefs: 0039F4B8
P, xrefs: 0039F448
M, xrefs: 0039F809
u, xrefs: 0039E82B
S, xrefs: 0039F0A5
{, xrefs: 0039F75D
^, xrefs: 0039EB6C
N, xrefs: 0039EDF0
E, xrefs: 0039EAFC
}, xrefs: 0039E96D
S, xrefs: 0039EFD3
_, xrefs: 0039F7C1
S, xrefs: 0039F3DF
t, xrefs: 0039EB0A
S, xrefs: 0039EF9B
V, xrefs: 0039E958
V, xrefs: 0039ED10
*, xrefs: 0039F701
E, xrefs: 0039EB9D
Q, xrefs: 0039F71D
2, xrefs: 0039F769
V, xrefs: 0039E81D
v, xrefs: 0039F73D
j, xrefs: 0039F49C
P, xrefs: 0039F288
Y, xrefs: 0039EAEE
4, xrefs: 0039F61D
j, xrefs: 0039F115
K, xrefs: 0039ED56
U, xrefs: 0039F0BA
h, xrefs: 0039ED4F
V, xrefs: 0039EC3E
[, xrefs: 0039F7C9
@, xrefs: 0039F4A3
Q, xrefs: 0039E94A
^, xrefs: 0039F7C5
2, xrefs: 0039F66A
U, xrefs: 0039F15B
P, xrefs: 0039E9CF
U, xrefs: 0039E92E
U, xrefs: 0039EBF8
u, xrefs: 0039F819
P, xrefs: 0039EF47
P, xrefs: 0039F53D
h, xrefs: 0039EFA2
8, xrefs: 0039E9AC
*, xrefs: 0039F62B
_, xrefs: 0039E912
2, xrefs: 0039F6E5
P, xrefs: 0039F3D8
h, xrefs: 0039EF24
P, xrefs: 0039F0AC
$, xrefs: 0039EA0E
W, xrefs: 0039F4CD
h, xrefs: 0039EDAA
7, xrefs: 0039ED09
@, xrefs: 0039F330
], xrefs: 0039ED1E
t, xrefs: 0039F7FD
X, xrefs: 0039E9E4
W, xrefs: 0039F146
@, xrefs: 0039F37D
U, xrefs: 0039F29D
E, xrefs: 0039F528
<, xrefs: 0039EE7C

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadMessage$Image$AdjustClassCursorDispatchGrayPeekProtectRectRegisterStringTranslateVirtualWindow
String ID: $$$$$'$($($($*$*$*$*$+$+$+$+$0$0$0$0$2$2$2$2$3$3$3$4$4$7$7$8$;$;$<$<$<$>$@$@$@$@$@$@$@$@$A$C$D$E$E$E$E$E$E$E$E$E$E$E$E$F$F$F$G$G$H$H$K$M$M$N$P$P$P$P$P$P$P$P$P$P$P$P$Q$Q$Q$Q$S$S$S$S$S$S$S$S$S$S$T$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$U$V$V$V$V$V$V$V$V$V$V$V$W$W$W$W$W$W$W$X$Y$Y$[$[$\$]$]$]$]$]$^$^$^$^$^$_$_$_$_$d$h$h$h$h$h$h$h$h$h$h$h$h$i$j$j$j$j$j$k$p$r$r$t$t$t$t$u$u$u$u$u$u$u$u$u$v$x$x${$}
API String ID: 4190410384-1290935443
Opcode ID: fc358b26b7131dee23d98bfff461dac07f3206b8718e729dec00d9b988b29422
Instruction ID: 1b2e557341027be6d708ee12a4b1bb427cfea37300b3da57b76ea1dc81dcfda8
Opcode Fuzzy Hash: fc358b26b7131dee23d98bfff461dac07f3206b8718e729dec00d9b988b29422
Instruction Fuzzy Hash: 68C2382090DBE9C8DB32867C5C5C7CDAE611B27325F5843C9D1F82A2D2C7B50B85DB66

Uniqueness

Uniqueness Score: -1.00%

Function 003AAF30, Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 003AAF34
_free.LIBCMT ref: 003AAF6D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003AAF74

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$Free_free
String ID:
API String ID: 2716640707-0
Opcode ID: d313569a7fcbf16084dedbb056a23a87fb6408d94124ed5307449392bf5cc10b
Instruction ID: 39291e45f72f1fdff762739178bcb25bdcf9f1480ee2dc9e4c87c6807f30cc17
Opcode Fuzzy Hash: d313569a7fcbf16084dedbb056a23a87fb6408d94124ed5307449392bf5cc10b
Instruction Fuzzy Hash: 51E02267209E202FD217227D7C8AA6F1A1DDFC77B1B2A0225F0199A183EF148C0280B6

Uniqueness

Uniqueness Score: -1.00%

Function 003AAFB1, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 003A7DB3: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,003A6D06,00000001,00000364,00000006,000000FF,?,?,?,003A5030,003A47F8), ref: 003A7DF4

_free.LIBCMT ref: 003AB020

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 02fe11b2886eb2e918ed6fb866bfb80df07478c2d5d7ef530b76c79738ea2e98
Instruction ID: df2c7f64dc32f51e723ae13bb12ac043bb3442c8653b449250ef680b3e06856f
Opcode Fuzzy Hash: 02fe11b2886eb2e918ed6fb866bfb80df07478c2d5d7ef530b76c79738ea2e98
Instruction Fuzzy Hash: 920126B26083166FC722CF68C8859DAFB98EB063B0F150229E555A76C1E3706810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 003A7DB3, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,003A6D06,00000001,00000364,00000006,000000FF,?,?,?,003A5030,003A47F8), ref: 003A7DF4

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a21eb6f27507887340b0d1fd845d6a8c008468ed7ec6d96a2ddcda30e0a89137
Instruction ID: 19f1e52e71d0b28d27e276fa1be890944a12e6186f45e5ee49ec83396c1c00d7
Opcode Fuzzy Hash: a21eb6f27507887340b0d1fd845d6a8c008468ed7ec6d96a2ddcda30e0a89137
Instruction Fuzzy Hash: DCF0E9321495246BDB23AB629C85F6B374DDF43770F1A4161F905DA481CB70EC0186E0

Uniqueness

Uniqueness Score: -1.00%

Function 003A667C, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?,?,003A17F5,00000000,?,00397E5C,00000000,?,00395E59,00000000), ref: 003A66AE

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d4abd624d30dcc516aa4cc35482bdb0d6e3dcb7e160cdfcb46e2eb3d409858cf
Instruction ID: b43331a49662583969cc5b005c673a1c7c55a902bed7e37a4a38165ebe541d70
Opcode Fuzzy Hash: d4abd624d30dcc516aa4cc35482bdb0d6e3dcb7e160cdfcb46e2eb3d409858cf
Instruction Fuzzy Hash: 3DE02231241A20AAEB2336719C02B5B7A9DEF533A4F2E0124FD01DA4F0CF64CC0086E4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00399420, Relevance: 84.7, APIs: 23, Strings: 25, Instructions: 718COMMON

Download Yara Rule

APIs

Part of subcall function 003985D0: GdiplusStartup.GDIPLUS(003EDB78,00000001,00000000,00000000,00000000,00000000), ref: 00398624

allocator.LIBCPMTD ref: 003995B2
allocator.LIBCPMTD ref: 003995D3
allocator.LIBCPMTD ref: 003995ED
D3D11CreateDeviceAndSwapChain.D3D11(00000000,00000001,00000000,00000000,00009100,00000001,00000007,00000280,00000000,?,00000000,?,?,00000000,?), ref: 00399615
task.LIBCPMTD ref: 0039966F
allocator.LIBCPMTD ref: 00399698
task.LIBCPMTD ref: 0039970F
allocator.LIBCPMTD ref: 0039972F
allocator.LIBCPMTD ref: 003998E0
task.LIBCPMTD ref: 0039995C
allocator.LIBCPMTD ref: 003999A7
task.LIBCPMTD ref: 00399A2A
allocator.LIBCPMTD ref: 00399A4A
task.LIBCPMTD ref: 00399AC9
allocator.LIBCPMTD ref: 00399AE9
task.LIBCPMTD ref: 00399B68
allocator.LIBCPMTD ref: 00399D9A
task.LIBCPMTD ref: 00399E18
allocator.LIBCPMTD ref: 00399EC4
task.LIBCPMTD ref: 00399F4A
allocator.LIBCPMTD ref: 00399FCA
task.LIBCPMTD ref: 003997AA

Part of subcall function 003A25AD: RaiseException.KERNEL32(E06D7363,00000001,00000003,003A1EAE,?,?,?,003A1EAE,?,003EB590), ref: 003A260D

task.LIBCPMTD ref: 0039A044

Strings

C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp, xrefs: 00399639
W, xrefs: 0039987F
Creating pixel shader, xrefs: 00399A7A
C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp, xrefs: 00399774
C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp, xrefs: 003999F4
Getting back buffer, xrefs: 003996C3
C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp, xrefs: 00399A93
C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp, xrefs: 00399926
Creating view on sysBuffer texture, xrefs: 003999DB
C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp, xrefs: 00399B32
Creating vertex buffer, xrefs: 00399DC9
W, xrefs: 0039953F
Creating vertex shader, xrefs: 00399B19
C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp, xrefs: 0039A00E
Creating device and swap chain, xrefs: 00399623
C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp, xrefs: 00399F14
Creating input layout, xrefs: 00399EFB
<, xrefs: 00399553
x, xrefs: 00399D4A
, xrefs: 0039955D
C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp, xrefs: 003996D9
Creating sysbuffer texture, xrefs: 0039990D
C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp, xrefs: 00399DE2
Creating sampler state, xrefs: 00399FF5
Creating render target view on backbuffer, xrefs: 0039975E

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: allocator$task$ChainCreateDeviceExceptionGdiplusRaiseStartupSwap
String ID: $<$C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp$C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp$C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp$C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp$C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp$C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp$C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp$C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp$C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp$C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp$Creating device and swap chain$Creating input layout$Creating pixel shader$Creating render target view on backbuffer$Creating sampler state$Creating sysbuffer texture$Creating vertex buffer$Creating vertex shader$Creating view on sysBuffer texture$Getting back buffer$W$W$x
API String ID: 1693892746-2379557278
Opcode ID: 31796b2a28c609f22cd103c079abf0491828d011b2f25f12217257c07dadd9c4
Instruction ID: f1508b084c63eaf5419790c608a4f10195341550fbb0c9684b16cb6b7b2560e5
Opcode Fuzzy Hash: 31796b2a28c609f22cd103c079abf0491828d011b2f25f12217257c07dadd9c4
Instruction Fuzzy Hash: D5725C71D006599FDF16DBA5CC95BEEB7B4BF89304F108299E0097B291DBB02A84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 003A2195, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 003A21A1
IsDebuggerPresent.KERNEL32 ref: 003A226D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 003A228D
UnhandledExceptionFilter.KERNEL32(?), ref: 003A2297

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3389be58a9259e5522e0eae420941bebdb5ec45115f354111bc60cd2bd4bae61
Instruction ID: 209616ced95285dceeb08067a3fd8ce8a83679be2bc32610d156ffd9bc3a0df6
Opcode Fuzzy Hash: 3389be58a9259e5522e0eae420941bebdb5ec45115f354111bc60cd2bd4bae61
Instruction Fuzzy Hash: 6C314775D052189FDF21DFA4D989BCDBBB8EF09304F1041AAE40DAB290EB709A858F44

