Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
R3ov8eFFFP.exe

Overview

General Information

Sample name:R3ov8eFFFP.exe
renamed because original name is a hash value
Original sample name:0A7D2BBBE2960FF24B9273036FC472DA.exe
Analysis ID:1383432
MD5:0a7d2bbbe2960ff24b9273036fc472da
SHA1:3b0fbb910651427a6a103327a0630e96acb8649c
SHA256:d812b05b85a25ab0ec4258f8a4e9adda4a84d2df5b07fed42b84de539dfcabc8
Tags:exenjratRAT
Infos:

Detection

Njrat
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops fake system file at system root drive
Snort IDS alert for network traffic
Yara detected Njrat
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Creates autorun.inf (USB autostart)
Creates autostart registry keys with suspicious names
Drops PE files to the startup folder
Drops PE files with benign system names
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the windows firewall
Protects its processes via BreakOnTermination flag
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Suspicious Process Patterns NTDS.DIT Exfil
Uses netsh to modify the Windows network and firewall settings
Uses taskkill to terminate AV processes
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May infect USB drives
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Uses taskkill to terminate processes
Yara signature match

Classification

Process Tree

  • System is w10x64
  • R3ov8eFFFP.exe (PID: 6664 cmdline: C:\Users\user\Desktop\R3ov8eFFFP.exe MD5: 0A7D2BBBE2960FF24B9273036FC472DA)
    • ESET Service.exe (PID: 3452 cmdline: "C:\Users\user\AppData\Roaming\ESET Service.exe" MD5: 0A7D2BBBE2960FF24B9273036FC472DA)
      • netsh.exe (PID: 772 cmdline: netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\ESET Service.exe" "ESET Service.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
        • conhost.exe (PID: 5300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 5284 cmdline: taskkill /F /IM taskmgr.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
        • conhost.exe (PID: 6404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • ESET Service.exe (PID: 1772 cmdline: "C:\Users\user\AppData\Roaming\ESET Service.exe" .. MD5: 0A7D2BBBE2960FF24B9273036FC472DA)
  • ESET Service.exe (PID: 5252 cmdline: "C:\Users\user\AppData\Roaming\ESET Service.exe" .. MD5: 0A7D2BBBE2960FF24B9273036FC472DA)
  • ESET Service.exe (PID: 4544 cmdline: "C:\Users\user\AppData\Roaming\ESET Service.exe" .. MD5: 0A7D2BBBE2960FF24B9273036FC472DA)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
NjRATRedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.
  • AQUATIC PANDA
  • Earth Lusca
  • Operation C-Major
  • The Gorgon Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Host": "2.tcp.eu.ngrok.io", "Port": "18227", "Version": "im523", "Campaign ID": "HacKed", "Install Name": "ESET Service.exe", "Install Dir": "AppData"}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
R3ov8eFFFP.exeJoeSecurity_NjratYara detected NjratJoe Security
    R3ov8eFFFP.exeWindows_Trojan_Njrat_30f3c220unknownunknown
    • 0x64c1:$a1: get_Registry
    • 0x7efe:$a3: Download ERROR
    • 0x81f0:$a5: netsh firewall delete allowedprogram "
    R3ov8eFFFP.exenjrat1Identify njRatBrian Wallace @botnet_hunter
    • 0x80e6:$a1: netsh firewall add allowedprogram
    • 0x82e0:$b1: [TAP]
    • 0x8286:$b2: & exit
    • 0x8252:$c1: md.exe /k ping 0 & del
    R3ov8eFFFP.exeMALWARE_Win_NjRATDetects NjRAT / BladabindiditekSHen
    • 0x81f0:$s1: netsh firewall delete allowedprogram
    • 0x80e6:$s2: netsh firewall add allowedprogram
    • 0x8250:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67
    • 0x7eda:$s4: Execute ERROR
    • 0x7f3a:$s4: Execute ERROR
    • 0x7efe:$s5: Download ERROR
    • 0x8296:$s6: [kl]

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Users\user\AppData\Roaming\ESET Service.exeJoeSecurity_NjratYara detected NjratJoe Security
      C:\Users\user\AppData\Roaming\ESET Service.exeWindows_Trojan_Njrat_30f3c220unknownunknown
      • 0x64c1:$a1: get_Registry
      • 0x7efe:$a3: Download ERROR
      • 0x81f0:$a5: netsh firewall delete allowedprogram "
      C:\Users\user\AppData\Roaming\ESET Service.exenjrat1Identify njRatBrian Wallace @botnet_hunter
      • 0x80e6:$a1: netsh firewall add allowedprogram
      • 0x82e0:$b1: [TAP]
      • 0x8286:$b2: & exit
      • 0x8252:$c1: md.exe /k ping 0 & del
      C:\Users\user\AppData\Roaming\ESET Service.exeMALWARE_Win_NjRATDetects NjRAT / BladabindiditekSHen
      • 0x81f0:$s1: netsh firewall delete allowedprogram
      • 0x80e6:$s2: netsh firewall add allowedprogram
      • 0x8250:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67
      • 0x7eda:$s4: Execute ERROR
      • 0x7f3a:$s4: Execute ERROR
      • 0x7efe:$s5: Download ERROR
      • 0x8296:$s6: [kl]
      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exeJoeSecurity_NjratYara detected NjratJoe Security
        Click to see the 7 entries

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_NjratYara detected NjratJoe Security
          00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmpWindows_Trojan_Njrat_30f3c220unknownunknown
          • 0x62c1:$a1: get_Registry
          • 0x7cfe:$a3: Download ERROR
          • 0x7ff0:$a5: netsh firewall delete allowedprogram "
          00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmpnjrat1Identify njRatBrian Wallace @botnet_hunter
          • 0x7ee6:$a1: netsh firewall add allowedprogram
          • 0x80e0:$b1: [TAP]
          • 0x8086:$b2: & exit
          • 0x8052:$c1: md.exe /k ping 0 & del
          Process Memory Space: R3ov8eFFFP.exe PID: 6664JoeSecurity_NjratYara detected NjratJoe Security
            Process Memory Space: ESET Service.exe PID: 3452JoeSecurity_NjratYara detected NjratJoe Security

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              0.0.R3ov8eFFFP.exe.460000.0.unpackJoeSecurity_NjratYara detected NjratJoe Security
                0.0.R3ov8eFFFP.exe.460000.0.unpackWindows_Trojan_Njrat_30f3c220unknownunknown
                • 0x64c1:$a1: get_Registry
                • 0x7efe:$a3: Download ERROR
                • 0x81f0:$a5: netsh firewall delete allowedprogram "
                0.0.R3ov8eFFFP.exe.460000.0.unpacknjrat1Identify njRatBrian Wallace @botnet_hunter
                • 0x80e6:$a1: netsh firewall add allowedprogram
                • 0x82e0:$b1: [TAP]
                • 0x8286:$b2: & exit
                • 0x8252:$c1: md.exe /k ping 0 & del
                0.0.R3ov8eFFFP.exe.460000.0.unpackMALWARE_Win_NjRATDetects NjRAT / BladabindiditekSHen
                • 0x81f0:$s1: netsh firewall delete allowedprogram
                • 0x80e6:$s2: netsh firewall add allowedprogram
                • 0x8250:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67
                • 0x7eda:$s4: Execute ERROR
                • 0x7f3a:$s4: Execute ERROR
                • 0x7efe:$s5: Download ERROR
                • 0x8296:$s6: [kl]

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Files With System Process Name In Unsuspected Locations
                Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\ESET Service.exe, ProcessId: 3452, TargetFilename: D:\svchost.exe
                Sigma detected: Suspicious Process Patterns NTDS.DIT Exfil
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Roaming\ESET Service.exe" , CommandLine: "C:\Users\user\AppData\Roaming\ESET Service.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\ESET Service.exe, NewProcessName: C:\Users\user\AppData\Roaming\ESET Service.exe, OriginalFileName: C:\Users\user\AppData\Roaming\ESET Service.exe, ParentCommandLine: C:\Users\user\Desktop\R3ov8eFFFP.exe, ParentImage: C:\Users\user\Desktop\R3ov8eFFFP.exe, ParentProcessId: 6664, ParentProcessName: R3ov8eFFFP.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\ESET Service.exe" , ProcessId: 3452, ProcessName: ESET Service.exe
                Sigma detected: CurrentVersion Autorun Keys Modification
                Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\ESET Service.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\ESET Service.exe, ProcessId: 3452, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fa8cebf4f3fd11252bf351a94ee5fa4a
                Sigma detected: Startup Folder File Write
                Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\ESET Service.exe, ProcessId: 3452, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe
                Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
                Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\ESET Service.exe" .., EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\ESET Service.exe, ProcessId: 3452, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fa8cebf4f3fd11252bf351a94ee5fa4a

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Sigma detected: Drops fake system file at system root drive
                Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\ESET Service.exe, ProcessId: 3452, TargetFilename: C:\svchost.exe

                Snort Signatures

                Timestamp:192.168.2.43.127.138.5749743182272825564 01/30/24-17:09:29.306132
                SID:2825564
                Source Port:49743
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749743182272825563 01/30/24-17:09:19.453005
                SID:2825563
                Source Port:49743
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749740182272814860 01/30/24-17:08:55.123453
                SID:2814860
                Source Port:49740
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749742182272033132 01/30/24-17:09:13.438158
                SID:2033132
                Source Port:49742
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749741182272033132 01/30/24-17:08:57.484517
                SID:2033132
                Source Port:49741
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749743182272033132 01/30/24-17:09:19.251884
                SID:2033132
                Source Port:49743
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749729182272033132 01/30/24-17:07:18.434785
                SID:2033132
                Source Port:49729
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749741182272814860 01/30/24-17:09:03.945846
                SID:2814860
                Source Port:49741
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649749182272814856 01/30/24-17:10:28.018781
                SID:2814856
                Source Port:49749
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649748182272814856 01/30/24-17:10:15.110171
                SID:2814856
                Source Port:49748
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649747182272814856 01/30/24-17:10:06.444735
                SID:2814856
                Source Port:49747
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749738182272814856 01/30/24-17:08:14.961731
                SID:2814856
                Source Port:49738
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749739182272814856 01/30/24-17:08:27.854209
                SID:2814856
                Source Port:49739
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749743182272814860 01/30/24-17:09:29.306132
                SID:2814860
                Source Port:49743
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749729182272825564 01/30/24-17:07:23.073796
                SID:2825564
                Source Port:49729
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749729182272825563 01/30/24-17:07:18.635283
                SID:2825563
                Source Port:49729
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549752182272033132 01/30/24-17:11:04.732771
                SID:2033132
                Source Port:49752
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749740182272814856 01/30/24-17:08:45.087741
                SID:2814856
                Source Port:49740
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549751182272033132 01/30/24-17:10:49.338671
                SID:2033132
                Source Port:49751
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549750182272033132 01/30/24-17:10:40.149950
                SID:2033132
                Source Port:49750
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749741182272814856 01/30/24-17:08:57.690610
                SID:2814856
                Source Port:49741
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749742182272814856 01/30/24-17:09:13.644212
                SID:2814856
                Source Port:49742
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649745182272814856 01/30/24-17:09:36.950026
                SID:2814856
                Source Port:49745
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649744182272814856 01/30/24-17:09:32.006134
                SID:2814856
                Source Port:49744
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649746182272814856 01/30/24-17:09:54.099801
                SID:2814856
                Source Port:49746
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749736182272814856 01/30/24-17:07:52.958354
                SID:2814856
                Source Port:49736
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749740182272033132 01/30/24-17:08:44.884475
                SID:2033132
                Source Port:49740
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549752182272814856 01/30/24-17:11:04.938711
                SID:2814856
                Source Port:49752
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749743182272814856 01/30/24-17:09:19.453005
                SID:2814856
                Source Port:49743
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549751182272814856 01/30/24-17:10:49.541184
                SID:2814856
                Source Port:49751
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549750182272814856 01/30/24-17:10:40.356210
                SID:2814856
                Source Port:49750
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649746182272825563 01/30/24-17:09:54.099801
                SID:2825563
                Source Port:49746
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649747182272033132 01/30/24-17:10:06.243628
                SID:2033132
                Source Port:49747
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649748182272033132 01/30/24-17:10:14.903223
                SID:2033132
                Source Port:49748
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749736182272033132 01/30/24-17:07:52.757868
                SID:2033132
                Source Port:49736
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649746182272825564 01/30/24-17:10:02.570250
                SID:2825564
                Source Port:49746
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649748182272825564 01/30/24-17:10:16.789499
                SID:2825564
                Source Port:49748
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749736182272825563 01/30/24-17:07:52.958354
                SID:2825563
                Source Port:49736
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749736182272825564 01/30/24-17:07:55.336198
                SID:2825564
                Source Port:49736
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649745182272033132 01/30/24-17:09:36.751580
                SID:2033132
                Source Port:49745
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649746182272033132 01/30/24-17:09:53.899404
                SID:2033132
                Source Port:49746
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649749182272033132 01/30/24-17:10:27.818089
                SID:2033132
                Source Port:49749
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649745182272825563 01/30/24-17:09:36.950026
                SID:2825563
                Source Port:49745
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649749182272825563 01/30/24-17:10:28.018781
                SID:2825563
                Source Port:49749
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649745182272825564 01/30/24-17:09:37.351336
                SID:2825564
                Source Port:49745
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649749182272825564 01/30/24-17:10:33.714882
                SID:2825564
                Source Port:49749
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749738182272033132 01/30/24-17:08:14.761110
                SID:2033132
                Source Port:49738
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649744182272825563 01/30/24-17:09:32.006134
                SID:2825563
                Source Port:49744
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749739182272033132 01/30/24-17:08:27.653310
                SID:2033132
                Source Port:49739
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549750182272814860 01/30/24-17:10:41.866704
                SID:2814860
                Source Port:49750
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549751182272814860 01/30/24-17:10:58.138650
                SID:2814860
                Source Port:49751
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649746182272814860 01/30/24-17:10:03.972545
                SID:2814860
                Source Port:49746
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749736182272814860 01/30/24-17:07:55.336198
                SID:2814860
                Source Port:49736
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649745182272814860 01/30/24-17:09:37.351336
                SID:2814860
                Source Port:49745
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749738182272825564 01/30/24-17:08:24.775359
                SID:2825564
                Source Port:49738
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749739182272825564 01/30/24-17:08:42.669529
                SID:2825564
                Source Port:49739
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649744182272033132 01/30/24-17:09:31.797713
                SID:2033132
                Source Port:49744
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749729182272814856 01/30/24-17:07:18.635283
                SID:2814856
                Source Port:49729
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649748182272825563 01/30/24-17:10:15.110171
                SID:2825563
                Source Port:49748
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549751182272825564 01/30/24-17:10:58.138650
                SID:2825564
                Source Port:49751
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549751182272825563 01/30/24-17:10:49.541184
                SID:2825563
                Source Port:49751
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749729182272814860 01/30/24-17:07:23.073796
                SID:2814860
                Source Port:49729
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549750182272825564 01/30/24-17:10:41.866704
                SID:2825564
                Source Port:49750
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549750182272825563 01/30/24-17:10:40.356210
                SID:2825563
                Source Port:49750
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649748182272814860 01/30/24-17:10:16.789499
                SID:2814860
                Source Port:49748
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749739182272814860 01/30/24-17:08:42.669529
                SID:2814860
                Source Port:49739
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749738182272814860 01/30/24-17:08:25.085626
                SID:2814860
                Source Port:49738
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649747182272814860 01/30/24-17:10:07.250125
                SID:2814860
                Source Port:49747
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.197.239.549752182272825563 01/30/24-17:11:04.938711
                SID:2825563
                Source Port:49752
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.418.192.93.8649749182272814860 01/30/24-17:10:33.714882
                SID:2814860
                Source Port:49749
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749741182272825564 01/30/24-17:09:03.945846
                SID:2825564
                Source Port:49741
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749741182272825563 01/30/24-17:08:57.690610
                SID:2825563
                Source Port:49741
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected
                Timestamp:192.168.2.43.127.138.5749742182272825563 01/30/24-17:09:13.644212
                SID:2825563
                Source Port:49742
                Destination Port:18227
                Protocol:TCP
                Classtype:A Network Trojan was detected

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus / Scanner detection for submitted sample
                Source: R3ov8eFFFP.exeAvira: detected
                Antivirus detection for URL or domain
                Source: 2.tcp.eu.ngrok.ioAvira URL Cloud: Label: malware
                Antivirus detection for dropped file
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exeAvira: detection malicious, Label: TR/ATRAPS.Gen
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeAvira: detection malicious, Label: TR/ATRAPS.Gen
                Source: C:\svchost.exeAvira: detection malicious, Label: TR/ATRAPS.Gen
                Found malware configuration
                Source: 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmpMalware Configuration Extractor: Njrat {"Host": "2.tcp.eu.ngrok.io", "Port": "18227", "Version": "im523", "Campaign ID": "HacKed", "Install Name": "ESET Service.exe", "Install Dir": "AppData"}
                Multi AV Scanner detection for dropped file
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeReversingLabs: Detection: 97%
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exeReversingLabs: Detection: 97%
                Source: C:\svchost.exeReversingLabs: Detection: 97%
                Multi AV Scanner detection for submitted file
                Source: R3ov8eFFFP.exeReversingLabs: Detection: 97%
                Yara detected Njrat
                Source: Yara matchFile source: R3ov8eFFFP.exe, type: SAMPLE
                Source: Yara matchFile source: 0.0.R3ov8eFFFP.exe.460000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: R3ov8eFFFP.exe PID: 6664, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: ESET Service.exe PID: 3452, type: MEMORYSTR
                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED
                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, type: DROPPED
                Source: Yara matchFile source: C:\svchost.exe, type: DROPPED
                Machine Learning detection for dropped file
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exeJoe Sandbox ML: detected
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeJoe Sandbox ML: detected
                Source: C:\svchost.exeJoe Sandbox ML: detected
                Machine Learning detection for sample
                Source: R3ov8eFFFP.exeJoe Sandbox ML: detected
                Source: R3ov8eFFFP.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior
                Source: R3ov8eFFFP.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                Spreading

                barindex
                Creates autorun.inf (USB autostart)
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeFile created: C:\autorun.infJump to behavior
                Source: R3ov8eFFFP.exe, 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: autorun.inf
                Source: R3ov8eFFFP.exe, 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: [autorun]
                Source: R3ov8eFFFP.exe, 00000000.00000002.1758561861.0000000002B71000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: autorun.inf
                Source: R3ov8eFFFP.exe, 00000000.00000002.1758561861.0000000002B71000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: [autorun]
                Source: ESET Service.exe, 00000001.00000002.4131549355.0000000003384000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: autorun.inf
                Source: ESET Service.exe, 00000001.00000002.4131549355.0000000003384000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: [autorun]
                Source: R3ov8eFFFP.exeBinary or memory string: autorun.inf
                Source: R3ov8eFFFP.exeBinary or memory string: [autorun]
                Source: autorun.inf.1.drBinary or memory string: [autorun]
                Source: fa8cebf4f3fd11252bf351a94ee5fa4a.exe.1.drBinary or memory string: autorun.inf
                Source: fa8cebf4f3fd11252bf351a94ee5fa4a.exe.1.drBinary or memory string: [autorun]
                Source: ESET Service.exe.0.drBinary or memory string: autorun.inf
                Source: ESET Service.exe.0.drBinary or memory string: [autorun]
                Source: svchost.exe.1.drBinary or memory string: autorun.inf
                Source: svchost.exe.1.drBinary or memory string: [autorun]

                Networking

                barindex
                Snort IDS alert for network traffic
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49729 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49729 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49729 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49729 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49729 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49736 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49736 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49736 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49736 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49736 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49738 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49738 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49738 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49738 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49739 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49739 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49739 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49739 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49740 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49740 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49740 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49741 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49741 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49741 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49741 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49741 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49742 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49742 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49742 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49743 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49743 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49743 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49743 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49743 -> 3.127.138.57:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49744 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49744 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49744 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49745 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49745 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49745 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49745 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49745 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49746 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49746 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49746 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49746 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49746 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49747 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49747 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49747 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49748 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49748 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49748 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49748 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49748 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49749 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49749 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49749 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49749 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49749 -> 18.192.93.86:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49750 -> 18.197.239.5:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49750 -> 18.197.239.5:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49750 -> 18.197.239.5:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49750 -> 18.197.239.5:18227
                Source: TrafficSnort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49750 -> 18.197.239.5:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49751 -> 18.197.239.5:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49751 -> 18.197.239.5:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49751 -> 18.197.239.5:18227
                Source: TrafficSnort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49751 -> 18.197.239.5:18227
                Source: TrafficSnort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49751 -> 18.197.239.5:18227
                Source: TrafficSnort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49752 -> 18.197.239.5:18227
                Source: TrafficSnort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49752 -> 18.197.239.5:18227
                Source: TrafficSnort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49752 -> 18.197.239.5:18227
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorURLs: 2.tcp.eu.ngrok.io
                Source: global trafficTCP traffic: 192.168.2.4:49729 -> 3.127.138.57:18227
                Source: global trafficTCP traffic: 192.168.2.4:49744 -> 18.192.93.86:18227
                Source: global trafficTCP traffic: 192.168.2.4:49750 -> 18.197.239.5:18227
                Source: Joe Sandbox ViewIP Address: 3.127.138.57 3.127.138.57
                Source: Joe Sandbox ViewIP Address: 18.192.93.86 18.192.93.86
                Source: Joe Sandbox ViewIP Address: 18.197.239.5 18.197.239.5
                Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
                Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
                Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownDNS traffic detected: queries for: 2.tcp.eu.ngrok.io
                Source: R3ov8eFFFP.exe, fa8cebf4f3fd11252bf351a94ee5fa4a.exe.1.dr, ESET Service.exe.0.dr, svchost.exe.1.drString found in binary or memory: https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0

                Key, Mouse, Clipboard, Microphone and Screen Capturing

                barindex
                Contains functionality to log keystrokes (.Net Source)
                Source: R3ov8eFFFP.exe, kl.cs.Net Code: VKCodeToUnicode
                Source: ESET Service.exe.0.dr, kl.cs.Net Code: VKCodeToUnicode
                Source: fa8cebf4f3fd11252bf351a94ee5fa4a.exe.1.dr, kl.cs.Net Code: VKCodeToUnicode
                Source: svchost.exe.1.dr, kl.cs.Net Code: VKCodeToUnicode

                E-Banking Fraud

                barindex
                Yara detected Njrat
                Source: Yara matchFile source: R3ov8eFFFP.exe, type: SAMPLE
                Source: Yara matchFile source: 0.0.R3ov8eFFFP.exe.460000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: R3ov8eFFFP.exe PID: 6664, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: ESET Service.exe PID: 3452, type: MEMORYSTR
                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED
                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, type: DROPPED
                Source: Yara matchFile source: C:\svchost.exe, type: DROPPED

                Operating System Destruction

                barindex
                Protects its processes via BreakOnTermination flag
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: 01 00 00 00 Jump to behavior

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: R3ov8eFFFP.exe, type: SAMPLEMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
                Source: R3ov8eFFFP.exe, type: SAMPLEMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
                Source: R3ov8eFFFP.exe, type: SAMPLEMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
                Source: 0.0.R3ov8eFFFP.exe.460000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
                Source: 0.0.R3ov8eFFFP.exe.460000.0.unpack, type: UNPACKEDPEMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
                Source: 0.0.R3ov8eFFFP.exe.460000.0.unpack, type: UNPACKEDPEMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
                Source: 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
                Source: 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
                Source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPEDMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
                Source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPEDMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
                Source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPEDMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, type: DROPPEDMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, type: DROPPEDMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, type: DROPPEDMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
                Source: C:\svchost.exe, type: DROPPEDMatched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
                Source: C:\svchost.exe, type: DROPPEDMatched rule: Identify njRat Author: Brian Wallace @botnet_hunter
                Source: C:\svchost.exe, type: DROPPEDMatched rule: Detects NjRAT / Bladabindi Author: ditekSHen
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeCode function: 1_2_058E010E NtSetInformationProcess,1_2_058E010E
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeCode function: 1_2_058E0346 NtQuerySystemInformation,1_2_058E0346
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeCode function: 1_2_058E00EC NtSetInformationProcess,1_2_058E00EC
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeCode function: 1_2_058E030B NtQuerySystemInformation,1_2_058E030B
                Source: R3ov8eFFFP.exe, 00000000.00000002.1757865607.00000000008FE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemscorwks.dllT vs R3ov8eFFFP.exe
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: edputil.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: appresolver.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: bcp47langs.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: slc.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: shfolder.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: wbemcomn.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: avicap32.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: msvfw32.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ifmon.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasmontr.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mfc42u.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: authfwcfg.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpolicyiomgr.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: firewallapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwbase.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcmonitor.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3cfg.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3api.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: onex.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappcfg.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappprxy.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwcfg.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: hnetmon.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netshell.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nlaapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netsetupapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netiohlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: httpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshipsec.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: activeds.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: polstore.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winipsec.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshwfp.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cabinet.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2pnetsh.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2p.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rpcnsh.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: whhelper.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlancfg.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlanapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wshelper.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wevtapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: peerdistsh.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wcmapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rmclient.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mobilenetworking.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: slc.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ktmw32.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprmsg.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeSection loaded: uxtheme.dllJump to behavior
                Source: R3ov8eFFFP.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: R3ov8eFFFP.exe, type: SAMPLEMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
                Source: R3ov8eFFFP.exe, type: SAMPLEMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
                Source: R3ov8eFFFP.exe, type: SAMPLEMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
                Source: 0.0.R3ov8eFFFP.exe.460000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
                Source: 0.0.R3ov8eFFFP.exe.460000.0.unpack, type: UNPACKEDPEMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
                Source: 0.0.R3ov8eFFFP.exe.460000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
                Source: 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
                Source: 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
                Source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPEDMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
                Source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPEDMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
                Source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPEDMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, type: DROPPEDMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, type: DROPPEDMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
                Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, type: DROPPEDMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
                Source: C:\svchost.exe, type: DROPPEDMatched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
                Source: C:\svchost.exe, type: DROPPEDMatched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
                Source: C:\svchost.exe, type: DROPPEDMatched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
                Source: classification engineClassification label: mal100.spre.troj.adwa.spyw.evad.winEXE@12/10@4/3
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeCode function: 1_2_015EBDA2 AdjustTokenPrivileges,1_2_015EBDA2
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeCode function: 1_2_015EBD6B AdjustTokenPrivileges,1_2_015EBD6B
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeFile created: C:\Users\user\AppData\Roaming\ESET Service.exeJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMutant created: NULL
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6404:120:WilError_03
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5300:120:WilError_03
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMutant created: \Sessions\1\BaseNamedObjects\fa8cebf4f3fd11252bf351a94ee5fa4a
                Source: R3ov8eFFFP.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: R3ov8eFFFP.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "taskmgr.exe")
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: R3ov8eFFFP.exeReversingLabs: Detection: 97%
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeFile read: C:\Users\user\Desktop\R3ov8eFFFP.exeJump to behavior
                Source: unknownProcess created: C:\Users\user\Desktop\R3ov8eFFFP.exe C:\Users\user\Desktop\R3ov8eFFFP.exe
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess created: C:\Users\user\AppData\Roaming\ESET Service.exe "C:\Users\user\AppData\Roaming\ESET Service.exe"
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\ESET Service.exe" "ESET Service.exe" ENABLE
                Source: C:\Windows\SysWOW64\netsh.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM taskmgr.exe
                Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: unknownProcess created: C:\Users\user\AppData\Roaming\ESET Service.exe "C:\Users\user\AppData\Roaming\ESET Service.exe" ..
                Source: unknownProcess created: C:\Users\user\AppData\Roaming\ESET Service.exe "C:\Users\user\AppData\Roaming\ESET Service.exe" ..
                Source: unknownProcess created: C:\Users\user\AppData\Roaming\ESET Service.exe "C:\Users\user\AppData\Roaming\ESET Service.exe" ..
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess created: C:\Users\user\AppData\Roaming\ESET Service.exe "C:\Users\user\AppData\Roaming\ESET Service.exe" Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\ESET Service.exe" "ESET Service.exe" ENABLEJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM taskmgr.exeJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
                Source: R3ov8eFFFP.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior
                Source: R3ov8eFFFP.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                Data Obfuscation

                barindex
                .NET source code contains potential unpacker
                Source: R3ov8eFFFP.exe, OK.cs.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
                Source: ESET Service.exe.0.dr, OK.cs.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
                Source: fa8cebf4f3fd11252bf351a94ee5fa4a.exe.1.dr, OK.cs.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
                Source: svchost.exe.1.dr, OK.cs.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

                Persistence and Installation Behavior

                barindex
                Drops PE files with benign system names
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeFile created: C:\svchost.exeJump to dropped file
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exeJump to dropped file
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeFile created: C:\svchost.exeJump to dropped file
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeFile created: C:\Users\user\AppData\Roaming\ESET Service.exeJump to dropped file

                Boot Survival

                barindex
                Creates autostart registry keys with suspicious names
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fa8cebf4f3fd11252bf351a94ee5fa4aJump to behavior
                Drops PE files to the startup folder
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exeJump to dropped file
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exeJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exeJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe\:Zone.Identifier:$DATAJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fa8cebf4f3fd11252bf351a94ee5fa4aJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fa8cebf4f3fd11252bf351a94ee5fa4aJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run fa8cebf4f3fd11252bf351a94ee5fa4aJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run fa8cebf4f3fd11252bf351a94ee5fa4aJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeMemory allocated: E00000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeMemory allocated: 2B70000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeMemory allocated: E50000 memory commit | memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMemory allocated: 3380000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMemory allocated: 3380000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMemory allocated: 5380000 memory commit | memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMemory allocated: C10000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMemory allocated: 2870000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMemory allocated: 4870000 memory commit | memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMemory allocated: E60000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMemory allocated: 2C00000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMemory allocated: EB0000 memory commit | memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMemory allocated: 1080000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMemory allocated: 2E60000 memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeMemory allocated: 11D0000 memory commit | memory reserve | memory write watchJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeWindow / User API: threadDelayed 3181Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeWindow / User API: threadDelayed 1490Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeWindow / User API: threadDelayed 3409Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeWindow / User API: foregroundWindowGot 535Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeWindow / User API: foregroundWindowGot 1159Jump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exe TID: 6708Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exe TID: 2316Thread sleep time: -1490000s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exe TID: 2316Thread sleep time: -3409000s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exe TID: 6764Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exe TID: 5220Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exe TID: 6792Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: R3ov8eFFFP.exe, 00000000.00000002.1757865607.000000000095E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _VMware_PJ
                Source: ESET Service.exe, 00000001.00000002.4130868397.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000003.00000003.1823872110.0000000000D02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeMemory allocated: page read and write | page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                .NET source code references suspicious native API functions
                Source: R3ov8eFFFP.exe, kl.csReference to suspicious API methods: MapVirtualKey(a, 0u)
                Source: R3ov8eFFFP.exe, kl.csReference to suspicious API methods: GetAsyncKeyState(num2)
                Source: R3ov8eFFFP.exe, OK.csReference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
                Uses taskkill to terminate AV processes
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM taskmgr.exeJump to behavior
                Source: C:\Users\user\Desktop\R3ov8eFFFP.exeProcess created: C:\Users\user\AppData\Roaming\ESET Service.exe "C:\Users\user\AppData\Roaming\ESET Service.exe" Jump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM taskmgr.exeJump to behavior
                Source: ESET Service.exe, 00000001.00000002.4131549355.0000000003592000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000001.00000002.4131549355.0000000003384000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000001.00000002.4131549355.00000000035B3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
                Source: ESET Service.exe, 00000001.00000002.4131549355.0000000003592000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000001.00000002.4131549355.0000000003384000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000001.00000002.4131549355.00000000035B3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: program managerL.
                Source: ESET Service.exe, 00000001.00000002.4131549355.0000000003384000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: program manager
                Source: ESET Service.exe, 00000001.00000002.4131549355.00000000035B3000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000001.00000002.4131549355.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, ESET Service.exe, 00000001.00000002.4131549355.0000000003682000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager@9
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Lowering of HIPS / PFW / Operating System Security Settings

                barindex
                Modifies the windows firewall
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\ESET Service.exe" "ESET Service.exe" ENABLE
                Uses netsh to modify the Windows network and firewall settings
                Source: C:\Users\user\AppData\Roaming\ESET Service.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\ESET Service.exe" "ESET Service.exe" ENABLE

                Stealing of Sensitive Information

                barindex
                Yara detected Njrat
                Source: Yara matchFile source: R3ov8eFFFP.exe, type: SAMPLE
                Source: Yara matchFile source: 0.0.R3ov8eFFFP.exe.460000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: R3ov8eFFFP.exe PID: 6664, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: ESET Service.exe PID: 3452, type: MEMORYSTR
                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED
                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, type: DROPPED
                Source: Yara matchFile source: C:\svchost.exe, type: DROPPED

                Remote Access Functionality

                barindex
                Yara detected Njrat
                Source: Yara matchFile source: R3ov8eFFFP.exe, type: SAMPLE
                Source: Yara matchFile source: 0.0.R3ov8eFFFP.exe.460000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: R3ov8eFFFP.exe PID: 6664, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: ESET Service.exe PID: 3452, type: MEMORYSTR
                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\ESET Service.exe, type: DROPPED
                Source: Yara matchFile source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, type: DROPPED
                Source: Yara matchFile source: C:\svchost.exe, type: DROPPED

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure11
                Replication Through Removable Media                		21
                Windows Management Instrumentation                		221
                Registry Run Keys / Startup Folder                		1
                Access Token Manipulation                		11
                Masquerading                		1
                Input Capture                		111
                Security Software Discovery                		Remote Services1
                Input Capture                		1
                Non-Standard Port                		Exfiltration Over Other Network MediumAbuse Accessibility Features
                CredentialsDomainsDefault Accounts1
                Native API                		1
                DLL Side-Loading                		12
                Process Injection                		311
                Disable or Modify Tools                		LSASS Memory2
                Process Discovery                		Remote Desktop ProtocolData from Removable Media1
                Non-Application Layer Protocol                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)221
                Registry Run Keys / Startup Folder                		41
                Virtualization/Sandbox Evasion                		Security Account Manager41
                Virtualization/Sandbox Evasion                		SMB/Windows Admin SharesData from Network Shared Drive11
                Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
                DLL Side-Loading                		1
                Access Token Manipulation                		NTDS1
                Application Window Discovery                		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
                Process Injection                		LSA Secrets1
                Peripheral Device Discovery                		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                Software Packing                		Cached Domain Credentials1
                File and Directory Discovery                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                DLL Side-Loading                		DCSync33
                System Information Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1383432 Sample: R3ov8eFFFP.exe Startdate: 30/01/2024 Architecture: WINDOWS Score: 100 39 2.tcp.eu.ngrok.io 2->39 47 Snort IDS alert for network traffic 2->47 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 19 other signatures 2->53 9 R3ov8eFFFP.exe 1 6 2->9         started        12 ESET Service.exe 2 2->12         started        14 ESET Service.exe 2 2->14         started        16 ESET Service.exe 3 2->16         started        signatures3 process4 file5 37 C:\Users\user\AppData\...SET Service.exe, PE32 9->37 dropped 18 ESET Service.exe 2 11 9->18         started        process6 dnsIp7 41 18.192.93.86, 18227, 49744, 49745 AMAZON-02US United States 18->41 43 18.197.239.5, 18227, 49750, 49751 AMAZON-02US United States 18->43 45 2.tcp.eu.ngrok.io 3.127.138.57, 18227, 49729, 49736 AMAZON-02US United States 18->45 31 C:\svchost.exe, PE32 18->31 dropped 33 C:\...\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, PE32 18->33 dropped 35 C:\autorun.inf, Microsoft 18->35 dropped 55 Uses taskkill to terminate AV processes 18->55 57 Protects its processes via BreakOnTermination flag 18->57 59 Creates autorun.inf (USB autostart) 18->59 61 Creates autostart registry keys with suspicious names 18->61 23 taskkill.exe 1 18->23         started        25 netsh.exe 2 18->25         started        file8 signatures9 process10 process11 27 conhost.exe 23->27         started        29 conhost.exe 25->29         started       

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                R3ov8eFFFP.exe97%ReversingLabsByteCode-MSIL.Backdoor.Ratenjay
                R3ov8eFFFP.exe100%AviraTR/ATRAPS.Gen
                R3ov8eFFFP.exe100%Joe Sandbox ML

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe100%AviraTR/ATRAPS.Gen
                C:\Users\user\AppData\Roaming\ESET Service.exe100%AviraTR/ATRAPS.Gen
                C:\svchost.exe100%AviraTR/ATRAPS.Gen
                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe100%Joe Sandbox ML
                C:\Users\user\AppData\Roaming\ESET Service.exe100%Joe Sandbox ML
                C:\svchost.exe100%Joe Sandbox ML
                C:\Users\user\AppData\Roaming\ESET Service.exe97%ReversingLabsByteCode-MSIL.Backdoor.Ratenjay
                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe97%ReversingLabsByteCode-MSIL.Backdoor.Ratenjay
                C:\svchost.exe97%ReversingLabsByteCode-MSIL.Backdoor.Ratenjay

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                2.tcp.eu.ngrok.io100%Avira URL Cloudmalware

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                2.tcp.eu.ngrok.io
                		3.127.138.57
                		truetrue
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  2.tcp.eu.ngrok.iotrue
                  • Avira URL Cloud: malware
                  		unknown

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0R3ov8eFFFP.exe, fa8cebf4f3fd11252bf351a94ee5fa4a.exe.1.dr, ESET Service.exe.0.dr, svchost.exe.1.drfalse
                    		high

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    3.127.138.57
                    		2.tcp.eu.ngrok.ioUnited States
                    		16509AMAZON-02UStrue
                    18.192.93.86
                    		unknownUnited States
                    		16509AMAZON-02UStrue
                    18.197.239.5
                    		unknownUnited States
                    		16509AMAZON-02UStrue

                    General Information

                    Joe Sandbox version:39.0.0 Ruby
                    Analysis ID:1383432
                    Start date and time:2024-01-30 17:06:06 +01:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 7m 46s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:14
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Sample name:R3ov8eFFFP.exe
                    renamed because original name is a hash value
                    Original Sample Name:0A7D2BBBE2960FF24B9273036FC472DA.exe
                    Detection:MAL
                    Classification:mal100.spre.troj.adwa.spyw.evad.winEXE@12/10@4/3
                    EGA Information:
                    • Successful, ratio: 100%
                    HCA Information:
                    • Successful, ratio: 99%
                    • Number of executed functions: 207
                    • Number of non-executed functions: 0
                    Cookbook Comments:
                    • Found application associated with file extension: .exe
                    • Override analysis time to 240000 for current running targets taking high CPU consumption

                    Warnings

                    • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                    • Excluded IPs from analysis (whitelisted): 52.165.165.26, 23.40.205.58, 23.40.205.34, 23.40.205.75, 23.40.205.57, 23.40.205.59, 23.40.205.83, 23.40.205.9, 23.40.205.81, 20.3.187.198, 13.95.31.18, 20.166.126.56
                    • Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size exceeded maximum capacity and may have missing behavior information.
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • VT rate limit hit for: R3ov8eFFFP.exe

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    16:07:16AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fa8cebf4f3fd11252bf351a94ee5fa4a "C:\Users\user\AppData\Roaming\ESET Service.exe" ..
                    16:07:25AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run fa8cebf4f3fd11252bf351a94ee5fa4a "C:\Users\user\AppData\Roaming\ESET Service.exe" ..
                    16:07:33AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fa8cebf4f3fd11252bf351a94ee5fa4a "C:\Users\user\AppData\Roaming\ESET Service.exe" ..
                    16:07:42AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe
                    17:07:47API Interceptor118915x Sleep call for process: ESET Service.exe modified

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    3.127.138.57b8UsrDOVGV.exeGet hashmaliciousNjratBrowse
                      2G8CgDVl3K.exeGet hashmaliciousNjratBrowse
                        tiodtk2cfy.exeGet hashmaliciousNjratBrowse
                          QUuUm3J8x3.exeGet hashmaliciousNjratBrowse
                            RWqHoCWEPI.exeGet hashmaliciousNjratBrowse
                              OUXkIxeP6k.exeGet hashmaliciousNjratBrowse
                                eI43OwXSvq.exeGet hashmaliciousNjratBrowse
                                  i9z1c1OtFb.exeGet hashmaliciousNjratBrowse
                                    JYGc3o49WE.exeGet hashmaliciousNjratBrowse
                                      J6VIiRgq3w.exeGet hashmaliciousNjratBrowse
                                        18.192.93.86P90GT_Invoice_Related_Property_Tax_P800.exeGet hashmaliciousRedLineBrowse
                                        • 2.tcp.eu.ngrok.io:17685/
                                        http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exeGet hashmaliciousRedLineBrowse
                                        • 2.tcp.eu.ngrok.io:17685/
                                        18.197.239.5P90GT_Invoice_Related_Property_Tax_P800.exeGet hashmaliciousRedLineBrowse
                                        • 2.tcp.eu.ngrok.io:17685/

                                        Domains

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        2.tcp.eu.ngrok.ioVe0c8i5So2.exeGet hashmaliciousNjratBrowse
                                        • 18.157.68.73
                                        LMQV4V1d3E.exeGet hashmaliciousNjratBrowse
                                        • 18.192.93.86
                                        b8UsrDOVGV.exeGet hashmaliciousNjratBrowse
                                        • 3.127.138.57
                                        2G8CgDVl3K.exeGet hashmaliciousNjratBrowse
                                        • 18.197.239.5
                                        BHp5Is5Xe7.exeGet hashmaliciousNjratBrowse
                                        • 18.192.93.86
                                        tiodtk2cfy.exeGet hashmaliciousNjratBrowse
                                        • 3.127.138.57
                                        QUuUm3J8x3.exeGet hashmaliciousNjratBrowse
                                        • 3.127.138.57
                                        81Rz15POL6.exeGet hashmaliciousNjratBrowse
                                        • 18.157.68.73
                                        649DB66A36E095B16832637A31D3CCC75040C5A6C23F6.exeGet hashmaliciousNjratBrowse
                                        • 18.156.13.209
                                        pQBmVoyRnw.exeGet hashmaliciousNjratBrowse
                                        • 18.156.13.209

                                        ASNs

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        AMAZON-02UShttps://optout.oracle-zoominfo-notice.com/acton/ct/45126/s-00a2-2401/Bct/g-00e9/l-00e4:4e5156/ct2_0/1/lu?sid=TV2%3A77KSjIGlP&c=E,1,oEV6T_FZXfcwsLJPdLRKsm5UxG5l1_dNlD0IFImFpjO05VML-T178ZPmvZqk5ormfZ0PuJEmGpb9jj51uxHqZ7XbQK5xoBbVXlPrmcKyudGsVoZJQcz-cg,,&typo=1Get hashmaliciousUnknownBrowse
                                        • 52.85.151.27
                                        Disputes_2Pages-Fax (2).htmlGet hashmaliciousUnknownBrowse
                                        • 108.156.152.114
                                        Fax-847-0944.xlsxGet hashmaliciousHTMLPhisherBrowse
                                        • 99.86.229.114
                                        https://protect-us.mimecast.com/s/WmtgC2krQxIovQN4I2X4tR?domain=click-notification.capitalone.comGet hashmaliciousUnknownBrowse
                                        • 3.124.226.107
                                        Garfieldpolice_Receipt_823481010238.htmlGet hashmaliciousHTMLPhisherBrowse
                                        • 99.84.108.67
                                        http://hytek.active.comGet hashmaliciousUnknownBrowse
                                        • 54.230.253.79
                                        https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//b3groover.com/html/xtml/3jv6hhtqoycydubawq4q0vkugtsynvny48qryppx7dhenfjqlwkk6qcqxsvbp7bq346ltip18tnamlwgiy2ulkd1zvmqe5oublogi1mrebjnrbytt634ropk41uqpmdplsjbqshs1l4nlmna1m81gbqowtvmkuiezp8cyyauc2aqgm6luxzldz6xgq3rficooly7z7i7/YW5kcmV3LmRvc3NAc3VtbWl0YmhjLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                        • 99.84.108.67
                                        https://t.ly/vUxxBGet hashmaliciousUnknownBrowse
                                        • 54.220.167.226
                                        https://www.bing.com/ck/a?!&&p=bd0766a2437219cbJmltdHM9MTcwNjQ4NjQwMCZpZ3VpZD0xMmI2NWRiOC0xMDdlLTYxYmYtMGUxMS00ZTQ0MTExNDYwNzYmaW5zaWQ9NTE5Mg&ptn=3&ver=2&hsh=3&fclid=12b65db8-107e-61bf-0e11-4e4411146076&psq=rayautox.co.za&u=a1aHR0cDovL3d3dy5yYXlhdXRveC5jby56YS8&ntb=1Get hashmaliciousUnknownBrowse
                                        • 3.163.101.111
                                        xshFIpJznd.elfGet hashmaliciousUnknownBrowse
                                        • 34.254.182.186
                                        AMAZON-02UShttps://optout.oracle-zoominfo-notice.com/acton/ct/45126/s-00a2-2401/Bct/g-00e9/l-00e4:4e5156/ct2_0/1/lu?sid=TV2%3A77KSjIGlP&c=E,1,oEV6T_FZXfcwsLJPdLRKsm5UxG5l1_dNlD0IFImFpjO05VML-T178ZPmvZqk5ormfZ0PuJEmGpb9jj51uxHqZ7XbQK5xoBbVXlPrmcKyudGsVoZJQcz-cg,,&typo=1Get hashmaliciousUnknownBrowse
                                        • 52.85.151.27
                                        Disputes_2Pages-Fax (2).htmlGet hashmaliciousUnknownBrowse
                                        • 108.156.152.114
                                        Fax-847-0944.xlsxGet hashmaliciousHTMLPhisherBrowse
                                        • 99.86.229.114
                                        https://protect-us.mimecast.com/s/WmtgC2krQxIovQN4I2X4tR?domain=click-notification.capitalone.comGet hashmaliciousUnknownBrowse
                                        • 3.124.226.107
                                        Garfieldpolice_Receipt_823481010238.htmlGet hashmaliciousHTMLPhisherBrowse
                                        • 99.84.108.67
                                        http://hytek.active.comGet hashmaliciousUnknownBrowse
                                        • 54.230.253.79
                                        https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//b3groover.com/html/xtml/3jv6hhtqoycydubawq4q0vkugtsynvny48qryppx7dhenfjqlwkk6qcqxsvbp7bq346ltip18tnamlwgiy2ulkd1zvmqe5oublogi1mrebjnrbytt634ropk41uqpmdplsjbqshs1l4nlmna1m81gbqowtvmkuiezp8cyyauc2aqgm6luxzldz6xgq3rficooly7z7i7/YW5kcmV3LmRvc3NAc3VtbWl0YmhjLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                        • 99.84.108.67
                                        https://t.ly/vUxxBGet hashmaliciousUnknownBrowse
                                        • 54.220.167.226
                                        https://www.bing.com/ck/a?!&&p=bd0766a2437219cbJmltdHM9MTcwNjQ4NjQwMCZpZ3VpZD0xMmI2NWRiOC0xMDdlLTYxYmYtMGUxMS00ZTQ0MTExNDYwNzYmaW5zaWQ9NTE5Mg&ptn=3&ver=2&hsh=3&fclid=12b65db8-107e-61bf-0e11-4e4411146076&psq=rayautox.co.za&u=a1aHR0cDovL3d3dy5yYXlhdXRveC5jby56YS8&ntb=1Get hashmaliciousUnknownBrowse
                                        • 3.163.101.111
                                        xshFIpJznd.elfGet hashmaliciousUnknownBrowse
                                        • 34.254.182.186
                                        AMAZON-02UShttps://optout.oracle-zoominfo-notice.com/acton/ct/45126/s-00a2-2401/Bct/g-00e9/l-00e4:4e5156/ct2_0/1/lu?sid=TV2%3A77KSjIGlP&c=E,1,oEV6T_FZXfcwsLJPdLRKsm5UxG5l1_dNlD0IFImFpjO05VML-T178ZPmvZqk5ormfZ0PuJEmGpb9jj51uxHqZ7XbQK5xoBbVXlPrmcKyudGsVoZJQcz-cg,,&typo=1Get hashmaliciousUnknownBrowse
                                        • 52.85.151.27
                                        Disputes_2Pages-Fax (2).htmlGet hashmaliciousUnknownBrowse
                                        • 108.156.152.114
                                        Fax-847-0944.xlsxGet hashmaliciousHTMLPhisherBrowse
                                        • 99.86.229.114
                                        https://protect-us.mimecast.com/s/WmtgC2krQxIovQN4I2X4tR?domain=click-notification.capitalone.comGet hashmaliciousUnknownBrowse
                                        • 3.124.226.107
                                        Garfieldpolice_Receipt_823481010238.htmlGet hashmaliciousHTMLPhisherBrowse
                                        • 99.84.108.67
                                        http://hytek.active.comGet hashmaliciousUnknownBrowse
                                        • 54.230.253.79
                                        https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//b3groover.com/html/xtml/3jv6hhtqoycydubawq4q0vkugtsynvny48qryppx7dhenfjqlwkk6qcqxsvbp7bq346ltip18tnamlwgiy2ulkd1zvmqe5oublogi1mrebjnrbytt634ropk41uqpmdplsjbqshs1l4nlmna1m81gbqowtvmkuiezp8cyyauc2aqgm6luxzldz6xgq3rficooly7z7i7/YW5kcmV3LmRvc3NAc3VtbWl0YmhjLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                        • 99.84.108.67
                                        https://t.ly/vUxxBGet hashmaliciousUnknownBrowse
                                        • 54.220.167.226
                                        https://www.bing.com/ck/a?!&&p=bd0766a2437219cbJmltdHM9MTcwNjQ4NjQwMCZpZ3VpZD0xMmI2NWRiOC0xMDdlLTYxYmYtMGUxMS00ZTQ0MTExNDYwNzYmaW5zaWQ9NTE5Mg&ptn=3&ver=2&hsh=3&fclid=12b65db8-107e-61bf-0e11-4e4411146076&psq=rayautox.co.za&u=a1aHR0cDovL3d3dy5yYXlhdXRveC5jby56YS8&ntb=1Get hashmaliciousUnknownBrowse
                                        • 3.163.101.111
                                        xshFIpJznd.elfGet hashmaliciousUnknownBrowse
                                        • 34.254.182.186

                                        JA3 Fingerprints

                                        ⊘No context

                                        Dropped Files

                                        ⊘No context

                                        Created / dropped Files

                                        C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\ESET Service.exe.log

                                        Download File
                                        Process:C:\Users\user\AppData\Roaming\ESET Service.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):525
                                        Entropy (8bit):5.259753436570609
                                        Encrypted:false
                                        SSDEEP:12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
                                        MD5:260E01CC001F9C4643CA7A62F395D747
                                        SHA1:492AD0ACE3A9C8736909866EEA168962D418BE5A
                                        SHA-256:4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
                                        SHA-512:01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
                                        Malicious:false
                                        Reputation:moderate, very likely benign file
                                        Preview:1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

                                        C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\R3ov8eFFFP.exe.log

                                        Download File
                                        Process:C:\Users\user\Desktop\R3ov8eFFFP.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:modified
                                        Size (bytes):525
                                        Entropy (8bit):5.259753436570609
                                        Encrypted:false
                                        SSDEEP:12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
                                        MD5:260E01CC001F9C4643CA7A62F395D747
                                        SHA1:492AD0ACE3A9C8736909866EEA168962D418BE5A
                                        SHA-256:4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
                                        SHA-512:01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
                                        Malicious:false
                                        Reputation:moderate, very likely benign file
                                        Preview:1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

                                        C:\Users\user\AppData\Roaming\ESET Service.exe

                                        Download File
                                        Process:C:\Users\user\Desktop\R3ov8eFFFP.exe
                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                        Category:dropped
                                        Size (bytes):37888
                                        Entropy (8bit):5.5730226036804105
                                        Encrypted:false
                                        SSDEEP:384:jstKUiDtblmJEpRGyEf7JfJuQCY6iXQrAF+rMRTyN/0L+EcoinblneHQM3epzX48:YtiHpR9Ef7JsQCFiArM+rMRa8NuqUt
                                        MD5:0A7D2BBBE2960FF24B9273036FC472DA
                                        SHA1:3B0FBB910651427A6A103327A0630E96ACB8649C
                                        SHA-256:D812B05B85A25AB0EC4258F8A4E9ADDA4A84D2DF5B07FED42B84DE539DFCABC8
                                        SHA-512:8266B81B3D24B0650465D35A5CF83EA4339F7CF417A78E4A5BD8EB5D111BD90EEB1C672DBE7A2C6F772849AECF13C6FE62488958CD27986727CD723D154DD62F
                                        Malicious:true
                                        Yara Hits:
                                        • Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: Joe Security
                                        • Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: unknown
                                        • Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: Brian Wallace @botnet_hunter
                                        • Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: ditekSHen
                                        Antivirus:
                                        • Antivirus: Avira, Detection: 100%
                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                        • Antivirus: ReversingLabs, Detection: 97%
                                        Reputation:low
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e................................. ........@.. ....................................@.................................p...K.......@............................................................................ ............... ..H............text....... ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......**..(......*.s.........s.........s.........s..........*.0...........~....o.....+..*.0...........~....o.....+..*.0...........~....o.....+..*.0...........~....o.....+..*.0.............(....(.....+..*...0............(.....+..*.0................(.....+..*.0............(.....+..*.0.. ...................,.(...+.+.+....+...*.0...........................**..(......*....0..&........~..............,.(...+.

                                        C:\Users\user\AppData\Roaming\ESET Service.exe:Zone.Identifier

                                        Download File
                                        Process:C:\Users\user\Desktop\R3ov8eFFFP.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):26
                                        Entropy (8bit):3.95006375643621
                                        Encrypted:false
                                        SSDEEP:3:ggPYV:rPYV
                                        MD5:187F488E27DB4AF347237FE461A079AD
                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                        Malicious:false
                                        Reputation:high, very likely benign file
                                        Preview:[ZoneTransfer]....ZoneId=0

                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe

                                        Download File
                                        Process:C:\Users\user\AppData\Roaming\ESET Service.exe
                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                        Category:dropped
                                        Size (bytes):37888
                                        Entropy (8bit):5.5730226036804105
                                        Encrypted:false
                                        SSDEEP:384:jstKUiDtblmJEpRGyEf7JfJuQCY6iXQrAF+rMRTyN/0L+EcoinblneHQM3epzX48:YtiHpR9Ef7JsQCFiArM+rMRa8NuqUt
                                        MD5:0A7D2BBBE2960FF24B9273036FC472DA
                                        SHA1:3B0FBB910651427A6A103327A0630E96ACB8649C
                                        SHA-256:D812B05B85A25AB0EC4258F8A4E9ADDA4A84D2DF5B07FED42B84DE539DFCABC8
                                        SHA-512:8266B81B3D24B0650465D35A5CF83EA4339F7CF417A78E4A5BD8EB5D111BD90EEB1C672DBE7A2C6F772849AECF13C6FE62488958CD27986727CD723D154DD62F
                                        Malicious:true
                                        Yara Hits:
                                        • Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, Author: Joe Security
                                        • Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, Author: unknown
                                        • Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, Author: Brian Wallace @botnet_hunter
                                        • Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe, Author: ditekSHen
                                        Antivirus:
                                        • Antivirus: Avira, Detection: 100%
                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                        • Antivirus: ReversingLabs, Detection: 97%
                                        Reputation:low
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e................................. ........@.. ....................................@.................................p...K.......@............................................................................ ............... ..H............text....... ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......**..(......*.s.........s.........s.........s..........*.0...........~....o.....+..*.0...........~....o.....+..*.0...........~....o.....+..*.0...........~....o.....+..*.0.............(....(.....+..*...0............(.....+..*.0................(.....+..*.0............(.....+..*.0.. ...................,.(...+.+.+....+...*.0...........................**..(......*....0..&........~..............,.(...+.

                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fa8cebf4f3fd11252bf351a94ee5fa4a.exe:Zone.Identifier

                                        Download File
                                        Process:C:\Users\user\AppData\Roaming\ESET Service.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):26
                                        Entropy (8bit):3.95006375643621
                                        Encrypted:false
                                        SSDEEP:3:ggPYV:rPYV
                                        MD5:187F488E27DB4AF347237FE461A079AD
                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                        Malicious:false
                                        Preview:[ZoneTransfer]....ZoneId=0

                                        C:\autorun.inf

                                        Download File
                                        Process:C:\Users\user\AppData\Roaming\ESET Service.exe
                                        File Type:Microsoft Windows Autorun file
                                        Category:dropped
                                        Size (bytes):50
                                        Entropy (8bit):4.320240000427043
                                        Encrypted:false
                                        SSDEEP:3:It1KV2LKMACovK0x:e1KzxvD
                                        MD5:5B0B50BADE67C5EC92D42E971287A5D9
                                        SHA1:90D5C99143E7A56AD6E5EE401015F8ECC093D95A
                                        SHA-256:04DDE2489D2D2E6846D42250D813AB90B5CA847D527F8F2C022E6C327DC6DB53
                                        SHA-512:C064DC3C4185A38D1CAEBD069ACB9FDBB85DFB650D6A241036E501A09BC89FD06E267BE9D400D20E6C14B4068473D1C6557962E8D82FDFD191DB7EABB6E66821
                                        Malicious:true
                                        Preview:[autorun]..open=C:\svchost.exe..shellexecute=C:\..

                                        C:\svchost.exe

                                        Download File
                                        Process:C:\Users\user\AppData\Roaming\ESET Service.exe
                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                        Category:dropped
                                        Size (bytes):37888
                                        Entropy (8bit):5.5730226036804105
                                        Encrypted:false
                                        SSDEEP:384:jstKUiDtblmJEpRGyEf7JfJuQCY6iXQrAF+rMRTyN/0L+EcoinblneHQM3epzX48:YtiHpR9Ef7JsQCFiArM+rMRa8NuqUt
                                        MD5:0A7D2BBBE2960FF24B9273036FC472DA
                                        SHA1:3B0FBB910651427A6A103327A0630E96ACB8649C
                                        SHA-256:D812B05B85A25AB0EC4258F8A4E9ADDA4A84D2DF5B07FED42B84DE539DFCABC8
                                        SHA-512:8266B81B3D24B0650465D35A5CF83EA4339F7CF417A78E4A5BD8EB5D111BD90EEB1C672DBE7A2C6F772849AECF13C6FE62488958CD27986727CD723D154DD62F
                                        Malicious:true
                                        Yara Hits:
                                        • Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\svchost.exe, Author: Joe Security
                                        • Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\svchost.exe, Author: unknown
                                        • Rule: njrat1, Description: Identify njRat, Source: C:\svchost.exe, Author: Brian Wallace @botnet_hunter
                                        • Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\svchost.exe, Author: ditekSHen
                                        Antivirus:
                                        • Antivirus: Avira, Detection: 100%
                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                        • Antivirus: ReversingLabs, Detection: 97%
                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e................................. ........@.. ....................................@.................................p...K.......@............................................................................ ............... ..H............text....... ...................... ..`.rsrc...@...........................@..@.reloc..............................@..B........................H........e...E..........................................................&.(......**..(......*.s.........s.........s.........s..........*.0...........~....o.....+..*.0...........~....o.....+..*.0...........~....o.....+..*.0...........~....o.....+..*.0.............(....(.....+..*...0............(.....+..*.0................(.....+..*.0............(.....+..*.0.. ...................,.(...+.+.+....+...*.0...........................**..(......*....0..&........~..............,.(...+.

                                        C:\svchost.exe:Zone.Identifier

                                        Download File
                                        Process:C:\Users\user\AppData\Roaming\ESET Service.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):26
                                        Entropy (8bit):3.95006375643621
                                        Encrypted:false
                                        SSDEEP:3:ggPYV:rPYV
                                        MD5:187F488E27DB4AF347237FE461A079AD
                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                        Malicious:false
                                        Preview:[ZoneTransfer]....ZoneId=0

                                        \Device\ConDrv

                                        Download File
                                        Process:C:\Windows\SysWOW64\netsh.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):313
                                        Entropy (8bit):4.971939296804078
                                        Encrypted:false
                                        SSDEEP:6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
                                        MD5:689E2126A85BF55121488295EE068FA1
                                        SHA1:09BAAA253A49D80C18326DFBCA106551EBF22DD6
                                        SHA-256:D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
                                        SHA-512:C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
                                        Malicious:false
                                        Preview:..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

                                        Static File Info

                                        General

                                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                        Entropy (8bit):5.5730226036804105
                                        TrID:
                                        • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                        • Win32 Executable (generic) a (10002005/4) 49.75%
                                        • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                        • Windows Screen Saver (13104/52) 0.07%
                                        • Generic Win/DOS Executable (2004/3) 0.01%
                                        File name:R3ov8eFFFP.exe
                                        File size:37'888 bytes
                                        MD5:0a7d2bbbe2960ff24b9273036fc472da
                                        SHA1:3b0fbb910651427a6a103327a0630e96acb8649c
                                        SHA256:d812b05b85a25ab0ec4258f8a4e9adda4a84d2df5b07fed42b84de539dfcabc8
                                        SHA512:8266b81b3d24b0650465d35a5cf83ea4339f7cf417a78e4a5bd8eb5d111bd90eeb1c672dbe7a2c6f772849aecf13c6fe62488958cd27986727cd723d154dd62f
                                        SSDEEP:384:jstKUiDtblmJEpRGyEf7JfJuQCY6iXQrAF+rMRTyN/0L+EcoinblneHQM3epzX48:YtiHpR9Ef7JsQCFiArM+rMRa8NuqUt
                                        TLSH:6D032A4D7FE18168C5FD467B05B2D41207BBE04B6E23D90E8EF564AA37636C18B50AF2
                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e................................. ........@.. ....................................@................................

                                        File Icon

                                        Icon Hash:90cececece8e8eb0

                                        Static PE Info

                                        General

                                        Entrypoint:0x40abbe
                                        Entrypoint Section:.text
                                        Digitally signed:false
                                        Imagebase:0x400000
                                        Subsystem:windows gui
                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                        Time Stamp:0x65B3A597 [Fri Jan 26 12:29:11 2024 UTC]
                                        TLS Callbacks:
                                        CLR (.Net) Version:
                                        OS Version Major:4
                                        OS Version Minor:0
                                        File Version Major:4
                                        File Version Minor:0
                                        Subsystem Version Major:4
                                        Subsystem Version Minor:0
                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                        Entrypoint Preview

                                        Instruction
                                        jmp dword ptr [00402000h]
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al

                                        Data Directories

                                        NameVirtual AddressVirtual Size Is in Section
                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xab700x4b.text
                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xc0000x240.rsrc
                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xe0000xc.reloc
                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                        Sections

                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                        .text0x20000x8bc40x8c0052435bf8111a2b756b0ca350659b2ea6False0.46353236607142856data5.604430733714899IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                        .rsrc0xc0000x2400x400f7ce2f7b506ce16c06c85a549ef2cd98False0.3134765625data4.968771659524424IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                        .reloc0xe0000xc0x200163d66697186c0743c0da6f82247a39aFalse0.044921875data0.08153941234324169IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                        Resources

                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                        RT_MANIFEST0xc0580x1e7XML 1.0 document, ASCII text, with CRLF line terminators0.5338809034907598

                                        Imports

                                        DLLImport
                                        mscoree.dll_CorExeMain

                                        Network Behavior

                                        Snort IDS Alerts

                                        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                        192.168.2.43.127.138.5749743182272825564 01/30/24-17:09:29.306132TCP2825564ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)4974318227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749743182272825563 01/30/24-17:09:19.453005TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4974318227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749740182272814860 01/30/24-17:08:55.123453TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4974018227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749742182272033132 01/30/24-17:09:13.438158TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4974218227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749741182272033132 01/30/24-17:08:57.484517TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4974118227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749743182272033132 01/30/24-17:09:19.251884TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4974318227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749729182272033132 01/30/24-17:07:18.434785TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4972918227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749741182272814860 01/30/24-17:09:03.945846TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4974118227192.168.2.43.127.138.57
                                        192.168.2.418.192.93.8649749182272814856 01/30/24-17:10:28.018781TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4974918227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649748182272814856 01/30/24-17:10:15.110171TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4974818227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649747182272814856 01/30/24-17:10:06.444735TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4974718227192.168.2.418.192.93.86
                                        192.168.2.43.127.138.5749738182272814856 01/30/24-17:08:14.961731TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4973818227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749739182272814856 01/30/24-17:08:27.854209TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4973918227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749743182272814860 01/30/24-17:09:29.306132TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4974318227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749729182272825564 01/30/24-17:07:23.073796TCP2825564ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)4972918227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749729182272825563 01/30/24-17:07:18.635283TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4972918227192.168.2.43.127.138.57
                                        192.168.2.418.197.239.549752182272033132 01/30/24-17:11:04.732771TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4975218227192.168.2.418.197.239.5
                                        192.168.2.43.127.138.5749740182272814856 01/30/24-17:08:45.087741TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4974018227192.168.2.43.127.138.57
                                        192.168.2.418.197.239.549751182272033132 01/30/24-17:10:49.338671TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4975118227192.168.2.418.197.239.5
                                        192.168.2.418.197.239.549750182272033132 01/30/24-17:10:40.149950TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4975018227192.168.2.418.197.239.5
                                        192.168.2.43.127.138.5749741182272814856 01/30/24-17:08:57.690610TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4974118227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749742182272814856 01/30/24-17:09:13.644212TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4974218227192.168.2.43.127.138.57
                                        192.168.2.418.192.93.8649745182272814856 01/30/24-17:09:36.950026TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4974518227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649744182272814856 01/30/24-17:09:32.006134TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4974418227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649746182272814856 01/30/24-17:09:54.099801TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4974618227192.168.2.418.192.93.86
                                        192.168.2.43.127.138.5749736182272814856 01/30/24-17:07:52.958354TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4973618227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749740182272033132 01/30/24-17:08:44.884475TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4974018227192.168.2.43.127.138.57
                                        192.168.2.418.197.239.549752182272814856 01/30/24-17:11:04.938711TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4975218227192.168.2.418.197.239.5
                                        192.168.2.43.127.138.5749743182272814856 01/30/24-17:09:19.453005TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4974318227192.168.2.43.127.138.57
                                        192.168.2.418.197.239.549751182272814856 01/30/24-17:10:49.541184TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4975118227192.168.2.418.197.239.5
                                        192.168.2.418.197.239.549750182272814856 01/30/24-17:10:40.356210TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4975018227192.168.2.418.197.239.5
                                        192.168.2.418.192.93.8649746182272825563 01/30/24-17:09:54.099801TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4974618227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649747182272033132 01/30/24-17:10:06.243628TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4974718227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649748182272033132 01/30/24-17:10:14.903223TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4974818227192.168.2.418.192.93.86
                                        192.168.2.43.127.138.5749736182272033132 01/30/24-17:07:52.757868TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4973618227192.168.2.43.127.138.57
                                        192.168.2.418.192.93.8649746182272825564 01/30/24-17:10:02.570250TCP2825564ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)4974618227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649748182272825564 01/30/24-17:10:16.789499TCP2825564ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)4974818227192.168.2.418.192.93.86
                                        192.168.2.43.127.138.5749736182272825563 01/30/24-17:07:52.958354TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4973618227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749736182272825564 01/30/24-17:07:55.336198TCP2825564ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)4973618227192.168.2.43.127.138.57
                                        192.168.2.418.192.93.8649745182272033132 01/30/24-17:09:36.751580TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4974518227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649746182272033132 01/30/24-17:09:53.899404TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4974618227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649749182272033132 01/30/24-17:10:27.818089TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4974918227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649745182272825563 01/30/24-17:09:36.950026TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4974518227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649749182272825563 01/30/24-17:10:28.018781TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4974918227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649745182272825564 01/30/24-17:09:37.351336TCP2825564ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)4974518227192.168.2.418.192.93.86
                                        192.168.2.418.192.93.8649749182272825564 01/30/24-17:10:33.714882TCP2825564ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)4974918227192.168.2.418.192.93.86
                                        192.168.2.43.127.138.5749738182272033132 01/30/24-17:08:14.761110TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4973818227192.168.2.43.127.138.57
                                        192.168.2.418.192.93.8649744182272825563 01/30/24-17:09:32.006134TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4974418227192.168.2.418.192.93.86
                                        192.168.2.43.127.138.5749739182272033132 01/30/24-17:08:27.653310TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4973918227192.168.2.43.127.138.57
                                        192.168.2.418.197.239.549750182272814860 01/30/24-17:10:41.866704TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4975018227192.168.2.418.197.239.5
                                        192.168.2.418.197.239.549751182272814860 01/30/24-17:10:58.138650TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4975118227192.168.2.418.197.239.5
                                        192.168.2.418.192.93.8649746182272814860 01/30/24-17:10:03.972545TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4974618227192.168.2.418.192.93.86
                                        192.168.2.43.127.138.5749736182272814860 01/30/24-17:07:55.336198TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4973618227192.168.2.43.127.138.57
                                        192.168.2.418.192.93.8649745182272814860 01/30/24-17:09:37.351336TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4974518227192.168.2.418.192.93.86
                                        192.168.2.43.127.138.5749738182272825564 01/30/24-17:08:24.775359TCP2825564ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)4973818227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749739182272825564 01/30/24-17:08:42.669529TCP2825564ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)4973918227192.168.2.43.127.138.57
                                        192.168.2.418.192.93.8649744182272033132 01/30/24-17:09:31.797713TCP2033132ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)4974418227192.168.2.418.192.93.86
                                        192.168.2.43.127.138.5749729182272814856 01/30/24-17:07:18.635283TCP2814856ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)4972918227192.168.2.43.127.138.57
                                        192.168.2.418.192.93.8649748182272825563 01/30/24-17:10:15.110171TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4974818227192.168.2.418.192.93.86
                                        192.168.2.418.197.239.549751182272825564 01/30/24-17:10:58.138650TCP2825564ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)4975118227192.168.2.418.197.239.5
                                        192.168.2.418.197.239.549751182272825563 01/30/24-17:10:49.541184TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4975118227192.168.2.418.197.239.5
                                        192.168.2.43.127.138.5749729182272814860 01/30/24-17:07:23.073796TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4972918227192.168.2.43.127.138.57
                                        192.168.2.418.197.239.549750182272825564 01/30/24-17:10:41.866704TCP2825564ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)4975018227192.168.2.418.197.239.5
                                        192.168.2.418.197.239.549750182272825563 01/30/24-17:10:40.356210TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4975018227192.168.2.418.197.239.5
                                        192.168.2.418.192.93.8649748182272814860 01/30/24-17:10:16.789499TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4974818227192.168.2.418.192.93.86
                                        192.168.2.43.127.138.5749739182272814860 01/30/24-17:08:42.669529TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4973918227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749738182272814860 01/30/24-17:08:25.085626TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4973818227192.168.2.43.127.138.57
                                        192.168.2.418.192.93.8649747182272814860 01/30/24-17:10:07.250125TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4974718227192.168.2.418.192.93.86
                                        192.168.2.418.197.239.549752182272825563 01/30/24-17:11:04.938711TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4975218227192.168.2.418.197.239.5
                                        192.168.2.418.192.93.8649749182272814860 01/30/24-17:10:33.714882TCP2814860ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)4974918227192.168.2.418.192.93.86
                                        192.168.2.43.127.138.5749741182272825564 01/30/24-17:09:03.945846TCP2825564ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)4974118227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749741182272825563 01/30/24-17:08:57.690610TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4974118227192.168.2.43.127.138.57
                                        192.168.2.43.127.138.5749742182272825563 01/30/24-17:09:13.644212TCP2825563ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)4974218227192.168.2.43.127.138.57