Uniqueness

Uniqueness Score: -1.00%

Function 003A48DC, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 003A49D4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 003A49DE
UnhandledExceptionFilter.KERNEL32(?), ref: 003A49EB

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9d0a2dbaf8cab59a0b7fa8f5c7382be7afab32aedee5186bd7b2b36b54233706
Instruction ID: 2e798925445518a4ce8897b1ed6b6979b01828ad5a8c7d9cb4048ad2d42e4440
Opcode Fuzzy Hash: 9d0a2dbaf8cab59a0b7fa8f5c7382be7afab32aedee5186bd7b2b36b54233706
Instruction Fuzzy Hash: BA31C5749012199BCB22DF68DC8978DBBB8FF49310F5041EAE40CAB291E7709F858F44

Uniqueness

Uniqueness Score: -1.00%

Function 003A5DA4, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,003A5DA3,?,?,?,?,?,003ADA62), ref: 003A5DC6
TerminateProcess.KERNEL32(00000000,?,003A5DA3,?,?,?,?,?,003ADA62), ref: 003A5DCD
ExitProcess.KERNEL32 ref: 003A5DDF

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 675f6a9b4d28fab4be873a885fb6c0618ecdf928e394bfe4384c747b3943e8c2
Instruction ID: c1d0fa19506e092dddf40f84562c78b3a89bc9f120ae5454aa7ad0bb47932dac
Opcode Fuzzy Hash: 675f6a9b4d28fab4be873a885fb6c0618ecdf928e394bfe4384c747b3943e8c2
Instruction Fuzzy Hash: 8BE0B632001908EFCB23ABA4ED0DA593B69EF46341F114524F9058A232CB79DD51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003A8456, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,003A8451,?,?,?,?,?,?,00000000), ref: 003A8683

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d94bf9982790ce0c09c1ad7d2d6c18529c83164dff0280411489edf338eb41b8
Instruction ID: edbe314e20c16c68187610c362e68f35e7af9ea01c9bae4dd59f895b1220cbd9
Opcode Fuzzy Hash: d94bf9982790ce0c09c1ad7d2d6c18529c83164dff0280411489edf338eb41b8
Instruction Fuzzy Hash: E0B12D31610605DFD71ACF28C48AB657BE0FF46364F268658E999CF2A1CB35E992CB40

Uniqueness

Uniqueness Score: -1.00%

Function 003A1EB4, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 003A1ECA

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 1cb4fa55ac7dd7de81da6784753bfc6564525fd2b820cbfa761cea16d9a0076b
Instruction ID: 8e966289954beb3d9ad9092b1c6f15655556715f7dd382a2d52c35c9f3050b59
Opcode Fuzzy Hash: 1cb4fa55ac7dd7de81da6784753bfc6564525fd2b820cbfa761cea16d9a0076b
Instruction Fuzzy Hash: BE519DB2A116458FDB26CF98D8C57AABBF8FB49314F15862AD805EB290D375AD00CF50

Uniqueness

Uniqueness Score: -1.00%

Function 003AA41D, Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d19704144837be629d2f85d83f3f2a5ac635394a81413f8ddb7b094618ce555
Instruction ID: 9101fc21e73259383aaf8303a445a7fcb158bfbf0d32ec3f00dd59d4800ad9d4
Opcode Fuzzy Hash: 3d19704144837be629d2f85d83f3f2a5ac635394a81413f8ddb7b094618ce555
Instruction Fuzzy Hash: D4312572900619AFCB25DFA9CC89DBB77BDEB86310F058168F80597241EB30EE40CB54

Uniqueness

Uniqueness Score: -1.00%

Function 003A8BC9, Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4516bdb7cbd2dbe2eb3c863264c1024815188f16fade2d56b9e26d145ce13372
Instruction ID: 51dbb7179c7167af4f9de70755469c436058aa227ccb6e8d00c72d7c3fea308a
Opcode Fuzzy Hash: 4516bdb7cbd2dbe2eb3c863264c1024815188f16fade2d56b9e26d145ce13372
Instruction Fuzzy Hash: 30320422D29F414DDB339634C866339A29DEFB73C4F15D727E819B99EAEB29C5834100

Uniqueness

Uniqueness Score: -1.00%

Function 00396C20, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 157722b42dd2edabb0d5c1b68a47141ec67689f77e302a3b9f3b4eef6d5ade88
Instruction ID: 968e111dbd5a9441549511155351755a6ead6d5629e43fec42b146c652659733
Opcode Fuzzy Hash: 157722b42dd2edabb0d5c1b68a47141ec67689f77e302a3b9f3b4eef6d5ade88
Instruction Fuzzy Hash: C3519972C0165E9ACB06DBDADD819FFF379BF48705F188B19E521761A0EB302688DB50

Uniqueness

Uniqueness Score: -1.00%

Function 003AAF80, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d2e2a2afd01257843c93a4397eddbfffd4c7ab91524d23fe8d6f62e972f76e
Instruction ID: 291fddd5c8a4bec1d4e0b5170217e66869e212f050aa74f4a71034f9644af629
Opcode Fuzzy Hash: 05d2e2a2afd01257843c93a4397eddbfffd4c7ab91524d23fe8d6f62e972f76e
Instruction Fuzzy Hash: 07E08CB2A11228EBCB2ADBC8CD4498AF3ECEB46F00B2100AAB501D7100C3B0DE00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0039AFA0, Relevance: 51.2, APIs: 25, Strings: 4, Instructions: 430COMMON

Download Yara Rule

APIs

Part of subcall function 0039B6B0: task.LIBCPMTD ref: 0039B782
Part of subcall function 0039B6B0: task.LIBCPMTD ref: 0039B78E
Part of subcall function 0039B6B0: task.LIBCPMTD ref: 0039B79A
Part of subcall function 0039B6B0: task.LIBCPMTD ref: 0039B7AC

std::ios_base::good.LIBCPMTD ref: 0039B029
std::ios_base::good.LIBCPMTD ref: 0039B0D3
std::ios_base::good.LIBCPMTD ref: 0039B1B5
std::ios_base::good.LIBCPMTD ref: 0039B2A5
task.LIBCPMTD ref: 0039B458
task.LIBCPMTD ref: 0039B467
task.LIBCPMTD ref: 0039B48B
task.LIBCPMTD ref: 0039B4AE
task.LIBCPMTD ref: 0039B4D2
task.LIBCPMTD ref: 0039B4F6
task.LIBCPMTD ref: 0039B519
task.LIBCPMTD ref: 0039B53D
task.LIBCPMTD ref: 0039B561
task.LIBCPMTD ref: 0039B584
task.LIBCPMTD ref: 0039B5A2
task.LIBCPMTD ref: 0039B5C0
task.LIBCPMTD ref: 0039B5DE
task.LIBCPMTD ref: 0039B5FC
task.LIBCPMTD ref: 0039B61A
task.LIBCPMTD ref: 0039B638
task.LIBCPMTD ref: 0039B656
task.LIBCPMTD ref: 0039B665
task.LIBCPMTD ref: 0039B674
task.LIBCPMTD ref: 0039B683
task.LIBCPMTD ref: 0039B695

Strings

Note: , xrefs: 0039B0EC
Location: , xrefs: 0039B03C
Error: , xrefs: 0039B2C1
Description: , xrefs: 0039B1D1

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: task$std::ios_base::good
String ID: Description: $Error: $Location: $Note:
API String ID: 683101471-3827417736
Opcode ID: c4f7d4c3390c351269332623e2e141de5718c052a0195976efb556f4443f16f8
Instruction ID: 3f13868a998300623f68fc574f8b351d2d7f025f452b3d0a1d58efe65756934d
Opcode Fuzzy Hash: c4f7d4c3390c351269332623e2e141de5718c052a0195976efb556f4443f16f8
Instruction Fuzzy Hash: 2722F2B1D00229DBDF15DF94CD95BEEB7B1BF88300F1086A9E059AB291DB705A85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003A0130, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 140registryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 003A01F9
LoadImageW.USER32 ref: 003A0210
LoadCursorW.USER32(00000000,00007F00), ref: 003A0220
RegisterClassExW.USER32 ref: 003A022D
AdjustWindowRect.USER32 ref: 003A0263
CreateWindowExW.USER32 ref: 003A029E
task.LIBCPMTD ref: 003A02F0
ShowWindow.USER32(00000000,0000000A), ref: 003A02FD
UpdateWindow.USER32 ref: 003A0309

Part of subcall function 003A25AD: RaiseException.KERNEL32(E06D7363,00000001,00000003,003A1EAE,?,?,?,003A1EAE,?,003EB590), ref: 003A260D

Strings

Chili DirectX Framework, xrefs: 003A0290
0, xrefs: 003A0196
C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\MainWindow.cpp, xrefs: 003A02C8
@, xrefs: 003A019D
d, xrefs: 003A0246
Failed to get valid window handle., xrefs: 003A02B1

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Load$Image$AdjustClassCreateCursorExceptionRaiseRectRegisterShowUpdatetask
String ID: 0$@$C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\MainWindow.cpp$Chili DirectX Framework$Failed to get valid window handle.$d
API String ID: 3618209217-2626809526
Opcode ID: 5bec625695dc9cef19522b1e7843a9fbe602e94fac901a9ffa28e075774ac144
Instruction ID: 776082f3fd9215e2b198bd7c06d3879584dbb3cd150b70d08d8f5603a776b7ef
Opcode Fuzzy Hash: 5bec625695dc9cef19522b1e7843a9fbe602e94fac901a9ffa28e075774ac144
Instruction Fuzzy Hash: 215134B4A40208EFEB15CFA4CC99BAEBBB5FB49700F108118F511AB3C1C7B56945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 003AB5A4, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 003AB5E8

Part of subcall function 003AB256: _free.LIBCMT ref: 003AB273
Part of subcall function 003AB256: _free.LIBCMT ref: 003AB285
Part of subcall function 003AB256: _free.LIBCMT ref: 003AB297
Part of subcall function 003AB256: _free.LIBCMT ref: 003AB2A9
Part of subcall function 003AB256: _free.LIBCMT ref: 003AB2BB
Part of subcall function 003AB256: _free.LIBCMT ref: 003AB2CD
Part of subcall function 003AB256: _free.LIBCMT ref: 003AB2DF
Part of subcall function 003AB256: _free.LIBCMT ref: 003AB2F1
Part of subcall function 003AB256: _free.LIBCMT ref: 003AB303
Part of subcall function 003AB256: _free.LIBCMT ref: 003AB315
Part of subcall function 003AB256: _free.LIBCMT ref: 003AB327
Part of subcall function 003AB256: _free.LIBCMT ref: 003AB339
Part of subcall function 003AB256: _free.LIBCMT ref: 003AB34B

_free.LIBCMT ref: 003AB5DD

Part of subcall function 003A6642: HeapFree.KERNEL32(00000000,00000000,?,003AB3E7,?,00000000,?,?,?,003AB40E,?,00000007,?,?,003AB73B,?), ref: 003A6658
Part of subcall function 003A6642: GetLastError.KERNEL32(?,?,003AB3E7,?,00000000,?,?,?,003AB40E,?,00000007,?,?,003AB73B,?,?), ref: 003A666A