                                        Network Port Distribution

                                        TCP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Jan 30, 2024 17:07:18.118943930 CET4972918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:18.319217920 CET18227497293.127.138.57192.168.2.4
                                        Jan 30, 2024 17:07:18.319299936 CET4972918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:18.434784889 CET4972918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:18.635211945 CET18227497293.127.138.57192.168.2.4
                                        Jan 30, 2024 17:07:18.635282993 CET4972918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:18.835705996 CET18227497293.127.138.57192.168.2.4
                                        Jan 30, 2024 17:07:23.073796034 CET4972918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:23.274883032 CET18227497293.127.138.57192.168.2.4
                                        Jan 30, 2024 17:07:38.365947008 CET18227497293.127.138.57192.168.2.4
                                        Jan 30, 2024 17:07:38.366117954 CET4972918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:50.537448883 CET18227497293.127.138.57192.168.2.4
                                        Jan 30, 2024 17:07:50.537543058 CET4972918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:52.540827036 CET4972918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:52.543697119 CET4973618227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:52.741385937 CET18227497293.127.138.57192.168.2.4
                                        Jan 30, 2024 17:07:52.744189024 CET18227497363.127.138.57192.168.2.4
                                        Jan 30, 2024 17:07:52.744402885 CET4973618227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:52.757868052 CET4973618227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:52.958242893 CET18227497363.127.138.57192.168.2.4
                                        Jan 30, 2024 17:07:52.958353996 CET4973618227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:53.158967018 CET18227497363.127.138.57192.168.2.4
                                        Jan 30, 2024 17:07:55.336198092 CET4973618227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:07:55.536633968 CET18227497363.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:10.617690086 CET18227497363.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:10.617791891 CET4973618227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:12.537127018 CET18227497363.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:12.537514925 CET4973618227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:14.539102077 CET4973618227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:14.542673111 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:14.739630938 CET18227497363.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:14.742988110 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:14.743413925 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:14.761110067 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:14.961522102 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:14.961730957 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:15.161993980 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:19.243091106 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:19.443494081 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:19.477243900 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:19.677969933 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:20.367721081 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:20.568304062 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:20.568823099 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:20.769416094 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:20.963871002 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:21.164271116 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:21.164709091 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:21.365112066 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:21.365535021 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:21.566121101 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:21.566350937 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:21.766688108 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:21.767122984 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:21.967407942 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:21.967708111 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:22.168124914 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:22.168242931 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:22.368449926 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:22.368839025 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:22.569097996 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:22.569669962 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:22.769943953 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:22.770020008 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:22.970360041 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:22.970438004 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:23.170423031 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:23.170541048 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:23.370558977 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:23.370650053 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:23.570831060 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:23.570909023 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:23.771100044 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:23.771297932 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:23.971381903 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:23.971502066 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:24.171686888 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:24.172255993 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:24.372564077 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:24.373183012 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:24.573587894 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:24.574031115 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:24.774331093 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:24.775358915 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:24.969839096 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:24.970046997 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:24.975495100 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:25.085625887 CET4973818227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:25.170259953 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:25.286309004 CET18227497383.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:27.444000006 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:27.644758940 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:27.645101070 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:27.653310061 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:27.853856087 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:27.854208946 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:28.055088043 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:28.055363894 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:28.256254911 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:28.256463051 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:28.457463980 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:28.457796097 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:28.658519030 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:28.658653975 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:28.859358072 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:28.859611034 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:29.060507059 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:29.060678005 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:29.262550116 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:29.262775898 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:29.463494062 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:29.463891029 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:29.665312052 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:29.665427923 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:29.866010904 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:29.866297960 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:30.067047119 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:30.067300081 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:30.268131971 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:30.268381119 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:30.469274998 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:30.469749928 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:30.670468092 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:30.670931101 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:30.872039080 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:30.872251034 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:31.073065042 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:31.073275089 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:31.274019957 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:31.274292946 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:31.475121021 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:31.475404024 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:31.676198006 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:31.676640034 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:31.877504110 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:31.877969027 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:32.079165936 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:32.079366922 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:32.279973984 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:32.280376911 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:32.481098890 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:32.481379032 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:32.682281017 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:32.682615042 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:32.883357048 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:32.883622885 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:33.084570885 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:33.084770918 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:33.285358906 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:33.285561085 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:33.486411095 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:33.486510992 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:33.687203884 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:33.687428951 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:33.887970924 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:33.888179064 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:34.088859081 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:34.089088917 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:34.289917946 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:34.290045023 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:34.490910053 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:34.491003990 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:34.692013979 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:34.692235947 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:34.893011093 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:34.893368959 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:35.094140053 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:35.094481945 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:35.296802044 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:35.296936035 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:35.497612000 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:35.497757912 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:35.698784113 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:35.699018002 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:35.899802923 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:35.900118113 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:36.100967884 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:36.101224899 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:36.301995039 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:36.302151918 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:36.503012896 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:36.503396034 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:36.704019070 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:36.704241037 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:36.904968977 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:36.905261993 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:37.105923891 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:37.106182098 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:37.308156013 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:37.308360100 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:37.508959055 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:37.509193897 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:37.709985971 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:37.710367918 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:37.911137104 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:37.911438942 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:38.112112999 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:38.112317085 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:38.313105106 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:38.313308001 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:38.514097929 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:38.514327049 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:38.714885950 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:38.715102911 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:38.915584087 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:38.915797949 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:39.117832899 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:39.118065119 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:39.319658995 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:39.319864035 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:39.520365000 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:39.520576954 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:39.721039057 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:39.721290112 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:39.921797991 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:39.922024965 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:40.122467041 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:40.122648001 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:40.322992086 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:40.323195934 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:40.524761915 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:40.525044918 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:40.725555897 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:40.725764990 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:40.926168919 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:40.926422119 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:41.126811028 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:41.127103090 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:41.327806950 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:41.328018904 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:41.528436899 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:41.528764963 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:41.729111910 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:41.729312897 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:41.929708004 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:41.929812908 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:42.130331993 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:42.130444050 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:42.330782890 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:42.330997944 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:42.531397104 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:42.531575918 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:42.669207096 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:42.669528961 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:42.734142065 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:42.872009993 CET18227497393.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:44.679548979 CET4973918227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:44.681642056 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:44.881992102 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:44.882122040 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:44.884474993 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:45.087626934 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:45.087740898 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:45.287996054 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:45.288111925 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:45.488462925 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:45.488564014 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:45.688940048 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:45.689011097 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:45.889549971 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:45.889744997 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:46.091192007 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:46.091260910 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:46.291507959 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:46.291585922 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:46.491950989 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:46.492031097 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:46.692506075 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:46.692730904 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:46.892987013 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:46.893059015 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:47.093296051 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:47.093439102 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:47.293668032 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:47.293873072 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:47.494277000 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:47.494352102 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:47.694648027 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:47.694982052 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:47.895296097 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:47.895435095 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:48.095747948 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:48.095837116 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:48.296068907 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:48.296242952 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:48.496522903 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:48.496678114 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:48.696949959 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:48.697027922 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:48.897325039 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:48.897505999 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:49.097862005 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:49.097980022 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:49.298382044 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:49.298487902 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:49.498874903 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:49.499016047 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:49.699412107 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:49.699527979 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:49.899882078 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:49.899991989 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:50.100332975 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:50.100490093 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:50.301017046 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:50.301127911 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:50.501569986 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:50.501708984 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:50.702137947 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:50.702244043 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:50.902580976 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:50.902679920 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:51.102962971 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:51.103044033 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:51.304964066 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:51.305064917 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:51.505270004 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:51.505410910 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:51.707837105 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:51.707947016 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:51.908606052 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:51.908724070 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:52.109834909 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:52.109925032 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:52.310616970 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:52.310734987 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:52.510993958 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:52.511230946 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:52.711625099 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:52.711745024 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:52.914916992 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:52.915050983 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:53.115425110 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:53.115540028 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:53.316591978 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:53.316668034 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:53.518784046 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:53.518970966 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:53.719316959 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:53.719502926 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:53.919795990 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:53.919861078 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:54.120193958 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:54.120398045 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:54.320712090 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:54.320959091 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:54.521378994 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:54.521447897 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:54.721806049 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:54.722073078 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:54.922344923 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:54.922549009 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:55.123080015 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:55.123452902 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:55.264420033 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:55.264622927 CET4974018227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:55.323803902 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:55.465073109 CET18227497403.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:57.275511026 CET4974118227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:57.481945038 CET18227497413.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:57.482146978 CET4974118227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:57.484517097 CET4974118227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:57.690444946 CET18227497413.127.138.57192.168.2.4
                                        Jan 30, 2024 17:08:57.690609932 CET4974118227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:08:57.896656990 CET18227497413.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:03.945846081 CET4974118227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:04.151952028 CET18227497413.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:11.212969065 CET18227497413.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:11.213119030 CET4974118227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:13.226383924 CET4974118227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:13.228857994 CET4974218227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:13.432775974 CET18227497413.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:13.434715986 CET18227497423.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:13.434828043 CET4974218227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:13.438158035 CET4974218227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:13.643991947 CET18227497423.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:13.644212008 CET4974218227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:13.850090027 CET18227497423.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:16.845592022 CET18227497423.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:16.845807076 CET4974218227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:19.044230938 CET4974218227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:19.047009945 CET4974318227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:19.247746944 CET18227497433.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:19.247994900 CET4974318227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:19.250448942 CET18227497423.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:19.251883984 CET4974318227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:19.452675104 CET18227497433.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:19.453005075 CET4974318227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:19.653126001 CET18227497433.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:21.117424011 CET4974318227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:21.317758083 CET18227497433.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:29.306132078 CET4974318227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:29.459018946 CET18227497433.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:29.459239006 CET4974318227192.168.2.43.127.138.57
                                        Jan 30, 2024 17:09:29.506648064 CET18227497433.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:29.659554958 CET18227497433.127.138.57192.168.2.4
                                        Jan 30, 2024 17:09:31.585031033 CET4974418227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:31.793375015 CET182274974418.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:31.793809891 CET4974418227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:31.797713041 CET4974418227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:32.005939960 CET182274974418.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:32.006134033 CET4974418227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:32.214406967 CET182274974418.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:33.836033106 CET182274974418.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:33.836234093 CET4974418227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:36.547142982 CET4974418227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:36.548971891 CET4974518227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:36.749315977 CET182274974518.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:36.749444008 CET4974518227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:36.751580000 CET4974518227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:36.756670952 CET182274974418.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:36.949923038 CET182274974518.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:36.950026035 CET4974518227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:37.148559093 CET182274974518.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:37.351336002 CET4974518227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:37.549942017 CET182274974518.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:51.692215919 CET182274974518.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:51.692401886 CET4974518227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:53.694715977 CET4974518227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:53.696887970 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:53.893224955 CET182274974518.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:53.896965981 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:53.897161007 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:53.899404049 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:54.099476099 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:54.099801064 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:54.299922943 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:55.136574984 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:55.336728096 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:58.523324013 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:58.723436117 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:09:59.210922003 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:09:59.411084890 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:01.444931984 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:01.647478104 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:01.647605896 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:01.847635031 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:02.570250034 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:02.770273924 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:02.770452976 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:02.970413923 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:02.970638037 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:03.171406031 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:03.171694994 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:03.371750116 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:03.371994019 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:03.572016001 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:03.572249889 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:03.772270918 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:03.772475004 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:03.972434998 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:03.972544909 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:04.025881052 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:04.025981903 CET4974618227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:04.172636986 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:04.225955963 CET182274974618.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:06.040126085 CET4974718227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:06.241348028 CET182274974718.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:06.241463900 CET4974718227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:06.243628025 CET4974718227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:06.444627047 CET182274974718.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:06.444735050 CET4974718227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:06.646179914 CET182274974718.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:06.646333933 CET4974718227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:06.847616911 CET182274974718.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:06.847719908 CET4974718227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:07.048841000 CET182274974718.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:07.048954010 CET4974718227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:07.250024080 CET182274974718.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:07.250124931 CET4974718227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:07.454602003 CET182274974718.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:12.683803082 CET182274974718.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:12.866539955 CET4974718227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:14.695255041 CET4974718227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:14.698376894 CET4974818227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:14.900815010 CET182274974818.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:14.901004076 CET4974818227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:14.903223038 CET4974818227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:15.109992981 CET182274974818.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:15.110171080 CET4974818227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:15.312527895 CET182274974818.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:16.789499044 CET4974818227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:16.992105007 CET182274974818.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:25.581134081 CET182274974818.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:25.581331968 CET4974818227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:27.607204914 CET4974818227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:27.609694958 CET4974918227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:27.809581995 CET182274974818.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:27.810312033 CET182274974918.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:27.810412884 CET4974918227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:27.818089008 CET4974918227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:28.018533945 CET182274974918.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:28.018780947 CET4974918227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:28.220441103 CET182274974918.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:33.714881897 CET4974918227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:33.915666103 CET182274974918.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:37.814516068 CET182274974918.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:37.814601898 CET4974918227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:39.819660902 CET4974918227192.168.2.418.192.93.86
                                        Jan 30, 2024 17:10:39.941637993 CET4975018227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:40.020395041 CET182274974918.192.93.86192.168.2.4
                                        Jan 30, 2024 17:10:40.147718906 CET182274975018.197.239.5192.168.2.4
                                        Jan 30, 2024 17:10:40.147929907 CET4975018227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:40.149950027 CET4975018227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:40.356014967 CET182274975018.197.239.5192.168.2.4
                                        Jan 30, 2024 17:10:40.356209993 CET4975018227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:40.562290907 CET182274975018.197.239.5192.168.2.4
                                        Jan 30, 2024 17:10:41.866703987 CET4975018227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:42.074218035 CET182274975018.197.239.5192.168.2.4
                                        Jan 30, 2024 17:10:47.123547077 CET182274975018.197.239.5192.168.2.4
                                        Jan 30, 2024 17:10:47.123745918 CET4975018227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:49.132155895 CET4975018227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:49.133641958 CET4975118227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:49.336246967 CET182274975118.197.239.5192.168.2.4
                                        Jan 30, 2024 17:10:49.336455107 CET4975118227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:49.338367939 CET182274975018.197.239.5192.168.2.4
                                        Jan 30, 2024 17:10:49.338670969 CET4975118227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:49.541121006 CET182274975118.197.239.5192.168.2.4
                                        Jan 30, 2024 17:10:49.541183949 CET4975118227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:49.743701935 CET182274975118.197.239.5192.168.2.4
                                        Jan 30, 2024 17:10:49.991692066 CET4975118227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:50.194586039 CET182274975118.197.239.5192.168.2.4
                                        Jan 30, 2024 17:10:58.138649940 CET4975118227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:10:58.341072083 CET182274975118.197.239.5192.168.2.4
                                        Jan 30, 2024 17:11:02.507663012 CET182274975118.197.239.5192.168.2.4
                                        Jan 30, 2024 17:11:02.507812023 CET4975118227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:11:04.522767067 CET4975118227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:11:04.524475098 CET4975218227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:11:04.725284100 CET182274975118.197.239.5192.168.2.4
                                        Jan 30, 2024 17:11:04.728880882 CET182274975218.197.239.5192.168.2.4
                                        Jan 30, 2024 17:11:04.730376005 CET4975218227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:11:04.732770920 CET4975218227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:11:04.937268019 CET182274975218.197.239.5192.168.2.4
                                        Jan 30, 2024 17:11:04.938710928 CET4975218227192.168.2.418.197.239.5
                                        Jan 30, 2024 17:11:05.143266916 CET182274975218.197.239.5192.168.2.4

                                        UDP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Jan 30, 2024 17:07:17.994070053 CET5513953192.168.2.41.1.1.1
                                        Jan 30, 2024 17:07:18.113529921 CET53551391.1.1.1192.168.2.4
                                        Jan 30, 2024 17:08:27.322241068 CET5530753192.168.2.41.1.1.1
                                        Jan 30, 2024 17:08:27.442148924 CET53553071.1.1.1192.168.2.4
                                        Jan 30, 2024 17:09:31.462668896 CET5106153192.168.2.41.1.1.1
                                        Jan 30, 2024 17:09:31.583060980 CET53510611.1.1.1192.168.2.4
                                        Jan 30, 2024 17:10:39.820972919 CET6405753192.168.2.41.1.1.1
                                        Jan 30, 2024 17:10:39.940418959 CET53640571.1.1.1192.168.2.4

                                        DNS Queries

                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                        Jan 30, 2024 17:07:17.994070053 CET192.168.2.41.1.1.10x82f2Standard query (0)2.tcp.eu.ngrok.ioA (IP address)IN (0x0001)false
                                        Jan 30, 2024 17:08:27.322241068 CET192.168.2.41.1.1.10x283Standard query (0)2.tcp.eu.ngrok.ioA (IP address)IN (0x0001)false
                                        Jan 30, 2024 17:09:31.462668896 CET192.168.2.41.1.1.10x8cd3Standard query (0)2.tcp.eu.ngrok.ioA (IP address)IN (0x0001)false
                                        Jan 30, 2024 17:10:39.820972919 CET192.168.2.41.1.1.10x8034Standard query (0)2.tcp.eu.ngrok.ioA (IP address)IN (0x0001)false

                                        DNS Answers

                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                        Jan 30, 2024 17:07:18.113529921 CET1.1.1.1192.168.2.40x82f2No error (0)2.tcp.eu.ngrok.io3.127.138.57A (IP address)IN (0x0001)false
                                        Jan 30, 2024 17:08:27.442148924 CET1.1.1.1192.168.2.40x283No error (0)2.tcp.eu.ngrok.io3.127.138.57A (IP address)IN (0x0001)false
                                        Jan 30, 2024 17:09:31.583060980 CET1.1.1.1192.168.2.40x8cd3No error (0)2.tcp.eu.ngrok.io18.192.93.86A (IP address)IN (0x0001)false
                                        Jan 30, 2024 17:10:39.940418959 CET1.1.1.1192.168.2.40x8034No error (0)2.tcp.eu.ngrok.io18.197.239.5A (IP address)IN (0x0001)false

                                        Statistics

                                        CPU Usage

                                        Click to jump to process

                                        Memory Usage

                                        Click to jump to process

                                        High Level Behavior Distribution

                                        Click to dive into process behavior distribution

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        General

                                        Target ID:0
                                        Start time:17:07:00
                                        Start date:30/01/2024
                                        Path:C:\Users\user\Desktop\R3ov8eFFFP.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Users\user\Desktop\R3ov8eFFFP.exe
                                        Imagebase:0x460000
                                        File size:37'888 bytes
                                        MD5 hash:0A7D2BBBE2960FF24B9273036FC472DA
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
                                        • Rule: njrat1, Description: Identify njRat, Source: 00000000.00000000.1688476254.0000000000462000.00000002.00000001.01000000.00000003.sdmp, Author: Brian Wallace @botnet_hunter
                                        Reputation:low
                                        Has exited:true

                                        General

                                        Target ID:1
                                        Start time:17:07:07
                                        Start date:30/01/2024
                                        Path:C:\Users\user\AppData\Roaming\ESET Service.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\AppData\Roaming\ESET Service.exe"
                                        Imagebase:0xdd0000
                                        File size:37'888 bytes
                                        MD5 hash:0A7D2BBBE2960FF24B9273036FC472DA
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: Joe Security
                                        • Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: unknown
                                        • Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: Brian Wallace @botnet_hunter
                                        • Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\ESET Service.exe, Author: ditekSHen
                                        Antivirus matches:
                                        • Detection: 100%, Avira
                                        • Detection: 100%, Joe Sandbox ML
                                        • Detection: 97%, ReversingLabs
                                        Reputation:low
                                        Has exited:false

                                        General

                                        Target ID:3
                                        Start time:17:07:13
                                        Start date:30/01/2024
                                        Path:C:\Windows\SysWOW64\netsh.exe
                                        Wow64 process (32bit):true
                                        Commandline:netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\ESET Service.exe" "ESET Service.exe" ENABLE
                                        Imagebase:0x1560000
                                        File size:82'432 bytes
                                        MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:moderate
                                        Has exited:true

                                        General

                                        Target ID:4
                                        Start time:17:07:13
                                        Start date:30/01/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff7699e0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:5
                                        Start time:17:07:13
                                        Start date:30/01/2024
                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                        Wow64 process (32bit):true
                                        Commandline:taskkill /F /IM taskmgr.exe
                                        Imagebase:0xd30000
                                        File size:74'240 bytes
                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:moderate
                                        Has exited:true

                                        General

                                        Target ID:6
                                        Start time:17:07:13
                                        Start date:30/01/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff7699e0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:10
                                        Start time:17:07:25
                                        Start date:30/01/2024
                                        Path:C:\Users\user\AppData\Roaming\ESET Service.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\AppData\Roaming\ESET Service.exe" ..
                                        Imagebase:0x250000
                                        File size:37'888 bytes
                                        MD5 hash:0A7D2BBBE2960FF24B9273036FC472DA
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Reputation:low
                                        Has exited:true

                                        General

                                        Target ID:11
                                        Start time:17:07:33
                                        Start date:30/01/2024
                                        Path:C:\Users\user\AppData\Roaming\ESET Service.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\AppData\Roaming\ESET Service.exe" ..
                                        Imagebase:0x4c0000
                                        File size:37'888 bytes
                                        MD5 hash:0A7D2BBBE2960FF24B9273036FC472DA
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Reputation:low
                                        Has exited:true

                                        General

                                        Target ID:12
                                        Start time:17:07:42
                                        Start date:30/01/2024
                                        Path:C:\Users\user\AppData\Roaming\ESET Service.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\AppData\Roaming\ESET Service.exe" ..
                                        Imagebase:0x690000
                                        File size:37'888 bytes
                                        MD5 hash:0A7D2BBBE2960FF24B9273036FC472DA
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Reputation:low
                                        Has exited:true

                                        Disassembly

                                        Reset < >

                                          Execution Graph

                                          Execution Coverage:8.3%
                                          Dynamic/Decrypted Code Coverage:100%
                                          Signature Coverage:0%
                                          Total number of Nodes:37
                                          Total number of Limit Nodes:1
                                          execution_graph 1751 c3a462 1753 c3a486 RegSetValueExW 1751->1753 1754 c3a507 1753->1754 1755 c3a361 1756 c3a392 RegQueryValueExW 1755->1756 1758 c3a41b 1756->1758 1759 c3aa07 1760 c3aa3e CopyFileW 1759->1760 1762 c3aa8e 1760->1762 1723 c3a8c6 1725 c3a8ef SetFileAttributesW 1723->1725 1726 c3a90b 1725->1726 1727 c3ac46 1728 c3ac6c ShellExecuteExW 1727->1728 1730 c3ac88 1728->1730 1731 c3a646 1733 c3a67e CreateMutexW 1731->1733 1734 c3a6c1 1733->1734 1767 c3a8a4 1770 c3a8c6 SetFileAttributesW 1767->1770 1769 c3a90b 1770->1769 1771 c3ac24 1773 c3ac46 ShellExecuteExW 1771->1773 1774 c3ac88 1773->1774 1747 c3a2d2 1750 c3a2d6 SetErrorMode 1747->1750 1749 c3a33f 1750->1749 1763 c3a612 1765 c3a646 CreateMutexW 1763->1765 1766 c3a6c1 1765->1766 1739 c3a2fe 1740 c3a353 1739->1740 1741 c3a32a SetErrorMode 1739->1741 1740->1741 1742 c3a33f 1741->1742 1743 c3aa3e 1745 c3aa67 CopyFileW 1743->1745 1746 c3aa8e 1745->1746

                                          Callgraph

                                          • Executed
                                          • Not Executed
                                          • Opacity -> Relevance
                                          • Disassembly available
                                          callgraph 0 Function_00C3A540 1 Function_00C3A7C7 2 Function_00C3ACC7 3 Function_00C3A646 4 Function_00C3A8C6 5 Function_00C3AC46 6 Function_00C32044 7 Function_00F8067F 8 Function_00F80074 9 Function_00C3AACF 10 Function_00C3A74E 11 Function_00C3A2D2 12 Function_00C3A952 13 Function_00F207E0 14 Function_00F8066A 15 Function_00C320D0 16 Function_00F8026D 17 Function_00F805E0 18 Function_00C32458 19 Function_00C3A25E 20 Function_00C3A45C 21 Function_00C3A462 22 Function_00F20F50 23 Function_00C3A361 24 Function_00C3AAE1 25 Function_00C32867 26 Function_00C32264 27 Function_00C32364 28 Function_00F20E55 29 Function_00F2075B 30 Function_00F20F58 31 Function_00C326EF 32 Function_00C3A56E 33 Function_00F80055 34 Function_00F80648 34->14 35 Function_00C3A172 36 Function_00F20D40 37 Function_00C321F0 38 Function_00C323F4 39 Function_00F805CF 40 Function_00C3A1F4 41 Function_00C3AB74 42 Function_00C3ACFA 43 Function_00C3A078 44 Function_00C3A2FE 45 Function_00C3A97E 46 Function_00C3247C 47 Function_00F80739 48 Function_00C32500 49 Function_00C3AA07 50 Function_00C3A486 51 Function_00C3AB06 52 Function_00C32586 53 Function_00C32005 54 Function_00C3A005 55 Function_00F805BF 56 Function_00F20938 56->17 89 Function_00F80606 56->89 57 Function_00F203BD 57->17 57->56 57->89 58 Function_00F20C22 59 Function_00C3A392 60 Function_00C3A612 61 Function_00C3AC11 62 Function_00C32310 63 Function_00C3A710 64 Function_00C32194 65 Function_00C32494 66 Function_00C3A09A 67 Function_00F20BA8 68 Function_00C32098 69 Function_00C3A81E 70 Function_00C3AB9E 71 Function_00F20310 71->17 71->56 71->89 72 Function_00C3A120 73 Function_00F20014 74 Function_00C3A8A4 75 Function_00C3AC24 76 Function_00F80710 77 Function_00F20D98 78 Function_00F20699 79 Function_00C3A02E 80 Function_00F20B03 81 Function_00C32430 82 Function_00F20301 82->17 82->56 82->89 83 Function_00F20707 84 Function_00F20F05 85 Function_00F80000 86 Function_00F20889 86->17 86->89 87 Function_00C3AA3E 88 Function_00C326BE 90 Function_00C3253D 91 Function_00C323BC 92 Function_00C3213C 93 Function_00F20C8D 94 Function_00C3A23C

                                          Executed Functions

                                          Function 00F20938 Relevance: 1.7, Strings: 1, Instructions: 492COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 0 f20938-f20993 2 f20999-f20a22 0->2 3 f20a2e-f20a30 0->3 153 f20a24 call f805e0 2->153 154 f20a24 call f80606 2->154 4 f20a37-f20a3c 3->4 5 f20a42-f20a7a 4->5 6 f20b1e-f20bc2 4->6 23 f20aa1-f20afc 5->23 24 f20a7c-f20a9a 5->24 44 f20bc8-f20c8b 6->44 45 f20c9e-f20ca7 6->45 62 f20b01 23->62 24->23 43 f20a2a-f20a2c 43->3 46 f20a32 43->46 44->45 48 f20d51-f20d5a 45->48 49 f20cad-f20d3e 45->49 46->4 50 f20d7a-f20d83 48->50 51 f20d5c-f20d73 48->51 49->48 53 f20d85-f20d96 50->53 54 f20da9-f20db2 50->54 51->50 53->54 58 f20f33-f20f3a 54->58 59 f20db8-f20e06 54->59 80 f20f1c-f20f2d 59->80 62->6 80->58 82 f20e0b-f20e14 80->82 84 f20f40-f20fd1 82->84 85 f20e1a-f20f1a 82->85 115 f20fd7-f20fe8 84->115 116 f210ca 84->116 85->80 135 f20f3b 85->135 123 f20fea-f2100b 115->123 118 f210cc-f210d3 116->118 131 f21012-f21048 123->131 132 f2100d 123->132 140 f2104a 131->140 141 f2104f-f21077 131->141 132->131 135->84 140->141 145 f21079-f2107b 141->145 146 f2107d-f210a1 141->146 145->118 149 f210a3-f210a8 146->149 150 f210aa-f210b4 146->150 149->118 151 f210b6-f210b8 150->151 152 f210ba-f210c4 150->152 151->118 152->116 152->123 153->43 154->43
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758491022.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_f20000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k
                                          • API String ID: 0-2277858631
                                          • Opcode ID: 7575f7c097ce47f88768cd45b3ca5ad578251330a0da71351cfe3b3628d3ece5
                                          • Instruction ID: 908bb332ba6ddafb691d75e4841b1be566db51307d96361fd29709b6498d00e9
                                          • Opcode Fuzzy Hash: 7575f7c097ce47f88768cd45b3ca5ad578251330a0da71351cfe3b3628d3ece5
                                          • Instruction Fuzzy Hash: 6A028C357002108FCB14EB78E5517AE77E2EF89308F204469D406DBBAAEF399C46DB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3A612 Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 155 c3a612-c3a695 159 c3a697 155->159 160 c3a69a-c3a6a3 155->160 159->160 161 c3a6a5 160->161 162 c3a6a8-c3a6b1 160->162 161->162 163 c3a6b3-c3a6d7 CreateMutexW 162->163 164 c3a702-c3a707 162->164 167 c3a709-c3a70e 163->167 168 c3a6d9-c3a6ff 163->168 164->163 167->168
                                          APIs
                                          • CreateMutexW.KERNELBASE(?,?), ref: 00C3A6B9
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID:
                                          • API String ID: 1964310414-0
                                          • Opcode ID: 942564cce38e0cc492a7e40fef3470298ae7713e2896b22f84c895802ad028e7
                                          • Instruction ID: d092247da9f85ab8f3f3a8d682fa79c5ea1e006d6aa79edb38f64906740c8f68
                                          • Opcode Fuzzy Hash: 942564cce38e0cc492a7e40fef3470298ae7713e2896b22f84c895802ad028e7
                                          • Instruction Fuzzy Hash: 653193B55093805FE712CB65DC85B96FFF8EF06310F08849AE984CB692D375E909C762
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3A361 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 171 c3a361-c3a3cf 174 c3a3d1 171->174 175 c3a3d4-c3a3dd 171->175 174->175 176 c3a3e2-c3a3e8 175->176 177 c3a3df 175->177 178 c3a3ea 176->178 179 c3a3ed-c3a404 176->179 177->176 178->179 181 c3a406-c3a419 RegQueryValueExW 179->181 182 c3a43b-c3a440 179->182 183 c3a442-c3a447 181->183 184 c3a41b-c3a438 181->184 182->181 183->184
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,027957DE,00000000,00000000,00000000,00000000), ref: 00C3A40C
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: b2107d4be893dd8879c04c03f26f5d847342cafcf1d302f83e6c004c53e0e848
                                          • Instruction ID: 3b60f2f5d63fe6d3f205756c8f921dad78a31141dd2066fb3688af5fabcbe11c
                                          • Opcode Fuzzy Hash: b2107d4be893dd8879c04c03f26f5d847342cafcf1d302f83e6c004c53e0e848
                                          • Instruction Fuzzy Hash: 8A318175508740AFE722CF11CC84F92BBF8EF06710F08849AE9858B692D364E949CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3A462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 188 c3a462-c3a4c3 191 c3a4c5 188->191 192 c3a4c8-c3a4d4 188->192 191->192 193 c3a4d6 192->193 194 c3a4d9-c3a4f0 192->194 193->194 196 c3a4f2-c3a505 RegSetValueExW 194->196 197 c3a527-c3a52c 194->197 198 c3a507-c3a524 196->198 199 c3a52e-c3a533 196->199 197->196 199->198
                                          APIs
                                          • RegSetValueExW.KERNELBASE(?,00000E24,027957DE,00000000,00000000,00000000,00000000), ref: 00C3A4F8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: Value
                                          • String ID:
                                          • API String ID: 3702945584-0
                                          • Opcode ID: 1465d4c1d666dd5afe4fe72787b797e49430fb5b1b06aac9090545223a121360
                                          • Instruction ID: 028068f268634409126651099c511ccbab23d092a9b4c00a8a491368081b90e2
                                          • Opcode Fuzzy Hash: 1465d4c1d666dd5afe4fe72787b797e49430fb5b1b06aac9090545223a121360
                                          • Instruction Fuzzy Hash: FE2192725087806FD7228F51DC45FA7BFB8EF46610F08849AE985CB652D264E948C7B1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3AA07 Relevance: 1.6, APIs: 1, Instructions: 72fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 218 c3aa07-c3aa65 220 c3aa67 218->220 221 c3aa6a-c3aa70 218->221 220->221 222 c3aa72 221->222 223 c3aa75-c3aa7e 221->223 222->223 224 c3aac1-c3aac6 223->224 225 c3aa80-c3aaa0 CopyFileW 223->225 224->225 228 c3aaa2-c3aabe 225->228 229 c3aac8-c3aacd 225->229 229->228
                                          APIs
                                          • CopyFileW.KERNELBASE(?,?,?), ref: 00C3AA86
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: CopyFile
                                          • String ID:
                                          • API String ID: 1304948518-0
                                          • Opcode ID: 38cec0a7ebfad9499e5e5af2202756a3637e2ea2c2fab471716f6999f4c8683b
                                          • Instruction ID: 8ff234e04c61d03d4e4cd26f4d8a4378c44b902613f586683df3631234d421f5
                                          • Opcode Fuzzy Hash: 38cec0a7ebfad9499e5e5af2202756a3637e2ea2c2fab471716f6999f4c8683b
                                          • Instruction Fuzzy Hash: C621B3B25043809FE711CB25DD45B52BFF8EF06310F0984DAE884CB163D234DA08CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3A646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 203 c3a646-c3a695 206 c3a697 203->206 207 c3a69a-c3a6a3 203->207 206->207 208 c3a6a5 207->208 209 c3a6a8-c3a6b1 207->209 208->209 210 c3a6b3-c3a6bb CreateMutexW 209->210 211 c3a702-c3a707 209->211 213 c3a6c1-c3a6d7 210->213 211->210 214 c3a709-c3a70e 213->214 215 c3a6d9-c3a6ff 213->215 214->215
                                          APIs
                                          • CreateMutexW.KERNELBASE(?,?), ref: 00C3A6B9
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID:
                                          • API String ID: 1964310414-0
                                          • Opcode ID: 066aeff3661ff39a3c4206eb330e9dbe55bf18e8858da0e7e305958e37f40469
                                          • Instruction ID: 08d875b38419c60908ba2d1332c89694d8dd46e0274232e89dc5b08aeac86bcf
                                          • Opcode Fuzzy Hash: 066aeff3661ff39a3c4206eb330e9dbe55bf18e8858da0e7e305958e37f40469
                                          • Instruction Fuzzy Hash: 6A21C5716042009FE710CF66CD85BA6FBE8EF04310F088469E9848B741D375E919CA72
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3A392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 231 c3a392-c3a3cf 233 c3a3d1 231->233 234 c3a3d4-c3a3dd 231->234 233->234 235 c3a3e2-c3a3e8 234->235 236 c3a3df 234->236 237 c3a3ea 235->237 238 c3a3ed-c3a404 235->238 236->235 237->238 240 c3a406-c3a419 RegQueryValueExW 238->240 241 c3a43b-c3a440 238->241 242 c3a442-c3a447 240->242 243 c3a41b-c3a438 240->243 241->240 242->243
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,027957DE,00000000,00000000,00000000,00000000), ref: 00C3A40C
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: 4bb01191bf804f934b2909029c7fa524d48ca994415ab7fe80bc30425854a2a7
                                          • Instruction ID: 0d2f173ddaa9cfd3b6a086cd7a52d3d4fe0f43877d408e307335d4ef3e61d691
                                          • Opcode Fuzzy Hash: 4bb01191bf804f934b2909029c7fa524d48ca994415ab7fe80bc30425854a2a7
                                          • Instruction Fuzzy Hash: 2121D2766003049FE720CF12CC84FA2F7ECEF04710F08845AE985CB651D360E959CAB2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3A486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 247 c3a486-c3a4c3 249 c3a4c5 247->249 250 c3a4c8-c3a4d4 247->250 249->250 251 c3a4d6 250->251 252 c3a4d9-c3a4f0 250->252 251->252 254 c3a4f2-c3a505 RegSetValueExW 252->254 255 c3a527-c3a52c 252->255 256 c3a507-c3a524 254->256 257 c3a52e-c3a533 254->257 255->254 257->256
                                          APIs
                                          • RegSetValueExW.KERNELBASE(?,00000E24,027957DE,00000000,00000000,00000000,00000000), ref: 00C3A4F8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: Value
                                          • String ID:
                                          • API String ID: 3702945584-0
                                          • Opcode ID: 1ee532fd43bd4612a96b6bd5df9909c1788c754ffb58bdfd1c75c98c2541aaf6
                                          • Instruction ID: 94ddc516f04c72a6ae70baa22f1624aa87833c10d84eda8b5cbad0903bd8f833
                                          • Opcode Fuzzy Hash: 1ee532fd43bd4612a96b6bd5df9909c1788c754ffb58bdfd1c75c98c2541aaf6
                                          • Instruction Fuzzy Hash: 6C11B172500600AFEB218E11DC45FA6FBECEF14714F08845AED458AA41D360E9588AB2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3A2D2 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 261 c3a2d2-c3a2d4 262 c3a2d6-c3a2dd 261->262 263 c3a2de-c3a328 261->263 262->263 265 c3a353-c3a358 263->265 266 c3a32a-c3a33d SetErrorMode 263->266 265->266 267 c3a35a-c3a35f 266->267 268 c3a33f-c3a352 266->268 267->268
                                          APIs
                                          • SetErrorMode.KERNELBASE(?), ref: 00C3A330
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: ErrorMode
                                          • String ID:
                                          • API String ID: 2340568224-0
                                          • Opcode ID: 89ae45e60c27eed1fc3d25528d6b8f1a34fede6c807360fcb7f3e88701c49353
                                          • Instruction ID: 7d0c60761972797487a7da92081d91773b623a70d4b65d7eef2aa8d6ba192e7f
                                          • Opcode Fuzzy Hash: 89ae45e60c27eed1fc3d25528d6b8f1a34fede6c807360fcb7f3e88701c49353
                                          • Instruction Fuzzy Hash: B7214F7140D3C09FD7138B25DC55A62BFB49F47624F0D80DBDD858F1A3C265A918DB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3AC24 Relevance: 1.6, APIs: 1, Instructions: 60COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 271 c3ac24-c3ac6a 273 c3ac6f-c3ac78 271->273 274 c3ac6c 271->274 275 c3ac7a-c3ac9a ShellExecuteExW 273->275 276 c3acb9-c3acbe 273->276 274->273 279 c3acc0-c3acc5 275->279 280 c3ac9c-c3acb8 275->280 276->275 279->280
                                          APIs
                                          • ShellExecuteExW.SHELL32(?), ref: 00C3AC80
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: ExecuteShell
                                          • String ID:
                                          • API String ID: 587946157-0
                                          • Opcode ID: 86690d9fc1056f1bbc5be24cf6c0246a12c4c2edf67bbafcc6d6cb45c4d9c862
                                          • Instruction ID: 86eb1a35befc077720f1d21f5c69c427c1c785b08d4a665d766fdb704f74c315
                                          • Opcode Fuzzy Hash: 86690d9fc1056f1bbc5be24cf6c0246a12c4c2edf67bbafcc6d6cb45c4d9c862
                                          • Instruction Fuzzy Hash: 531163755093809FD712CB25DC95B52BFB8DF46210F0884EAED85CB652D265E908CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3A8A4 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 282 c3a8a4-c3a8ed 284 c3a8f2-c3a8fb 282->284 285 c3a8ef 282->285 286 c3a8fd-c3a91d SetFileAttributesW 284->286 287 c3a93c-c3a941 284->287 285->284 290 c3a943-c3a948 286->290 291 c3a91f-c3a93b 286->291 287->286 290->291
                                          APIs
                                          • SetFileAttributesW.KERNELBASE(?,?), ref: 00C3A903
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: AttributesFile
                                          • String ID:
                                          • API String ID: 3188754299-0
                                          • Opcode ID: 5b407ed11b024e75ca6507a2100152a8bb269a36cce6890893ac489ad9cb4fc3
                                          • Instruction ID: d10055e65b8298fc0da82ad36173f33a3fa9d413fc1d8a27725bdef35643a9fc
                                          • Opcode Fuzzy Hash: 5b407ed11b024e75ca6507a2100152a8bb269a36cce6890893ac489ad9cb4fc3
                                          • Instruction Fuzzy Hash: BE11B2716043809FDB11CF25DC85B56BFE8EF46220F0984AAEC85CB652D274E948CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3AA3E Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 293 c3aa3e-c3aa65 294 c3aa67 293->294 295 c3aa6a-c3aa70 293->295 294->295 296 c3aa72 295->296 297 c3aa75-c3aa7e 295->297 296->297 298 c3aac1-c3aac6 297->298 299 c3aa80-c3aa88 CopyFileW 297->299 298->299 301 c3aa8e-c3aaa0 299->301 302 c3aaa2-c3aabe 301->302 303 c3aac8-c3aacd 301->303 303->302
                                          APIs
                                          • CopyFileW.KERNELBASE(?,?,?), ref: 00C3AA86
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: CopyFile
                                          • String ID:
                                          • API String ID: 1304948518-0
                                          • Opcode ID: bd00a02a52e75945886670332c7c1892414bdafdbe6fda93310ea6c4a8ac8806
                                          • Instruction ID: e71e895eb4da6a3170978d3b14e85bea9f17f36140ac21f107b38f0cd85872f5
                                          • Opcode Fuzzy Hash: bd00a02a52e75945886670332c7c1892414bdafdbe6fda93310ea6c4a8ac8806
                                          • Instruction Fuzzy Hash: 4411A1726003009FEB60CF66D985B66FBE8EF14720F08846ADC89CB751D275E924DF62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3A8C6 Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 305 c3a8c6-c3a8ed 306 c3a8f2-c3a8fb 305->306 307 c3a8ef 305->307 308 c3a8fd-c3a905 SetFileAttributesW 306->308 309 c3a93c-c3a941 306->309 307->306 310 c3a90b-c3a91d 308->310 309->308 312 c3a943-c3a948 310->312 313 c3a91f-c3a93b 310->313 312->313
                                          APIs
                                          • SetFileAttributesW.KERNELBASE(?,?), ref: 00C3A903
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: AttributesFile
                                          • String ID:
                                          • API String ID: 3188754299-0
                                          • Opcode ID: 0a055c9e99ac808cef72cd95eb2e6e90defc76075b2a9ddb8f70777c544191bf
                                          • Instruction ID: ccdc90f533244bd99268df682ad26383a323916bec16bc532fb94de0d509828a
                                          • Opcode Fuzzy Hash: 0a055c9e99ac808cef72cd95eb2e6e90defc76075b2a9ddb8f70777c544191bf
                                          • Instruction Fuzzy Hash: F701B5716003048FEB10CF26D885766FBE8EF18324F08C4AADD85DB742D275D954CBA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3AC46 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 315 c3ac46-c3ac6a 316 c3ac6f-c3ac78 315->316 317 c3ac6c 315->317 318 c3ac7a-c3ac82 ShellExecuteExW 316->318 319 c3acb9-c3acbe 316->319 317->316 320 c3ac88-c3ac9a 318->320 319->318 322 c3acc0-c3acc5 320->322 323 c3ac9c-c3acb8 320->323 322->323
                                          APIs
                                          • ShellExecuteExW.SHELL32(?), ref: 00C3AC80
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: ExecuteShell
                                          • String ID:
                                          • API String ID: 587946157-0
                                          • Opcode ID: 7deb27a79e48a11b1438c608e1bfe79fb7dc9cf28a45142bf8edb25c60594670
                                          • Instruction ID: 7667b9290741a2bb92eeed16b78d307e6d956805a4d10d3ac80f20c45e25a39a
                                          • Opcode Fuzzy Hash: 7deb27a79e48a11b1438c608e1bfe79fb7dc9cf28a45142bf8edb25c60594670
                                          • Instruction Fuzzy Hash: 600192716042008FEB10CF56E885766FBD8EF05320F08C4AADD49CB756D376E914CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C3A2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 325 c3a2fe-c3a328 326 c3a353-c3a358 325->326 327 c3a32a-c3a33d SetErrorMode 325->327 326->327 328 c3a35a-c3a35f 327->328 329 c3a33f-c3a352 327->329 328->329
                                          APIs
                                          • SetErrorMode.KERNELBASE(?), ref: 00C3A330
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758094013.0000000000C3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c3a000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID: ErrorMode
                                          • String ID:
                                          • API String ID: 2340568224-0
                                          • Opcode ID: 0608db5b75930385868617116d45b314ab558fb7ddbd3a2157abc83d2ddd0811
                                          • Instruction ID: 7a34bcf14d883348bfeddc0c41095f8366cc0fc25c26077936e14820fc254cc6
                                          • Opcode Fuzzy Hash: 0608db5b75930385868617116d45b314ab558fb7ddbd3a2157abc83d2ddd0811
                                          • Instruction Fuzzy Hash: 99F0FF31904200CFEB608F0AD885761FBE0EF14320F08C09ACD890B762D2B5E918CAA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00F20310 Relevance: .2, Instructions: 190COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758491022.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_f20000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 23c702e7c3280c05dcd8485a237230125176c5c7640159c18a10186f4ddd812b
                                          • Instruction ID: 69b37955b5990797296e22715affef643f1d536a511d8d2f73aa5a03b29a6737
                                          • Opcode Fuzzy Hash: 23c702e7c3280c05dcd8485a237230125176c5c7640159c18a10186f4ddd812b
                                          • Instruction Fuzzy Hash: 375126317002118FCB08EB7994517BE77E6ABC9308B144569E402CF7E6DF39DD0A9BA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00F20014 Relevance: .2, Instructions: 180COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758491022.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_f20000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a01d110615afc41f0ad89a10f85cc9f2b631a03d02eeeb60e67ab69f35a69020
                                          • Instruction ID: 92da84d4636500daea3a834d62dbabf137e9f4e0dcc34ceee37397af7eacaff1
                                          • Opcode Fuzzy Hash: a01d110615afc41f0ad89a10f85cc9f2b631a03d02eeeb60e67ab69f35a69020
                                          • Instruction Fuzzy Hash: 8471953011A3C18FC705EB79EA555893BB2FFA610C345859AD0458FAAFDB345D0ECBA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00F203BD Relevance: .1, Instructions: 135COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758491022.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_f20000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4e53e5551fe4942c1687458bcd22213c6c8d35471d618d492adf8d5cb06a7493
                                          • Instruction ID: 1f72009b6ff213a5423cb352d7204a574fd06e3d806f6595514c112333a071ba
                                          • Opcode Fuzzy Hash: 4e53e5551fe4942c1687458bcd22213c6c8d35471d618d492adf8d5cb06a7493
                                          • Instruction Fuzzy Hash: 28411431B001114BCB08ABB994517BD76D3AFC9308B144029E002DFBA6DF79CE0AA7B2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00F805E0 Relevance: .0, Instructions: 44COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758520827.0000000000F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_f80000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0b5d60fcf80831a9ef5f86292f882c7c5fc06d2910d296fb19240b8daeef838e
                                          • Instruction ID: 6672d3bfb384e5839b00cb953e7a34cc9b3e9d5f853c9325fa1e694ec8ef8ee0
                                          • Opcode Fuzzy Hash: 0b5d60fcf80831a9ef5f86292f882c7c5fc06d2910d296fb19240b8daeef838e
                                          • Instruction Fuzzy Hash: 0D01D6B55093806FD7128B15AC41862FFB8EF86520709849FEC498BA52C225E909CBB2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00F20889 Relevance: .0, Instructions: 42COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758491022.0000000000F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F20000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_f20000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e9e8a13c8e37c8d67c9b1c8e322f76d3367727f5a921c9a71a8d21a289623f5b
                                          • Instruction ID: 7570fccf794921f64bfec9ae2402021ff9a316f5978925be8561c29b72ac8558
                                          • Opcode Fuzzy Hash: e9e8a13c8e37c8d67c9b1c8e322f76d3367727f5a921c9a71a8d21a289623f5b
                                          • Instruction Fuzzy Hash: 1D0121746042428FCB04FB78D55955DBBF1FF9630CB40886DE586CB7A9EB3098099B93
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00F80606 Relevance: .0, Instructions: 27COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758520827.0000000000F80000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_f80000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9e428e8729747a1b66af7d6fdcef4c1cdfcaf61d31be47e816ee01217e64ed60
                                          • Instruction ID: fd47fcbc92ba833f2dc027022e089e417b38c7ee7b7247b405dc4dae1dfd5530
                                          • Opcode Fuzzy Hash: 9e428e8729747a1b66af7d6fdcef4c1cdfcaf61d31be47e816ee01217e64ed60
                                          • Instruction Fuzzy Hash: 80E092B66007049BD750CF0AFD81452F7D8EB84630B18C47FDC0D8BB01D276B508CAA5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C323F4 Relevance: .0, Instructions: 15COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758081376.0000000000C32000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C32000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c32000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3139449d67ef6dcd546a933e423bfeb17c995a6044ca34c0f2118c9fbd22e145
                                          • Instruction ID: b2b71043cce8130b38647725eca4bb3312774591c1094597bb59628076e0e79b
                                          • Opcode Fuzzy Hash: 3139449d67ef6dcd546a933e423bfeb17c995a6044ca34c0f2118c9fbd22e145
                                          • Instruction Fuzzy Hash: B2D05E79215AC14FD7169A1CC1A4B9537D4AB61714F4A44F9A8008B763C768EAC1E640
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00C323BC Relevance: .0, Instructions: 14COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1758081376.0000000000C32000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C32000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_c32000_R3ov8eFFFP.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b6320a1172894cdb356a9c64eaee2ad9f819664564484dbff7653b7058b373f4
                                          • Instruction ID: 15848f87d8a6a4aca7a48fa455f0fe466c84402e477cb9468ef764b0a45352fa
                                          • Opcode Fuzzy Hash: b6320a1172894cdb356a9c64eaee2ad9f819664564484dbff7653b7058b373f4
                                          • Instruction Fuzzy Hash: 2DD05E352406814BCB15DA0CC6D4F5977D8AB50B14F0644E8AC208B772C7A8E9C0CA00
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Execution Graph

                                          Execution Coverage:20.7%
                                          Dynamic/Decrypted Code Coverage:91.3%
                                          Signature Coverage:5.1%
                                          Total number of Nodes:277
                                          Total number of Limit Nodes:11
                                          execution_graph 7196 15eac5a 7197 15eac92 CreateFileW 7196->7197 7199 15eace1 7197->7199 7420 15ea09a 7421 15ea0cf send 7420->7421 7422 15ea107 7420->7422 7423 15ea0dd 7421->7423 7422->7421 7200 15eb1d6 7203 15eb1ff SetFileAttributesW 7200->7203 7202 15eb21b 7203->7202 7424 58e0346 7425 58e037b NtQuerySystemInformation 7424->7425 7426 58e03a6 7424->7426 7427 58e0390 7425->7427 7426->7425 7428 58e2e46 7429 58e2e6f select 7428->7429 7431 58e2ea4 7429->7431 7204 15eab52 7205 15eab8a RegOpenKeyExW 7204->7205 7207 15eabe0 7205->7207 7208 15eb352 7211 15eb37b CopyFileW 7208->7211 7210 15eb3a2 7211->7210 7212 58e0282 7213 58e02ae K32EnumProcesses 7212->7213 7215 58e02ca 7213->7215 7216 58e1682 7218 58e16b7 shutdown 7216->7218 7219 58e16e0 7218->7219 7220 58e0e02 7223 58e0e3a WSASocketW 7220->7223 7222 58e0e76 7223->7222 7436 15ea392 7439 15ea3c7 RegQueryValueExW 7436->7439 7438 15ea41b 7439->7438 7224 15ea74e 7225 15ea77a FindCloseChangeNotification 7224->7225 7226 15ea7b9 7224->7226 7227 15ea788 7225->7227 7226->7225 7228 58e1b1e 7229 58e1b53 WSAConnect 7228->7229 7231 58e1b72 7229->7231 7440 58e13de 7441 58e1416 MapViewOfFile 7440->7441 7443 58e1465 7441->7443 7232 58e2b9a 7233 58e2bd2 RegCreateKeyExW 7232->7233 7235 58e2c44 7233->7235 7236 58e2f1a 7238 58e2f4f GetProcessWorkingSetSize 7236->7238 7239 58e2f7b 7238->7239 7444 559158f 7446 5591595 7444->7446 7445 5591a0b 7447 5591ecf 6 API calls 7445->7447 7448 5591e41 6 API calls 7445->7448 7449 5591eb1 6 API calls 7445->7449 7450 5591ee2 6 API calls 7445->7450 7446->7445 7451 15eb51a GetLogicalDrives 7446->7451 7452 15eb572 GetLogicalDrives 7446->7452 7447->7445 7448->7445 7449->7445 7450->7445 7451->7446 7452->7446 7240 15ea646 7241 15ea67e CreateMutexW 7240->7241 7243 15ea6c1 7241->7243 7453 15eaa06 7454 15eaa35 WaitForInputIdle 7453->7454 7456 15eaa6b 7453->7456 7455 15eaa43 7454->7455 7456->7454 7457 15ea486 7458 15ea4bb RegSetValueExW 7457->7458 7460 15ea507 7458->7460 7461 58e1852 7464 58e1887 GetProcessTimes 7461->7464 7463 58e18b9 7464->7463 7465 5590006 7466 5590076 7465->7466 7470 5590310 2 API calls 7465->7470 7473 55905d7 7465->7473 7477 5590634 7465->7477 7481 5590301 7465->7481 7485 55903bd 7465->7485 7489 5590509 7465->7489 7470->7466 7474 55905e4 7473->7474 7475 559065e 7474->7475 7476 5592ba8 2 API calls 7474->7476 7475->7466 7476->7475 7478 559063b 7477->7478 7479 559065e 7478->7479 7480 5592ba8 2 API calls 7478->7480 7479->7466 7480->7479 7482 5590322 7481->7482 7483 5591500 2 API calls 7482->7483 7484 5590348 7482->7484 7483->7484 7484->7466 7487 55903c4 7485->7487 7486 55905bf 7486->7466 7487->7486 7488 5591500 2 API calls 7487->7488 7488->7486 7490 5590510 7489->7490 7491 55905bf 7490->7491 7492 5591500 2 API calls 7490->7492 7491->7466 7492->7491 7244 15ea2fe 7245 15ea32a SetErrorMode 7244->7245 7246 15ea353 7244->7246 7247 15ea33f 7245->7247 7246->7245 7248 58e122e 7249 58e1266 ConvertStringSecurityDescriptorToSecurityDescriptorW 7248->7249 7251 58e12a7 7249->7251 7493 58e03ee 7494 58e042c DuplicateHandle 7493->7494 7495 58e0464 7493->7495 7496 58e043a 7494->7496 7495->7494 7252 5591df8 7253 5591a42 7252->7253 7258 5591ecf 7253->7258 7273 5591ee2 7253->7273 7288 5591eb1 7253->7288 7303 5591e41 7253->7303 7259 5591ed6 7258->7259 7318 5590310 7259->7318 7261 5591f9d 7262 5590310 2 API calls 7261->7262 7263 5592006 7262->7263 7264 559202c 7263->7264 7322 55924dd 7263->7322 7326 55926c5 7263->7326 7330 55925e3 7263->7330 7334 55927e0 7263->7334 7338 55923c9 7263->7338 7344 55923d8 7263->7344 7350 559252d 7263->7350 7354 559256f 7263->7354 7274 5591ee9 7273->7274 7275 5590310 2 API calls 7274->7275 7276 5591f9d 7275->7276 7277 5590310 2 API calls 7276->7277 7278 5592006 7277->7278 7279 559202c 7278->7279 7280 55923c9 4 API calls 7278->7280 7281 55923d8 4 API calls 7278->7281 7282 559252d 2 API calls 7278->7282 7283 55924dd 2 API calls 7278->7283 7284 559256f 2 API calls 7278->7284 7285 55927e0 2 API calls 7278->7285 7286 55925e3 2 API calls 7278->7286 7287 55926c5 2 API calls 7278->7287 7280->7279 7281->7279 7282->7279 7283->7279 7284->7279 7285->7279 7286->7279 7287->7279 7289 5591eb8 7288->7289 7290 5590310 2 API calls 7289->7290 7291 5591f9d 7290->7291 7292 5590310 2 API calls 7291->7292 7293 5592006 7292->7293 7294 559202c 7293->7294 7295 55923c9 4 API calls 7293->7295 7296 55923d8 4 API calls 7293->7296 7297 559252d 2 API calls 7293->7297 7298 55924dd 2 API calls 7293->7298 7299 559256f 2 API calls 7293->7299 7300 55927e0 2 API calls 7293->7300 7301 55925e3 2 API calls 7293->7301 7302 55926c5 2 API calls 7293->7302 7295->7294 7296->7294 7297->7294 7298->7294 7299->7294 7300->7294 7301->7294 7302->7294 7304 5591e4e 7303->7304 7305 5590310 2 API calls 7304->7305 7306 5591f9d 7305->7306 7307 5590310 2 API calls 7306->7307 7308 5592006 7307->7308 7309 559202c 7308->7309 7310 55923c9 4 API calls 7308->7310 7311 55923d8 4 API calls 7308->7311 7312 559252d 2 API calls 7308->7312 7313 55924dd 2 API calls 7308->7313 7314 559256f 2 API calls 7308->7314 7315 55927e0 2 API calls 7308->7315 7316 55925e3 2 API calls 7308->7316 7317 55926c5 2 API calls 7308->7317 7310->7309 7311->7309 7312->7309 7313->7309 7314->7309 7315->7309 7316->7309 7317->7309 7320 5590322 7318->7320 7319 5590348 7319->7261 7320->7319 7358 5591500 7320->7358 7323 55924e4 7322->7323 7371 5592ba8 7323->7371 7324 55928a7 7324->7264 7327 55926cc 7326->7327 7329 5592ba8 2 API calls 7327->7329 7328 55928a7 7328->7264 7329->7328 7331 55925ea 7330->7331 7333 5592ba8 2 API calls 7331->7333 7332 55928a7 7332->7264 7333->7332 7335 55927e7 7334->7335 7337 5592ba8 2 API calls 7335->7337 7336 55928a7 7336->7264 7337->7336 7339 5592403 7338->7339 7340 559244b 7339->7340 7384 55929f2 7339->7384 7343 5592ba8 2 API calls 7340->7343 7341 55928a7 7341->7264 7343->7341 7345 5592403 7344->7345 7346 559244b 7345->7346 7349 55929f2 2 API calls 7345->7349 7348 5592ba8 2 API calls 7346->7348 7347 55928a7 7347->7264 7348->7347 7349->7346 7351 5592534 7350->7351 7353 5592ba8 2 API calls 7351->7353 7352 55928a7 7352->7264 7353->7352 7355 5592576 7354->7355 7357 5592ba8 2 API calls 7355->7357 7356 55928a7 7356->7264 7357->7356 7359 5591506 7358->7359 7362 5591551 7359->7362 7363 58e010e 7359->7363 7367 58e00ec 7359->7367 7362->7319 7364 58e016e 7363->7364 7365 58e0143 NtSetInformationProcess 7363->7365 7364->7365 7366 58e0158 7365->7366 7366->7362 7368 58e010e NtSetInformationProcess 7367->7368 7370 58e0158 7368->7370 7370->7362 7372 5592bad 7371->7372 7376 15eb51a 7372->7376 7380 15eb572 7372->7380 7373 5592bd7 7373->7324 7378 15eb572 GetLogicalDrives 7376->7378 7379 15eb5a9 7378->7379 7379->7373 7381 15eb59b GetLogicalDrives 7380->7381 7382 15eb5d1 7380->7382 7383 15eb5a9 7381->7383 7382->7381 7383->7373 7385 5592a25 7384->7385 7389 58e1c1a 7385->7389 7392 58e1baa 7385->7392 7386 5592a60 7386->7340 7390 58e1c6a GetVolumeInformationA 7389->7390 7391 58e1c72 7390->7391 7391->7386 7393 58e1c1a GetVolumeInformationA 7392->7393 7395 58e1c72 7393->7395 7395->7386 7497 5591238 7499 5591265 7497->7499 7498 5591385 7499->7498 7501 5592e40 7499->7501 7502 5592e80 7501->7502 7503 5592ed7 7502->7503 7506 55930ff 7502->7506 7511 5593110 7502->7511 7503->7499 7507 559313b 7506->7507 7508 559317f 7507->7508 7509 15eb51a GetLogicalDrives 7507->7509 7510 15eb572 GetLogicalDrives 7507->7510 7508->7503 7509->7508 7510->7508 7512 559313b 7511->7512 7513 559317f 7512->7513 7514 15eb51a GetLogicalDrives 7512->7514 7515 15eb572 GetLogicalDrives 7512->7515 7513->7503 7514->7513 7515->7513 7516 58e2d6a 7518 58e2d9f ioctlsocket 7516->7518 7519 58e2dcb 7518->7519 7396 58e1ea6 7398 58e1ee1 LoadLibraryA 7396->7398 7399 58e1f1e 7398->7399 7400 15ead72 7402 15eada7 GetFileType 7400->7402 7403 15eadd4 7402->7403 7408 15eb0f2 7411 15eb127 ReadFile 7408->7411 7410 15eb159 7411->7410 7412 58e193e 7413 58e1979 getaddrinfo 7412->7413 7415 58e19eb 7413->7415 7523 58e2ffe 7524 58e3033 SetProcessWorkingSetSize 7523->7524 7526 58e305f 7524->7526 7527 15eb4ae 7528 15eb50c 7527->7528 7529 15eb4da FindClose 7527->7529 7528->7529 7530 15eb4ef 7529->7530 7531 15eaaae 7532 15eaada OleInitialize 7531->7532 7533 15eab10 7531->7533 7534 15eaae8 7532->7534 7533->7532 7416 58e0032 7418 58e0067 GetExitCodeProcess 7416->7418 7419 58e0090 7418->7419 7535 15ebc22 7536 15ebc4b LookupPrivilegeValueW 7535->7536 7538 15ebc72 7536->7538 7539 15ebda2 7540 15ebdd1 AdjustTokenPrivileges 7539->7540 7542 15ebdf3 7540->7542