_free.LIBCMT ref: 003AB5FF
_free.LIBCMT ref: 003AB614
_free.LIBCMT ref: 003AB61F
_free.LIBCMT ref: 003AB641
_free.LIBCMT ref: 003AB654
_free.LIBCMT ref: 003AB662
_free.LIBCMT ref: 003AB66D
_free.LIBCMT ref: 003AB6A5
_free.LIBCMT ref: 003AB6AC
_free.LIBCMT ref: 003AB6C9
_free.LIBCMT ref: 003AB6E1

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: c7a0063c66f47cd68202a6665d160cb861a9a437aa2ab54aacc04128beb07f5a
Instruction ID: 683906ab955cabfdf6a53d33a8923233ece34694084237c6eec0322a86af9646
Opcode Fuzzy Hash: c7a0063c66f47cd68202a6665d160cb861a9a437aa2ab54aacc04128beb07f5a
Instruction Fuzzy Hash: E0315231A047019FEB27AA79D94AB56B3E8FF52310F254419E099DB1B2DF34ED80CB24

Uniqueness

Uniqueness Score: -1.00%

Function 003A6A4C, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 003A6A62

Part of subcall function 003A6642: HeapFree.KERNEL32(00000000,00000000,?,003AB3E7,?,00000000,?,?,?,003AB40E,?,00000007,?,?,003AB73B,?), ref: 003A6658
Part of subcall function 003A6642: GetLastError.KERNEL32(?,?,003AB3E7,?,00000000,?,?,?,003AB40E,?,00000007,?,?,003AB73B,?,?), ref: 003A666A

_free.LIBCMT ref: 003A6A6E
_free.LIBCMT ref: 003A6A79
_free.LIBCMT ref: 003A6A84
_free.LIBCMT ref: 003A6A8F
_free.LIBCMT ref: 003A6A9A
_free.LIBCMT ref: 003A6AA5
_free.LIBCMT ref: 003A6AB0
_free.LIBCMT ref: 003A6ABB
_free.LIBCMT ref: 003A6AC9

Strings

p->, xrefs: 003A6A59

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: p->
API String ID: 776569668-1258026502
Opcode ID: e142481152ca98c4e651657da56325a95c919746506998d8d814150b89164456
Instruction ID: ce5ded1eabbe747540018d599beed3f03ea5a778be96f5ab85e0a989c7bb4fbc
Opcode Fuzzy Hash: e142481152ca98c4e651657da56325a95c919746506998d8d814150b89164456
Instruction Fuzzy Hash: F921C67A900108AFCB42EFA4C996DDE7BB8FF19340F1481A6F6159F121DB31EA44CB80

Uniqueness

Uniqueness Score: -1.00%

Function 003A3801, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 304COMMON

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 003A38FE
type_info::operator==.LIBVCRUNTIME ref: 003A3920
___TypeMatch.LIBVCRUNTIME ref: 003A3A2F
CatchIt.LIBVCRUNTIME ref: 003A3A80
IsInExceptionSpec.LIBVCRUNTIME ref: 003A3B01
_UnwindNestedFrames.LIBCMT ref: 003A3B85
CallUnexpected.LIBVCRUNTIME ref: 003A3BA0

Strings

csm, xrefs: 003A383E
csm, xrefs: 003A3957
csm, xrefs: 003A38AB

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: 97c2a46f81f027db2ba49f0ccac81b944864e6ed70c96ea9c11c14971d1349fc
Instruction ID: aa018aef01fab453605113fd9fcfd6a8d1ef2bcf0c5cc4240a657cc604cd5213
Opcode Fuzzy Hash: 97c2a46f81f027db2ba49f0ccac81b944864e6ed70c96ea9c11c14971d1349fc
Instruction Fuzzy Hash: 9FB17971800219EFCF16DFA4C8819AEBBBAFF1A310B15415AF8156B212D375DF51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0039A9D0, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 194COMMON

Download Yara Rule

APIs

swap.LIBCMTD ref: 0039AA04
swap.LIBCMTD ref: 0039AA25
swap.LIBCMTD ref: 0039AA46
swap.LIBCMTD ref: 0039AA7A
swap.LIBCMTD ref: 0039AAD3

Part of subcall function 0039A630: __floor_pentium4.LIBCMT ref: 0039A6A9
Part of subcall function 0039A630: __floor_pentium4.LIBCMT ref: 0039A6DB
Part of subcall function 0039A630: __floor_pentium4.LIBCMT ref: 0039A773
Part of subcall function 0039A630: __floor_pentium4.LIBCMT ref: 0039A7A2

Part of subcall function 0039A800: __floor_pentium4.LIBCMT ref: 0039A879
Part of subcall function 0039A800: __floor_pentium4.LIBCMT ref: 0039A8AB
Part of subcall function 0039A800: __floor_pentium4.LIBCMT ref: 0039A943
Part of subcall function 0039A800: __floor_pentium4.LIBCMT ref: 0039A972

Strings

Iw9, xrefs: 0039AA0F, 0039AAAA, 0039AB10, 0039AB39, 0039ABD0, 0039AB8E, 0039AABF, 0039AAE7, 0039AACB, 0039AA8E, 0039AA1D, 0039AA20, 0039AA91, 0039AACE, 0039AADB, 0039AAEA, 0039AB91, 0039ABD3
Iw9, xrefs: 0039A9DF

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: __floor_pentium4$swap
String ID: Iw9$Iw9
API String ID: 1832335491-2575950149
Opcode ID: d0180207e2725a86479b09b56075559e2d3825ee89ffdeb9ef605ed67fd232dc
Instruction ID: c58be1eacba8934ddf633ceb5942f300c4aa0baec941fc0609ce00c6c21a5b4c
Opcode Fuzzy Hash: d0180207e2725a86479b09b56075559e2d3825ee89ffdeb9ef605ed67fd232dc
Instruction Fuzzy Hash: 33711C76E00508EBCF06DFD9D981CEEF7B9AF88300B14C649A915B7251EB30AB45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0039ABF0, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 003A25AD: RaiseException.KERNEL32(E06D7363,00000001,00000003,003A1EAE,?,?,?,003A1EAE,?,003EB590), ref: 003A260D

task.LIBCPMTD ref: 0039AC9B
task.LIBCPMTD ref: 0039AEB0

Strings

Mapping sysbuffer, xrefs: 0039AC4F
C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp, xrefs: 0039AE7D
Presenting back buffer, xrefs: 0039AE64
C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp, xrefs: 0039AC68

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: task$ExceptionRaise
String ID: C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp$C:\xampp\htdocs\Cryptor\12cb4e31ecbe42d39dc30824c28a2a8a\Loader\qw\Engine\Graphics.cpp$Mapping sysbuffer$Presenting back buffer
API String ID: 717192378-4191005460
Opcode ID: d177bd9c6221c07f74b764de9563804e4fb4048d382d56fd068ad01e0ab51d6c
Instruction ID: a6583a289d005cdb4c1b25391b0b86c81e8c86094479b0f5e061853a935c7128
Opcode Fuzzy Hash: d177bd9c6221c07f74b764de9563804e4fb4048d382d56fd068ad01e0ab51d6c
Instruction Fuzzy Hash: 0491E9B5A10119AFDF09EB98CC91FAEB7B5BF88700F104158E516AB3D1DB70A941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 003A32D0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 003A3307
___except_validate_context_record.LIBVCRUNTIME ref: 003A330F
_ValidateLocalCookies.LIBCMT ref: 003A3398
__IsNonwritableInCurrentImage.LIBCMT ref: 003A33C3
_ValidateLocalCookies.LIBCMT ref: 003A3418

Strings

csm, xrefs: 003A33AD

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c8cef56e64da43e313cc22ec4ad47c0dbf9e01fad596f4dc3a219f943d876633
Instruction ID: 9d9a6e9b159e4ee90a57de82c24156498d30328c03e47a25661441ad891a736e
Opcode Fuzzy Hash: c8cef56e64da43e313cc22ec4ad47c0dbf9e01fad596f4dc3a219f943d876633
Instruction Fuzzy Hash: 6341B138A04218AFCF12DF69C885A9EBBF5EF46324F148155F8149F392DB31DA05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0039B6B0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

task.LIBCPMTD ref: 0039B782
task.LIBCPMTD ref: 0039B78E
task.LIBCPMTD ref: 0039B79A
task.LIBCPMTD ref: 0039B7AC

Strings

Line [, xrefs: 0039B70E
] in , xrefs: 0039B6DF

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: task
String ID: Line [$] in
API String ID: 1384045349-532795066
Opcode ID: d9f8f57a34857d993bcd5ed8d7e3b65e6a6e9998709d257320618333fc502f98
Instruction ID: 87d6e7271cc5342ef8ccb22e82cfd91f11722da3e7df06853103d952aa7fe6c4
Opcode Fuzzy Hash: d9f8f57a34857d993bcd5ed8d7e3b65e6a6e9998709d257320618333fc502f98
Instruction Fuzzy Hash: D03119B1D05248EFCF05DFA8D941BEEBBB4EB49700F108259E415BB382D7755A04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003A79F0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

ext-ms-, xrefs: 003A7A5B
api-ms-, xrefs: 003A7A47

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: e4c3f1c8da1f83a0ed5c49f3b5557aa7f305198dd487433d11d7fc814d864293
Instruction ID: 7a57e173622e2b3c4b6c2b48a1e793a2bf12e7d6ab06a479c0fc90ee5edfbc55
Opcode Fuzzy Hash: e4c3f1c8da1f83a0ed5c49f3b5557aa7f305198dd487433d11d7fc814d864293
Instruction Fuzzy Hash: 5221A572A09621BFDB338665DCC5B6F375CEF53760F260620E806A7391E630EE0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 003AB3F5, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 003AB3BD: _free.LIBCMT ref: 003AB3E2

_free.LIBCMT ref: 003AB443

Part of subcall function 003A6642: HeapFree.KERNEL32(00000000,00000000,?,003AB3E7,?,00000000,?,?,?,003AB40E,?,00000007,?,?,003AB73B,?), ref: 003A6658
Part of subcall function 003A6642: GetLastError.KERNEL32(?,?,003AB3E7,?,00000000,?,?,?,003AB40E,?,00000007,?,?,003AB73B,?,?), ref: 003A666A

_free.LIBCMT ref: 003AB44E
_free.LIBCMT ref: 003AB459
_free.LIBCMT ref: 003AB4AD
_free.LIBCMT ref: 003AB4B8
_free.LIBCMT ref: 003AB4C3
_free.LIBCMT ref: 003AB4CE

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8194409c322fd6fb222828396374f2ccc1a24e740e001590e1041b79c2e6c5c3
Instruction ID: 9070e22c375697578e0a15809766f388a22b7e95c70b1cef8d6540e8cbdbd3a4
Opcode Fuzzy Hash: 8194409c322fd6fb222828396374f2ccc1a24e740e001590e1041b79c2e6c5c3
Instruction Fuzzy Hash: 4F112175540B04AAD922BBB0CC5BFCBB79CEF06700F444816B299AE0A3DB75B5248750

Uniqueness

Uniqueness Score: -1.00%

Function 003A4532, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,003A45F3,00000000,00000FA0,003EE11C,00000000,?,003A471E,00000004,InitializeCriticalSectionEx,003E2464,InitializeCriticalSectionEx,00000000), ref: 003A45C2

Strings

34:, xrefs: 003A457D, 003A4587, 003A4598
api-ms-, xrefs: 003A4582

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: 34:$api-ms-
API String ID: 3664257935-2624560687
Opcode ID: efc65f13245bf0c3cf25d257de1c74eeb7c8f249b43e841bf93d496912dabc87
Instruction ID: 622bf9151257201e338a7908d2674631fceb88020df836574fa3d705b49d456c
Opcode Fuzzy Hash: efc65f13245bf0c3cf25d257de1c74eeb7c8f249b43e841bf93d496912dabc87
Instruction Fuzzy Hash: B2117371E41625ABDF339B69DC49B5A7798DF83760F264220F911EB2C0E6B0ED008AD1

Uniqueness

Uniqueness Score: -1.00%

Function 003AD160, Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 003AD1A8
__fassign.LIBCMT ref: 003AD38D
__fassign.LIBCMT ref: 003AD3AA
WriteFile.KERNEL32(?,003ABAE8,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003AD3F2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 003AD432
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 003AD4DA

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: bbd58decbb9a06d4deefdf4ea86d1a9413c7ae7e888763953659a677f156c82e
Instruction ID: dce6a4acdddd542de2600b01dfbb25e5c7930c55090230e37054a39f77b8acf2
Opcode Fuzzy Hash: bbd58decbb9a06d4deefdf4ea86d1a9413c7ae7e888763953659a677f156c82e
Instruction Fuzzy Hash: F5C18275D002589FCF16CFE9D8809EDBBB9EF0A314F28416AE856BB641D631AD06CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003A34CA, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,003A34C1,003A3276,003A2379), ref: 003A34D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 003A34E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003A34FF
SetLastError.KERNEL32(00000000,003A34C1,003A3276,003A2379), ref: 003A3551

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 89b16a41cf31b6e1ceae48a3efb5993f25743d9d40ec51c676226852e6af3c41
Instruction ID: a401c9f48deb65d6d106b7def35537def6d6da7791bfe7bc18c75a96de29a947
Opcode Fuzzy Hash: 89b16a41cf31b6e1ceae48a3efb5993f25743d9d40ec51c676226852e6af3c41
Instruction Fuzzy Hash: D001F7326096115EA73727B9BCC9E662B8CEB93775F210339F510AD1F1EF914E019188

Uniqueness

Uniqueness Score: -1.00%

Function 003A5DE6, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,003A5DDB,?,?,003A5DA3,?,?,?), ref: 003A5DFB
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 003A5E0E
FreeLibrary.KERNEL32(00000000,?,?,003A5DDB,?,?,003A5DA3,?,?,?), ref: 003A5E31

Strings

CorExitProcess, xrefs: 003A5E06
mscoree.dll, xrefs: 003A5DF4

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 962a1a1971bdf8f0567aab33a3a60e144471adf9b4e865f5f1afed7cfaa1b626
Instruction ID: ea0e8d89231e7dd1344021d3dc9f3396ba715e2fe71c6d3e804156c2dd0822fb
Opcode Fuzzy Hash: 962a1a1971bdf8f0567aab33a3a60e144471adf9b4e865f5f1afed7cfaa1b626
Instruction Fuzzy Hash: 95F01C31600629FBDB179B91DC0AFDF7AACEB46756F150060E405A51A0CB748F01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 003AB354, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 003AB36C

Part of subcall function 003A6642: HeapFree.KERNEL32(00000000,00000000,?,003AB3E7,?,00000000,?,?,?,003AB40E,?,00000007,?,?,003AB73B,?), ref: 003A6658
Part of subcall function 003A6642: GetLastError.KERNEL32(?,?,003AB3E7,?,00000000,?,?,?,003AB40E,?,00000007,?,?,003AB73B,?,?), ref: 003A666A

_free.LIBCMT ref: 003AB37E
_free.LIBCMT ref: 003AB390
_free.LIBCMT ref: 003AB3A2
_free.LIBCMT ref: 003AB3B4

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 043e269692bc61f3cf1aab4194d74c88f6481818f99c3da8a07f4cae749df0e7
Instruction ID: a81fff35abc57add7d540827f0690e923bfbd2c194364f04c0e4b00bad055b4e
Opcode Fuzzy Hash: 043e269692bc61f3cf1aab4194d74c88f6481818f99c3da8a07f4cae749df0e7
Instruction Fuzzy Hash: B4F03676504640ABCA33EB68F9D6C5AB7DDEA12711B7D4905F008DF591CB30FC818A54

Uniqueness

Uniqueness Score: -1.00%

Function 003A5607, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\KkPVouLuOx.exe, xrefs: 003A5645, 003A564C, 003A5680

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user\Desktop\KkPVouLuOx.exe
API String ID: 0-1332543494
Opcode ID: 18a9a1da82126f8cf6b3d4da804239f1712f9a5a93a512d3edb52839f3265f61
Instruction ID: 7fbe88ae6de85f295c6f67a15fc53873d8b3c5d9e1a480576b9201520824bee6
Opcode Fuzzy Hash: 18a9a1da82126f8cf6b3d4da804239f1712f9a5a93a512d3edb52839f3265f61
Instruction Fuzzy Hash: E4316071A00A54EFCB27DB9998859AEBBFCEB9A320B554166F404EB261D7718E00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003A3BAB, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 003A3BD0
CatchIt.LIBVCRUNTIME ref: 003A3CB6

Strings

RCC, xrefs: 003A3BEA
MOC, xrefs: 003A3BE2

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 8fbaf2d0fa00ad611d86140e97da517a41c90e0000abf9322806357b10e2ad8c
Instruction ID: 742697a86c96d8048c882a46f6ec43d46d1da2af3cd34544ddca50eb73a50983
Opcode Fuzzy Hash: 8fbaf2d0fa00ad611d86140e97da517a41c90e0000abf9322806357b10e2ad8c
Instruction Fuzzy Hash: 18416772900209AFCF16CF98CD85AAEBBB5FF49314F158159F905BB221D3359EA0DB50

Uniqueness

Uniqueness Score: -1.00%

Function 003A0570, Relevance: 6.2, APIs: 4, Instructions: 244windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 003A05EF
SetCapture.USER32(?,?,?), ref: 003A06AD
DefWindowProcW.USER32(?,?,?,00000009), ref: 003A0881

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureMessagePostProcQuitWindow
String ID:
API String ID: 139009503-0
Opcode ID: 3de47fd8bf85ed58fa653ca5f7f06ad98a250e7cd7fa22c7612efa07dc808b73
Instruction ID: 3f2d391be6adf2a22b9b44fb3edd61e8480a81cf84ba5654af355cdc7bdf17f0
Opcode Fuzzy Hash: 3de47fd8bf85ed58fa653ca5f7f06ad98a250e7cd7fa22c7612efa07dc808b73
Instruction Fuzzy Hash: 38916275D0452A9BCF0EDFD8C890AFFB3B9FF8A701F00441DE51266255E6389A50CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 003A35AA, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 003A3671
___AdjustPointer.LIBCMT ref: 003A3694
___AdjustPointer.LIBCMT ref: 003A3730

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: fefc1436e507cfc82e2752f30ebf84cb259a1462d61520ce9ddcffd6377b13f4
Instruction ID: 3fa02f4a5724124ba22a2226c7c040f4d6ebf549cc4663fbfa4f732a3a40df98
Opcode Fuzzy Hash: fefc1436e507cfc82e2752f30ebf84cb259a1462d61520ce9ddcffd6377b13f4
Instruction Fuzzy Hash: C15107B1605206AFDB2B9F54D891B7AB3A5EF02310F21412EFC014B7A1E732EE40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0039A630, Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0039A6A9
__floor_pentium4.LIBCMT ref: 0039A6DB
__floor_pentium4.LIBCMT ref: 0039A773
__floor_pentium4.LIBCMT ref: 0039A7A2

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 1a1805baba5bfbacd296308d5fee7fa4b779207bb1b8500ca565b09359e0afcd
Instruction ID: ac1215ec7f94fc17b5d157b41255637ebb6149eb409a5f43b342dbf92ad1bcb6
Opcode Fuzzy Hash: 1a1805baba5bfbacd296308d5fee7fa4b779207bb1b8500ca565b09359e0afcd
Instruction Fuzzy Hash: F551F535C1060DDFCB06DFAAD58149DFBB1EF89340B288748E8457A251EB31A984DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0039A800, Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0039A879
__floor_pentium4.LIBCMT ref: 0039A8AB
__floor_pentium4.LIBCMT ref: 0039A943
__floor_pentium4.LIBCMT ref: 0039A972

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: dfd112420caf36a5c41a340b647e53e090e392b8b303010f320cf87f76bd4571
Instruction ID: f582a657f4897fb85fecae4f1894c66d41274a7a37da1c4d68bfd303de3fd200
Opcode Fuzzy Hash: dfd112420caf36a5c41a340b647e53e090e392b8b303010f320cf87f76bd4571
Instruction Fuzzy Hash: 8C51F435C1060D9FCB06DFAAD58149DFBB1FF89340B288758E8057A251EB31A988DF95

Uniqueness

Uniqueness Score: -1.00%

Function 003A6B64, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,003AD5A8,?,00000001,003ABB59,?,003ADA62,00000001,?,?,?,003ABAE8,?,?), ref: 003A6B69
_free.LIBCMT ref: 003A6BC6
_free.LIBCMT ref: 003A6BFC
SetLastError.KERNEL32(00000000,00000006,000000FF,?,003ADA62,00000001,?,?,?,003ABAE8,?,?,?,003EC038,0000002C,003ABB59), ref: 003A6C07

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: aed78cf0686247d1f036f9572b21616fa743186d282f7ca54f659e850b315b21
Instruction ID: df988d7a817da766242f2f9dd845703433d9840416fc709f377524ef9ab198e8
Opcode Fuzzy Hash: aed78cf0686247d1f036f9572b21616fa743186d282f7ca54f659e850b315b21
Instruction Fuzzy Hash: F811A5722086556ADB2327B59DCBE2B265DDBC37B4F2E4334F526DF1E1EE218D024260

Uniqueness

Uniqueness Score: -1.00%

Function 003A6CBB, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,003A5030,003A47F8,?,?,0038163A,?,?,DirectDraw does not support provided Cliplist.), ref: 003A6CC0
_free.LIBCMT ref: 003A6D1D
_free.LIBCMT ref: 003A6D53
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,003A5030,003A47F8,?,?,0038163A,?,?,DirectDraw does not support provided Cliplist.), ref: 003A6D5E

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 3455c527fdbadb83b7f321cc283d680e9709e8babd8196e212a29854b96ea833
Instruction ID: 4a9b62015d9818b4476b57ac228383e25bed6b14e2dfee409588814f9a34fa61
Opcode Fuzzy Hash: 3455c527fdbadb83b7f321cc283d680e9709e8babd8196e212a29854b96ea833
Instruction Fuzzy Hash: 4711A5323082546BDA1327789DC7E2A225DEBC37F4F2D4338F5259A1E1DA61CC014160

Uniqueness

Uniqueness Score: -1.00%

Function 003AE566, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,003AE010,?,00000001,?,00000001,?,003AD537,?,?,00000001), ref: 003AE57D
GetLastError.KERNEL32(?,003AE010,?,00000001,?,00000001,?,003AD537,?,?,00000001,?,00000001,?,003ADA83,003ABAE8), ref: 003AE589