                                          Executed Functions

                                          Function 015EBD6B Relevance: 1.6, APIs: 1, Instructions: 75COMMON
                                          Download Yara Rule
                                          APIs
                                          • AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 015EBDEB
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: AdjustPrivilegesToken
                                          • String ID:
                                          • API String ID: 2874748243-0
                                          • Opcode ID: e805f4cf6f8117440d6b67ad562697142d0f7781f6b101ed7cae47da64bbbc0d
                                          • Instruction ID: 19683d4c43d7c995210e23e215c082563a8a6700761cfabf16e3d608ad927ec3
                                          • Opcode Fuzzy Hash: e805f4cf6f8117440d6b67ad562697142d0f7781f6b101ed7cae47da64bbbc0d
                                          • Instruction Fuzzy Hash: B4219FB5509780AFDB138F25DC44B62BFF4FF06210F08859AE9858F563D275A908CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E030B Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • NtQuerySystemInformation.NTDLL ref: 058E0381
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: InformationQuerySystem
                                          • String ID:
                                          • API String ID: 3562636166-0
                                          • Opcode ID: c2f1de9a5b80461a536b41c7a92752fd36e924b0af1d16cac4d3428bca9e8fa2
                                          • Instruction ID: b5a3e6f0a25c6a5705861960a591db95baeeb2b5ce981d37801c14b9d455174b
                                          • Opcode Fuzzy Hash: c2f1de9a5b80461a536b41c7a92752fd36e924b0af1d16cac4d3428bca9e8fa2
                                          • Instruction Fuzzy Hash: 7921AE714097C0AFDB238B21DC45A62FFB4EF07214F0984CBED848B1A3D265A909CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EBDA2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                          Download Yara Rule
                                          APIs
                                          • AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 015EBDEB
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: AdjustPrivilegesToken
                                          • String ID:
                                          • API String ID: 2874748243-0
                                          • Opcode ID: 12259714b303bfb3bcb3e92350a3f7824c22733dc77fc471525bbf5131b192c6
                                          • Instruction ID: c9a49a7acedb27ee1858d190ef6a0d5838c849e1172a05cac4b56357b1ac409b
                                          • Opcode Fuzzy Hash: 12259714b303bfb3bcb3e92350a3f7824c22733dc77fc471525bbf5131b192c6
                                          • Instruction Fuzzy Hash: EA115E71A002009FDB21CF55D984B66FBE4FF04221F08C86AEE458F656D375E418CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E00EC Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • NtSetInformationProcess.NTDLL ref: 058E0149
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: InformationProcess
                                          • String ID:
                                          • API String ID: 1801817001-0
                                          • Opcode ID: 5bdd024e44f9548c7ff96b79093fe88ab76d89e27227010bf10277d8e3870d92
                                          • Instruction ID: 9a5d732a5cb8fc94d86f68634e2c840fbe581a736d87e26e08a440278550d99e
                                          • Opcode Fuzzy Hash: 5bdd024e44f9548c7ff96b79093fe88ab76d89e27227010bf10277d8e3870d92
                                          • Instruction Fuzzy Hash: D111A071408380AFDB228F11DC45F62FFB4EF46220F08849AED844B662D275A918CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E010E Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • NtSetInformationProcess.NTDLL ref: 058E0149
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: InformationProcess
                                          • String ID:
                                          • API String ID: 1801817001-0
                                          • Opcode ID: 96ef69037aaa96504d1e876a9bc72d7e7a676f888a58a18bb9fcc26af80f3caf
                                          • Instruction ID: ce257afae30d454a5146193f7502b936746f91116e91844505c95fef3a0103fa
                                          • Opcode Fuzzy Hash: 96ef69037aaa96504d1e876a9bc72d7e7a676f888a58a18bb9fcc26af80f3caf
                                          • Instruction Fuzzy Hash: BA017C31500244DFDB20DF45DC49B61FBE1FF15624F08C49ADD494E656D2B5E818CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E0346 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • NtQuerySystemInformation.NTDLL ref: 058E0381
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: InformationQuerySystem
                                          • String ID:
                                          • API String ID: 3562636166-0
                                          • Opcode ID: 96ef69037aaa96504d1e876a9bc72d7e7a676f888a58a18bb9fcc26af80f3caf
                                          • Instruction ID: 59cef30c030c669b5a87295aaa26caa4e12ac2f33349405f4f4f8c76ec208ff0
                                          • Opcode Fuzzy Hash: 96ef69037aaa96504d1e876a9bc72d7e7a676f888a58a18bb9fcc26af80f3caf
                                          • Instruction Fuzzy Hash: A0017831504244DFDB20CF55D989B62FBB4FF19624F08C49AEE894A652D3B5E818CBA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590310 Relevance: 3.9, Strings: 3, Instructions: 189COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 0 5590310-5590334 2 559033e-5590346 0->2 3 5590336-5590338 0->3 4 5590348-559034d 2->4 5 559034e-5590391 2->5 3->2 8 55903d8-5590418 5->8 9 5590393-55903ce 5->9 16 559041a 8->16 17 559041f 8->17 9->8 16->17 56 559041f call 5590938 17->56 57 559041f call 5590ba8 17->57 58 559041f call 5590d98 17->58 59 559041f call 5590c8d 17->59 60 559041f call 15f05e7 17->60 61 559041f call 5590d40 17->61 62 559041f call 15f0606 17->62 63 559041f call 5590b03 17->63 64 559041f call 5590c22 17->64 65 559041f call 5590f05 17->65 66 559041f call 5590e55 17->66 18 5590425-5590434 19 559046b-5590523 18->19 20 5590436-5590460 18->20 39 5590570-5590587 19->39 40 5590525-5590531 19->40 20->19 41 559058d-55905b4 39->41 42 5590880 39->42 67 5590533 call 15f05e7 40->67 68 5590533 call 15f0606 40->68 53 55905b9 call 15f05e7 41->53 54 55905b9 call 5591500 41->54 55 55905b9 call 15f0606 41->55 45 5590539-5590569 45->39 50 55905bf 50->42 53->50 54->50 55->50 56->18 57->18 58->18 59->18 60->18 61->18 62->18 63->18 64->18 65->18 66->18 67->45 68->45
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: [9k^$-[9k^$=[9k^
                                          • API String ID: 0-4294424315
                                          • Opcode ID: 7a7643425c0573731e8f09ff52dc8377ff712307b716bf493d7cfe8a46ab466d
                                          • Instruction ID: 9fc42b7d78aa8225035c02e79fb0e20076c3434376c6141a64fb9edfefad011c
                                          • Opcode Fuzzy Hash: 7a7643425c0573731e8f09ff52dc8377ff712307b716bf493d7cfe8a46ab466d
                                          • Instruction Fuzzy Hash: 8551DC30B002018FCB1ADB7998146BEB7EBBBC8204B144569E406CB7E5DF39CD0687A2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 055903BD Relevance: 3.9, Strings: 3, Instructions: 135COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 69 55903bd-5590418 77 559041a 69->77 78 559041f 69->78 77->78 117 559041f call 5590938 78->117 118 559041f call 5590ba8 78->118 119 559041f call 5590d98 78->119 120 559041f call 5590c8d 78->120 121 559041f call 15f05e7 78->121 122 559041f call 5590d40 78->122 123 559041f call 15f0606 78->123 124 559041f call 5590b03 78->124 125 559041f call 5590c22 78->125 126 559041f call 5590f05 78->126 127 559041f call 5590e55 78->127 79 5590425-5590434 80 559046b-5590523 79->80 81 5590436-5590460 79->81 100 5590570-5590587 80->100 101 5590525-5590531 80->101 81->80 102 559058d-55905b4 100->102 103 5590880 100->103 128 5590533 call 15f05e7 101->128 129 5590533 call 15f0606 101->129 114 55905b9 call 15f05e7 102->114 115 55905b9 call 5591500 102->115 116 55905b9 call 15f0606 102->116 106 5590539-5590569 106->100 111 55905bf 111->103 114->111 115->111 116->111 117->79 118->79 119->79 120->79 121->79 122->79 123->79 124->79 125->79 126->79 127->79 128->106 129->106
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: [9k^$-[9k^$=[9k^
                                          • API String ID: 0-4294424315
                                          • Opcode ID: b1d2b8dc63c39d6a85b415dd9a9cf1fa26d4a72eba2ab0ca37f17305b0842faa
                                          • Instruction ID: 5db6f5d07f0e068a1a3ebb06f854d6337bcbe678a11f0c912feb8dedf53e8518
                                          • Opcode Fuzzy Hash: b1d2b8dc63c39d6a85b415dd9a9cf1fa26d4a72eba2ab0ca37f17305b0842faa
                                          • Instruction Fuzzy Hash: 9F41C230B002114BCB4EEBBA88146BE76DBBFD9248B04456DD006DB7E5DF2DCD0687A2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05591E41 Relevance: 2.8, Strings: 2, Instructions: 334COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 130 5591e41-5591e4c 131 5591e4e-5591e71 130->131 132 5591e81-5591e98 130->132 133 5591e7b 131->133 135 5591e9a-5591ea0 132->135 136 5591ec2-559201f call 5590310 * 2 132->136 133->132 137 5591ea7-5591eaf 135->137 243 5592026 call 55923c9 136->243 244 5592026 call 55923d8 136->244 245 5592026 call 559252d 136->245 246 5592026 call 55924dd 136->246 247 5592026 call 559256f 136->247 248 5592026 call 15f05e7 136->248 249 5592026 call 55927e0 136->249 250 5592026 call 15f0606 136->250 251 5592026 call 55925e3 136->251 252 5592026 call 55926c5 136->252 137->136 166 559202c-559205d call 5592c52 call 55913b8 172 559205f-5592080 166->172 173 5592082-55920bf call 55913b8 166->173 179 55920c2-559219a 172->179 173->179 196 559219c-55921a1 179->196 197 55921a3 179->197 198 55921a8-55921d0 196->198 197->198 201 55921d9 198->201 202 55921d2-55921d7 198->202 203 55921de-5592206 201->203 202->203 206 5592208-559220d 203->206 207 559220f 203->207 208 5592214-559223c 206->208 207->208 211 559223e-5592243 208->211 212 5592245 208->212 213 559224a-5592272 211->213 212->213 216 559227b 213->216 217 5592274-5592279 213->217 218 5592280-55922a8 216->218 217->218 221 55922aa-55922af 218->221 222 55922b1 218->222 223 55922b6-55922de 221->223 222->223 226 55922e0-55922e5 223->226 227 55922e7 223->227 228 55922ec-5592314 226->228 227->228 231 559231d 228->231 232 5592316-559231b 228->232 233 5592322-559235a call 5592c52 231->233 232->233 238 5592360-55923aa 233->238 242 55923ab 238->242 242->242 243->166 244->166 245->166 246->166 247->166 248->166 249->166 250->166 251->166 252->166
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k$:@k
                                          • API String ID: 0-4032727010
                                          • Opcode ID: bd3e50cc2ad6c3d09da2d88c0420ebb9aedf22baf610e9c8842f4e8afe326bf7
                                          • Instruction ID: 836b260be4eea60eb750a663e3a24cdd5596bb0f608f9f9c33f7dcf58c224ad9
                                          • Opcode Fuzzy Hash: bd3e50cc2ad6c3d09da2d88c0420ebb9aedf22baf610e9c8842f4e8afe326bf7
                                          • Instruction Fuzzy Hash: 46C16B747002519FDF09DBB9D9117BAB7AAFBDC308F10942A94069B794CB3E8C46CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05591EB1 Relevance: 2.8, Strings: 2, Instructions: 280COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 255 5591eb1-559201f call 5590310 * 2 364 5592026 call 55923c9 255->364 365 5592026 call 55923d8 255->365 366 5592026 call 559252d 255->366 367 5592026 call 55924dd 255->367 368 5592026 call 559256f 255->368 369 5592026 call 15f05e7 255->369 370 5592026 call 55927e0 255->370 371 5592026 call 15f0606 255->371 372 5592026 call 55925e3 255->372 373 5592026 call 55926c5 255->373 287 559202c-559205d call 5592c52 call 55913b8 293 559205f-5592080 287->293 294 5592082-55920bf call 55913b8 287->294 300 55920c2-559219a 293->300 294->300 317 559219c-55921a1 300->317 318 55921a3 300->318 319 55921a8-55921d0 317->319 318->319 322 55921d9 319->322 323 55921d2-55921d7 319->323 324 55921de-5592206 322->324 323->324 327 5592208-559220d 324->327 328 559220f 324->328 329 5592214-559223c 327->329 328->329 332 559223e-5592243 329->332 333 5592245 329->333 334 559224a-5592272 332->334 333->334 337 559227b 334->337 338 5592274-5592279 334->338 339 5592280-55922a8 337->339 338->339 342 55922aa-55922af 339->342 343 55922b1 339->343 344 55922b6-55922de 342->344 343->344 347 55922e0-55922e5 344->347 348 55922e7 344->348 349 55922ec-5592314 347->349 348->349 352 559231d 349->352 353 5592316-559231b 349->353 354 5592322-559235a call 5592c52 352->354 353->354 359 5592360-55923aa 354->359 363 55923ab 359->363 363->363 364->287 365->287 366->287 367->287 368->287 369->287 370->287 371->287 372->287 373->287
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k$:@k
                                          • API String ID: 0-4032727010
                                          • Opcode ID: 8deefa4f6956bd838c73f00562dedbe18eee8b4bb5692809c7542f99908e4f3a
                                          • Instruction ID: e550633f2775738c83e7634af05f94cda9adc23d84d761cbeca2cc6c7c4fffc9
                                          • Opcode Fuzzy Hash: 8deefa4f6956bd838c73f00562dedbe18eee8b4bb5692809c7542f99908e4f3a
                                          • Instruction Fuzzy Hash: 99A18D74300250AFDF099BB5D8117BEB2ABBBE8308F20542A94069BB95CF7DCC06D761
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05591ECF Relevance: 2.8, Strings: 2, Instructions: 277COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 376 5591ecf-559201f call 5590310 * 2 484 5592026 call 55923c9 376->484 485 5592026 call 55923d8 376->485 486 5592026 call 559252d 376->486 487 5592026 call 55924dd 376->487 488 5592026 call 559256f 376->488 489 5592026 call 15f05e7 376->489 490 5592026 call 55927e0 376->490 491 5592026 call 15f0606 376->491 492 5592026 call 55925e3 376->492 493 5592026 call 55926c5 376->493 407 559202c-559205d call 5592c52 call 55913b8 413 559205f-5592080 407->413 414 5592082-55920bf call 55913b8 407->414 420 55920c2-559219a 413->420 414->420 437 559219c-55921a1 420->437 438 55921a3 420->438 439 55921a8-55921d0 437->439 438->439 442 55921d9 439->442 443 55921d2-55921d7 439->443 444 55921de-5592206 442->444 443->444 447 5592208-559220d 444->447 448 559220f 444->448 449 5592214-559223c 447->449 448->449 452 559223e-5592243 449->452 453 5592245 449->453 454 559224a-5592272 452->454 453->454 457 559227b 454->457 458 5592274-5592279 454->458 459 5592280-55922a8 457->459 458->459 462 55922aa-55922af 459->462 463 55922b1 459->463 464 55922b6-55922de 462->464 463->464 467 55922e0-55922e5 464->467 468 55922e7 464->468 469 55922ec-5592314 467->469 468->469 472 559231d 469->472 473 5592316-559231b 469->473 474 5592322-559235a call 5592c52 472->474 473->474 479 5592360-55923aa 474->479 483 55923ab 479->483 483->483 484->407 485->407 486->407 487->407 488->407 489->407 490->407 491->407 492->407 493->407
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k$:@k
                                          • API String ID: 0-4032727010
                                          • Opcode ID: 65f9049f8663f764961eb0d35a3cda97698257318686b1f769763b235c3b8d57
                                          • Instruction ID: d14e17cde59bbf15b14fbef3593a2780dc620f0aadd43939239898012391f5a0
                                          • Opcode Fuzzy Hash: 65f9049f8663f764961eb0d35a3cda97698257318686b1f769763b235c3b8d57
                                          • Instruction Fuzzy Hash: 9DA19E74300210AFDF099BB598117BE72ABBBE8308F20542A94069BB94CF7DCC06D761
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05591EE2 Relevance: 2.8, Strings: 2, Instructions: 276COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 496 5591ee2-559201f call 5590310 * 2 603 5592026 call 55923c9 496->603 604 5592026 call 55923d8 496->604 605 5592026 call 559252d 496->605 606 5592026 call 55924dd 496->606 607 5592026 call 559256f 496->607 608 5592026 call 15f05e7 496->608 609 5592026 call 55927e0 496->609 610 5592026 call 15f0606 496->610 611 5592026 call 55925e3 496->611 612 5592026 call 55926c5 496->612 526 559202c-559205d call 5592c52 call 55913b8 532 559205f-5592080 526->532 533 5592082-55920bf call 55913b8 526->533 539 55920c2-559219a 532->539 533->539 556 559219c-55921a1 539->556 557 55921a3 539->557 558 55921a8-55921d0 556->558 557->558 561 55921d9 558->561 562 55921d2-55921d7 558->562 563 55921de-5592206 561->563 562->563 566 5592208-559220d 563->566 567 559220f 563->567 568 5592214-559223c 566->568 567->568 571 559223e-5592243 568->571 572 5592245 568->572 573 559224a-5592272 571->573 572->573 576 559227b 573->576 577 5592274-5592279 573->577 578 5592280-55922a8 576->578 577->578 581 55922aa-55922af 578->581 582 55922b1 578->582 583 55922b6-55922de 581->583 582->583 586 55922e0-55922e5 583->586 587 55922e7 583->587 588 55922ec-5592314 586->588 587->588 591 559231d 588->591 592 5592316-559231b 588->592 593 5592322-559235a call 5592c52 591->593 592->593 598 5592360-55923aa 593->598 602 55923ab 598->602 602->602 603->526 604->526 605->526 606->526 607->526 608->526 609->526 610->526 611->526 612->526
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k$:@k
                                          • API String ID: 0-4032727010
                                          • Opcode ID: 286936c596636459e8875583a4f2b484f8e71bfe9a5ff3b8aaea9e8b3d7d8126
                                          • Instruction ID: f7425c7860c7eda6c6439d6b43e40fa201216b2ae6eb16240db7b230f66d29da
                                          • Opcode Fuzzy Hash: 286936c596636459e8875583a4f2b484f8e71bfe9a5ff3b8aaea9e8b3d7d8126
                                          • Instruction Fuzzy Hash: EBA18E74300250AFDF099BB599117BE72ABBBEC308F20542A94069BB95CF7DCC46D761
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590938 Relevance: 1.7, Strings: 1, Instructions: 496COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 615 5590938-5590993 617 5590999-5590a22 615->617 618 5590a2e-5590a30 615->618 768 5590a24 call 15f05e7 617->768 769 5590a24 call 15f0606 617->769 619 5590a37-5590a3c 618->619 621 5590b1e-5590bc2 619->621 622 5590a42-5590a7a 619->622 658 5590bc8-5590c50 621->658 659 5590c9e-5590ca7 621->659 638 5590a7c-5590a9a 622->638 639 5590aa1-5590b01 622->639 638->639 639->621 694 5590c57-5590c8b 658->694 663 5590cad-5590d2c 659->663 664 5590d51-5590d5a 659->664 660 5590a2a-5590a2c 660->618 662 5590a32 660->662 662->619 709 5590d33-5590d3e 663->709 666 5590d7a-5590d83 664->666 667 5590d5c-5590d73 664->667 670 5590da9-5590db2 666->670 671 5590d85-5590d8c 666->671 667->666 672 5590db8-5590dd6 670->672 673 5590f33-5590f3a 670->673 681 5590d96 671->681 770 5590dd8 call 15f05e7 672->770 771 5590dd8 call 15f0606 672->771 679 5590dde-5590e06 696 5590f1c-5590f2d 679->696 681->670 694->659 696->673 697 5590e0b-5590e14 696->697 699 5590e1a-5590efb 697->699 700 5590f40-5590fd1 697->700 744 5590f03-5590f1a 699->744 731 55910ca 700->731 732 5590fd7-5590fe8 700->732 709->664 734 55910cc-55910d3 731->734 739 5590fea-559100b 732->739 746 559100d 739->746 747 5591012-5591048 739->747 744->696 749 5590f3b 744->749 746->747 755 559104a 747->755 756 559104f-5591077 747->756 749->700 755->756 760 5591079-559107b 756->760 761 559107d-55910a1 756->761 760->734 764 55910aa-55910b4 761->764 765 55910a3-55910a8 761->765 766 55910ba-55910c4 764->766 767 55910b6-55910b8 764->767 765->734 766->731 766->739 767->734 768->660 769->660 770->679 771->679
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k
                                          • API String ID: 0-2277858631
                                          • Opcode ID: 487a5a69c9758991c949459c6b8cb20735e2b8c5f319939c318947adf0d81bc9
                                          • Instruction ID: 7b57f75121684cc305986bd53ad8254f05fdffe32d73a772fad1550ef88dd13a
                                          • Opcode Fuzzy Hash: 487a5a69c9758991c949459c6b8cb20735e2b8c5f319939c318947adf0d81bc9
                                          • Instruction Fuzzy Hash: B40265307002118FCB59EB78D854AAEB7E6FB88308F204569D406DB7A5EF3D9C46CB91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E2B6E Relevance: 1.6, APIs: 1, Instructions: 99registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 772 58e2b6e-58e2bf2 776 58e2bf7-58e2c03 772->776 777 58e2bf4 772->777 778 58e2c08-58e2c11 776->778 779 58e2c05 776->779 777->776 780 58e2c16-58e2c2d 778->780 781 58e2c13 778->781 779->778 783 58e2c6f-58e2c74 780->783 784 58e2c2f-58e2c42 RegCreateKeyExW 780->784 781->780 783->784 785 58e2c76-58e2c7b 784->785 786 58e2c44-58e2c6c 784->786 785->786
                                          APIs
                                          • RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 058E2C35
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Create
                                          • String ID:
                                          • API String ID: 2289755597-0
                                          • Opcode ID: 7383b5a1a4ef1a59afbb54a57797d42149feaefaa2af79abd7cdac5ec256b2e7
                                          • Instruction ID: f981301d2f7ae952c096e2025bdecd2f0314f19f78e4c9bf85e47164d89cef12
                                          • Opcode Fuzzy Hash: 7383b5a1a4ef1a59afbb54a57797d42149feaefaa2af79abd7cdac5ec256b2e7
                                          • Instruction Fuzzy Hash: 45318FB2504344AFE721CF65CC44FA7BBFCEF06610F08859AE985DB652D324E948CBA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E0CEF Relevance: 1.6, APIs: 1, Instructions: 98registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 791 58e0cef-58e0d0f 792 58e0d31-58e0d63 791->792 793 58e0d11-58e0d30 791->793 797 58e0d66-58e0dbe RegQueryValueExW 792->797 793->792 799 58e0dc4-58e0dda 797->799
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 058E0DB6
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: 659c2873c0b091a9d9d76994e17ec3ad5e37ebb6749fc38a0bd3d9b4dc211332
                                          • Instruction ID: fe855cc7b7b50ac71da3daabb54b327839dee07600a7c4f371041b3178da36e1
                                          • Opcode Fuzzy Hash: 659c2873c0b091a9d9d76994e17ec3ad5e37ebb6749fc38a0bd3d9b4dc211332
                                          • Instruction Fuzzy Hash: 5F318F7510E3C06FD3138B258C65A61BFB4EF47610B0E45CBD8C4CB6A3D2596809C7B2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EAC19 Relevance: 1.6, APIs: 1, Instructions: 96fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 800 15eac19-15eacb2 804 15eacb7-15eacc3 800->804 805 15eacb4 800->805 806 15eacc8-15eacd1 804->806 807 15eacc5 804->807 805->804 808 15ead22-15ead27 806->808 809 15eacd3-15eacf7 CreateFileW 806->809 807->806 808->809 812 15ead29-15ead2e 809->812 813 15eacf9-15ead1f 809->813 812->813
                                          APIs
                                          • CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 015EACD9
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CreateFile
                                          • String ID:
                                          • API String ID: 823142352-0
                                          • Opcode ID: feb024b63d95375c7164208deb6691bae41ae10ec02e7f0d13b0cd5c8314f49a
                                          • Instruction ID: 42c6ccd2cf7d8aff247010d0e0eeeeb830280ddf4a8acef0c401aa779d1f155a
                                          • Opcode Fuzzy Hash: feb024b63d95375c7164208deb6691bae41ae10ec02e7f0d13b0cd5c8314f49a
                                          • Instruction Fuzzy Hash: 0D31A1715093806FE722CF65CD45B56BFE8EF06314F08889EE9898B652D365E408CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E191C Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 816 58e191c-58e19db 822 58e1a2d-58e1a32 816->822 823 58e19dd-58e19e5 getaddrinfo 816->823 822->823 824 58e19eb-58e19fd 823->824 826 58e19ff-58e1a2a 824->826 827 58e1a34-58e1a39 824->827 827->826
                                          APIs
                                          • getaddrinfo.WS2_32(?,00000E24), ref: 058E19E3
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: getaddrinfo
                                          • String ID:
                                          • API String ID: 300660673-0
                                          • Opcode ID: 198927a701ff70715b685b967aa9f85d300f59d3c1e3464510cf356d8bdbbdfe
                                          • Instruction ID: 71468a560a837561d7d45700bca2858210e3a3e8e362fc0b6993a4e0e77a56e1
                                          • Opcode Fuzzy Hash: 198927a701ff70715b685b967aa9f85d300f59d3c1e3464510cf356d8bdbbdfe
                                          • Instruction Fuzzy Hash: 1B31DFB2504300AFE721CB61DD85FA6FBACEB04714F04489AFA489B692D375A94CCB71
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1BAA Relevance: 1.6, APIs: 1, Instructions: 92COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 831 58e1baa-58e1c6c GetVolumeInformationA 834 58e1c72-58e1c9b 831->834
                                          APIs
                                          • GetVolumeInformationA.KERNELBASE(?,00000E24,?,?), ref: 058E1C6A
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: InformationVolume
                                          • String ID:
                                          • API String ID: 2039140958-0
                                          • Opcode ID: cccfdbefccedfa64fdc194c0a369db18f5e373ca56962e2091e090f01a78ead2
                                          • Instruction ID: 63e3bb672de7b292bec89c82ca56c2ee53dbdb6a4f98185dd26a0285219ef8a7
                                          • Opcode Fuzzy Hash: cccfdbefccedfa64fdc194c0a369db18f5e373ca56962e2091e090f01a78ead2
                                          • Instruction Fuzzy Hash: 1D31807150D3C06FD3038B358C61AA2BFB8AF47210F1980CBD8C4CF6A3D225A959C7A2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EAB1E Relevance: 1.6, APIs: 1, Instructions: 91registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 836 15eab1e-15eab84 838 15eab8a-15eab9b 836->838 839 15eaba1-15eabad 838->839 840 15eabaf 839->840 841 15eabb2-15eabc9 839->841 840->841 843 15eac0b-15eac10 841->843 844 15eabcb-15eabde RegOpenKeyExW 841->844 843->844 845 15eac12-15eac17 844->845 846 15eabe0-15eac08 844->846 845->846
                                          APIs
                                          • RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 015EABD1
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Open
                                          • String ID:
                                          • API String ID: 71445658-0
                                          • Opcode ID: 64fdb74d09b64a20f63910ef278dd80f4135b437b406c2a8cefaa377e90504c6
                                          • Instruction ID: 6ecfcda587fee62cd6a84b588f24b9116ca9a8794cdf454a6fc91e6268a17d5c
                                          • Opcode Fuzzy Hash: 64fdb74d09b64a20f63910ef278dd80f4135b437b406c2a8cefaa377e90504c6
                                          • Instruction Fuzzy Hash: 9C3193714093846FE7228B65CD84FA7BFFCEF06210F08849AE9858B553D224A94CCB71
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA612 Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 851 15ea612-15ea695 855 15ea69a-15ea6a3 851->855 856 15ea697 851->856 857 15ea6a8-15ea6b1 855->857 858 15ea6a5 855->858 856->855 859 15ea702-15ea707 857->859 860 15ea6b3-15ea6d7 CreateMutexW 857->860 858->857 859->860 863 15ea709-15ea70e 860->863 864 15ea6d9-15ea6ff 860->864 863->864
                                          APIs
                                          • CreateMutexW.KERNELBASE(?,?), ref: 015EA6B9
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID:
                                          • API String ID: 1964310414-0
                                          • Opcode ID: b1cf22f02bed1d07af51a290091337155c8afe40d0124dec377d09b103aecf2b
                                          • Instruction ID: b8115819375631e1860b871d8e8ac13b3967b0d99a76096d05574b05692ecf4f
                                          • Opcode Fuzzy Hash: b1cf22f02bed1d07af51a290091337155c8afe40d0124dec377d09b103aecf2b
                                          • Instruction Fuzzy Hash: 013195B55093805FE712CB65CD85B56FFF8EF06210F08849AE944CF692D375E909CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1208 Relevance: 1.6, APIs: 1, Instructions: 89COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 867 58e1208-58e1289 871 58e128e-58e1297 867->871 872 58e128b 867->872 873 58e12ef-58e12f4 871->873 874 58e1299-58e12a1 ConvertStringSecurityDescriptorToSecurityDescriptorW 871->874 872->871 873->874 876 58e12a7-58e12b9 874->876 877 58e12bb-58e12ec 876->877 878 58e12f6-58e12fb 876->878 878->877
                                          APIs
                                          • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 058E129F
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: DescriptorSecurity$ConvertString
                                          • String ID:
                                          • API String ID: 3907675253-0
                                          • Opcode ID: 700b922b2eae512d56fdc443d1ecece95db4bcd6884c03bbb3409f077a3005ce
                                          • Instruction ID: 0db256df16304e47448e4e4922c45b536856c53e274bbeed3c9df0cd391b9d1f
                                          • Opcode Fuzzy Hash: 700b922b2eae512d56fdc443d1ecece95db4bcd6884c03bbb3409f077a3005ce
                                          • Instruction Fuzzy Hash: 3A31BF71509384AFE721CB65DC45FA7BBB8EF06210F08849AE944DB652D324A948CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E2B9A Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 058E2C35
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Create
                                          • String ID:
                                          • API String ID: 2289755597-0
                                          • Opcode ID: 39c5f474bccbe8ecac9306f1b921184f4d0af8be455b7fc1e02fbc937960c10f
                                          • Instruction ID: 4a9e28966dccfabfa618cd96479f88e7660ddcd233754472b2b329ec52305d2c
                                          • Opcode Fuzzy Hash: 39c5f474bccbe8ecac9306f1b921184f4d0af8be455b7fc1e02fbc937960c10f
                                          • Instruction Fuzzy Hash: B821CCB6500304AFEB20CF21CD80FA7BBFCEF09714F08845AED46D6A51D720E8488AA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA361 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 015EA40C
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: bca5152502bd6ebf809272591316bfa06d8352fb750eafda8e70ba3373e7d6dd
                                          • Instruction ID: b5c441709d36a25a369a6f4cf7e9f14658aa579a5a9142f9b92be7773a50590d
                                          • Opcode Fuzzy Hash: bca5152502bd6ebf809272591316bfa06d8352fb750eafda8e70ba3373e7d6dd
                                          • Instruction Fuzzy Hash: 4C318175508780AFE722CF25CC84F96BFF8EF06610F08849AE9458B692D364E949CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E2EDC Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetProcessWorkingSetSize.KERNEL32(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E2F73
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ProcessSizeWorking
                                          • String ID:
                                          • API String ID: 3584180929-0
                                          • Opcode ID: 6cc1cbabe237a5ba33415a07802806e583ba0654303c052d78667c37e8497605
                                          • Instruction ID: 876b6780e268a2a9cd77eb577fe487f4d8a24332fe66b4f2e1e48ef565aa804c
                                          • Opcode Fuzzy Hash: 6cc1cbabe237a5ba33415a07802806e583ba0654303c052d78667c37e8497605
                                          • Instruction Fuzzy Hash: 6521D5715093806FE713CB20CC55BA6BFB8AF46214F0884DAE9898F193D224A949C771
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1814 Relevance: 1.6, APIs: 1, Instructions: 84timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetProcessTimes.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E18B1
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ProcessTimes
                                          • String ID:
                                          • API String ID: 1995159646-0
                                          • Opcode ID: 70d831492e320f3516acf5523fa220dff42226b53018bdee472a86741bb9e8b3
                                          • Instruction ID: a38e40f80cc572e94c867533d772cda4e525a65f21dfc6c4a42849d0db191606
                                          • Opcode Fuzzy Hash: 70d831492e320f3516acf5523fa220dff42226b53018bdee472a86741bb9e8b3
                                          • Instruction Fuzzy Hash: DE21F6B25043446FD711CF55DD45FA6BBB8EF46320F08849AE944CB592D334A909CB71
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E193E Relevance: 1.6, APIs: 1, Instructions: 84COMMON
                                          Download Yara Rule
                                          APIs
                                          • getaddrinfo.WS2_32(?,00000E24), ref: 058E19E3
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: getaddrinfo
                                          • String ID:
                                          • API String ID: 300660673-0
                                          • Opcode ID: b2ae7fd98b6114583b7d63e45a92ba8fe2ca7ed11bda59ad688e2b3bf7fa4080
                                          • Instruction ID: db45537eae33e33ab1d63bfac22c305d2468b34f5c3e972088fd2f8d8e77ca7c
                                          • Opcode Fuzzy Hash: b2ae7fd98b6114583b7d63e45a92ba8fe2ca7ed11bda59ad688e2b3bf7fa4080
                                          • Instruction Fuzzy Hash: 09219F72500304AEEB20DB51DD85FB6F7ACEB04714F04885AFA48DB681D775A94DCB71
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EAD30 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetFileType.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 015EADC5
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: FileType
                                          • String ID:
                                          • API String ID: 3081899298-0
                                          • Opcode ID: 46d0946f65bad6f0e7c61a271fe7212756f9e3e1e8c194eb45dba66425d1ba89
                                          • Instruction ID: a22bdf965d4c91117088e882f84cdd65d523589dcfbc64183a4c8c7b7fd74426
                                          • Opcode Fuzzy Hash: 46d0946f65bad6f0e7c61a271fe7212756f9e3e1e8c194eb45dba66425d1ba89
                                          • Instruction Fuzzy Hash: 6E21F8B54097806FD7138B259C45BA2BFBCEF47720F0880D6E9848B693D264A94DC7B1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E2E0D Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: select
                                          • String ID:
                                          • API String ID: 1274211008-0
                                          • Opcode ID: ec516b77866571518f1dcf4fc98706821888f71a173e1b90f288afc032b71654
                                          • Instruction ID: 4bb33c4bd9221c55c5f2e67dc3e23627057c00238eb0db9460e6245015384831
                                          • Opcode Fuzzy Hash: ec516b77866571518f1dcf4fc98706821888f71a173e1b90f288afc032b71654
                                          • Instruction Fuzzy Hash: 20213975509385AFDB22CF25DC44A62BFF8EF06210F08889AED85CB163D275A949CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EB51A Relevance: 1.6, APIs: 1, Instructions: 78COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLogicalDrives.KERNELBASE ref: 015EB5A1
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: DrivesLogical
                                          • String ID:
                                          • API String ID: 999431828-0
                                          • Opcode ID: 16e489f2e0d4718e2886b37bcaa52677bf82c0cb2fd60d405b48f38d4b44d5e9
                                          • Instruction ID: d7128896d940dec279c37a7bc95e1e72bf3bbd110b665b149ac14a04f1b1a3f7
                                          • Opcode Fuzzy Hash: 16e489f2e0d4718e2886b37bcaa52677bf82c0cb2fd60d405b48f38d4b44d5e9
                                          • Instruction Fuzzy Hash: DE215C7144E3C05FD7138B259C65A62BFB4EF47220F0A84DBE984CF1A3D2685909C772
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegSetValueExW.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 015EA4F8
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Value
                                          • String ID:
                                          • API String ID: 3702945584-0
                                          • Opcode ID: 96a173c633c9b89631610a92bedf4601ef20d42c42a2975e0e964c8c815cef9c
                                          • Instruction ID: e35db7c11244de52a603fa31d503011f5aad63538f5bb3940ad9907e8c300948
                                          • Opcode Fuzzy Hash: 96a173c633c9b89631610a92bedf4601ef20d42c42a2975e0e964c8c815cef9c
                                          • Instruction Fuzzy Hash: F92192B25083806FE7228F65DC45FA7BFF8EF46610F08849AE945CB652D364E848C771
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E13BE Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: FileView
                                          • String ID:
                                          • API String ID: 3314676101-0
                                          • Opcode ID: 9687546c6f723958514c161734c5fcbf75c9b8a79caa5053a8b21515d57b03f5
                                          • Instruction ID: ad4ecd39626a254c562a95533fb57b69a2cdebae446ab05b9d40b724de22187e
                                          • Opcode Fuzzy Hash: 9687546c6f723958514c161734c5fcbf75c9b8a79caa5053a8b21515d57b03f5
                                          • Instruction Fuzzy Hash: D621B171408340AFE722CF55DD45FA6FBF8EF09224F08849EE9848B652D375E948CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E0DE2 Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WSASocketW.WS2_32(?,?,?,?,?), ref: 058E0E6E
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Socket
                                          • String ID:
                                          • API String ID: 38366605-0
                                          • Opcode ID: 771c9bbaec7f9fbd5c4e13e4e1f135b6f848a55a3c0ffba1d5ba60c9f89d3d5e
                                          • Instruction ID: 5e18fca980fa84a3b9308cf825cf6c32743d67523f9b0cc323acf1e2d4daf667
                                          • Opcode Fuzzy Hash: 771c9bbaec7f9fbd5c4e13e4e1f135b6f848a55a3c0ffba1d5ba60c9f89d3d5e
                                          • Instruction Fuzzy Hash: 6421D671509380AFD721CF51DD45F66FFF8EF05210F08889EE9858B652D375A508CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 055923D8 Relevance: 1.6, Strings: 1, Instructions: 327COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k
                                          • API String ID: 0-2277858631
                                          • Opcode ID: 07b1bad8290d3c6fec22b98477ab55a385c4dc0501fa5674b2edf6185bf3c80a
                                          • Instruction ID: 667b7bc0bf2d6afb3890e290f5c4e48862611a49d5ff103d82cf442a577a92f1
                                          • Opcode Fuzzy Hash: 07b1bad8290d3c6fec22b98477ab55a385c4dc0501fa5674b2edf6185bf3c80a
                                          • Instruction Fuzzy Hash: EED11A35A00305AFCF09DBB5E4519AEB7B6FB8C304F209569D816973A4DF399C42CB91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EAC5A Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 015EACD9
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CreateFile
                                          • String ID:
                                          • API String ID: 823142352-0
                                          • Opcode ID: 6372ccaf486f629dea39c01f653e45be3f5bca32fbefc4fd80e0b1eab0d31b0e
                                          • Instruction ID: a9016db8e8111689d5725348bbc9df93e0cc3b6cf524e75e4d90ef0b5590fba7
                                          • Opcode Fuzzy Hash: 6372ccaf486f629dea39c01f653e45be3f5bca32fbefc4fd80e0b1eab0d31b0e
                                          • Instruction Fuzzy Hash: EF219271904204AFEB21CF65DD45B66FBE8FF08214F048869E9498B751D375E458CB71
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1116 Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E11B4
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: 5335e7e612824094e392ad1890b93559a6dbc8366b638dda29f65aa26e3e6859
                                          • Instruction ID: f9e4e737358fb5c75be7be25ef0a96ba94680b0f92919fef9fdb3f05d16f27ec
                                          • Opcode Fuzzy Hash: 5335e7e612824094e392ad1890b93559a6dbc8366b638dda29f65aa26e3e6859
                                          • Instruction Fuzzy Hash: 6F218172508340AFE721CB55DC44FA7FFF8EF46610F08849AE945DB692D364E908CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E122E Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                                          Download Yara Rule
                                          APIs
                                          • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 058E129F
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: DescriptorSecurity$ConvertString
                                          • String ID:
                                          • API String ID: 3907675253-0
                                          • Opcode ID: 51d364844026609ec2830126a402c67203edc06d7293dd239018c0eea1424d4a
                                          • Instruction ID: f88252871fdd0d3d06eb9f60c82ed131c7c28dfc6e145fefe26f1849c44f65c4
                                          • Opcode Fuzzy Hash: 51d364844026609ec2830126a402c67203edc06d7293dd239018c0eea1424d4a
                                          • Instruction Fuzzy Hash: FE21CF72600204AFEB20DF65DD45FAAFBACEF05224F08846AED45DB641D774E948CAB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E023C Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                                          Download Yara Rule
                                          APIs
                                          • K32EnumProcesses.KERNEL32(?,?,?,0C786A9F,00000000,?,?,?,?,?,?,?,?,6C9A3C58), ref: 058E02C2
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: EnumProcesses
                                          • String ID:
                                          • API String ID: 84517404-0
                                          • Opcode ID: 39924eb4fa5e697cd24aa68bd034c935af6ab90a15468736eeedf0a5038493a4
                                          • Instruction ID: 27aea1b698108e96cb3c02bc17abbd73aae6304dbe8bae621a0a7fca4371bd67
                                          • Opcode Fuzzy Hash: 39924eb4fa5e697cd24aa68bd034c935af6ab90a15468736eeedf0a5038493a4
                                          • Instruction Fuzzy Hash: 98216B715493C09FD7138B65DC59AA2BFB4AF47210F0D88DBE984CB1A3D264A918CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E0006 Relevance: 1.6, APIs: 1, Instructions: 75COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetExitCodeProcess.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E0088
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CodeExitProcess
                                          • String ID:
                                          • API String ID: 3861947596-0
                                          • Opcode ID: d7186acec92fe511d101183d3f0598d3acf29964d3f51383e85a3229ceb784fa
                                          • Instruction ID: 8c02c8997ff5d6084dc243891687e6e488f6c82fe01503a09b3b2940bcb7e561
                                          • Opcode Fuzzy Hash: d7186acec92fe511d101183d3f0598d3acf29964d3f51383e85a3229ceb784fa
                                          • Instruction Fuzzy Hash: 3021D7715493806FE712CB55DC45FA6BFB8EF46220F0884DAF944CB592D268A948C771
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EAB52 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 015EABD1
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Open
                                          • String ID:
                                          • API String ID: 71445658-0
                                          • Opcode ID: e7c9736e76d152f4550a19035dafa88318ee18979b85117ea23c5ed187eb61df
                                          • Instruction ID: 583eeb92b6ea3802f3ab1ebeac50f0f749f23342de16b075f93d307f75ee769b
                                          • Opcode Fuzzy Hash: e7c9736e76d152f4550a19035dafa88318ee18979b85117ea23c5ed187eb61df
                                          • Instruction Fuzzy Hash: BC21D472900304AFE7219F65CD84FABFBECEF14314F04885AE9458BA42D724E94C8AB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EB0D2 Relevance: 1.6, APIs: 1, Instructions: 73fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ReadFile.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 015EB151
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: FileRead
                                          • String ID:
                                          • API String ID: 2738559852-0
                                          • Opcode ID: 1cbf8bae852399c4a908e6024e5a95f61489aaaa6ed9bec8adab24e014217a76
                                          • Instruction ID: 404bf847c720ac25ad75ed205fbeb365bbc57c265b0a1d668bfd8c012b815728
                                          • Opcode Fuzzy Hash: 1cbf8bae852399c4a908e6024e5a95f61489aaaa6ed9bec8adab24e014217a76
                                          • Instruction Fuzzy Hash: F521A1B2904340AFE7228F55DC44FA7BBA8EF45724F08849AF9449B652D275A908CBB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E2FDB Relevance: 1.6, APIs: 1, Instructions: 73COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetProcessWorkingSetSize.KERNEL32(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E3057
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ProcessSizeWorking
                                          • String ID:
                                          • API String ID: 3584180929-0
                                          • Opcode ID: 6962bb49e3f061033bee5034760137508258e23f0f3a1104c29b7aedec864d56
                                          • Instruction ID: ca4d85e61802a36558d491cfa2bff91176c6560097a74c52f734064204c94bee
                                          • Opcode Fuzzy Hash: 6962bb49e3f061033bee5034760137508258e23f0f3a1104c29b7aedec864d56
                                          • Instruction Fuzzy Hash: 7621C2715083806FDB12CB61DC45FA6BFB8EF46220F08849AE944CB552D264A908CBA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateMutexW.KERNELBASE(?,?), ref: 015EA6B9
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID:
                                          • API String ID: 1964310414-0
                                          • Opcode ID: 7ab21787ac1ddc97512a4f9cacb26c5593a1aaadac848d1c92d0d367b7020e0f
                                          • Instruction ID: 02c0b3b2c972add0a1325deae4be7f6b26c7febd8ede2217cb494a3fc8fb2c3c
                                          • Opcode Fuzzy Hash: 7ab21787ac1ddc97512a4f9cacb26c5593a1aaadac848d1c92d0d367b7020e0f
                                          • Instruction Fuzzy Hash: 2621A4B1A042409FE710DF65CD89BAAFBE8FF05224F048869E949CF741D775E909CA71
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1655 Relevance: 1.6, APIs: 1, Instructions: 72COMMON
                                          Download Yara Rule
                                          APIs
                                          • shutdown.WS2_32(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E16D8
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: shutdown
                                          • String ID:
                                          • API String ID: 2510479042-0
                                          • Opcode ID: e655f0778ea8aa89f6b86fca99c92c8dc251cbae5045c6ce1cb9c66b5bc4e370
                                          • Instruction ID: 9120045b8e4e76f62a7feaae1bf00bc641eae13c57c79d8084a07fd79cd86b6e
                                          • Opcode Fuzzy Hash: e655f0778ea8aa89f6b86fca99c92c8dc251cbae5045c6ce1cb9c66b5bc4e370
                                          • Instruction Fuzzy Hash: EF2195B15093806FD712CB51CC45B96FFB8EF46624F0884DAE984DB552D368A948C7A1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EBBF0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                          Download Yara Rule
                                          APIs
                                          • LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 015EBC6A
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: LookupPrivilegeValue
                                          • String ID:
                                          • API String ID: 3899507212-0
                                          • Opcode ID: c332a15f84d34b3c369f90ac088aa64aa8539e332b39735ffc9352bf2caf36a6
                                          • Instruction ID: 4666737a9295aaa67abc445cd9de292f2318f74a9e2c3f7dda37457c74584d45
                                          • Opcode Fuzzy Hash: c332a15f84d34b3c369f90ac088aa64aa8539e332b39735ffc9352bf2caf36a6
                                          • Instruction Fuzzy Hash: 15219FB1A093815FE7228F29DC44B52BFF8EF46210F0884DAED49CB253D665E808CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 015EA40C
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: 7f5fe6ab545448433ed23b275fb64ab95e54ebd562fc2e93f04c3035194895c4
                                          • Instruction ID: 033a88ec1d5f965b69f47479db4e57cb98422d5173a8bcb131b4c6a580aa686c
                                          • Opcode Fuzzy Hash: 7f5fe6ab545448433ed23b275fb64ab95e54ebd562fc2e93f04c3035194895c4
                                          • Instruction Fuzzy Hash: 30216075A00704AFE721CF65CC89FA6F7ECFF04610F08C45AE9458B652D764E949CAB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E2D47 Relevance: 1.6, APIs: 1, Instructions: 69COMMON
                                          Download Yara Rule
                                          APIs
                                          • ioctlsocket.WS2_32(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E2DC3
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ioctlsocket
                                          • String ID:
                                          • API String ID: 3577187118-0
                                          • Opcode ID: e536634125dad6cc55ea09c41d9520a2e21cd4823685eed5c2ce67bd318aabaf
                                          • Instruction ID: 4eddbd20cfd931e02720630589c476bbd2434fcfbd11a608b01014ad4c0b2fb6
                                          • Opcode Fuzzy Hash: e536634125dad6cc55ea09c41d9520a2e21cd4823685eed5c2ce67bd318aabaf
                                          • Instruction Fuzzy Hash: D121C3715093846FD722CF51CC44FA6FFB8EF46220F08849AE9459B552D374A908C7B1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EBE38 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                          • FindCloseChangeNotification.KERNELBASE(?), ref: 015EBEA4
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ChangeCloseFindNotification
                                          • String ID:
                                          • API String ID: 2591292051-0
                                          • Opcode ID: 8a04bfdf4ea2c927b76164e2e78bf245b87f480d22f1052ef774ca5d5d5e0cf6
                                          • Instruction ID: 922e91f41dcb271a963f4ca463c0bd4dff08e1f09c4fe400d148230cb9b79e3c
                                          • Opcode Fuzzy Hash: 8a04bfdf4ea2c927b76164e2e78bf245b87f480d22f1052ef774ca5d5d5e0cf6
                                          • Instruction Fuzzy Hash: C221AEB25093C05FDB02CB25DC95792BFB4AF47224F0984DAE9858F663D275A908CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E13DE Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: FileView
                                          • String ID:
                                          • API String ID: 3314676101-0
                                          • Opcode ID: 9215fe2dfb958697a171faf2f5ad94bb364e73d3226d7cc72e6035c747750042
                                          • Instruction ID: 3cabd52c166ddc41da0ab7fab33faea58cf149086eadc11e9c009bbf00397250
                                          • Opcode Fuzzy Hash: 9215fe2dfb958697a171faf2f5ad94bb364e73d3226d7cc72e6035c747750042
                                          • Instruction Fuzzy Hash: 6921F071504204AFE721CF55DD89FA6FBE8EF09228F08845AE9458BB41D375E84CCBA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1AEE Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 058E1B6A
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Connect
                                          • String ID:
                                          • API String ID: 3144859779-0
                                          • Opcode ID: 3e92e39c7a6579c6a9d9ec8bd08146a1af80c907bc4790d28cca0d684c233afe
                                          • Instruction ID: 805d6b1b19675eab0d7f0ec616f57a2ebb8e824258ccb6c10970b89db8dc3418
                                          • Opcode Fuzzy Hash: 3e92e39c7a6579c6a9d9ec8bd08146a1af80c907bc4790d28cca0d684c233afe
                                          • Instruction Fuzzy Hash: 46219F71508380AFDB228F61DC44B62BFF8FF46310F0884DAED858B562D375A819DB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E0E02 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WSASocketW.WS2_32(?,?,?,?,?), ref: 058E0E6E
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Socket
                                          • String ID:
                                          • API String ID: 38366605-0
                                          • Opcode ID: f5d9319c18f748f727a4074ba3546d5d81badca86b7fa7446cd628fac263d3ec
                                          • Instruction ID: 2d821875f81b231afa6bc6b1a816dac4bc305d575f4f96363d55ecfa38cc24db
                                          • Opcode Fuzzy Hash: f5d9319c18f748f727a4074ba3546d5d81badca86b7fa7446cd628fac263d3ec
                                          • Instruction Fuzzy Hash: D921C271504200AFE721DF55DD45F66FBF8EF05224F048869ED858AA51D3B5E448CB72
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EB19B Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetFileAttributesW.KERNELBASE(?,?), ref: 015EB213
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: AttributesFile
                                          • String ID:
                                          • API String ID: 3188754299-0
                                          • Opcode ID: 018ad8dbb282e4915dc8a51011337c6e9d75529c4cb6e66816479bdd87096393
                                          • Instruction ID: a4a5313acf179e924b78496057e5d0f14573e2e283edaa667b20a4f780d878b6
                                          • Opcode Fuzzy Hash: 018ad8dbb282e4915dc8a51011337c6e9d75529c4cb6e66816479bdd87096393
                                          • Instruction Fuzzy Hash: 5D21F3B19083C05FDB12CB29DC95796BFE8EF06314F0980EAE884CF153D2249909CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1E86 Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNELBASE(?,00000E24), ref: 058E1F0F
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: LibraryLoad
                                          • String ID:
                                          • API String ID: 1029625771-0
                                          • Opcode ID: 6aa307c46d41036a81f7522393c72fd3e796ff8bca55e8a02af8b22e5bf13f73
                                          • Instruction ID: f8875232b7ff085af41e09123365c265d88199dd4c2079b6a1f9c5bf2ce047eb
                                          • Opcode Fuzzy Hash: 6aa307c46d41036a81f7522393c72fd3e796ff8bca55e8a02af8b22e5bf13f73
                                          • Instruction Fuzzy Hash: 2011E4715083406FE721CB11DC85FA2FBB8EF45720F08809AF9449B692D374A948CBA5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegSetValueExW.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 015EA4F8
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Value
                                          • String ID:
                                          • API String ID: 3702945584-0
                                          • Opcode ID: 225d6510bc9ccee49939954d26a3991f8934ce3060d597e2ea2ade34cfc4e512
                                          • Instruction ID: d2bede573e020e244e641791f55837adeb81f7332534b5194fbcbcdc062203fb
                                          • Opcode Fuzzy Hash: 225d6510bc9ccee49939954d26a3991f8934ce3060d597e2ea2ade34cfc4e512
                                          • Instruction Fuzzy Hash: 7B1181B6900700AFEB218E65DD49FA6FBECEF04614F08845AED458BA51D764E4488AB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1142 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E11B4
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: 8e4dc83869147d550f41b378488615d5ee9217c9de90bd0feed5bbb09814e395
                                          • Instruction ID: b8410040c68f77deaaf0a0bd7eae45f4054c88ec0114f11ec05f46a39f1bec7b
                                          • Opcode Fuzzy Hash: 8e4dc83869147d550f41b378488615d5ee9217c9de90bd0feed5bbb09814e395
                                          • Instruction Fuzzy Hash: 1011BE72604204AFE720DF91DC84FA6FBF8EF05624F08845AED45CB651D774E948CAB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EB330 Relevance: 1.6, APIs: 1, Instructions: 64fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CopyFileW.KERNELBASE(?,?,?), ref: 015EB39A
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CopyFile
                                          • String ID:
                                          • API String ID: 1304948518-0
                                          • Opcode ID: d3eae92456d0028cae53eccec85648b696ca14650ae313004ff7a693251a09bd
                                          • Instruction ID: 9e317a451c81281ca1bc7fa750db3cccb1e95594c4e95858a46daa48c53d87e9
                                          • Opcode Fuzzy Hash: d3eae92456d0028cae53eccec85648b696ca14650ae313004ff7a693251a09bd
                                          • Instruction Fuzzy Hash: 6D1184B1A053809FD721CF69DC85B57BFE8EF45220F0884AAED45CF652D274E808CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1852 Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetProcessTimes.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E18B1
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ProcessTimes
                                          • String ID:
                                          • API String ID: 1995159646-0
                                          • Opcode ID: b100f348d91c1b6f79bf3275a60c070f2316a4ddf7754a874e2fce4c966446bc
                                          • Instruction ID: 15f515bc3728e34ff67b7d1358aed5ed0a0335e3ffd5daa5d776651a6f73fc74
                                          • Opcode Fuzzy Hash: b100f348d91c1b6f79bf3275a60c070f2316a4ddf7754a874e2fce4c966446bc
                                          • Instruction Fuzzy Hash: AF11EE72600204AFEB20CF55CC85BA6BBA8EF05224F08846AED05CAA41D374E808CBB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA710 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                          Download Yara Rule
                                          APIs
                                          • FindCloseChangeNotification.KERNELBASE(?), ref: 015EA780
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ChangeCloseFindNotification
                                          • String ID:
                                          • API String ID: 2591292051-0
                                          • Opcode ID: a3a5a31018d912057d9f7997b6243f9f5bc06f91a7da7528ebb5ea40278bc3c5
                                          • Instruction ID: 23ac83cb035769b340904a7cc231d24fd1ad63453444973b595c6eaf24f6c294
                                          • Opcode Fuzzy Hash: a3a5a31018d912057d9f7997b6243f9f5bc06f91a7da7528ebb5ea40278bc3c5
                                          • Instruction Fuzzy Hash: D411E1B59443809FD701CB65DD86B52BFA8FF06320F0884ABED858B693D334A909CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E2FFE Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetProcessWorkingSetSize.KERNEL32(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E3057
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ProcessSizeWorking
                                          • String ID:
                                          • API String ID: 3584180929-0
                                          • Opcode ID: 13222f6f3184e4359f64dacccfc002acdfae59cddc1c49549c6e2ea5333fb8d8
                                          • Instruction ID: 391ae85e25156c009b06b5da2608e78b74e09e86c2a6ba0272e1e86d9673133c
                                          • Opcode Fuzzy Hash: 13222f6f3184e4359f64dacccfc002acdfae59cddc1c49549c6e2ea5333fb8d8
                                          • Instruction Fuzzy Hash: 8511E371600204AFEB21CF65DD85FA6F7E8EF45324F08886AED05CB641D774E9488BB5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E2F1A Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetProcessWorkingSetSize.KERNEL32(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E2F73
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ProcessSizeWorking
                                          • String ID:
                                          • API String ID: 3584180929-0
                                          • Opcode ID: 13222f6f3184e4359f64dacccfc002acdfae59cddc1c49549c6e2ea5333fb8d8
                                          • Instruction ID: 2cb63f08a150567e59e3be9247b0f6ef2340cdb4f3107ccd4cca20b46a373bb4
                                          • Opcode Fuzzy Hash: 13222f6f3184e4359f64dacccfc002acdfae59cddc1c49549c6e2ea5333fb8d8
                                          • Instruction Fuzzy Hash: 92110175600204AFEB20CF51CC85FAAF7ACEF45324F08846AED05CB681D374E9088BB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E03C0 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                          Download Yara Rule
                                          APIs
                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 058E0432
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: DuplicateHandle
                                          • String ID:
                                          • API String ID: 3793708945-0
                                          • Opcode ID: b6641576fe59f4b9bc51e70bc5e5c31d2970741a873c7465fb83ed027d651bbe
                                          • Instruction ID: 4e86ace86cfaa3f3e44896ce4d7c4325bc9e55267d5c93f26f3bcbcb5865e0ea
                                          • Opcode Fuzzy Hash: b6641576fe59f4b9bc51e70bc5e5c31d2970741a873c7465fb83ed027d651bbe
                                          • Instruction Fuzzy Hash: E921A871449380AFDB22CF61DC44A52FFF4FF46320F0988DAE9858B562D275A859CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E0032 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetExitCodeProcess.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E0088
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CodeExitProcess
                                          • String ID:
                                          • API String ID: 3861947596-0
                                          • Opcode ID: 105754d74d7df3bf29cfa3a357850645f592b4952b749e1dc871734bfb0ffd68
                                          • Instruction ID: d2d96801acf5a13637907d0c7e78589d3abda521731601404a185f4572e8c6b6
                                          • Opcode Fuzzy Hash: 105754d74d7df3bf29cfa3a357850645f592b4952b749e1dc871734bfb0ffd68
                                          • Instruction Fuzzy Hash: 2F112371600204AFEB11CF51CC85BA6B7ECEF45224F08886AED04CB641E7B4E9088AB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EB0F2 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ReadFile.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 015EB151
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: FileRead
                                          • String ID:
                                          • API String ID: 2738559852-0
                                          • Opcode ID: 7b6575fece9efdcab40684e9e642fd728ccbb3e5a5a98eedb767eda38459a8ad
                                          • Instruction ID: d47c6701852cf57a76d7c84d43307aa2fbd1d9dadd4f3340d68718659d59760f
                                          • Opcode Fuzzy Hash: 7b6575fece9efdcab40684e9e642fd728ccbb3e5a5a98eedb767eda38459a8ad
                                          • Instruction Fuzzy Hash: 2511C172900300AFEB21CF55DD45FAAFBE8EF44724F08885AE9459FA51D374E5488BB2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E2D6A Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                          Download Yara Rule
                                          APIs
                                          • ioctlsocket.WS2_32(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E2DC3
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ioctlsocket
                                          • String ID:
                                          • API String ID: 3577187118-0
                                          • Opcode ID: 07c2a565e23560f7b4f35f746d4b151ecb6a4594128357bbe3eb06327817dc9c
                                          • Instruction ID: c8852f86cf6f4f746ab040ef47b40801e73d5a9950a8e60478b9b1d4bcb7e538
                                          • Opcode Fuzzy Hash: 07c2a565e23560f7b4f35f746d4b151ecb6a4594128357bbe3eb06327817dc9c
                                          • Instruction Fuzzy Hash: 9B11E075604204AFEB20CF51CC84FA6FBACEF45324F08846AEE45CB645D374A9488AB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EAA81 Relevance: 1.6, APIs: 1, Instructions: 57comCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Initialize
                                          • String ID:
                                          • API String ID: 2538663250-0
                                          • Opcode ID: 84bcad45bed0064cc45b61ff95f0de06a80f9fad94d05fc932b3495f143e5642
                                          • Instruction ID: b41d85cd0fb1d42c0dfd0fdc8c1b1bee06669b9f8eda80ee1c05ca7b0be45b38
                                          • Opcode Fuzzy Hash: 84bcad45bed0064cc45b61ff95f0de06a80f9fad94d05fc932b3495f143e5642
                                          • Instruction Fuzzy Hash: 851160715493C06FDB128B25DC55792BFB4EF46220F0888DAED848F153D275A948CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1682 Relevance: 1.6, APIs: 1, Instructions: 57COMMON
                                          Download Yara Rule
                                          APIs
                                          • shutdown.WS2_32(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 058E16D8
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: shutdown
                                          • String ID:
                                          • API String ID: 2510479042-0
                                          • Opcode ID: 4671d2fc28540b0636c60f147a2ff024d97c3b66fe8be720386081d258e10c65
                                          • Instruction ID: 5245f1cee2bc28569191573d1fe26e47cbfa68825ca1ab3383b33e7753b51f5f
                                          • Opcode Fuzzy Hash: 4671d2fc28540b0636c60f147a2ff024d97c3b66fe8be720386081d258e10c65
                                          • Instruction Fuzzy Hash: 41112571504204AFEB20CF51CC84FA6F7ECEF45724F18845AED04DB645D374A908CAB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA2D2 Relevance: 1.6, APIs: 1, Instructions: 56COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNELBASE(?), ref: 015EA330
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ErrorMode
                                          • String ID:
                                          • API String ID: 2340568224-0
                                          • Opcode ID: c2b14b3ac0932413cf4f178b793821ef2c1be1004ffd1ba1b2eb537182b3058b
                                          • Instruction ID: 822b8e03a25ed365ebde66f31d8d079df362e9626e18aad34329b556c9dfb206
                                          • Opcode Fuzzy Hash: c2b14b3ac0932413cf4f178b793821ef2c1be1004ffd1ba1b2eb537182b3058b
                                          • Instruction Fuzzy Hash: A4116D718493C06FDB138B259C54A62BFB4AF47620F0880CAED848F263D265A908D772
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1EA6 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNELBASE(?,00000E24), ref: 058E1F0F
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: LibraryLoad
                                          • String ID:
                                          • API String ID: 1029625771-0
                                          • Opcode ID: 75e31c807532840241980cb170dac9f495ab02db5fc72fba6fab045a13e1a247
                                          • Instruction ID: 9c08cafe7d639dbeb76586c5fe95484227689f9e42f77af82a0109f0094e1093
                                          • Opcode Fuzzy Hash: 75e31c807532840241980cb170dac9f495ab02db5fc72fba6fab045a13e1a247
                                          • Instruction Fuzzy Hash: 11110871504204AEE720DB15DD85FB6F7A8EF05724F14809AFD049B781D3B4E94DCAA5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E2E46 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: select
                                          • String ID:
                                          • API String ID: 1274211008-0
                                          • Opcode ID: 542ae0084650c5dbb5d517a2fd85280a89996aa0200716ebaf9a38b06c784ee1
                                          • Instruction ID: 0e22a8fc9182c872d787d51eba02ba5da7471a0fc638ddd28a57ceafb5d6f91c
                                          • Opcode Fuzzy Hash: 542ae0084650c5dbb5d517a2fd85280a89996aa0200716ebaf9a38b06c784ee1
                                          • Instruction Fuzzy Hash: 0D116D796002059FEB20CF55C884F62F7F8FF05610F0884AADD8ACB656D374E848CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA078 Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: send
                                          • String ID:
                                          • API String ID: 2809346765-0
                                          • Opcode ID: 21821b8582a7cd1898719522f38fddd1ffc85bcee5f6c65826c63a4ac2946fc2
                                          • Instruction ID: 249b13e6ee9c578bf121edc52791cbcccce58cdd44495066c7c64ce830e1f9ee
                                          • Opcode Fuzzy Hash: 21821b8582a7cd1898719522f38fddd1ffc85bcee5f6c65826c63a4ac2946fc2
                                          • Instruction Fuzzy Hash: E811BF71549380AFDB22CF25DC44B52FFB4EF46220F08849AED848F552C275E908CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EB352 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CopyFileW.KERNELBASE(?,?,?), ref: 015EB39A
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CopyFile
                                          • String ID:
                                          • API String ID: 1304948518-0
                                          • Opcode ID: ac84ba8cd4ba39a81c675a9eeb1e1e009889fa4e62219bf13a0b9cca53a9a960
                                          • Instruction ID: c33ea13449cb322731d76c17f89aef2bb3d60519419c5b0277e6186bf4f982de
                                          • Opcode Fuzzy Hash: ac84ba8cd4ba39a81c675a9eeb1e1e009889fa4e62219bf13a0b9cca53a9a960
                                          • Instruction Fuzzy Hash: 7011A5B2A003409FEB20CF69D886756FBE8FF18221F08C46ADD49CF746D674E404CA61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EBC22 Relevance: 1.6, APIs: 1, Instructions: 53COMMON
                                          Download Yara Rule
                                          APIs
                                          • LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 015EBC6A
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: LookupPrivilegeValue
                                          • String ID:
                                          • API String ID: 3899507212-0
                                          • Opcode ID: ac84ba8cd4ba39a81c675a9eeb1e1e009889fa4e62219bf13a0b9cca53a9a960
                                          • Instruction ID: 676be45f1a54e2aac979e59b28966fc9a3e0033f539159c70ba51e3d2431e31b
                                          • Opcode Fuzzy Hash: ac84ba8cd4ba39a81c675a9eeb1e1e009889fa4e62219bf13a0b9cca53a9a960
                                          • Instruction Fuzzy Hash: 0611A0B1A042018FEB14CF29D889B56BBD8EB04211F0884AADD49CB642D674E414CA62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EAD72 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetFileType.KERNELBASE(?,00000E24,0C786A9F,00000000,00000000,00000000,00000000), ref: 015EADC5
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: FileType
                                          • String ID:
                                          • API String ID: 3081899298-0
                                          • Opcode ID: 075560a11f4e1e6a9e6c0d813cbc4c1d557f0985c45571291f4421dd685e007c
                                          • Instruction ID: 7a83a8fba5721adef34b3aecf3ffea0aefb06c068961db9f40f2235227de3462
                                          • Opcode Fuzzy Hash: 075560a11f4e1e6a9e6c0d813cbc4c1d557f0985c45571291f4421dd685e007c
                                          • Instruction Fuzzy Hash: D801D675904240AFE711CB15DD85BA6F7E8EF45624F18C056ED048F741D775E84C8AB2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EB48C Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CloseFind
                                          • String ID:
                                          • API String ID: 1863332320-0
                                          • Opcode ID: 9a114069bb911a9368e2578670b1846f9612e5ff94d6afbb78b3693575aff149
                                          • Instruction ID: cde6508601c46738dc1c2d6abd334f3ad489382c598e6aaf7e4e1e90f58528e7
                                          • Opcode Fuzzy Hash: 9a114069bb911a9368e2578670b1846f9612e5ff94d6afbb78b3693575aff149
                                          • Instruction Fuzzy Hash: 8D11E571549380AFCB128F25DC55B52FFB4EF46220F0880DBED858F253D274A908CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA9E4 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                          Download Yara Rule
                                          APIs
                                          • WaitForInputIdle.USER32(?,?), ref: 015EAA3B
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: IdleInputWait
                                          • String ID:
                                          • API String ID: 2200289081-0
                                          • Opcode ID: 8713948ed4407597956898270ce62c44a680fc3d76037aa6f83c0ef00c8f2b6c
                                          • Instruction ID: fdb5030d4b3446cb2dd0251a014aec28e7cffe15b2a3cb76be6ea517c107d472
                                          • Opcode Fuzzy Hash: 8713948ed4407597956898270ce62c44a680fc3d76037aa6f83c0ef00c8f2b6c
                                          • Instruction Fuzzy Hash: DA11C1714483809FDB128F25CC84B52BFE4EF46220F08849AED858F263D278A908CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E0282 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                          Download Yara Rule
                                          APIs
                                          • K32EnumProcesses.KERNEL32(?,?,?,0C786A9F,00000000,?,?,?,?,?,?,?,?,6C9A3C58), ref: 058E02C2
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: EnumProcesses
                                          • String ID:
                                          • API String ID: 84517404-0
                                          • Opcode ID: 9d583e3118f2b9430646d1fac6b84e9bdd4540cd6acee6237be2797fc2d8692d
                                          • Instruction ID: be55cbef3d6c34394c27c5a33ea44840361b41b31bccc76d1e943887710d7df9
                                          • Opcode Fuzzy Hash: 9d583e3118f2b9430646d1fac6b84e9bdd4540cd6acee6237be2797fc2d8692d
                                          • Instruction Fuzzy Hash: 4C118B71600204CFDB10CF65D888B66FBE8EF06220F0888AADD49CB655D2B4E808CA61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1B1E Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 058E1B6A
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Connect
                                          • String ID:
                                          • API String ID: 3144859779-0
                                          • Opcode ID: 0022b39e5d0fdce6628f3bcb2e3e5088d1eafa65178ee25eea034a32e678efd1
                                          • Instruction ID: 5f7c430457d1db26a6d569842fee7071ad913ba452079517c89d39ebb1158e62
                                          • Opcode Fuzzy Hash: 0022b39e5d0fdce6628f3bcb2e3e5088d1eafa65178ee25eea034a32e678efd1
                                          • Instruction Fuzzy Hash: 2C1170715007049FEB20CF55D844B62FBF5FF89710F08849ADD458B621E375E818CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EB1D6 Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetFileAttributesW.KERNELBASE(?,?), ref: 015EB213
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: AttributesFile
                                          • String ID:
                                          • API String ID: 3188754299-0
                                          • Opcode ID: 35cec6121330398dc1f68c32c257d5a1aabd8b18c6087c7ad348449a9922798d
                                          • Instruction ID: 5814d08a522d11a47bf8267cba38ed186cad26cbf331a119d9fab82e74cf68e9
                                          • Opcode Fuzzy Hash: 35cec6121330398dc1f68c32c257d5a1aabd8b18c6087c7ad348449a9922798d
                                          • Instruction Fuzzy Hash: 3B01B571A002009FEB10CF69D98976AFBD8FF15221F08C4AADD49CF756D678E404CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E1C1A Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetVolumeInformationA.KERNELBASE(?,00000E24,?,?), ref: 058E1C6A
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: InformationVolume
                                          • String ID:
                                          • API String ID: 2039140958-0
                                          • Opcode ID: ad322bdd5acf37ebc66541c83b50c20bd5ea6a97104076732206a66f36f43267
                                          • Instruction ID: b5f0f2a811ad32785911e9a49573b51c8b699537819ceaaddf6ca1aff7ddaf79
                                          • Opcode Fuzzy Hash: ad322bdd5acf37ebc66541c83b50c20bd5ea6a97104076732206a66f36f43267
                                          • Instruction Fuzzy Hash: BF01B171A40200ABD310DF16CD46B66FBE8FB88A20F14811AED089BB41D735B919CBE5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E03EE Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                          Download Yara Rule
                                          APIs
                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 058E0432
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: DuplicateHandle
                                          • String ID:
                                          • API String ID: 3793708945-0
                                          • Opcode ID: 953f071e3f4168b82937c38228086ad3822ca05887d3ca4c8e0a1470faaf0b91
                                          • Instruction ID: 823c23b024091b4e773877a09c58fb111dfcb815f4062ed35ede2794e864dfd1
                                          • Opcode Fuzzy Hash: 953f071e3f4168b82937c38228086ad3822ca05887d3ca4c8e0a1470faaf0b91
                                          • Instruction Fuzzy Hash: 12018B32900700DFDB20CF91D944B62FBF1EF49628F08C89AEE498A656D275E418CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA74E Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          • FindCloseChangeNotification.KERNELBASE(?), ref: 015EA780
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ChangeCloseFindNotification
                                          • String ID:
                                          • API String ID: 2591292051-0
                                          • Opcode ID: 7d297463267e280315d0f0d1df17fa914e3063b02e118dc83223f66241e22f20
                                          • Instruction ID: bd3de4138a93a30e517253a215d923a9445e2421cb5d2ad628ba630be2306b43
                                          • Opcode Fuzzy Hash: 7d297463267e280315d0f0d1df17fa914e3063b02e118dc83223f66241e22f20
                                          • Instruction Fuzzy Hash: 9401F771A40200CFEB10CF65D989765FBE4EF04220F08C4ABDD4A8F746D274E808CEA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EBE72 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          • FindCloseChangeNotification.KERNELBASE(?), ref: 015EBEA4
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ChangeCloseFindNotification
                                          • String ID:
                                          • API String ID: 2591292051-0
                                          • Opcode ID: c9c3ab46e295cd827f22588fbb42ea1a9f4fac17dab2b73a766794bc383fa67b
                                          • Instruction ID: 678185a8c59b834ec206ac529caceb9b32dc00cb07fba0eeda259dd88ef926eb
                                          • Opcode Fuzzy Hash: c9c3ab46e295cd827f22588fbb42ea1a9f4fac17dab2b73a766794bc383fa67b
                                          • Instruction Fuzzy Hash: F801D471A042408FDB10CF69D889766FBE4EF04221F08C4AADE498F746D275E408CAA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 058E0D66 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 058E0DB6
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133867151.00000000058E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_58e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: a18890c4cfd14ad56416ce765f9190e91aed0d26057e7354916718b86776e651
                                          • Instruction ID: af9cac8b206ba2d5660ccc7ebc12a6900746d012b6610db0e126a790969b60ba
                                          • Opcode Fuzzy Hash: a18890c4cfd14ad56416ce765f9190e91aed0d26057e7354916718b86776e651
                                          • Instruction Fuzzy Hash: 5901A271640200ABD310DF16CD46B66FBE8FB88A20F14811AED089BB41D771F959CBE6
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA09A Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: send
                                          • String ID:
                                          • API String ID: 2809346765-0
                                          • Opcode ID: 3322f90108091a8abafe8a8c6fad020a157d5e9b13c08558d40c4e35dccea493
                                          • Instruction ID: 8522fe4a6bc4b900ec5b8d32ea5f4724e2e4e404a7d0275dc7bf9cb3d57cc7a2
                                          • Opcode Fuzzy Hash: 3322f90108091a8abafe8a8c6fad020a157d5e9b13c08558d40c4e35dccea493
                                          • Instruction Fuzzy Hash: B0018C719002409FDB20CF65D888B65FBE4FF04220F08889ADD498F656D375E418CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EAA06 Relevance: 1.5, APIs: 1, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • WaitForInputIdle.USER32(?,?), ref: 015EAA3B
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: IdleInputWait
                                          • String ID:
                                          • API String ID: 2200289081-0
                                          • Opcode ID: f222d5efa3b45049994245238853b2167920f2221cc69779d129b166bf8dd631
                                          • Instruction ID: f0c3486f59a790075e445a8d37110b7fe3f8741a3880abb61d3e437de9bf3965
                                          • Opcode Fuzzy Hash: f222d5efa3b45049994245238853b2167920f2221cc69779d129b166bf8dd631
                                          • Instruction Fuzzy Hash: 92018F719003409FDB10CF65D989766FBE4FF44620F08C8AADD498F656D2B9E508CBA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EAAAE Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Initialize
                                          • String ID:
                                          • API String ID: 2538663250-0
                                          • Opcode ID: 34f8bc5854046a7cec53cc47f82cafdee4b157a2d8706293ecff20da41c760f9
                                          • Instruction ID: 67433ca2f081aa4fa65654385be68a869fa6db9699dee62d2054106a9f4deca8
                                          • Opcode Fuzzy Hash: 34f8bc5854046a7cec53cc47f82cafdee4b157a2d8706293ecff20da41c760f9
                                          • Instruction Fuzzy Hash: B001AD71A003409FDB10CF65D989766FBE4EF14220F08C8AADD488F646D2B9E448CAA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EB4AE Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CloseFind
                                          • String ID:
                                          • API String ID: 1863332320-0
                                          • Opcode ID: c84c075ac3c206c7c95bc5d0f42ee0c084a41d29aef3fd45de26b519ac218939
                                          • Instruction ID: 4d5c5389dd5b1ed904b9096eeeb383ba445ec29828ab98e7e367f03f634a3802
                                          • Opcode Fuzzy Hash: c84c075ac3c206c7c95bc5d0f42ee0c084a41d29aef3fd45de26b519ac218939
                                          • Instruction Fuzzy Hash: 7B01D175A003009FDB208F19D989765FBE4EF05221F08C0AADD098F752E375E808CEA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EB572 Relevance: 1.5, APIs: 1, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLogicalDrives.KERNELBASE ref: 015EB5A1
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: DrivesLogical
                                          • String ID:
                                          • API String ID: 999431828-0
                                          • Opcode ID: 16f706763ed5857caac71d133281aed9761ab1939e5e1a3d665b2f3598de4aca
                                          • Instruction ID: 153c182c23354cf3fe802bb37526cdc50d143bea914b4ba0d4381870c0123d5d
                                          • Opcode Fuzzy Hash: 16f706763ed5857caac71d133281aed9761ab1939e5e1a3d665b2f3598de4aca
                                          • Instruction Fuzzy Hash: DA01D1719042408FDB10CF55D889766FBE4EF45321F08C8ABDD088F646E278E408CBA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015EA2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNELBASE(?), ref: 015EA330
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131154866.00000000015EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 015EA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15ea000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ErrorMode
                                          • String ID:
                                          • API String ID: 2340568224-0
                                          • Opcode ID: 1cadcfc9dc5322e0ae5ea10246fc09204c047b8a7216d83c68ea0dba1e7ed829
                                          • Instruction ID: 57d4433a30afe241a468d551ec503cc9509fcfee8f029072b0d4206ec0cf0930
                                          • Opcode Fuzzy Hash: 1cadcfc9dc5322e0ae5ea10246fc09204c047b8a7216d83c68ea0dba1e7ed829
                                          • Instruction Fuzzy Hash: 80F08C75D04240DFDB108F19D889765FBE4EF09621F08C09ADD494F752E2B9E408CAA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 055923C9 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k
                                          • API String ID: 0-2277858631
                                          • Opcode ID: 8108dc20f6f610a199efd883bf39b012537cefec9a52e66608752d3e9596f79f
                                          • Instruction ID: a6c697284734dd529a86b9a410e478bab7210e07c81628befc3291888583b19a
                                          • Opcode Fuzzy Hash: 8108dc20f6f610a199efd883bf39b012537cefec9a52e66608752d3e9596f79f
                                          • Instruction Fuzzy Hash: 4BA10C39B00305AFCF09DBB5E451A6EB7B6FB8C304F209569E816973A4DB399C42CB51
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 055924DD Relevance: 1.5, Strings: 1, Instructions: 228COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k
                                          • API String ID: 0-2277858631
                                          • Opcode ID: 503714d994ae4c2b1dd97933652d8918fda31dd3fd54db7cea158e9f75a2b940
                                          • Instruction ID: 2965cd98ff0b23da6c43a97dca2f01e92b7c479650d9c369e6641024cdcd41ea
                                          • Opcode Fuzzy Hash: 503714d994ae4c2b1dd97933652d8918fda31dd3fd54db7cea158e9f75a2b940
                                          • Instruction Fuzzy Hash: 46912C39A00305AFCF09DBB5E45156EB7B6FB8C308F209569E816973A4DB399C42CB51
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0559252D Relevance: 1.5, Strings: 1, Instructions: 217COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k
                                          • API String ID: 0-2277858631
                                          • Opcode ID: 555c248c8342fdcc0186161f962b7277abed1760fc293f4955b107a8d529b399
                                          • Instruction ID: f93faec9e83178f387110b8f7d59f2d632cab090e802013da794d6223030a2b5
                                          • Opcode Fuzzy Hash: 555c248c8342fdcc0186161f962b7277abed1760fc293f4955b107a8d529b399
                                          • Instruction Fuzzy Hash: B1810C39B00305AFCF09DBB5E451A6EB3A6FB89308F20956DE815977A4DB399C42CB41
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0559256F Relevance: 1.5, Strings: 1, Instructions: 210COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k
                                          • API String ID: 0-2277858631
                                          • Opcode ID: aeb2fcf07b29b12eb65d0cd0fd1ca983f0cde3091740a4196c499ba50d7e803f
                                          • Instruction ID: 1cfa688e7af4b0249ecb9a2aecf23d122c55694681d9dd4b2a505c30110c65c6
                                          • Opcode Fuzzy Hash: aeb2fcf07b29b12eb65d0cd0fd1ca983f0cde3091740a4196c499ba50d7e803f
                                          • Instruction Fuzzy Hash: BC811C38B00305EFCF09DBB5E451A6EB3A6FB89308F20956DE815977A4DB399C42CB41
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590B03 Relevance: 1.4, Strings: 1, Instructions: 194COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k
                                          • API String ID: 0-2277858631
                                          • Opcode ID: 7e142f936a4576736430de5469aa48ad2b24558bb2d6443f39e805bac29ae7bd
                                          • Instruction ID: ebac31beb4ac3320c2eb56a3db7156555b7959caafc6c172f1d452255d21d57d
                                          • Opcode Fuzzy Hash: 7e142f936a4576736430de5469aa48ad2b24558bb2d6443f39e805bac29ae7bd
                                          • Instruction Fuzzy Hash: 8A7156347003108FDB19EB75D85167EB7AAFB89308F20556DD8069B3A9DB3E9C42CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 055925E3 Relevance: 1.4, Strings: 1, Instructions: 189COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k
                                          • API String ID: 0-2277858631
                                          • Opcode ID: 8db898b43e9304954040d479928a1724a0b3d30b1727d8c2dc3ec7c30642812f
                                          • Instruction ID: 7d645caf5c90aab61071604544e83d5d77ad36a765912de63216dc66ab8fa34d
                                          • Opcode Fuzzy Hash: 8db898b43e9304954040d479928a1724a0b3d30b1727d8c2dc3ec7c30642812f
                                          • Instruction Fuzzy Hash: 19711938B00305AFCF099BB5E45166EB3A6FB8D308F20956DE812977A4DB399C42CB41
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 055926C5 Relevance: 1.4, Strings: 1, Instructions: 142COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k
                                          • API String ID: 0-2277858631
                                          • Opcode ID: 5d03e5614d6801adf1ed132441ae65cccf32009b419882f34384f51d8ce282f6
                                          • Instruction ID: e81a686150b0a9b2f89514e1dcf1223b91268f26108e1c02795111762e6c64d8
                                          • Opcode Fuzzy Hash: 5d03e5614d6801adf1ed132441ae65cccf32009b419882f34384f51d8ce282f6
                                          • Instruction Fuzzy Hash: 06513E39B00315AFCF19DBB5E45166EB3A6FB88318F208529D816973A4DF399C42CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 055927E0 Relevance: 1.3, Strings: 1, Instructions: 89COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: :@k
                                          • API String ID: 0-2277858631
                                          • Opcode ID: ef5ae952ba928794c7bc38920a2dad367bc4390d0bf7a0eb7e9ed760fa11db12
                                          • Instruction ID: 9460b6420fd1c6467fe2d795d5ce360df10cf20b079a3af57ea44ccfa2656daa
                                          • Opcode Fuzzy Hash: ef5ae952ba928794c7bc38920a2dad367bc4390d0bf7a0eb7e9ed760fa11db12
                                          • Instruction Fuzzy Hash: 78314039B00315AFDF099BB5D45166EB36BFB98308F20412AD40597764CF398D02CB91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590509 Relevance: 1.3, Strings: 1, Instructions: 50COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: [9k^
                                          • API String ID: 0-2319944660
                                          • Opcode ID: afb57f9ec2dce3b3f3cdafc394d083999d8f4ac85e9feff7e69b81971e983578
                                          • Instruction ID: aebef02e88fb1b8f651c1f3cad8bdbacc9f579a6fc60d13b2fb44298de554729
                                          • Opcode Fuzzy Hash: afb57f9ec2dce3b3f3cdafc394d083999d8f4ac85e9feff7e69b81971e983578
                                          • Instruction Fuzzy Hash: F401B120B041118B8B5EABBA481937F75D7BBD9144B08481ED406DB7D4DE2CCC0297E2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0559158F Relevance: .5, Instructions: 497COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a7662f95b9d5b11ae0b2a93b3fc45c8a885d7c482d5436e4f4c6db76bbff4d6b
                                          • Instruction ID: 97c56730f68b8c08cbdaf9910e1bf6c0ff0fd4f9587ef2bbfd849f5d3e14f6c9
                                          • Opcode Fuzzy Hash: a7662f95b9d5b11ae0b2a93b3fc45c8a885d7c482d5436e4f4c6db76bbff4d6b
                                          • Instruction Fuzzy Hash: 65028830A056228FDB19EB75C9407BEB2E7BF88244F148568D416DB6D4EB3CDC46CBA1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05591A28 Relevance: .3, Instructions: 283COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2aa34b2fd18d92f1aa46dff2b79d896f8df7fde8fbdceac6a123e935241d81e9
                                          • Instruction ID: ff3606015883a1d674d296558d3fbb8e5d5bf09be2e86d1141b31b469cebf24e
                                          • Opcode Fuzzy Hash: 2aa34b2fd18d92f1aa46dff2b79d896f8df7fde8fbdceac6a123e935241d81e9
                                          • Instruction Fuzzy Hash: 8FA1BA30A04B228BDB19DB35D945BAAB3E7BBC9354F184668D4129B3D0EB3CDD06C791
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05592E40 Relevance: .2, Instructions: 216COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 530917be6e8493d62a93ff64300c30f3ff0b3f9b0e32a750def57595cf31e882
                                          • Instruction ID: ee650faa090c30d583cfa05a327abe309bb96badce8ba90e95734ce734c10509
                                          • Opcode Fuzzy Hash: 530917be6e8493d62a93ff64300c30f3ff0b3f9b0e32a750def57595cf31e882
                                          • Instruction Fuzzy Hash: 9061853AD042209EDF3DA67CC4563FDB2A1BB59345F1A0879C852A7360EB2D9C85C7D2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 055905D7 Relevance: .2, Instructions: 172COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ce7aaa66d077335ba7fa155074ed4bb273f2befae546a890e539ee38a8378635
                                          • Instruction ID: 879fe6fe217aa1457508f7fd21d591436a543d1616f20519cbe069bccbc52ef5
                                          • Opcode Fuzzy Hash: ce7aaa66d077335ba7fa155074ed4bb273f2befae546a890e539ee38a8378635
                                          • Instruction Fuzzy Hash: 7B612535604301CFCB199B35E4546BAB7AAFB8C309B1459ADD8029B3A5DF3EDC42CB50
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590BA8 Relevance: .2, Instructions: 153COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e370588561b11ca1820154cb57a766b57cefa717929001d27e02c223946e9b80
                                          • Instruction ID: 1fdb48d0d1f62f7b70cf76f3852c6eb8bfc098fe37767ba1dfa3a17ff4a7a91c
                                          • Opcode Fuzzy Hash: e370588561b11ca1820154cb57a766b57cefa717929001d27e02c223946e9b80
                                          • Instruction Fuzzy Hash: 6D513434704300CFDB19DB75E85467AB7A6FB89308B24556CD4068B3A9DB3EAC42DB50
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590634 Relevance: .1, Instructions: 145COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 26dee6291e2861678a7d9307bbd959f33e13ea13f4459607f964148a66b0580a
                                          • Instruction ID: ec17166cd760cf1fc6a713b16eaa342ddc66f5c52d06e65f43d09493d388a2d8
                                          • Opcode Fuzzy Hash: 26dee6291e2861678a7d9307bbd959f33e13ea13f4459607f964148a66b0580a
                                          • Instruction Fuzzy Hash: 8D51F535700301CFCB199B35E45567AB7AAFB8D309B2455ADD8029B3A9DF3EAC42CB50
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05591DF8 Relevance: .1, Instructions: 133COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2632f886e359e8cc21f026322f9ca620663c90162278d102d1c95c85334b117d
                                          • Instruction ID: 258dad017affb50e78bde894a11456bfca21c1ec6b164e43500dcdc66b8eba20
                                          • Opcode Fuzzy Hash: 2632f886e359e8cc21f026322f9ca620663c90162278d102d1c95c85334b117d
                                          • Instruction Fuzzy Hash: AC41CF30A08B12CBDF29CB3299017B973E7BB88355F184269D0129A2D0EF3CDD46C761
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590080 Relevance: .1, Instructions: 130COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1ddc6aee9d5bd2d3f0a49c33b01a68f361132319d791d4616f73ec3e33ca011b
                                          • Instruction ID: 5b4830ffbc844ae84726d06acdb9ce0b35e0a6e6e4e3dc820af683417bc359c2
                                          • Opcode Fuzzy Hash: 1ddc6aee9d5bd2d3f0a49c33b01a68f361132319d791d4616f73ec3e33ca011b
                                          • Instruction Fuzzy Hash: 1F5173705023428FCB05DB75E9448ABF7B6FBEC308B40956DD0098B76ADB389D1ACB81
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590C22 Relevance: .1, Instructions: 125COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: afd54f08d06f8ae0a3a9a94f55df9fe7462b36330b1c93a81ba71474edf6f9de
                                          • Instruction ID: 3356773c683be95b6a099907c3d9afb4ced45a0cd14444a67cace1c3325a58f1
                                          • Opcode Fuzzy Hash: afd54f08d06f8ae0a3a9a94f55df9fe7462b36330b1c93a81ba71474edf6f9de
                                          • Instruction Fuzzy Hash: 204166347003108FDB19EB75E8546BEB7A6FB88308F24556CD40A8B3A9DB39AC42DB50
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05591238 Relevance: .1, Instructions: 115COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fdf59454d009681a3fed28208c2f7fead97d01409c77a5ad2667c5556977bc56
                                          • Instruction ID: c5c5ae42fc726b03872d450dd736ed74e01b2a1250dbfbd0f88d9f0bdcb0d4e1
                                          • Opcode Fuzzy Hash: fdf59454d009681a3fed28208c2f7fead97d01409c77a5ad2667c5556977bc56
                                          • Instruction Fuzzy Hash: 58415E31A002128FDF18DF75C9855AEB7B6BF88204B5880A9D809DB799EF38DD45C7A0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05591228 Relevance: .1, Instructions: 109COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 41e629f3e0f0aceb2e16ef033b4a5d3f6fd8b21ce78949861615ac58ee3d3fa9
                                          • Instruction ID: 97f4fa01f6638a948d55a0fd0d0563e2e0d591cb3e2b2ac35d0838b2087aee61
                                          • Opcode Fuzzy Hash: 41e629f3e0f0aceb2e16ef033b4a5d3f6fd8b21ce78949861615ac58ee3d3fa9
                                          • Instruction Fuzzy Hash: 79416431A002128FCF54DF75C9945AEB7F6BF88244B588069D809DB799EF38DD45C7A0
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05592C90 Relevance: .1, Instructions: 107COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 438236894c7758687feab280e846d32011ed86ab4418019e18b4885349198e56
                                          • Instruction ID: 51b3bf6d496055e8908a0adb29aebcefac35141345068b92fe717edb1863ee8a
                                          • Opcode Fuzzy Hash: 438236894c7758687feab280e846d32011ed86ab4418019e18b4885349198e56
                                          • Instruction Fuzzy Hash: 00319E34B00205AFDB18CB75D854BAEBBF6BF88214F148169E405EB3A0DB7899068B91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590C8D Relevance: .1, Instructions: 100COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4f32e039aecca6313533490ffcb9ffb786ccc2b72f1bcd59c4e57cf4e0a43917
                                          • Instruction ID: 37feaafc51e88137b40a7a203d5a8edca331ce03f42ed9b9fdd701d755e764a3
                                          • Opcode Fuzzy Hash: 4f32e039aecca6313533490ffcb9ffb786ccc2b72f1bcd59c4e57cf4e0a43917
                                          • Instruction Fuzzy Hash: 0A3198387042108FDB19EB79E8147AEB6A6BB88308F14956CD01A8B7A5DF399C01DB50
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015F0DD3 Relevance: .1, Instructions: 82COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131173021.00000000015F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15f0000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: df335b2cfe8e8dd5b5f46b58e5041cf9167333bf7c5bdd170ca7433360935136
                                          • Instruction ID: ce82c1ab35b299518c31d008cd784e41e23c94ca059201514d9e481193fc0977
                                          • Opcode Fuzzy Hash: df335b2cfe8e8dd5b5f46b58e5041cf9167333bf7c5bdd170ca7433360935136
                                          • Instruction Fuzzy Hash: 3231C2715493C08FC717CB14D950B29BFA2AF46218F1D85DEE6888F6A3C33A9816C752
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05DD1C82 Relevance: .1, Instructions: 75COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4134051422.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5dd0000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: fdbb673132cb44c6599f58684624d35e62026a0c11dffa5967fcf9ec5a40b38a
                                          • Instruction ID: e4d0a8fa4b3a4f616e9d9e7036e8c6a0c8b501d778ccd1c0877d82496e505ac0
                                          • Opcode Fuzzy Hash: fdbb673132cb44c6599f58684624d35e62026a0c11dffa5967fcf9ec5a40b38a
                                          • Instruction Fuzzy Hash: AA2118B5508341AFC301CF29C850916BFE4EB89624F04899EF888DB312D235E909CBA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05593110 Relevance: .1, Instructions: 71COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b90d903667221d7d86dfc8e9f888b4489cfca81a60b0e7b4acf65c99eca20f4f
                                          • Instruction ID: e3acfdf070543393914295af03d040f13ac7634f671bd7c303f17c3ee2a084ec
                                          • Opcode Fuzzy Hash: b90d903667221d7d86dfc8e9f888b4489cfca81a60b0e7b4acf65c99eca20f4f
                                          • Instruction Fuzzy Hash: 8111AE31F002059BCF1DEAB5CC45BBFB6FBBB88200F018969D502AB284DA38984087A5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590E55 Relevance: .1, Instructions: 63COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 067b0aa12bb48ddfdcfc619bcdef781f55c4f3eb01f653e3077189fc8ddf4cdb
                                          • Instruction ID: cf4daf30126f3ba6efd30848fb86cf20403edd0d566755e6b24a0bba02c1b256
                                          • Opcode Fuzzy Hash: 067b0aa12bb48ddfdcfc619bcdef781f55c4f3eb01f653e3077189fc8ddf4cdb
                                          • Instruction Fuzzy Hash: 85214D35B101149FCB48DBB9D494AAEB3F3FF88218F208069E406AB765DF359D45CB91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590D40 Relevance: .1, Instructions: 61COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e200be5be4b465981f5e53bde733787362aca1ce3788d6838424f452edf4f65b
                                          • Instruction ID: 997058a4a1467f789a29ea44c166a4e3bef1a5c24f7bf89b6528883ee531d287
                                          • Opcode Fuzzy Hash: e200be5be4b465981f5e53bde733787362aca1ce3788d6838424f452edf4f65b
                                          • Instruction Fuzzy Hash: 62118E74B00210CFDF29EB75D8446ADB7A2BB88218F54982DD056D7394DB39D941CB50
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590773 Relevance: .1, Instructions: 61COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 34189336d9a3f559ec586cef52fa029bc29763288110fb87c833a4494514c7c1
                                          • Instruction ID: db38696c0b2d512f00edd949179565e9dd0876b5a9c256bc6e1649f1f1b71393
                                          • Opcode Fuzzy Hash: 34189336d9a3f559ec586cef52fa029bc29763288110fb87c833a4494514c7c1
                                          • Instruction Fuzzy Hash: 0021B435700301CFCB099B34E45567AB3A6FB8D349B2555ADD806973A5DF3EAC42CB81
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05592B00 Relevance: .1, Instructions: 60COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a1b724b3cd7fdec69b609e0dbb131e7ef76039b59bcb2e19b002575abdc7053f
                                          • Instruction ID: fa9603d296b0e91d0e29f8a5f2d67c7d5097b4c66fc6e5fbd0794418cb3c30f6
                                          • Opcode Fuzzy Hash: a1b724b3cd7fdec69b609e0dbb131e7ef76039b59bcb2e19b002575abdc7053f
                                          • Instruction Fuzzy Hash: B801D23BF042096AEF08AEB5CC052EE77E7FBC4224F054076D918E7380EB3D894142A1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05DD2400 Relevance: .1, Instructions: 60COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4134051422.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5dd0000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 062342f99864eec1f5bdd02534beb6548704ab28259744a614b1a842b8ce0916
                                          • Instruction ID: 1e9342b013db592ca68235734cda8e83b62ac372ed24cb0fdca1e31aa1f34d65
                                          • Opcode Fuzzy Hash: 062342f99864eec1f5bdd02534beb6548704ab28259744a614b1a842b8ce0916
                                          • Instruction Fuzzy Hash: F311BAB5A48341AFD340CF19D841A5BFBE4FB98664F04895EF998D7311D235E9088FA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015F0E0C Relevance: .1, Instructions: 59COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131173021.00000000015F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15f0000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 006ff4d8e1ad74c318a6110d76292c490dc30da51a5b5c5ce66fcabc7cf6321b
                                          • Instruction ID: 68800b29b4df94cb483379fb8f1582ea07fb053b06254ba2502aa6291702dd97
                                          • Opcode Fuzzy Hash: 006ff4d8e1ad74c318a6110d76292c490dc30da51a5b5c5ce66fcabc7cf6321b
                                          • Instruction Fuzzy Hash: A111CD31204280DFDB158F14D980B26BBE2AB89708F28C99CEA490B683C73BD813CA41
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05592BA8 Relevance: .1, Instructions: 58COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: aead704e477f7b331bcec6b1eb8f1f6e1340474beb3f22ded1e3df818768a6ec
                                          • Instruction ID: ee5417b79bd2a84767b4ba63e1818fe464baf19d48ef73328ecf8995bb97b8fb
                                          • Opcode Fuzzy Hash: aead704e477f7b331bcec6b1eb8f1f6e1340474beb3f22ded1e3df818768a6ec
                                          • Instruction Fuzzy Hash: 1711E136E00219ABCF09EAB49C054EFB7E5FB89214B0505A9D801FB341EB29DE04C7E1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0160B5A0 Relevance: .1, Instructions: 52COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131228886.000000000160A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_160a000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7347c61d0ab1c080bde58558645540cf071ebfa8856b0d19f80ba48fbf7c84aa
                                          • Instruction ID: 19d66041b747e2a60ad615c1f2caa6a517baf3e5669b4cce968d2fac6eb2b260
                                          • Opcode Fuzzy Hash: 7347c61d0ab1c080bde58558645540cf071ebfa8856b0d19f80ba48fbf7c84aa
                                          • Instruction Fuzzy Hash: 1E11FAB5A48301AFD350CF09DC41E57FBE8EB98660F04891EF95997311D271E9088FA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 055929F2 Relevance: .1, Instructions: 52COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e720bc1a0f60f18816a6c82d8b30273fae058588a48bc6e44fbe8150b23e0b7e
                                          • Instruction ID: 4ae9f0a50d0eaac73fe145ff0e421bb357fe37f7d51647868b4e1086a6f33711
                                          • Opcode Fuzzy Hash: e720bc1a0f60f18816a6c82d8b30273fae058588a48bc6e44fbe8150b23e0b7e
                                          • Instruction Fuzzy Hash: DF11FEB6D11209AFDB04DFA9E8818DEFBF9EF89310F14817AE515A3110EA345905CB60
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590006 Relevance: .0, Instructions: 49COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e51f7229a9609f68321b7d8a9fdb7970c3122f90f7d757dce4997c9ba3c26143
                                          • Instruction ID: f779c7c1328bd5b8bc2d54cc442073e4bdab52fcc0cdb75cdcf7b95c3714fab7
                                          • Opcode Fuzzy Hash: e51f7229a9609f68321b7d8a9fdb7970c3122f90f7d757dce4997c9ba3c26143
                                          • Instruction Fuzzy Hash: B7015BA648E3C04FD74787749C266917FB0AE13221B1F55DBC080CF1E3E94D989AC722
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 055913B8 Relevance: .0, Instructions: 48COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8a9d862f32607e7beecbe6f743ba1f9003e37221207ee69cd874d79192978197
                                          • Instruction ID: 442442503b4208ba6175cac4101b4b62b7e9755e26e3980fd6edb9eec4500086
                                          • Opcode Fuzzy Hash: 8a9d862f32607e7beecbe6f743ba1f9003e37221207ee69cd874d79192978197
                                          • Instruction Fuzzy Hash: C2019E72F002158F8F94DB7999010EEB7FAEB8D254B20417EC40AE7350EB398E02CB90
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 055913AA Relevance: .0, Instructions: 45COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c0394f3d9a49963fabc14a24240f89d134c68ca3cddfd9522f61672616917f71
                                          • Instruction ID: 2f36b41f3fbf24b480491cb992c2d3c44091aa6ab90e0cd2d910de829f516e19
                                          • Opcode Fuzzy Hash: c0394f3d9a49963fabc14a24240f89d134c68ca3cddfd9522f61672616917f71
                                          • Instruction Fuzzy Hash: AE015E76F002168FCF59CB7899411ADB7F6FB89254B2441BEC40ADB7A4EB398D42C780
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015F05E7 Relevance: .0, Instructions: 42COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131173021.00000000015F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15f0000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0d9d6a13cc759db54bd941dfdf1de3db50002525d5e8fc4994194bc989f7e92d
                                          • Instruction ID: f2985061717e73ffea410f66bbb72f045f22ad4d065e061224406e3d2ba54111
                                          • Opcode Fuzzy Hash: 0d9d6a13cc759db54bd941dfdf1de3db50002525d5e8fc4994194bc989f7e92d
                                          • Instruction Fuzzy Hash: 0FF0A4B65493806FD7118B16AC40863FFB8EB86620709C49FEC498B612D225B908CB72
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05590D98 Relevance: .0, Instructions: 42COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f3c560b540d970847795a116d30ca71a1b3f26bcd05e97e16d66d3bcd7cb8c42
                                          • Instruction ID: 838eceeae53bea5e6c58733ec8670f9f127f471eaf694540c5d8ce9d853a658f
                                          • Opcode Fuzzy Hash: f3c560b540d970847795a116d30ca71a1b3f26bcd05e97e16d66d3bcd7cb8c42
                                          • Instruction Fuzzy Hash: 7D014870A01204CFDF19EFB5E4445ADB7B2FB88259B50846DE01597394EB39C941CB50
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05591500 Relevance: .0, Instructions: 41COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 31029871abdfc03e35e88db9c86c13ba043635dc0ff7066e0a43560937fbfd5a
                                          • Instruction ID: 2081661cd54f541436c12b69d1dde020edae82a9205a8900ce4f7d68a2df6bc9
                                          • Opcode Fuzzy Hash: 31029871abdfc03e35e88db9c86c13ba043635dc0ff7066e0a43560937fbfd5a
                                          • Instruction Fuzzy Hash: ABF086B1E052598FCF55DBB888415DFBFF5EB45210F24417BD115D6241F73A8902CB91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0559088A Relevance: .0, Instructions: 40COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e201b10a01f881fe2440fd76a37d54638f88b19fd63ed04aefd0badca6d3fa45
                                          • Instruction ID: 3e53085c0bd3247906351cf9854bbc895801b9a93939803d36c63bffdbb7a947
                                          • Opcode Fuzzy Hash: e201b10a01f881fe2440fd76a37d54638f88b19fd63ed04aefd0badca6d3fa45
                                          • Instruction Fuzzy Hash: 960156706043038BC705BF75D95855FB7E5FBD4314F01891CE44A8B798DB75D9298B42
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015F0EC8 Relevance: .0, Instructions: 31COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131173021.00000000015F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15f0000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f5405e8c2313153df6eab1cfdcb54e4ecace335342848f3dcb2b97980fc5d3c2
                                          • Instruction ID: 31519ce11bd1428e9c076e31b726f65743132f0069007597b91b12123179dfef
                                          • Opcode Fuzzy Hash: f5405e8c2313153df6eab1cfdcb54e4ecace335342848f3dcb2b97980fc5d3c2
                                          • Instruction Fuzzy Hash: 95F0FB35148644DFC616CF04D540B26FBA2FB89718F28CAADEA491B752C737A812DA81
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015F0606 Relevance: .0, Instructions: 27COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131173021.00000000015F0000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15f0000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 43fe53870022710fcbd4bccbfdd77fd0c4ccfbfca9eac5fcfce05c5d1b18bb57
                                          • Instruction ID: 87bd57caeaed66593975e33a11140086e81e4ce403140439061d5a772c39aec0
                                          • Opcode Fuzzy Hash: 43fe53870022710fcbd4bccbfdd77fd0c4ccfbfca9eac5fcfce05c5d1b18bb57
                                          • Instruction Fuzzy Hash: 75E092B66407005B9750DF0AED41452F7D8EB84630718C47FDC0D8B701E279B908CAA6
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 0160B5EF Relevance: .0, Instructions: 26COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131228886.000000000160A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0160A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_160a000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b4e11a6183c83a887585fb19b42c01b4ae08bbaccb1437fee880e0b755ecb109
                                          • Instruction ID: 94b71cd05708bbb7fa3de202079eb5e20b1620ae6d359b6fc4de77837998bb81
                                          • Opcode Fuzzy Hash: b4e11a6183c83a887585fb19b42c01b4ae08bbaccb1437fee880e0b755ecb109
                                          • Instruction Fuzzy Hash: AAE0D8B258030467D2109E069C46F52F798DB50930F08C557ED091F741E175B50489F1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05DD246B Relevance: .0, Instructions: 26COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4134051422.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5dd0000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 965869568d59647f3b44c88f312b8c0ac4d58e46628729b21e9c4eb955951683
                                          • Instruction ID: fa9f60808d9ab7449bd5c44ffdaa59f1dc66510afe551fbc512eee54a758ac38
                                          • Opcode Fuzzy Hash: 965869568d59647f3b44c88f312b8c0ac4d58e46628729b21e9c4eb955951683
                                          • Instruction Fuzzy Hash: 19E0D8F268030067D3109E069C46F52FBD8DB54931F08C467ED081F741E175B51889E1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05DD1D17 Relevance: .0, Instructions: 26COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4134051422.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5dd0000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4d265beff411f5ff60802d04b4d86695e3faac4d3ed7024bb229e9d0ae66fcf8
                                          • Instruction ID: 20d08d6bd34d73de1c550c0b8ca96f5f56366c2d228c11a124362a79a998af5d
                                          • Opcode Fuzzy Hash: 4d265beff411f5ff60802d04b4d86695e3faac4d3ed7024bb229e9d0ae66fcf8
                                          • Instruction Fuzzy Hash: B7E0D8B254030067D210DE069C46F53FBD8DB50930F08C457ED091F701E176B514C9E1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05591450 Relevance: .0, Instructions: 16COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ab718fb23e0081da9a725e46c2d425e1394e20fe693407280c879fd0d9d4bd44
                                          • Instruction ID: 45b12e8e4f7848e6b6c17aca0a350338686f74b5d95344e9174b2c7c87ae0e41
                                          • Opcode Fuzzy Hash: ab718fb23e0081da9a725e46c2d425e1394e20fe693407280c879fd0d9d4bd44
                                          • Instruction Fuzzy Hash: 58D02B3060CFD24FCB49D779BC340C87FA17F8101430802AEC0199B956CB105812C796
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 05592C52 Relevance: .0, Instructions: 16COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4133554865.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_5590000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a9203affd181c4f1c70f18708cde234a7147c962692847232d29ee8ecc7fa8ed
                                          • Instruction ID: db2f50e26cb2b7db9bd686a7931be06a366469dee4e1099bdf3e46e19f8e23db
                                          • Opcode Fuzzy Hash: a9203affd181c4f1c70f18708cde234a7147c962692847232d29ee8ecc7fa8ed
                                          • Instruction Fuzzy Hash: 40D0A732601208BBCB169F50DD0639F7768FB40125F1001A9D80597B50D93A5A028381
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015E23F4 Relevance: .0, Instructions: 15COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131136410.00000000015E2000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15e2000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: af3b01a180e6382406a2af0b13d2bd6317307149bf645d2d1c9eeb8baa714401
                                          • Instruction ID: 64ac32f9912357b2907c115ac307b0339758472ab247b4ee9aeb9c08a569f289
                                          • Opcode Fuzzy Hash: af3b01a180e6382406a2af0b13d2bd6317307149bf645d2d1c9eeb8baa714401
                                          • Instruction Fuzzy Hash: 79D05E79605BC14FE31A9B1CC1A8B993BE8BB61714F4A44F9A8008F767C768E5C1D600
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 015E23BC Relevance: .0, Instructions: 14COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000001.00000002.4131136410.00000000015E2000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_1_2_15e2000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 1af8c98f5450182ca981c9495f99bd2fbf0b763a28412ed10e526dae11fb1ebc
                                          • Instruction ID: 176dc7565cbc47a24bccfa600a9025774309c4078667972670f988fb8f6e45db
                                          • Opcode Fuzzy Hash: 1af8c98f5450182ca981c9495f99bd2fbf0b763a28412ed10e526dae11fb1ebc
                                          • Instruction Fuzzy Hash: 6AD05E346006814BD719DA0CC6D8F5D3BD8BB54B14F1A44E8AC108F766C7A4E8C0CE00
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Execution Graph