Part of subcall function 003AE54F: CloseHandle.KERNEL32(FFFFFFFE,003AE599,?,003AE010,?,00000001,?,00000001,?,003AD537,?,?,00000001,?,00000001), ref: 003AE55F

___initconout.LIBCMT ref: 003AE599

Part of subcall function 003AE511: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,003AE540,003ADFFD,00000001,?,003AD537,?,?,00000001,?), ref: 003AE524

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,003AE010,?,00000001,?,00000001,?,003AD537,?,?,00000001,?), ref: 003AE5AE

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 80a593bbdb5569c5aafe8d3f0f864d70220cb90218d305df6d40867605716aad
Instruction ID: 02b54e4bb3b53d3da82ff806f401e039411dcc299c6dfde63fb0036e56669a53
Opcode Fuzzy Hash: 80a593bbdb5569c5aafe8d3f0f864d70220cb90218d305df6d40867605716aad
Instruction Fuzzy Hash: CEF01C36800164BBCF236FD6EC049893F2AFF0A3B4F054120FA1989170E632C920DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0039FED0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

_Max_value.LIBCPMTD ref: 0039FF74
allocator.LIBCONCRTD ref: 0039FFAC

Strings

.>, xrefs: 0039FF3F, 0039FF42

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: Max_valueallocator
String ID: .>
API String ID: 3544681812-3710981146
Opcode ID: d3513c7c75c5a67896fd86333a1c6c072f12212118baa7e6313deef99ed00524
Instruction ID: ef3d71ac5b6178f7cb7dec535fa7d6083fdd579f551c765d8604096f7c7442ee
Opcode Fuzzy Hash: d3513c7c75c5a67896fd86333a1c6c072f12212118baa7e6313deef99ed00524
Instruction Fuzzy Hash: C7514BB5D0020DAFCF05DFA8E891AEEB7B9AF48304F144159F515B7381DB35AA45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00397770, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 00396AE0: Concurrency::cancellation_token_source::~cancellation_token_source.LIBCPMTD ref: 00396BAE

_Smanip.LIBCPMTD ref: 003978E2

Strings

}:, xrefs: 00397798, 0039779B
]u9, xrefs: 0039790C

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: Concurrency::cancellation_token_source::~cancellation_token_sourceSmanip
String ID: ]u9$}:
API String ID: 1404505953-4133048224
Opcode ID: 4d19af000109480608529a5f99b256cb49f8e8905ab82de7620912c6736eacf2
Instruction ID: d245c4b4589ad48f674b61d9ae885c3a87f42a3445a6c0be9ace08aa816746b8
Opcode Fuzzy Hash: 4d19af000109480608529a5f99b256cb49f8e8905ab82de7620912c6736eacf2
Instruction Fuzzy Hash: BC417EF0D05258DFEB11CF94C959BDEBBB4FB05308F108188E5596B281C7BA2A88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 003A04B0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 0039B6B0: task.LIBCPMTD ref: 0039B782
Part of subcall function 0039B6B0: task.LIBCPMTD ref: 0039B78E
Part of subcall function 0039B6B0: task.LIBCPMTD ref: 0039B79A
Part of subcall function 0039B6B0: task.LIBCPMTD ref: 0039B7AC

Part of subcall function 0039FDC0: _WChar_traits.LIBCPMTD ref: 0039FDDC

task.LIBCPMTD ref: 003A053C
task.LIBCPMTD ref: 003A054B

Strings

At: , xrefs: 003A04F5

Memory Dump Source

Source File: 00000000.00000002.239512223.0000000000381000.00000020.00020000.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.239496826.0000000000380000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239644307.00000000003AF000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.239912652.00000000003ED000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.239924106.00000000003EF000.00000002.00020000.sdmp Download File

Similarity

API ID: task$Char_traits
String ID: At:
API String ID: 3491928287-3792039641
Opcode ID: c85fba3e5ab2051eb1f2897d65f630a50ac44098e8903232031a63aa7a72c050
Instruction ID: f427765a371bd0e6de999ec04b2c2d9bf22e75c8a43b96cffa73e5b25c1b93d2
Opcode Fuzzy Hash: c85fba3e5ab2051eb1f2897d65f630a50ac44098e8903232031a63aa7a72c050
Instruction Fuzzy Hash: 7711E7B1D0424DABCF05DFD4D941BEEBBB4EB48710F108229E515AB381DB356A04CBA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exe PID: 1068 Parent PID: 1336 MSBuild.exeCOMMON

Executed Functions

Function 016B0878, Relevance: 1.7, APIs: 1, Instructions: 178libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 016B0928

Memory Dump Source

Source File: 00000002.00000002.501040148.00000000016B0000.00000040.00000001.sdmp, Offset: 016B0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc2f0329eebd2485fa8f37e3e3fbe42a238a9ab0ecd4f915c0335e060feff343
Instruction ID: 8bd65a08ae0ede21b74cbc0bed7e632e74ded07cf56e9b22ecfd8faa340bd9f2
Opcode Fuzzy Hash: bc2f0329eebd2485fa8f37e3e3fbe42a238a9ab0ecd4f915c0335e060feff343
Instruction Fuzzy Hash: 0251B431A002059FCB04EBB4D884AAEB7F6FF85204F148569E5169F395DF34EC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 016E0A70, Relevance: 8.5, APIs: 5, Instructions: 955libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E0AA7
LdrInitializeThunk.NTDLL ref: 016E0B85
KiUserExceptionDispatcher.NTDLL ref: 016E0F5C
KiUserExceptionDispatcher.NTDLL ref: 016E0FA3

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 67e98c5c814cdaea36355a6c51798508ca3298b8972953953191bb95cdc11f04
Instruction ID: 5a2d93e08cf756bd7aa1374acf7ece984bbd220cbca614c200cecf0036702207
Opcode Fuzzy Hash: 67e98c5c814cdaea36355a6c51798508ca3298b8972953953191bb95cdc11f04
Instruction Fuzzy Hash: 77A2F574A05229CFCB64DF34D858AADB7F6BB89305F1081EAD609A7344CB349E86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 03286B50, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 03286BB0
GetCurrentThread.KERNEL32 ref: 03286BED
GetCurrentProcess.KERNEL32 ref: 03286C2A
GetCurrentThreadId.KERNEL32 ref: 03286C83

Memory Dump Source

Source File: 00000002.00000002.502654178.0000000003280000.00000040.00000001.sdmp, Offset: 03280000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e8424b725e63ee0b91b4be2784a99b326ca042be29330ab03faef196bec2a93e
Instruction ID: f811450cdd3d7c1764bebf9caa8319bc5cd3cb1821d4ef824aac4fadc45933d0
Opcode Fuzzy Hash: e8424b725e63ee0b91b4be2784a99b326ca042be29330ab03faef196bec2a93e
Instruction Fuzzy Hash: FA5163B4A012498FDB14DFAAC648B9EBBF0FF89318F248059E519B7390D7346884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 016E0EA8, Relevance: 5.0, APIs: 3, Instructions: 472COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E0F5C
KiUserExceptionDispatcher.NTDLL ref: 016E0FA3
KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4d142e34b9f8709cdbe09a878d45d93ee6ab3a20e4a67b43d30de91e44776e82
Instruction ID: a117cfc5c77b33d1acaa359e0ed3e40cb47bb3d0a0715275546ffd267a12bb7e
Opcode Fuzzy Hash: 4d142e34b9f8709cdbe09a878d45d93ee6ab3a20e4a67b43d30de91e44776e82
Instruction Fuzzy Hash: 26320B74A05219CFCB65DF34D8846ADB7B6BF89306F2081EAD609A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E0EEF, Relevance: 5.0, APIs: 3, Instructions: 465COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E0F5C
KiUserExceptionDispatcher.NTDLL ref: 016E0FA3
KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: eb46c179ea3756ca8d629809425c3881d4328a615716a27e3167c1b6ba045746
Instruction ID: 003773c3393b848d6b7dff1427350fcaadefdbff1e08ca4c0ee92d01b158b0bf
Opcode Fuzzy Hash: eb46c179ea3756ca8d629809425c3881d4328a615716a27e3167c1b6ba045746
Instruction Fuzzy Hash: 5C220D74A05219CFCB65DF34D8846ADB7B6BF89306F2081EAD609A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E0F36, Relevance: 5.0, APIs: 3, Instructions: 458COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E0F5C
KiUserExceptionDispatcher.NTDLL ref: 016E0FA3
KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a9490b7ae1f3d51c365a8f3d77c45014d9ef029088307611e3b1024cf52591b7
Instruction ID: ed172e1c646bb10c282126edeabdd4bfe486ab8b5863fac7e44c82c420bf6205
Opcode Fuzzy Hash: a9490b7ae1f3d51c365a8f3d77c45014d9ef029088307611e3b1024cf52591b7
Instruction Fuzzy Hash: 12220D74A05219CFCB65DF34D8846ADB7B6BF89306F2081EAD609A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E0F7D, Relevance: 3.5, APIs: 2, Instructions: 451COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E0FA3
KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 174c3eb7385e930e1e31023fca5944d745f988d6909f1e7090e735f90fab3341
Instruction ID: beaec3dd29a26036e91c233e09c6f0d255d1fd2c358566e9e361c85e53013b48
Opcode Fuzzy Hash: 174c3eb7385e930e1e31023fca5944d745f988d6909f1e7090e735f90fab3341
Instruction Fuzzy Hash: CE220D74A05219CFCB65DF34D8846ADB7B6BF89306F1081EAD609A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E0FDA, Relevance: 1.9, APIs: 1, Instructions: 440COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: aa86d73ab19d903232c4c69fa954e554e6f4f9fce8ed13289f445bf2ec2cf0a1
Instruction ID: 4ba1df027e6617278a13afc67fddcf64ae3e139dcc3c47853d735c50e993dd89
Opcode Fuzzy Hash: aa86d73ab19d903232c4c69fa954e554e6f4f9fce8ed13289f445bf2ec2cf0a1
Instruction Fuzzy Hash: 34220D74A05219CFCB65DF34D8886ADB7B6BF89306F1081EAD609A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1021, Relevance: 1.9, APIs: 1, Instructions: 433COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 893efaacd609fdc5b72aefe855af5b9ce324a16ca8145e480685d430b1cef08b
Instruction ID: 4493fc769d0eec4311ca0d320e9d2ee413d353b426970da20eaa3a4f233d980f
Opcode Fuzzy Hash: 893efaacd609fdc5b72aefe855af5b9ce324a16ca8145e480685d430b1cef08b
Instruction Fuzzy Hash: 1F220D74A05219CFCB65DF34D8846ADB7B6BF89306F2081EAD609A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1068, Relevance: 1.9, APIs: 1, Instructions: 426COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 705ac163516056320a34797fb6be389df3f8a988ac0156df85e396866060eb7d
Instruction ID: deca8ed68172f6953e05cdd854d17e8bfecf8de36c486130f16627c36a312faf
Opcode Fuzzy Hash: 705ac163516056320a34797fb6be389df3f8a988ac0156df85e396866060eb7d
Instruction Fuzzy Hash: 59120D74A05219CFCB65DF34D8886ADB7B6BF89306F1081EAD609A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E10AF, Relevance: 1.9, APIs: 1, Instructions: 419COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 47a3efbd20f9a2174e495e7679a8dcd4252952657d28bdb7552f3d7ac3bfca23
Instruction ID: 7d1b7ddbfebb884100a047eb63af65d8426d13fabe9cd0112769df5c969daf10
Opcode Fuzzy Hash: 47a3efbd20f9a2174e495e7679a8dcd4252952657d28bdb7552f3d7ac3bfca23
Instruction Fuzzy Hash: 5D121D74A05219CFCB65DF34D8886ADB7B6BF89306F1081EAD609A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E10F6, Relevance: 1.9, APIs: 1, Instructions: 412COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ba39c2146c3ea7cc6d874a52d932d8d17678f115d90b397d7609475630791dd7
Instruction ID: 09b9a69f0bd8317ef0fb4e5b4ec8fbb81703594f4bdb835cc55b1f5afef59749
Opcode Fuzzy Hash: ba39c2146c3ea7cc6d874a52d932d8d17678f115d90b397d7609475630791dd7
Instruction Fuzzy Hash: FC121D74A05219CFCB64DF34D8886ADB7B6BF89306F1081EAD619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E113D, Relevance: 1.9, APIs: 1, Instructions: 405COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ec6d29312aee87e46048cc70e89d452a24ee6a01cb7cb206704f73c88b3e88a7
Instruction ID: 98e6c84bad8802aff2e254c6a5d4452dcac7a5a3f18e7817d3b233a278110669
Opcode Fuzzy Hash: ec6d29312aee87e46048cc70e89d452a24ee6a01cb7cb206704f73c88b3e88a7
Instruction Fuzzy Hash: DC120E74A05219CFCB64DF34D8846ADB7B6BF89306F1081EAD619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1184, Relevance: 1.9, APIs: 1, Instructions: 398COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ca6919d474be5dd242b0cc12932b496177ad9d7df20348f4d917a1518f77e305
Instruction ID: ae713fc56b8770c9a3d08d4b6331acdb9c6dd737e1ea0bf9c110f34bb24ce755
Opcode Fuzzy Hash: ca6919d474be5dd242b0cc12932b496177ad9d7df20348f4d917a1518f77e305
Instruction Fuzzy Hash: AD120D74A05219CFCB64DF34D8886ADB7B6BF89306F1081EAD619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E11CB, Relevance: 1.9, APIs: 1, Instructions: 391COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ca3d0c213966a8262a6cf849a1c3f1f66414e9a4d956e96e98c9b6be13ea322b
Instruction ID: 606512faaa8f36b1843f097ad6a80abb0215bd799c53aa30f73cc12153c43911
Opcode Fuzzy Hash: ca3d0c213966a8262a6cf849a1c3f1f66414e9a4d956e96e98c9b6be13ea322b
Instruction Fuzzy Hash: 2F120E74A05219CFCB64DF34D8886ADB7B6BF89306F1081EAD619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1212, Relevance: 1.9, APIs: 1, Instructions: 384COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6a0055af0d8e8a22f4d05f356bf8b5aa5bbb4455719edc798b185c6cfcd57395
Instruction ID: 3d5dd2b1fd37adb7eeb1ca59a048b3bc9215bb13c2553b10c37706975eeb3065
Opcode Fuzzy Hash: 6a0055af0d8e8a22f4d05f356bf8b5aa5bbb4455719edc798b185c6cfcd57395
Instruction Fuzzy Hash: 55020E74A05219CFCB64DF34D8886ADB7B6BF89306F1081EAD619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1259, Relevance: 1.9, APIs: 1, Instructions: 377COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6acd6df8ec20e422706f653160cba8a7cb68e37df0f65647b64ab012b15b6e3a
Instruction ID: a5394563552e81e1d8ecf91316c4cc28be1fb343ddf6635680524f4c64ebbc1b
Opcode Fuzzy Hash: 6acd6df8ec20e422706f653160cba8a7cb68e37df0f65647b64ab012b15b6e3a
Instruction Fuzzy Hash: 82021D74A05219CFCB64DF34D8886ADB7B6BF89306F1081EAD619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E12A0, Relevance: 1.9, APIs: 1, Instructions: 370COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d9c57490ded0f0f8cb6d0cdb1c7b8afca85794ae6dd679400d91fe691c75dce6
Instruction ID: 47f70d0d92a88d7266a91a15ecb85326eac9d2ad3a422d7bd28ef70953b86afc
Opcode Fuzzy Hash: d9c57490ded0f0f8cb6d0cdb1c7b8afca85794ae6dd679400d91fe691c75dce6
Instruction Fuzzy Hash: 93021E74A05219CFCB64DF34D8986ADB7B6BF89306F1081EAD609A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E12FD, Relevance: 1.9, APIs: 1, Instructions: 359COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 97031098b2c106027b641a6c24e46f8578cca4b34504e23422116714f0cf948d
Instruction ID: 72a7dc7c4acd873e734f1c634ad123bccf24446626355a4161b407c2323436ea
Opcode Fuzzy Hash: 97031098b2c106027b641a6c24e46f8578cca4b34504e23422116714f0cf948d
Instruction Fuzzy Hash: EB021FB4A05219CFCB64DF34D8886AD77B6BF89306F1081EAD619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1344, Relevance: 1.9, APIs: 1, Instructions: 352COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f95942c6966a28eb6d861cb8aeb795a81c28cf3a52fa8dd1ae2a63463c9561ac
Instruction ID: e785cb281386e2169f45d452e5200ce3242aedca9fbd1b8680deffdef6f9a3f5
Opcode Fuzzy Hash: f95942c6966a28eb6d861cb8aeb795a81c28cf3a52fa8dd1ae2a63463c9561ac
Instruction Fuzzy Hash: 1AF11FB4A05219CFCB64DF34D8886AD77B6BF89306F1081EAD619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E138B, Relevance: 1.8, APIs: 1, Instructions: 345COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e5b59283606e60c287e08e6e3cb34bcd6e8dc5e5673623919adf783147627487
Instruction ID: c17c4a6c9e84992991f8c955d26698aab47d7591cae29e65726c145813bc26e1
Opcode Fuzzy Hash: e5b59283606e60c287e08e6e3cb34bcd6e8dc5e5673623919adf783147627487
Instruction Fuzzy Hash: 67F12FB4A05219CFCB64DF34D8886AD77B2BF89306F1081E9D619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E13D5, Relevance: 1.8, APIs: 1, Instructions: 338COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6cb1ec5531c2fface7ca538ceecd016ddff51d312639edc9f4e2ecd486fd871f
Instruction ID: f37adf61fb9a64906e2d6fafe11aa79489069911c1d8774aac1aabf4bc99116f
Opcode Fuzzy Hash: 6cb1ec5531c2fface7ca538ceecd016ddff51d312639edc9f4e2ecd486fd871f
Instruction Fuzzy Hash: C2F11DB4A05219CFCB64DF34D8986ADB7B2BF89206F1081E9D619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E141F, Relevance: 1.8, APIs: 1, Instructions: 329COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a6c3df8f9f26047cfb8f01d8e47453fd79f7ffc36975a7f503a2b7ff0eb2bbdd
Instruction ID: f9a65fb508b3839c8ee9ec87f128cfce213846cd42f98e237bc436b279edd22c
Opcode Fuzzy Hash: a6c3df8f9f26047cfb8f01d8e47453fd79f7ffc36975a7f503a2b7ff0eb2bbdd
Instruction Fuzzy Hash: A0E12CB4A05219CFCB64DF34D8986ADB7F2BF89206F1081E9D619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E145D, Relevance: 1.8, APIs: 1, Instructions: 324COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0db22abc8c0067f515caae450af381a065faca96b210efd2b796dca9b7235aaf
Instruction ID: 10b8758c2324f4b1ea51870be3b21414002eefd990f45df3ca00768fa16465e7
Opcode Fuzzy Hash: 0db22abc8c0067f515caae450af381a065faca96b210efd2b796dca9b7235aaf
Instruction Fuzzy Hash: DFE11BB4A05219CFCB64DF34C8986ADB7B6BF89306F1081E9D619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E14A7, Relevance: 1.8, APIs: 1, Instructions: 317COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 996552ca00fd0ee461dbaa276548c77b772973ea246b250d3a88b1dc7edee988
Instruction ID: bfd2d060d692fc2094a42a9c3c2dc66f75fa49bd3dad4a9d4e9379bc08ecd1c5
Opcode Fuzzy Hash: 996552ca00fd0ee461dbaa276548c77b772973ea246b250d3a88b1dc7edee988
Instruction Fuzzy Hash: 3CE11DB4A05219CFCB64DF34C8986ADB7F2BF89206F1081E9D619A3340DB349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E14F1, Relevance: 1.8, APIs: 1, Instructions: 308COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 43065a7add459fada1d4145b1ddfa545ae2f3d24edfa2b151041b6e683aae202
Instruction ID: b802faa21d10e69ef8e78968641501bddf5b1068015ca32098a11ee1c6ba047e
Opcode Fuzzy Hash: 43065a7add459fada1d4145b1ddfa545ae2f3d24edfa2b151041b6e683aae202
Instruction Fuzzy Hash: 7EE11CB4A05219CFCB64DF34C8986ADB7F6BF89206F1081E9D619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E152F, Relevance: 1.8, APIs: 1, Instructions: 303COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: bccb01c209d2b54530a5378c75dcac6e8755ebaf33df02220764cc77aabb2927
Instruction ID: 35bf2be3524873445ff6097ffbe8c6688cb4f91a2fc5a67a36ccf9315f42e4de
Opcode Fuzzy Hash: bccb01c209d2b54530a5378c75dcac6e8755ebaf33df02220764cc77aabb2927
Instruction Fuzzy Hash: B7E11DB4A05219CFCB64DF34C8886ADB7F2BF89206F1081E9D619A3340CB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1579, Relevance: 1.8, APIs: 1, Instructions: 296COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4d2ca82c199b70b5122b399c6eb67ae0ca92055bdab097a491325a93d70f743b
Instruction ID: 9665dca5d64eb11e1014b5405c9acf33d68b1264cf1a3d608a384afc32f1da1b
Opcode Fuzzy Hash: 4d2ca82c199b70b5122b399c6eb67ae0ca92055bdab097a491325a93d70f743b
Instruction Fuzzy Hash: DBD10CB4A05219CFCB64DF34C8986ADB7B2BF89306F1081E9D619A3340DB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E15C3, Relevance: 1.8, APIs: 1, Instructions: 289COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6f1e5286c7c532627eb9593eb6b4604c610a9e0163435823d57fc9cb428ded52
Instruction ID: 41fd35f4468f1a2fd746c6622de4c002cc2bfba215f2d2ad291ba43c42d03d6a
Opcode Fuzzy Hash: 6f1e5286c7c532627eb9593eb6b4604c610a9e0163435823d57fc9cb428ded52
Instruction Fuzzy Hash: 22D11DB4A05219CFCB64DF34C8986ADB7F2BF89206F1081E9D619A3340DB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E160D, Relevance: 1.8, APIs: 1, Instructions: 282COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d6679c275452f8460c169d23496d931ed5287187309f1a0cfa39cffa1deef43a
Instruction ID: cef6fe8811679c01c33831df0f6bf9473467744b664f582349213de177ee13a0
Opcode Fuzzy Hash: d6679c275452f8460c169d23496d931ed5287187309f1a0cfa39cffa1deef43a
Instruction Fuzzy Hash: 1CD10CB4A05219CFCB64DF34C8986ADB7F2BF89205F1081E9D619A3340DB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1657, Relevance: 1.8, APIs: 1, Instructions: 275COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 76ecff032349e14c4aba252cb47aae7014859508ab9b2b427da2f0dac6160dfe
Instruction ID: 3a6582e9d92320d7fa7c235b3d861c67d2bedfcfbd8376f230832e14f44d034b
Opcode Fuzzy Hash: 76ecff032349e14c4aba252cb47aae7014859508ab9b2b427da2f0dac6160dfe
Instruction Fuzzy Hash: 6EC1FBB4A05219CBCB64DB34C8987ADB7F2BF89205F1081E9D619A3340DB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E16A1, Relevance: 1.8, APIs: 1, Instructions: 266COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6368e9e15d249840922f9e31e0a8a4ec3bfe9678c61696ea89398efd29c6fcf0
Instruction ID: c76a552a53e9397b9078d03644f1340fad6ae07e640aecb6f58324ba30c1ecff
Opcode Fuzzy Hash: 6368e9e15d249840922f9e31e0a8a4ec3bfe9678c61696ea89398efd29c6fcf0
Instruction Fuzzy Hash: 3DC10BB4A05219CFCB64DB34C8987ADB7F2BF89206F1081E9D619A3340DB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E16DF, Relevance: 1.8, APIs: 1, Instructions: 259COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 523fe9e8b2810f33c3d4d436d857687a1dd0a05c952fd6a81d8183ed96e393f0
Instruction ID: 7c01742fe181b47b36aa6e0388c27f7b9b8522e3a3bc22f823468a28a3760648
Opcode Fuzzy Hash: 523fe9e8b2810f33c3d4d436d857687a1dd0a05c952fd6a81d8183ed96e393f0
Instruction Fuzzy Hash: 9BC10BB4A05219CFCB64DB34C8987ADB7F2BF89206F1081E9D619A3340DB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E171D, Relevance: 1.8, APIs: 1, Instructions: 252COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ba1e5d5dc9d70cea1cb3603276288818927c8620426de86b76d6e181bcfd7839
Instruction ID: ce0230325d8504ba52aa0325e8067cbef82c3eeac9e3d779c88b8cc767140442
Opcode Fuzzy Hash: ba1e5d5dc9d70cea1cb3603276288818927c8620426de86b76d6e181bcfd7839
Instruction Fuzzy Hash: 25B11BB4A05219CFCB64DB34C8987ADB7F2BF89206F1081E9D619A3340DB359E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E175B, Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 224564126540c0514ee1ea9b17afd1e4fb9349aa2f4f84b7f43053ce0c20fbb5
Instruction ID: dfa2f5b53ff4e35a99ba58fb1ce7c8b81085aa591da0a3a415667fd1fea99180
Opcode Fuzzy Hash: 224564126540c0514ee1ea9b17afd1e4fb9349aa2f4f84b7f43053ce0c20fbb5
Instruction Fuzzy Hash: 01B11BB4A05219CFCB64DB34C8987ADB7F2BF89205F1081E9D619A3340DB349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E17A5, Relevance: 1.7, APIs: 1, Instructions: 240COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 71394bc892f6e33d21bc85a1626eeadb2610d5c630536c58972c3d2a68517806
Instruction ID: 8db36db7e593ce3f669c51a17648f87ba6aea915a1824655601fcdb31c1f9ed1
Opcode Fuzzy Hash: 71394bc892f6e33d21bc85a1626eeadb2610d5c630536c58972c3d2a68517806
Instruction Fuzzy Hash: A1B11BB4A05229CBCB64DB34C8987ADB7F2BF89205F5081E9D619A3340DB349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E17EF, Relevance: 1.7, APIs: 1, Instructions: 233COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 81bd03c6b6f89eb3792a3643125672218d32c0ef1a3e9b1c3d89c2be4479832a
Instruction ID: 60857b011d561ee7332a28d52ba3f633e01eeb59341e72eb7e07669f08ae1708
Opcode Fuzzy Hash: 81bd03c6b6f89eb3792a3643125672218d32c0ef1a3e9b1c3d89c2be4479832a
Instruction Fuzzy Hash: 68A13BB4A05229CBCB64DB34C8987ADB7F2BF89205F1081EDD619A3340DB349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1839, Relevance: 1.7, APIs: 1, Instructions: 226COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7084927bb0107ad8d961c3f21b8d14a50d77c8c2ef7db2b2a2e59e11dd83dbe4
Instruction ID: 7aeeea1ce35ea2c24894b86331b4c6a78cd53469f35a2fc95d54f82788b00942
Opcode Fuzzy Hash: 7084927bb0107ad8d961c3f21b8d14a50d77c8c2ef7db2b2a2e59e11dd83dbe4
Instruction Fuzzy Hash: ADA12BB4A05229CBCB64DB34C8987ADB7F2BF89205F5081EDD619A3340DB349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1883, Relevance: 1.7, APIs: 1, Instructions: 219COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3e195644399b6284af68891f5c110ac4b3ddbd2305ebc3de72a78b23b4c814c8
Instruction ID: 0939f0451069ee7c564de739abcd6325eaf891eff15b3d4d57d7b5ee98a55eca
Opcode Fuzzy Hash: 3e195644399b6284af68891f5c110ac4b3ddbd2305ebc3de72a78b23b4c814c8
Instruction Fuzzy Hash: 60913CB4A05229CBCB64DB34C8987ADB7F6BF89205F1081E9D619A3340DB349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E18CD, Relevance: 1.7, APIs: 1, Instructions: 212COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 73cd838e15f4fdcafe3675b89d85ab091e4bbdb65a17c8d29d09aa89fc0c9ce4
Instruction ID: 17692cac0d7811f13765663e1e77ec0fd7f93a1ba7fc5508ea07818fdd24bc9c
Opcode Fuzzy Hash: 73cd838e15f4fdcafe3675b89d85ab091e4bbdb65a17c8d29d09aa89fc0c9ce4
Instruction Fuzzy Hash: FC914DB4A05229CBCB64DB34C8987ADB7F6BF89205F1081EDD609A3340DB349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1917, Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 984d8493dc38055ce8530b75dc4eeceb86fa5e87103276ab7a3c2d01b6a23fa5
Instruction ID: 4d9e870389909eb4b9723d02bb729e1ca73c644d173e8ced97f9b59f3f849663
Opcode Fuzzy Hash: 984d8493dc38055ce8530b75dc4eeceb86fa5e87103276ab7a3c2d01b6a23fa5
Instruction Fuzzy Hash: 0E914CB4A01229CBCB64DB34C8987ADB7F6BF89205F1081EDD609A3340DB349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1961, Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0c6482d0024154b6a0e2733e72ce2bfc8465510f153b3e5968b347350b4566ae
Instruction ID: 2b382e484c4bee38146913d98d4f0768f2db5493b232b2dce43d5154174725de
Opcode Fuzzy Hash: 0c6482d0024154b6a0e2733e72ce2bfc8465510f153b3e5968b347350b4566ae
Instruction Fuzzy Hash: 24814DB4A01229CBCB64DB34C8987ADB7F6BF89205F1081EDD619A3340DB349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E19AB, Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3690573d3e2da9fc6bed0cab61648fdb28b976bac0e92f84fe05e32f9fdb8e76
Instruction ID: fe80d9340f0644b1febdc2f266ef5e43343c615f01a5c4bcb425298ab8323455
Opcode Fuzzy Hash: 3690573d3e2da9fc6bed0cab61648fdb28b976bac0e92f84fe05e32f9fdb8e76
Instruction Fuzzy Hash: CC815DB0A01219CBCB64EB34C8987AD77F6BF89205F1081E9D619A3340DB349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E19E9, Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7e550394b7b70c90edd5124598b6ad805a694178131e4999faaf1a3bfa95685d
Instruction ID: e0e8383f7628d4fd6b127b5712759ee921a40038aeec417f01774371f51aff94
Opcode Fuzzy Hash: 7e550394b7b70c90edd5124598b6ad805a694178131e4999faaf1a3bfa95685d
Instruction Fuzzy Hash: D8716E74A012298BCB64DB34C898BAD77F6BF89205F1081E9D619E3340DB349E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1A33, Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d3f17586dd21d8ffd88ef20c0b78f32b86ebde85d9e8383dff1454433e02875d
Instruction ID: 3386629de122e18bc7c9ed6373b9bccbf56551b191e89f1bbf47b8379ba0714a
Opcode Fuzzy Hash: d3f17586dd21d8ffd88ef20c0b78f32b86ebde85d9e8383dff1454433e02875d
Instruction Fuzzy Hash: 7F715EB4A012298BCB64DB34C898BAD77F6AF89205F1081E9D619E3740DF349D86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 016E1A7D, Relevance: 1.7, APIs: 1, Instructions: 170COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 016E1AA6