                                          Execution Coverage:10.4%
                                          Dynamic/Decrypted Code Coverage:100%
                                          Signature Coverage:0%
                                          Total number of Nodes:12
                                          Total number of Limit Nodes:0
                                          execution_graph 562 b6a646 564 b6a67e CreateMutexW 562->564 565 b6a6c1 564->565 570 b6a612 571 b6a646 CreateMutexW 570->571 573 b6a6c1 571->573 574 b6a462 575 b6a486 RegSetValueExW 574->575 577 b6a507 575->577 578 b6a361 580 b6a392 RegQueryValueExW 578->580 581 b6a41b 580->581

                                          Callgraph

                                          Executed Functions

                                          Function 04A10310 Relevance: 3.9, Strings: 3, Instructions: 189COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 0 4a10310-4a10334 2 4a10336-4a10338 0->2 3 4a1033e-4a10346 0->3 2->3 4 4a10348-4a1034d 3->4 5 4a1034e-4a10391 3->5 8 4a10393-4a103bb 5->8 9 4a103d8-4a103ff 5->9 14 4a103ce 8->14 15 4a1040a-4a10418 9->15 14->9 16 4a1041a 15->16 17 4a1041f-4a10434 15->17 16->17 19 4a10436-4a10460 17->19 20 4a1046b-4a10523 17->20 19->20 39 4a10570-4a10587 20->39 40 4a10525-4a10569 20->40 41 4a10880 39->41 42 4a1058d-4a105bf 39->42 40->39 42->41
                                          Strings
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987677483.0000000004A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_4a10000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: [k^$-[k^$=[k^
                                          • API String ID: 0-3244988689
                                          • Opcode ID: c58e3cbd5a8dc8414267e4a2cd0f32629390ea42c7df1e29d4b4a63f7c71b607
                                          • Instruction ID: 4ec3d15eeedfa5e828e99f5819ab50c1df45c840df8f5a0d19ce1523e51386f9
                                          • Opcode Fuzzy Hash: c58e3cbd5a8dc8414267e4a2cd0f32629390ea42c7df1e29d4b4a63f7c71b607
                                          • Instruction Fuzzy Hash: 5D5137307046008FD708EB7984597BE77E7AB8930471444A9E00ADBBE6DF39DD86D7A2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 04A103BD Relevance: 3.9, Strings: 3, Instructions: 135COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 53 4a103bd-4a10418 61 4a1041a 53->61 62 4a1041f-4a10434 53->62 61->62 64 4a10436-4a10460 62->64 65 4a1046b-4a10523 62->65 64->65 84 4a10570-4a10587 65->84 85 4a10525-4a10569 65->85 86 4a10880 84->86 87 4a1058d-4a105bf 84->87 85->84 87->86
                                          Strings
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987677483.0000000004A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_4a10000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: [k^$-[k^$=[k^
                                          • API String ID: 0-3244988689
                                          • Opcode ID: e3d4a88de01dff298304fcdc5f1f4f1eea0bd0c984804095bb1254e853be101c
                                          • Instruction ID: 16307ec4d24011a6a074cb67f5c466fbb535d07bd28f60976173904739116a57
                                          • Opcode Fuzzy Hash: e3d4a88de01dff298304fcdc5f1f4f1eea0bd0c984804095bb1254e853be101c
                                          • Instruction Fuzzy Hash: 96412330B045104BDB08ABB984193BD76D39FD934870440ADE00ADBBE6EF39CE4797A2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00B6A612 Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 98 b6a612-b6a695 102 b6a697 98->102 103 b6a69a-b6a6a3 98->103 102->103 104 b6a6a5 103->104 105 b6a6a8-b6a6b1 103->105 104->105 106 b6a702-b6a707 105->106 107 b6a6b3-b6a6d7 CreateMutexW 105->107 106->107 110 b6a709-b6a70e 107->110 111 b6a6d9-b6a6ff 107->111 110->111
                                          APIs
                                          • CreateMutexW.KERNELBASE(?,?), ref: 00B6A6B9
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987156903.0000000000B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B6A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_b6a000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID:
                                          • API String ID: 1964310414-0
                                          • Opcode ID: c4ec9709cf1c93698d3180902d3d38288c5bcc9ee1da10a4f0aa8f44827f7db3
                                          • Instruction ID: 8f6369836f8df603b364e713578cdef6d44f40998f85faed6287ee4eba94181d
                                          • Opcode Fuzzy Hash: c4ec9709cf1c93698d3180902d3d38288c5bcc9ee1da10a4f0aa8f44827f7db3
                                          • Instruction Fuzzy Hash: 8E3190B55093805FE711CB65CC85B96BFF8EF06310F0884DAE9849B692D365E909CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00B6A361 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 114 b6a361-b6a3cf 117 b6a3d4-b6a3dd 114->117 118 b6a3d1 114->118 119 b6a3e2-b6a3e8 117->119 120 b6a3df 117->120 118->117 121 b6a3ed-b6a404 119->121 122 b6a3ea 119->122 120->119 124 b6a406-b6a419 RegQueryValueExW 121->124 125 b6a43b-b6a440 121->125 122->121 126 b6a442-b6a447 124->126 127 b6a41b-b6a438 124->127 125->124 126->127
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,BFD258AB,00000000,00000000,00000000,00000000), ref: 00B6A40C
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987156903.0000000000B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B6A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_b6a000_ESET Service.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: 38f4af843f4d238c2dd929b33e55087926eb16b313f9853cf6ff2749e2b1fd17
                                          • Instruction ID: 11eab3a360d9433c4d867b168cbf4740ba27ff1373221fb30737893740f441c0
                                          • Opcode Fuzzy Hash: 38f4af843f4d238c2dd929b33e55087926eb16b313f9853cf6ff2749e2b1fd17
                                          • Instruction Fuzzy Hash: 35318E75509780AFE722CF11CC84F92BBF8EF06310F0884DAE9459B692D364E949CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00B6A462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 131 b6a462-b6a4c3 134 b6a4c5 131->134 135 b6a4c8-b6a4d4 131->135 134->135 136 b6a4d6 135->136 137 b6a4d9-b6a4f0 135->137 136->137 139 b6a527-b6a52c 137->139 140 b6a4f2-b6a505 RegSetValueExW 137->140 139->140 141 b6a507-b6a524 140->141 142 b6a52e-b6a533 140->142 142->141
                                          APIs
                                          • RegSetValueExW.KERNELBASE(?,00000E24,BFD258AB,00000000,00000000,00000000,00000000), ref: 00B6A4F8
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987156903.0000000000B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B6A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_b6a000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Value
                                          • String ID:
                                          • API String ID: 3702945584-0
                                          • Opcode ID: e0c01ffb60d539fa264b47362551f28e770b44fa81a765a5e84508414f3ce2c7
                                          • Instruction ID: 41a0df503f87cee33baa59810f488386d7ee962a7527c9640e312d5df9c17015
                                          • Opcode Fuzzy Hash: e0c01ffb60d539fa264b47362551f28e770b44fa81a765a5e84508414f3ce2c7
                                          • Instruction Fuzzy Hash: 9B2181725093806FDB22CF51DC44FA7BFF8EF46210F08849AE9459B652D264E848CBB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00B6A646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 146 b6a646-b6a695 149 b6a697 146->149 150 b6a69a-b6a6a3 146->150 149->150 151 b6a6a5 150->151 152 b6a6a8-b6a6b1 150->152 151->152 153 b6a702-b6a707 152->153 154 b6a6b3-b6a6bb CreateMutexW 152->154 153->154 156 b6a6c1-b6a6d7 154->156 157 b6a709-b6a70e 156->157 158 b6a6d9-b6a6ff 156->158 157->158
                                          APIs
                                          • CreateMutexW.KERNELBASE(?,?), ref: 00B6A6B9
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987156903.0000000000B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B6A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_b6a000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID:
                                          • API String ID: 1964310414-0
                                          • Opcode ID: bffc8cee1a3c0a63402eafc7cb4af5aa5a7c90738d406698a328cf01c2e76d2c
                                          • Instruction ID: b317c2fa2285fcc14da42320fb7523a24d7dda637ff7b793ba5059b7db8ddb3f
                                          • Opcode Fuzzy Hash: bffc8cee1a3c0a63402eafc7cb4af5aa5a7c90738d406698a328cf01c2e76d2c
                                          • Instruction Fuzzy Hash: 1821D4B16042009FEB10CF65CD85BA6FBE8EF14324F0884A9E948DB741D375E809CE72
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00B6A392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 161 b6a392-b6a3cf 163 b6a3d4-b6a3dd 161->163 164 b6a3d1 161->164 165 b6a3e2-b6a3e8 163->165 166 b6a3df 163->166 164->163 167 b6a3ed-b6a404 165->167 168 b6a3ea 165->168 166->165 170 b6a406-b6a419 RegQueryValueExW 167->170 171 b6a43b-b6a440 167->171 168->167 172 b6a442-b6a447 170->172 173 b6a41b-b6a438 170->173 171->170 172->173
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,BFD258AB,00000000,00000000,00000000,00000000), ref: 00B6A40C
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987156903.0000000000B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B6A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_b6a000_ESET Service.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: f23abfc5a7afe15f8c76160f2ceded8e98731dd96682d106c561dd3d8f1dc4e0
                                          • Instruction ID: d9f58c973987f94c798bad7c53aac854fc26d9da291a8518e5100ebc94ea26be
                                          • Opcode Fuzzy Hash: f23abfc5a7afe15f8c76160f2ceded8e98731dd96682d106c561dd3d8f1dc4e0
                                          • Instruction Fuzzy Hash: 1F2190756006049FEB20CF55CC84FA6F7ECEF04710F08849AE945DB751D764E849CAB2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00B6A486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 177 b6a486-b6a4c3 179 b6a4c5 177->179 180 b6a4c8-b6a4d4 177->180 179->180 181 b6a4d6 180->181 182 b6a4d9-b6a4f0 180->182 181->182 184 b6a527-b6a52c 182->184 185 b6a4f2-b6a505 RegSetValueExW 182->185 184->185 186 b6a507-b6a524 185->186 187 b6a52e-b6a533 185->187 187->186
                                          APIs
                                          • RegSetValueExW.KERNELBASE(?,00000E24,BFD258AB,00000000,00000000,00000000,00000000), ref: 00B6A4F8
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987156903.0000000000B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B6A000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_b6a000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Value
                                          • String ID:
                                          • API String ID: 3702945584-0
                                          • Opcode ID: 2d2c368ae1fa059d9e243faf2dd8a8d98f3af060387685b5182a59f278fe6f80
                                          • Instruction ID: b3e22f67c5207e281d9e9324a77fca830768ec6520cd5a83b805b886e36531a7
                                          • Opcode Fuzzy Hash: 2d2c368ae1fa059d9e243faf2dd8a8d98f3af060387685b5182a59f278fe6f80
                                          • Instruction Fuzzy Hash: CB118176500600AFEB21CE51DC85FA6FBECEF14714F08849AED469BB51D764E848CAB2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 04A10080 Relevance: .1, Instructions: 128COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 191 4a10080-4a100ad 194 4a100b8-4a102f9 191->194
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987677483.0000000004A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_4a10000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 331b8874f2cc0ee5a6fc752ed72e6958bb5bc50dd2a114a3160635943a068bf5
                                          • Instruction ID: e64d3148e071e3e3aeebf33cf5b57865bddbdc2cbdc70ef880102af0ec73ebe6
                                          • Opcode Fuzzy Hash: 331b8874f2cc0ee5a6fc752ed72e6958bb5bc50dd2a114a3160635943a068bf5
                                          • Instruction Fuzzy Hash: 36515230115A428FC704FF76E58D98977B3BBA520874089ADD00C8BB6EEF34D95ACB91
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 04A10006 Relevance: .0, Instructions: 41COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 232 4a10006-4a10076
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987677483.0000000004A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_4a10000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0d8e23754bd5e0ed56f993c85f5b0c31031a49786da3eedc579d1d86639b07a0
                                          • Instruction ID: 8d307b60fe16e33b69a79fc396b6be72637c1d3a249e18a2fbb3f74eff0a74f8
                                          • Opcode Fuzzy Hash: 0d8e23754bd5e0ed56f993c85f5b0c31031a49786da3eedc579d1d86639b07a0
                                          • Instruction Fuzzy Hash: 870164A244E3C08FE30383B4AD28A803F702E63118B4F40DBD1C1CB1A7E11D490ACB23
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 008E0648 Relevance: .0, Instructions: 40COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 233 8e0648-8e064b 236 8e0626-8e0643 233->236
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987059221.00000000008E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_8e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c4c2a1286e5a46c774315d19542fe9a01a564161340f11b04c395e91b3780bda
                                          • Instruction ID: 323b1685a7258754b3b647378c7ec4aeb88361ba13b1c0304d8acab09612fa13
                                          • Opcode Fuzzy Hash: c4c2a1286e5a46c774315d19542fe9a01a564161340f11b04c395e91b3780bda
                                          • Instruction Fuzzy Hash: A9F0CDB65086806F8310CB06EC80C53FBECEB85630708886FEC0997B11C276B908CAB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 008E05EC Relevance: .0, Instructions: 39COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 237 8e05ec-8e0603 239 8e0606-8e0620 237->239 240 8e0626-8e0643 239->240
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987059221.00000000008E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_8e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4cb449fde01a766f76fc46a4da819d237108e6074b249e108709cd8d491d5811
                                          • Instruction ID: be57e6f87629c90d6bff24feed7eb10619983a473e4f93b3c2adc5bc14914d58
                                          • Opcode Fuzzy Hash: 4cb449fde01a766f76fc46a4da819d237108e6074b249e108709cd8d491d5811
                                          • Instruction Fuzzy Hash: 43F062B65497806FC711CB16EC41853FFE8EF8663070884AFEC499B612D175B919CBB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 008E0606 Relevance: .0, Instructions: 27COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 241 8e0606-8e0620 242 8e0626-8e0643 241->242
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987059221.00000000008E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_8e0000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c86aece05048e747fd83d9be4ffcc2086d821c1c58d7b7be57a9caae2b41af34
                                          • Instruction ID: f755b7dd6e6468cddcaef189f749427bb9450e515cf7212f022dd5d5b380ffe9
                                          • Opcode Fuzzy Hash: c86aece05048e747fd83d9be4ffcc2086d821c1c58d7b7be57a9caae2b41af34
                                          • Instruction Fuzzy Hash: 7CE092B66006005B9750CF0AEC81452F7D8EB84630708C47FDC0D8BB11D276B508CAA5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00B623F4 Relevance: .0, Instructions: 15COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 243 b623f4-b623ff 244 b62412-b62417 243->244 245 b62401-b6240e 243->245 246 b6241a 244->246 247 b62419 244->247 245->244 248 b62420-b62421 246->248
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987145842.0000000000B62000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B62000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_b62000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 957c5d2e252d419fc23502efd5d44fd17b137f65f1ceaa18772719c4ef73bb01
                                          • Instruction ID: 793f117027a2efeab205ad3399b38d8e6d301d974bb2230e0719ed4264151ac5
                                          • Opcode Fuzzy Hash: 957c5d2e252d419fc23502efd5d44fd17b137f65f1ceaa18772719c4ef73bb01
                                          • Instruction Fuzzy Hash: A2D05E79205AC14FE3169B1CC1A9BA537D4AF61714F4A44F9A8008BB63CB6CE9C5D600
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00B623BC Relevance: .0, Instructions: 14COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 249 b623bc-b623c3 250 b623d6-b623db 249->250 251 b623c5-b623d2 249->251 252 b623e1 250->252 253 b623dd-b623e0 250->253 251->250 254 b623e7-b623e8 252->254
                                          Memory Dump Source
                                          • Source File: 0000000A.00000002.1987145842.0000000000B62000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B62000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_10_2_b62000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 043197e7e63cfabad1cc69aa60a01bdc3b4424563c502036dbc05e7aa97f5e4a
                                          • Instruction ID: 8f0bf6f87381390b82d38129bfa1f2d606071e159465411c01459da8a68762e4
                                          • Opcode Fuzzy Hash: 043197e7e63cfabad1cc69aa60a01bdc3b4424563c502036dbc05e7aa97f5e4a
                                          • Instruction Fuzzy Hash: A9D05E34201A814FD715DB0CC6D4F5937D4AB50B14F0644E9AC108B762C7ACE8C0CA00
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Execution Graph

                                          Execution Coverage:10.1%
                                          Dynamic/Decrypted Code Coverage:100%
                                          Signature Coverage:0%
                                          Total number of Nodes:19
                                          Total number of Limit Nodes:1
                                          execution_graph 649 ada74e 650 ada7b9 649->650 651 ada77a FindCloseChangeNotification 649->651 650->651 652 ada788 651->652 657 ada646 658 ada67e CreateMutexW 657->658 660 ada6c1 658->660 665 ada361 666 ada392 RegQueryValueExW 665->666 668 ada41b 666->668 673 ada710 674 ada74e FindCloseChangeNotification 673->674 676 ada788 674->676 669 ada462 671 ada486 RegSetValueExW 669->671 672 ada507 671->672 677 ada612 678 ada646 CreateMutexW 677->678 680 ada6c1 678->680

                                          Callgraph

                                          Executed Functions

                                          Function 00F90310 Relevance: 3.9, Strings: 3, Instructions: 190COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 0 f90310-f90334 2 f9033e-f90346 0->2 3 f90336-f90338 0->3 4 f90348-f9034d 2->4 5 f9034e-f90391 2->5 3->2 8 f903d8-f903ff 5->8 9 f90393-f903bb 5->9 15 f9040a-f90418 8->15 14 f903ce 9->14 14->8 16 f9041a 15->16 17 f9041f-f90434 15->17 16->17 19 f9046b-f90523 17->19 20 f90436-f90460 17->20 39 f90570-f90587 19->39 40 f90525-f90569 19->40 20->19 41 f9058d-f905bf 39->41 42 f90880 39->42 40->39 41->42
                                          Strings
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076373444.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_f90000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: [k^$-[k^$=[k^
                                          • API String ID: 0-3244988689
                                          • Opcode ID: a52ec42d0a32e7e12dfac1e9ae2a0ada933cd1e9c06bc31df88f21b4f30e2ce7
                                          • Instruction ID: a4cf8c346a7bb47063dd24a08971761d10fbc80f8206e83df84131494bb36952
                                          • Opcode Fuzzy Hash: a52ec42d0a32e7e12dfac1e9ae2a0ada933cd1e9c06bc31df88f21b4f30e2ce7
                                          • Instruction Fuzzy Hash: 275114317042818FDB08EBB988557BE77E6AB85348B194469E002CF7E5DF39CD06D7A2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00F903BD Relevance: 3.9, Strings: 3, Instructions: 135COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 53 f903bd-f90418 61 f9041a 53->61 62 f9041f-f90434 53->62 61->62 64 f9046b-f90523 62->64 65 f90436-f90460 62->65 84 f90570-f90587 64->84 85 f90525-f90569 64->85 65->64 86 f9058d-f905bf 84->86 87 f90880 84->87 85->84 86->87
                                          Strings
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076373444.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_f90000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: [k^$-[k^$=[k^
                                          • API String ID: 0-3244988689
                                          • Opcode ID: 4ec75d1b3f9eae9cae57229edc61fdc866fe4e165083b65f25e9d12df7edc946
                                          • Instruction ID: dc19a975f6264283767488f698caf7f6bd37c06b3188112eef306eba93b66d59
                                          • Opcode Fuzzy Hash: 4ec75d1b3f9eae9cae57229edc61fdc866fe4e165083b65f25e9d12df7edc946
                                          • Instruction Fuzzy Hash: 64410E30B002914FDB08E7BA88557BD72D79FD83587194429E002DFBA5DF38CE0A97A2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00ADA612 Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 98 ada612-ada695 102 ada69a-ada6a3 98->102 103 ada697 98->103 104 ada6a8-ada6b1 102->104 105 ada6a5 102->105 103->102 106 ada6b3-ada6d7 CreateMutexW 104->106 107 ada702-ada707 104->107 105->104 110 ada709-ada70e 106->110 111 ada6d9-ada6ff 106->111 107->106 110->111
                                          APIs
                                          • CreateMutexW.KERNELBASE(?,?), ref: 00ADA6B9
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076056914.0000000000ADA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_ada000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID:
                                          • API String ID: 1964310414-0
                                          • Opcode ID: 8e074e6d5cb9a012bc8c8fb87398ea356a7e074885c784ee5fc2d429e006b850
                                          • Instruction ID: b5cc9b8069fd839208271df8aca56d1813bfb2fd9be8bd3b61a72dda4a036e8a
                                          • Opcode Fuzzy Hash: 8e074e6d5cb9a012bc8c8fb87398ea356a7e074885c784ee5fc2d429e006b850
                                          • Instruction Fuzzy Hash: ED31AFB15093806FE712CB65CC85B96FFF8EF06310F08849AE984CB292D375E909C762
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00ADA361 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 114 ada361-ada3cf 117 ada3d4-ada3dd 114->117 118 ada3d1 114->118 119 ada3df 117->119 120 ada3e2-ada3e8 117->120 118->117 119->120 121 ada3ed-ada404 120->121 122 ada3ea 120->122 124 ada43b-ada440 121->124 125 ada406-ada419 RegQueryValueExW 121->125 122->121 124->125 126 ada41b-ada438 125->126 127 ada442-ada447 125->127 127->126
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,AB324934,00000000,00000000,00000000,00000000), ref: 00ADA40C
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076056914.0000000000ADA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_ada000_ESET Service.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: 9f59d3517e88f798a07ca35bf54fac2c06c0645540d83282f81f5c31a89929a5
                                          • Instruction ID: 3c4449c1a50f05d3abee0d0f1718223cd2246c73fc06f6b329b3f67298ea5497
                                          • Opcode Fuzzy Hash: 9f59d3517e88f798a07ca35bf54fac2c06c0645540d83282f81f5c31a89929a5
                                          • Instruction Fuzzy Hash: 41318175509740AFD721CF11CC84F92BBF8EF16714F08849AE9458B692D364E949CB72
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00ADA462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 131 ada462-ada4c3 134 ada4c8-ada4d4 131->134 135 ada4c5 131->135 136 ada4d9-ada4f0 134->136 137 ada4d6 134->137 135->134 139 ada527-ada52c 136->139 140 ada4f2-ada505 RegSetValueExW 136->140 137->136 139->140 141 ada52e-ada533 140->141 142 ada507-ada524 140->142 141->142
                                          APIs
                                          • RegSetValueExW.KERNELBASE(?,00000E24,AB324934,00000000,00000000,00000000,00000000), ref: 00ADA4F8
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076056914.0000000000ADA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_ada000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Value
                                          • String ID:
                                          • API String ID: 3702945584-0
                                          • Opcode ID: 26c0047b36b4a19b48e42c6859ffd9b5c207e1fd819513bf6e0b7db260adf088
                                          • Instruction ID: 52cf0671fcdec511924ae34b0a13fcc7b87ea78b13c13933250a8eb85bafca13
                                          • Opcode Fuzzy Hash: 26c0047b36b4a19b48e42c6859ffd9b5c207e1fd819513bf6e0b7db260adf088
                                          • Instruction Fuzzy Hash: 5B2192B25083806FD7228F51DC45FA7BFB8EF56614F08849AE945CB652D364E848C771
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00ADA646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 146 ada646-ada695 149 ada69a-ada6a3 146->149 150 ada697 146->150 151 ada6a8-ada6b1 149->151 152 ada6a5 149->152 150->149 153 ada6b3-ada6bb CreateMutexW 151->153 154 ada702-ada707 151->154 152->151 155 ada6c1-ada6d7 153->155 154->153 157 ada709-ada70e 155->157 158 ada6d9-ada6ff 155->158 157->158
                                          APIs
                                          • CreateMutexW.KERNELBASE(?,?), ref: 00ADA6B9
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076056914.0000000000ADA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_ada000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID:
                                          • API String ID: 1964310414-0
                                          • Opcode ID: 0fd55c6f37f0118f6170c40c449f404f81f55f7c6b5fd3f6827b5b95bbfbf44e
                                          • Instruction ID: 50cf632ecc4952944adea25d4f08c00acd412a8bf23fdffa53d8aa6e0cfa719e
                                          • Opcode Fuzzy Hash: 0fd55c6f37f0118f6170c40c449f404f81f55f7c6b5fd3f6827b5b95bbfbf44e
                                          • Instruction Fuzzy Hash: 072192716042009FE710CF65CD85BA6FBE8EF15724F08846AE949CB741D775E909CA72
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00ADA392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 161 ada392-ada3cf 163 ada3d4-ada3dd 161->163 164 ada3d1 161->164 165 ada3df 163->165 166 ada3e2-ada3e8 163->166 164->163 165->166 167 ada3ed-ada404 166->167 168 ada3ea 166->168 170 ada43b-ada440 167->170 171 ada406-ada419 RegQueryValueExW 167->171 168->167 170->171 172 ada41b-ada438 171->172 173 ada442-ada447 171->173 173->172
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,AB324934,00000000,00000000,00000000,00000000), ref: 00ADA40C
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076056914.0000000000ADA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_ada000_ESET Service.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: 8440e7b2a7c89df0b11ff503a9d9f7221ca9b04771db1ba6d28264b961661e86
                                          • Instruction ID: 83a7386c25342dcdd4d615058ed51c2d722b14478d127d8f074b14e236f47c68
                                          • Opcode Fuzzy Hash: 8440e7b2a7c89df0b11ff503a9d9f7221ca9b04771db1ba6d28264b961661e86
                                          • Instruction Fuzzy Hash: 9F21A2B5600204AFE720CF55CC85FA6F7ECEF24724F08845AE946CB751D7A0E949CAB2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00ADA486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 177 ada486-ada4c3 179 ada4c8-ada4d4 177->179 180 ada4c5 177->180 181 ada4d9-ada4f0 179->181 182 ada4d6 179->182 180->179 184 ada527-ada52c 181->184 185 ada4f2-ada505 RegSetValueExW 181->185 182->181 184->185 186 ada52e-ada533 185->186 187 ada507-ada524 185->187 186->187
                                          APIs
                                          • RegSetValueExW.KERNELBASE(?,00000E24,AB324934,00000000,00000000,00000000,00000000), ref: 00ADA4F8
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076056914.0000000000ADA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_ada000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Value
                                          • String ID:
                                          • API String ID: 3702945584-0
                                          • Opcode ID: e1ad635867d62636fc83af882dc7ccf93803b0f14f31c68b3adbd1cbedcd3034
                                          • Instruction ID: 87f3190c748a44b36516d7a39ad0548117693e2594c609877bec6c8fbd6fc969
                                          • Opcode Fuzzy Hash: e1ad635867d62636fc83af882dc7ccf93803b0f14f31c68b3adbd1cbedcd3034
                                          • Instruction Fuzzy Hash: 291181B6500600AFEB218F51DC45FA6FBECEF25714F08845AED468AB51D760E8488AB2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00ADA710 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 191 ada710-ada778 193 ada7b9-ada7be 191->193 194 ada77a-ada782 FindCloseChangeNotification 191->194 193->194 196 ada788-ada79a 194->196 197 ada79c-ada7b8 196->197 198 ada7c0-ada7c5 196->198 198->197
                                          APIs
                                          • FindCloseChangeNotification.KERNELBASE(?), ref: 00ADA780
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076056914.0000000000ADA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_ada000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ChangeCloseFindNotification
                                          • String ID:
                                          • API String ID: 2591292051-0
                                          • Opcode ID: 08618dea0861f19a536e5347847106670a6b1e783c3912ac91142d193bc5b992
                                          • Instruction ID: 700a88575bb63b2503bb50400b0418b8b797be4bb5e5505790133b75628c9a02
                                          • Opcode Fuzzy Hash: 08618dea0861f19a536e5347847106670a6b1e783c3912ac91142d193bc5b992
                                          • Instruction Fuzzy Hash: 9521D2B59093809FD7028B25DC86752BFB8EF56324F0984EBDD858B693D2349909CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00ADA74E Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 200 ada74e-ada778 201 ada7b9-ada7be 200->201 202 ada77a-ada782 FindCloseChangeNotification 200->202 201->202 204 ada788-ada79a 202->204 205 ada79c-ada7b8 204->205 206 ada7c0-ada7c5 204->206 206->205
                                          APIs
                                          • FindCloseChangeNotification.KERNELBASE(?), ref: 00ADA780
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076056914.0000000000ADA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_ada000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ChangeCloseFindNotification
                                          • String ID:
                                          • API String ID: 2591292051-0
                                          • Opcode ID: 38ec5f34a22ad111f86cbba18681dec597c31483bddbc8bb6a8cf7bd234ad840
                                          • Instruction ID: 29263498ac14f8551cb904121508d25e0ff0695a38c35e684f81452406752b45
                                          • Opcode Fuzzy Hash: 38ec5f34a22ad111f86cbba18681dec597c31483bddbc8bb6a8cf7bd234ad840
                                          • Instruction Fuzzy Hash: B701DF71A002009FEB108F55D885766FBF4EF25324F08C4ABDD4ACB742D374E808CAA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00F90006 Relevance: .2, Instructions: 186COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 208 f90006-f900ad 211 f900b8-f902f9 208->211
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076373444.0000000000F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F90000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_f90000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3696f277fddc459eaed3a59a1d5c3e93872b6d9fdfe555e9cace9b57e3208d40
                                          • Instruction ID: 42d0a357172f99d92b170fdec9911373930af5d6ab54f5c4b7d012afc4f269f5
                                          • Opcode Fuzzy Hash: 3696f277fddc459eaed3a59a1d5c3e93872b6d9fdfe555e9cace9b57e3208d40
                                          • Instruction Fuzzy Hash: 0671753410A3C18FC702EB75DD996957BB2AF9620C30A84AAD044CF6AFDB345D4ECB51
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00F605E0 Relevance: .0, Instructions: 44COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 249 f605e0-f60603 250 f60606-f60620 249->250 251 f60626-f60643 250->251
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076337366.0000000000F60000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_f60000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 865987411e0103d12fb7f34f73f5341be0d5bacad0032ffabc7ba0f0b5a55a65
                                          • Instruction ID: eb815bd018bbc28dda95692987b75dc5c7a3733bae48aaf998aee601c0769071
                                          • Opcode Fuzzy Hash: 865987411e0103d12fb7f34f73f5341be0d5bacad0032ffabc7ba0f0b5a55a65
                                          • Instruction Fuzzy Hash: FE01D6B65093806FC7028B15EC40893BFF8DF8623070984ABE8498B622D135A909CBB1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00F60606 Relevance: .0, Instructions: 27COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 252 f60606-f60620 253 f60626-f60643 252->253
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076337366.0000000000F60000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_f60000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: af0b6d66b1b1ac37c001d99e7df3c3b46297aa0dcb5bf52b769638f74a7be702
                                          • Instruction ID: 3db1e31163810c8f51a31c2c9694988522092d3021c5fc37b75c1dcfc65d9864
                                          • Opcode Fuzzy Hash: af0b6d66b1b1ac37c001d99e7df3c3b46297aa0dcb5bf52b769638f74a7be702
                                          • Instruction Fuzzy Hash: A8E092B6A006005B9750CF0AEC81462F7D8EB94630708C47FDC0D8B701E235B508CAA5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00AD23F4 Relevance: .0, Instructions: 15COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 254 ad23f4-ad23ff 255 ad2401-ad240e 254->255 256 ad2412-ad2417 254->256 255->256 257 ad2419 256->257 258 ad241a 256->258 259 ad2420-ad2421 258->259
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076037940.0000000000AD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_ad2000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: cfdca6b5b9b90cfa4475089283f3eae24695f711a54462201f7e91b60d86d8f8
                                          • Instruction ID: fd48eb28e5d8bf7639499793cb8298f98d518383003a86b84702705343aadb46
                                          • Opcode Fuzzy Hash: cfdca6b5b9b90cfa4475089283f3eae24695f711a54462201f7e91b60d86d8f8
                                          • Instruction Fuzzy Hash: 43D05EB9245AC14FD3179B1CC1A4B9537D4AB61714F4A44FAAC008B763C768E9C1D600
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00AD23BC Relevance: .0, Instructions: 14COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 260 ad23bc-ad23c3 261 ad23c5-ad23d2 260->261 262 ad23d6-ad23db 260->262 261->262 263 ad23dd-ad23e0 262->263 264 ad23e1 262->264 265 ad23e7-ad23e8 264->265
                                          Memory Dump Source
                                          • Source File: 0000000B.00000002.2076037940.0000000000AD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AD2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_11_2_ad2000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9a0373ac5d6b5789d08799d41b39c01d46b5ca905c766b26d192d77734e37a73
                                          • Instruction ID: 4763eb00729099444e80b3559a3c5c8cb87e47b248c5aa19cd7a67c6fdbd60d0
                                          • Opcode Fuzzy Hash: 9a0373ac5d6b5789d08799d41b39c01d46b5ca905c766b26d192d77734e37a73
                                          • Instruction Fuzzy Hash: C1D05E342006814BD715DB0CC6D4F5937D4ABA0B14F0644E9AC118F762C7A8E8C0CA00
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Execution Graph

                                          Execution Coverage:10%
                                          Dynamic/Decrypted Code Coverage:100%
                                          Signature Coverage:0%
                                          Total number of Nodes:19
                                          Total number of Limit Nodes:1
                                          execution_graph 665 fda74e 666 fda77a FindCloseChangeNotification 665->666 668 fda7b9 665->668 667 fda788 666->667 668->666 669 fda646 671 fda67e CreateMutexW 669->671 672 fda6c1 671->672 681 fda361 682 fda392 RegQueryValueExW 681->682 684 fda41b 682->684 689 fda710 690 fda74e FindCloseChangeNotification 689->690 692 fda788 690->692 685 fda462 686 fda486 RegSetValueExW 685->686 688 fda507 686->688 693 fda612 695 fda646 CreateMutexW 693->695 696 fda6c1 695->696

                                          Callgraph

                                          Executed Functions

                                          Function 00FDA612 Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 0 fda612-fda695 4 fda69a-fda6a3 0->4 5 fda697 0->5 6 fda6a8-fda6b1 4->6 7 fda6a5 4->7 5->4 8 fda6b3-fda6d7 CreateMutexW 6->8 9 fda702-fda707 6->9 7->6 12 fda709-fda70e 8->12 13 fda6d9-fda6ff 8->13 9->8 12->13
                                          APIs
                                          • CreateMutexW.KERNELBASE(?,?), ref: 00FDA6B9
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2157924527.0000000000FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_fda000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID:
                                          • API String ID: 1964310414-0
                                          • Opcode ID: 54584c2c9879821eadf964e9aa88c7af5ac61ebc31ba6479fccda790c879dad9
                                          • Instruction ID: 0192b8f25a48be7208d14ee4c16e0a6d16ddeb8d4abcaf08cc336e69905fe06c
                                          • Opcode Fuzzy Hash: 54584c2c9879821eadf964e9aa88c7af5ac61ebc31ba6479fccda790c879dad9
                                          • Instruction Fuzzy Hash: 4731A1B15093805FE711CB65CC45B96BFF8EF06320F08849AE984CF292D374E909C766
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00FDA361 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 16 fda361-fda3cf 19 fda3d4-fda3dd 16->19 20 fda3d1 16->20 21 fda3df 19->21 22 fda3e2-fda3e8 19->22 20->19 21->22 23 fda3ed-fda404 22->23 24 fda3ea 22->24 26 fda43b-fda440 23->26 27 fda406-fda419 RegQueryValueExW 23->27 24->23 26->27 28 fda41b-fda438 27->28 29 fda442-fda447 27->29 29->28
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,788D8B64,00000000,00000000,00000000,00000000), ref: 00FDA40C
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2157924527.0000000000FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_fda000_ESET Service.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: d9c1f6c91cc362c621cf19ab7402a7ea8ddff1a91baad07d0ba71200f5d0d8ca
                                          • Instruction ID: 42ea6e3475bd943f194030dd63cd72d6b2741f96995d79b6cf15029d2fc4d905
                                          • Opcode Fuzzy Hash: d9c1f6c91cc362c621cf19ab7402a7ea8ddff1a91baad07d0ba71200f5d0d8ca
                                          • Instruction Fuzzy Hash: 4A318175508740AFE721CF11CC84F92BBF8EF06320F08859AE9458B692D364E949CB76
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00FDA462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 33 fda462-fda4c3 36 fda4c8-fda4d4 33->36 37 fda4c5 33->37 38 fda4d9-fda4f0 36->38 39 fda4d6 36->39 37->36 41 fda527-fda52c 38->41 42 fda4f2-fda505 RegSetValueExW 38->42 39->38 41->42 43 fda52e-fda533 42->43 44 fda507-fda524 42->44 43->44
                                          APIs
                                          • RegSetValueExW.KERNELBASE(?,00000E24,788D8B64,00000000,00000000,00000000,00000000), ref: 00FDA4F8
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2157924527.0000000000FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_fda000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Value
                                          • String ID:
                                          • API String ID: 3702945584-0
                                          • Opcode ID: c0c506794152f8d2214c6429e05f7d5de762448a4044278a47944075619d3d21
                                          • Instruction ID: 37c9da68a8408fc540ec3d55883333258bfeabc818be810a2d80d2db3f3c6dd6
                                          • Opcode Fuzzy Hash: c0c506794152f8d2214c6429e05f7d5de762448a4044278a47944075619d3d21
                                          • Instruction Fuzzy Hash: B22181725083806FD7228F51DC45FA7BFB8EF46220F08849AE9858B652D364E848C775
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00FDA646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 48 fda646-fda695 51 fda69a-fda6a3 48->51 52 fda697 48->52 53 fda6a8-fda6b1 51->53 54 fda6a5 51->54 52->51 55 fda6b3-fda6bb CreateMutexW 53->55 56 fda702-fda707 53->56 54->53 57 fda6c1-fda6d7 55->57 56->55 59 fda709-fda70e 57->59 60 fda6d9-fda6ff 57->60 59->60
                                          APIs
                                          • CreateMutexW.KERNELBASE(?,?), ref: 00FDA6B9
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2157924527.0000000000FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_fda000_ESET Service.jbxd
                                          Similarity
                                          • API ID: CreateMutex
                                          • String ID:
                                          • API String ID: 1964310414-0
                                          • Opcode ID: dc23a8b492138357852c9d170c328e8278999c88d8996be0e252eae8c41c897e
                                          • Instruction ID: 1f4748cbc9b3525af42e8910a252c221d96aaf57dd1b81052eb14478c29903e5
                                          • Opcode Fuzzy Hash: dc23a8b492138357852c9d170c328e8278999c88d8996be0e252eae8c41c897e
                                          • Instruction Fuzzy Hash: CE2192716042049FE720CF65CD45BA6FBE8EF14324F08886AED48CB741D775E909DA76
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00FDA392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 63 fda392-fda3cf 65 fda3d4-fda3dd 63->65 66 fda3d1 63->66 67 fda3df 65->67 68 fda3e2-fda3e8 65->68 66->65 67->68 69 fda3ed-fda404 68->69 70 fda3ea 68->70 72 fda43b-fda440 69->72 73 fda406-fda419 RegQueryValueExW 69->73 70->69 72->73 74 fda41b-fda438 73->74 75 fda442-fda447 73->75 75->74
                                          APIs
                                          • RegQueryValueExW.KERNELBASE(?,00000E24,788D8B64,00000000,00000000,00000000,00000000), ref: 00FDA40C
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2157924527.0000000000FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_fda000_ESET Service.jbxd
                                          Similarity
                                          • API ID: QueryValue
                                          • String ID:
                                          • API String ID: 3660427363-0
                                          • Opcode ID: e8bae11c51ab7e74315458bf383155614f81501433c2f4a0886bc5c7945d3508
                                          • Instruction ID: cbd43ad5e242f2bd8b9efbf1899dc915a99e0004c2c0ab30c651edfbfe8f7d0b
                                          • Opcode Fuzzy Hash: e8bae11c51ab7e74315458bf383155614f81501433c2f4a0886bc5c7945d3508
                                          • Instruction Fuzzy Hash: 6921CD72A00604AFEB20CF51CC84FA6F7ECEF05720F08845AE9458B751D7A0E949DAB6
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00FDA710 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 93 fda710-fda778 95 fda7b9-fda7be 93->95 96 fda77a-fda782 FindCloseChangeNotification 93->96 95->96 97 fda788-fda79a 96->97 99 fda79c-fda7b8 97->99 100 fda7c0-fda7c5 97->100 100->99
                                          APIs
                                          • FindCloseChangeNotification.KERNELBASE(?), ref: 00FDA780
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2157924527.0000000000FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_fda000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ChangeCloseFindNotification
                                          • String ID:
                                          • API String ID: 2591292051-0
                                          • Opcode ID: 6058dfaf26169566411abe172a0325c0abdab3d4e8222a6590ddc7a66194d0e2
                                          • Instruction ID: 3999b0698364f679dd150bac562daf46430f5460c719733c226d88dbc334d3d2
                                          • Opcode Fuzzy Hash: 6058dfaf26169566411abe172a0325c0abdab3d4e8222a6590ddc7a66194d0e2
                                          • Instruction Fuzzy Hash: 7B21E7B59053809FD7128B25DC85B51BFB4EF06320F0884DBDC858F693D3349905CB62
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00FDA486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 79 fda486-fda4c3 81 fda4c8-fda4d4 79->81 82 fda4c5 79->82 83 fda4d9-fda4f0 81->83 84 fda4d6 81->84 82->81 86 fda527-fda52c 83->86 87 fda4f2-fda505 RegSetValueExW 83->87 84->83 86->87 88 fda52e-fda533 87->88 89 fda507-fda524 87->89 88->89
                                          APIs
                                          • RegSetValueExW.KERNELBASE(?,00000E24,788D8B64,00000000,00000000,00000000,00000000), ref: 00FDA4F8
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2157924527.0000000000FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_fda000_ESET Service.jbxd
                                          Similarity
                                          • API ID: Value
                                          • String ID:
                                          • API String ID: 3702945584-0
                                          • Opcode ID: 2ead843d0d67b5a56dfbc0ff8dedd27492ab98ef49f1b12949b99dd06cf42ad4
                                          • Instruction ID: cf3f237cd33b2e944ae39c8fc1f128b1124cce1b56b1b223dba09e2786066664
                                          • Opcode Fuzzy Hash: 2ead843d0d67b5a56dfbc0ff8dedd27492ab98ef49f1b12949b99dd06cf42ad4
                                          • Instruction Fuzzy Hash: 3511B172900600AFEB20CE11DC45FA6FBECEF15724F08845AED458BB51D360E848DAB6
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00FDA74E Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 102 fda74e-fda778 103 fda7b9-fda7be 102->103 104 fda77a-fda782 FindCloseChangeNotification 102->104 103->104 105 fda788-fda79a 104->105 107 fda79c-fda7b8 105->107 108 fda7c0-fda7c5 105->108 108->107
                                          APIs
                                          • FindCloseChangeNotification.KERNELBASE(?), ref: 00FDA780
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2157924527.0000000000FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDA000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_fda000_ESET Service.jbxd
                                          Similarity
                                          • API ID: ChangeCloseFindNotification
                                          • String ID:
                                          • API String ID: 2591292051-0
                                          • Opcode ID: 876a2b4d280c81ec23ab9b5ca7e9928f430565766d1d2dbcd101daee233f7afa
                                          • Instruction ID: 6cd9c5ea422add3c4a98d5b79d435f7dd07ecfa0f98c6ff23bbc8d7a33102f86
                                          • Opcode Fuzzy Hash: 876a2b4d280c81ec23ab9b5ca7e9928f430565766d1d2dbcd101daee233f7afa
                                          • Instruction Fuzzy Hash: 33018F75A002408FEB508F55D985766FBE4EF15320F08C4ABDD498F756D375E808DAA2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 04F90310 Relevance: .2, Instructions: 191COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 110 4f90310-4f90334 112 4f9033e-4f90346 110->112 113 4f90336-4f90338 110->113 114 4f90348-4f9034d 112->114 115 4f9034e-4f90391 112->115 113->112 118 4f903d8-4f903ff 115->118 119 4f90393-4f903bb 115->119 125 4f9040a-4f90418 118->125 124 4f903ce 119->124 124->118 126 4f9041a 125->126 127 4f9041f-4f90434 125->127 126->127 129 4f9046b-4f90523 127->129 130 4f90436-4f90460 127->130 149 4f90570-4f90587 129->149 150 4f90525-4f90569 129->150 130->129 151 4f9058d-4f905bf 149->151 152 4f90880 149->152 150->149 151->152
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2158403409.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_4f90000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4c9ee68529f8e1edf00212b7f505dd32a52fa8d8aba1f5995ef71db16704a072
                                          • Instruction ID: a5404c95baf4f5d764caf525cf97cc08db27ceae77c8203c80d50c30aee0bc88
                                          • Opcode Fuzzy Hash: 4c9ee68529f8e1edf00212b7f505dd32a52fa8d8aba1f5995ef71db16704a072
                                          • Instruction Fuzzy Hash: 735135307002108FDB09AB76885967E77E7AF993447084569E102DB3A6DF39DD0797A1
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 04F903BD Relevance: .1, Instructions: 135COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 163 4f903bd-4f90418 171 4f9041a 163->171 172 4f9041f-4f90434 163->172 171->172 174 4f9046b-4f90523 172->174 175 4f90436-4f90460 172->175 194 4f90570-4f90587 174->194 195 4f90525-4f90569 174->195 175->174 196 4f9058d-4f905bf 194->196 197 4f90880 194->197 195->194 196->197
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2158403409.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_4f90000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: edc6b81213f66e0495308303d04a9d1b04e13953b9f0bea81528b9481dba623e
                                          • Instruction ID: 0f6da940d6df264cb4caf0ef3c70401d0d052e0411df0aafdb31312ada047cac
                                          • Opcode Fuzzy Hash: edc6b81213f66e0495308303d04a9d1b04e13953b9f0bea81528b9481dba623e
                                          • Instruction Fuzzy Hash: FC411830B002614FDB49A7BA84597BE76D75FD52487084129E002DF7A6DF39CD07A7E2
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 04F90080 Relevance: .1, Instructions: 132COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 208 4f90080-4f900ad 211 4f900b8-4f902f9 208->211
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2158403409.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_4f90000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 5e230a8e2971f85712a9dde10734567c98bde6f38cc3bdba570fa5be6bcfbd8b
                                          • Instruction ID: 923ed6909f3aa8088acb37dd5a25fe67c204f197a9a5be7785a07a9dda78f7f4
                                          • Opcode Fuzzy Hash: 5e230a8e2971f85712a9dde10734567c98bde6f38cc3bdba570fa5be6bcfbd8b
                                          • Instruction Fuzzy Hash: 175164305056928FC745FF77E58958B77B2BFB428C3408A29D1089B76EDB349D0ACB81
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 04F90006 Relevance: .1, Instructions: 54COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 249 4f90006-4f90076
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2158403409.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_4f90000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 8e4abffa9644e979d2724b8bcf25c37ac1e5cfa05817e16cb535335e231dee12
                                          • Instruction ID: 1e549b76dc63db484b0a6f5c7684c95c13ed02e35be152415dc3e707205ea33e
                                          • Opcode Fuzzy Hash: 8e4abffa9644e979d2724b8bcf25c37ac1e5cfa05817e16cb535335e231dee12
                                          • Instruction Fuzzy Hash: 6201049685F7C05FE70352741CBA1913FB19D6711975E40DBC8C2CB1A3A81D290FA332
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 012705E0 Relevance: .0, Instructions: 43COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 250 12705e0-1270603 251 1270606-1270620 250->251 252 1270626-1270643 251->252
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2158192761.0000000001270000.00000040.00000020.00020000.00000000.sdmp, Offset: 01270000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_1270000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d3f660dd035ca3c3c6562215fd346ad8f54483230bc4e17d78a51be4a50d35e9
                                          • Instruction ID: 45db594f4dd27f681c23d7f371a214cb5b77f76eaa4a5d75aaa150e27b758542
                                          • Opcode Fuzzy Hash: d3f660dd035ca3c3c6562215fd346ad8f54483230bc4e17d78a51be4a50d35e9
                                          • Instruction Fuzzy Hash: 3C01A2B65087806FC7118F15AC41857BFE8EF8623070984ABEC488B612D225E919CB61
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 01270606 Relevance: .0, Instructions: 27COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 253 1270606-1270620 254 1270626-1270643 253->254
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2158192761.0000000001270000.00000040.00000020.00020000.00000000.sdmp, Offset: 01270000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_1270000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: cb76bc3353e9d131beaeb9e77815766b03e4c5b9a5d5628757f9c214dd78344c
                                          • Instruction ID: c755b0feb88eff20db38d0a8bedadc6f7b26f7ba48c06a874af684bc56c95c18
                                          • Opcode Fuzzy Hash: cb76bc3353e9d131beaeb9e77815766b03e4c5b9a5d5628757f9c214dd78344c
                                          • Instruction Fuzzy Hash: F2E092B6A006045F9750CF0AEC41856F7D8EB88630B08C47FDC0D8B701D235B508CAA5
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00FD23F4 Relevance: .0, Instructions: 15COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 255 fd23f4-fd23ff 256 fd2401-fd240e 255->256 257 fd2412-fd2417 255->257 256->257 258 fd2419 257->258 259 fd241a 257->259 260 fd2420-fd2421 259->260
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2157907071.0000000000FD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_fd2000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b430fa73c0cb4f3631d56a40f08ce62759570299010af8185ec26f2044080f5b
                                          • Instruction ID: 719c829e7cd8b649cb3d04808dcf5100499cf4183080c963c04a3aad3dd2d53e
                                          • Opcode Fuzzy Hash: b430fa73c0cb4f3631d56a40f08ce62759570299010af8185ec26f2044080f5b
                                          • Instruction Fuzzy Hash: 99D05E7A605AC14FD317DA1CC1A4B9537D5AB62724F4A44FAAC008B763C768E9C1E640
                                          Uniqueness

                                          Uniqueness Score: -1.00%

                                          Function 00FD23BC Relevance: .0, Instructions: 14COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 0000000C.00000002.2157907071.0000000000FD2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD2000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_12_2_fd2000_ESET Service.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 747af43a617b2105687b954301e38bf97b3d3c83453ffaa53ba7eaace13c980e
                                          • Instruction ID: c72c0f1af3ca7c6ea63dd95fe0204e4a78f5abc2743d83db46d66c9f62ac4aab
                                          • Opcode Fuzzy Hash: 747af43a617b2105687b954301e38bf97b3d3c83453ffaa53ba7eaace13c980e
                                          • Instruction Fuzzy Hash: 6AD05E346006814BC715DA0CC6D4F5937D5ABA0B24F0A44E9AC108B762C7A8E8C0DA40
                                          Uniqueness

                                          Uniqueness Score: -1.00%