Memory Dump Source

Source File: 00000002.00000002.501336980.00000000016E0000.00000040.00000001.sdmp, Offset: 016E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cc03f523cf5f29365a9490e91cb0f09e1d25d994ffdf773eee81c2f981082b5d
Instruction ID: 35a042793d516d62b54e46a926c0d4a5e207d720587935dc9bde332d1c00c9ae
Opcode Fuzzy Hash: cc03f523cf5f29365a9490e91cb0f09e1d25d994ffdf773eee81c2f981082b5d
Instruction Fuzzy Hash: 8D615E74A012298BCBA4EB34C898BAD77F6AF89205F1081EDD619E3744DF348D86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01450B78, Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.499662147.0000000001450000.00000040.00000001.sdmp, Offset: 01450000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0d9aa059f1e4a661f5f95baabe11bc10744b337e77d995b8c46a7309668636
Instruction ID: 3d6d3703868d6f4697fdd0979298ecf5bf5446140e6a066b67dbab290d8cbc59
Opcode Fuzzy Hash: aa0d9aa059f1e4a661f5f95baabe11bc10744b337e77d995b8c46a7309668636
Instruction Fuzzy Hash: AD411172E043498FCB14CFB9C8046AEFBF1AF89224F05C56BD908AB751DB749845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 016BEA30, Relevance: 1.6, APIs: 1, Instructions: 114registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?), ref: 016BEB44

Memory Dump Source

Source File: 00000002.00000002.501040148.00000000016B0000.00000040.00000001.sdmp, Offset: 016B0000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 85de9cc6fab87dcb869418886c6565a0b18d30baf69883ef1c114756f59b0845
Instruction ID: 5f3ab96bf940ae58e431ae490213cd3b56984b9fc36a27cff860aa1abf8f4c1a
Opcode Fuzzy Hash: 85de9cc6fab87dcb869418886c6565a0b18d30baf69883ef1c114756f59b0845
Instruction Fuzzy Hash: 4A414670A043498FDB14CFA9C584ADEFBF5BF49304F19816AE809AB345C7759885CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03285190, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 032852A2

Memory Dump Source

Source File: 00000002.00000002.502654178.0000000003280000.00000040.00000001.sdmp, Offset: 03280000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 68be8aa1cc4ce66a049b4afd07cb8cb1ae4f5cac05b362add7893ea9433b61c9
Instruction ID: 2cfdb2a56718348d199f450c106cd98524eaace8cc51ca9e82ea8ad311812d4e
Opcode Fuzzy Hash: 68be8aa1cc4ce66a049b4afd07cb8cb1ae4f5cac05b362add7893ea9433b61c9
Instruction Fuzzy Hash: 5141D0B1D10309DFDB14CF99C884ADEFBB5BF88314F24812AE819AB254D770A885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 03286964, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 03287CF9

Memory Dump Source

Source File: 00000002.00000002.502654178.0000000003280000.00000040.00000001.sdmp, Offset: 03280000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c89b10847c567d58479914ce8370863e692db20c8df7f621da89012b6fd8bd9b
Instruction ID: 3d776f97290a8120e3b73ba7caa73ac69260d12e4df280e8a7f40786663f723f
Opcode Fuzzy Hash: c89b10847c567d58479914ce8370863e692db20c8df7f621da89012b6fd8bd9b
Instruction Fuzzy Hash: F34149B5A102098FCB14DF59C488AAAFBF5FF88314F29C458D419AB361D774A881CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 016BECF8, Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 016BEDB1

Memory Dump Source

Source File: 00000002.00000002.501040148.00000000016B0000.00000040.00000001.sdmp, Offset: 016B0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f38431662a004e3864694e0d85946d1a7ef0c008bcad4193e3c27d09cca52b29
Instruction ID: 5ea77800f7c7b8d9767a9d3a9de3d32cae2441fe7638c640d62f92c5c18def24
Opcode Fuzzy Hash: f38431662a004e3864694e0d85946d1a7ef0c008bcad4193e3c27d09cca52b29
Instruction Fuzzy Hash: 8331CCB1D002589FCB20CF9AC984ACEBFF5BB48314F14802AE819AB310D7759945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 016BECF7, Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 016BEDB1

Memory Dump Source

Source File: 00000002.00000002.501040148.00000000016B0000.00000040.00000001.sdmp, Offset: 016B0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 82f21a2c5be275e27cb1d85b7525d698d50850232fe18169633533c8647ddad4
Instruction ID: a92537f873bb5dcaa07aac251273ea512cce14a58e735489fecb33dbfbc5c266
Opcode Fuzzy Hash: 82f21a2c5be275e27cb1d85b7525d698d50850232fe18169633533c8647ddad4
Instruction Fuzzy Hash: E231CCB1D002589FCB24CFAAC984ADEBFF5BF48314F14802AE819AB310C7759945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01457588, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004B), ref: 0145766D

Memory Dump Source

Source File: 00000002.00000002.499662147.0000000001450000.00000040.00000001.sdmp, Offset: 01450000, based on PE: false

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: bc64189e998bd953abe267727f50fb39c5002f49e3ca032d9d3e16ef7142bb68
Instruction ID: dd1134fb1472bc69f598460146384c33977c09b0627c83d6dc6a599466c207d3
Opcode Fuzzy Hash: bc64189e998bd953abe267727f50fb39c5002f49e3ca032d9d3e16ef7142bb68
Instruction Fuzzy Hash: 2731D2709053C98FDB11EF69E4083EABFF4EB12354F04809ED944A7257D3384589CB62

Uniqueness

Uniqueness Score: -1.00%

Function 016BEA90, Relevance: 1.6, APIs: 1, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?), ref: 016BEB44

Memory Dump Source

Source File: 00000002.00000002.501040148.00000000016B0000.00000040.00000001.sdmp, Offset: 016B0000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 1fc9c3c029d2237b66a6975c82ada8afaa4e50285935379dd1d62a71e8b77770
Instruction ID: 0f52476e362f96e3e44746a5e9fa91e49b8d45220bca3050d3851c18710a3b6f
Opcode Fuzzy Hash: 1fc9c3c029d2237b66a6975c82ada8afaa4e50285935379dd1d62a71e8b77770
Instruction Fuzzy Hash: 0531DEB19002498FDB14CF99C684ACEFBF5BF48314F29816AE909AB341C7759985CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01451990, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 01451A13

Memory Dump Source

Source File: 00000002.00000002.499662147.0000000001450000.00000040.00000001.sdmp, Offset: 01450000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: c63f81ae0a0f9e378ff87e70f0b13bac9b505eabcb7e1d315d5f5d44ca40fbf4
Instruction ID: 7b05abce4864446e70d323b612f6ed27e9d9821c7815ce08d6d26cad8bcb98ee
Opcode Fuzzy Hash: c63f81ae0a0f9e378ff87e70f0b13bac9b505eabcb7e1d315d5f5d44ca40fbf4
Instruction Fuzzy Hash: 712102B59002098FCB54CFA9D844BEFFBF5AB88324F14842AE859A7750C774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03286D78, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 03286DFF

Memory Dump Source

Source File: 00000002.00000002.502654178.0000000003280000.00000040.00000001.sdmp, Offset: 03280000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 328d7e14559d1b274039dbd105c45e0d386ffcfaa2339aa1a484c4c74ff00f75
Instruction ID: 5cac65e26d886d4e358f66b6a5de0be152e0d81ae6652498962e259f19bb9eb6
Opcode Fuzzy Hash: 328d7e14559d1b274039dbd105c45e0d386ffcfaa2339aa1a484c4c74ff00f75
Instruction Fuzzy Hash: 9321F3B59002089FDB10CFAAD984ADEFBF8FF48324F14841AE918A7350D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01451998, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 01451A13

Memory Dump Source

Source File: 00000002.00000002.499662147.0000000001450000.00000040.00000001.sdmp, Offset: 01450000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: bd56f12f38415b30a571f93ff4ac59c41031e730aa32257bb216339f776c3063
Instruction ID: a177af07ac0df7d72ab80a3dcd0a8076e33c119fcc27e946d90436a364d3d77f
Opcode Fuzzy Hash: bd56f12f38415b30a571f93ff4ac59c41031e730aa32257bb216339f776c3063
Instruction Fuzzy Hash: 932113B59002088FCB54CF9AD844BEFFBF5AB88324F14842AE419A7750CB74A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014592A0, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000,?,0145A4C9,00000800), ref: 0145A55A

Memory Dump Source

Source File: 00000002.00000002.499662147.0000000001450000.00000040.00000001.sdmp, Offset: 01450000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 32caf627be639f2887ca4a004f1f0dd9f2a1742388837202908f439063782b51
Instruction ID: 58d7495eab9e5b491e4f081ed7b0604a174f9ea7c9801f314ac766e0cfab359f
Opcode Fuzzy Hash: 32caf627be639f2887ca4a004f1f0dd9f2a1742388837202908f439063782b51
Instruction Fuzzy Hash: 331114B69002099FDB14CF9AC444BDEFBF4EB88324F14852AE929A7710C374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0328BE08, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0328BE82

Memory Dump Source

Source File: 00000002.00000002.502654178.0000000003280000.00000040.00000001.sdmp, Offset: 03280000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 7ac3e27542678a63e292512eed6aace47103f1c31ad29e27a3323fe37e2d6c03
Instruction ID: fd7b4d2da647f73a9fbb475f2df95c24fad15a45ce4e31a234de62ed0e475f8c
Opcode Fuzzy Hash: 7ac3e27542678a63e292512eed6aace47103f1c31ad29e27a3323fe37e2d6c03
Instruction Fuzzy Hash: 97116AB19113098FDB10EFA9C54879EBBF4FB49314F24842ED409BBA40C7396984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0145A4EB, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,00000000,?,0145A4C9,00000800), ref: 0145A55A

Memory Dump Source

Source File: 00000002.00000002.499662147.0000000001450000.00000040.00000001.sdmp, Offset: 01450000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6a1e15ebf97841cd1d933bc93e1d1a62ec429cc9a754e464ad5b13ce6d3c7d88
Instruction ID: 695346d380dbe2d53b6a9a7cfb8e0dabcc33f42f12e72e1fbad55c53a6d99d49
Opcode Fuzzy Hash: 6a1e15ebf97841cd1d933bc93e1d1a62ec429cc9a754e464ad5b13ce6d3c7d88
Instruction Fuzzy Hash: 6E1114B69002089FDB14CFAAD444BDEFBF4AB88324F14852ED919A7701C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 03282F44, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 03284216

Memory Dump Source

Source File: 00000002.00000002.502654178.0000000003280000.00000040.00000001.sdmp, Offset: 03280000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3745e00fa037d13525fdbd288bf23c9317ff920ac803205bae120e0e8b621f97
Instruction ID: 011267a6dfeae4cd47297225b258fae81ba89bd9a7486a5dee9119a31155552e
Opcode Fuzzy Hash: 3745e00fa037d13525fdbd288bf23c9317ff920ac803205bae120e0e8b621f97
Instruction Fuzzy Hash: 311143B1C0024A8FCB10EF9AD444BDEFBF4EB89324F04842AD829B7600C374A585CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017DD450, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.502002413.00000000017DD000.00000040.00000001.sdmp, Offset: 017DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c40be6b5032f95aacb175a47f02d797a6d1cd8cb1b5253dffcd89aea75d5c7
Instruction ID: 4c866d17fe112c0acfb63cfd8415b648c5bcf2ecfb7967328760fc7248e463ee
Opcode Fuzzy Hash: 62c40be6b5032f95aacb175a47f02d797a6d1cd8cb1b5253dffcd89aea75d5c7
Instruction Fuzzy Hash: 1E2124B1504248EFDB25DF54D9C0B66FF71FB88324F2485A9E9064B286C336E846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017ED01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.502048766.00000000017ED000.00000040.00000001.sdmp, Offset: 017ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0cfab8249c0953d7873013558201ffc76823be584c090368038a4ee29fc294d
Instruction ID: a132e62c7164f262d26fcf95eddd1f52e203e819f7eb016e20fab5731744b7f9
Opcode Fuzzy Hash: c0cfab8249c0953d7873013558201ffc76823be584c090368038a4ee29fc294d
Instruction Fuzzy Hash: 6B2103B1504240DFCB25CF58D9C8B16FFE1FB88264F28C9A9D9494B246C336D847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 017DD44B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.502002413.00000000017DD000.00000040.00000001.sdmp, Offset: 017DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01431c851efd8120f701f3fb52e7b0f01cff9aa6de1395822b7caa9b86509e3
Instruction ID: 9d8aff5f417b3ed8206f4e87523bdb6794b1489d1656a63293d8423ddec86935
Opcode Fuzzy Hash: c01431c851efd8120f701f3fb52e7b0f01cff9aa6de1395822b7caa9b86509e3
Instruction Fuzzy Hash: EA11BE76404284CFDB12CF54D9C4B66FF71FB84324F2886A9D8054B657C33AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 017ED017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.502048766.00000000017ED000.00000040.00000001.sdmp, Offset: 017ED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b27446398622fa15f31026d314988bca877f4e7b1beb61865058e1672d4433
Instruction ID: aaddfd7e21c82811ef715b641aa31a1aeb1da48e52c8929b7308ae0376f286eb
Opcode Fuzzy Hash: 01b27446398622fa15f31026d314988bca877f4e7b1beb61865058e1672d4433
Instruction Fuzzy Hash: 2211BE75504280CFCB12CF14D5D4B15FFB1FB48324F28C6AAD8094B656C33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report KkPVouLuOx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Networking:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre