Edit tour

Windows Analysis Report
8tvMmyxveyzFcnJ.exe

Overview

General Information

Sample name:	8tvMmyxveyzFcnJ.exe
Analysis ID:	1470721
MD5:	fff69b0890fc5c9c754e17d06deb5216
SHA1:	e3b4644bd7f114a830ec649edbed92a437a81673
SHA256:	a8fe32e805d1e0a0a61e2763308b01be24656f9bd356a863b174ce61e32d9a7e
Tags:	exe
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected FormBook

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Uses netsh to modify the Windows network and firewall settings

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

8tvMmyxveyzFcnJ.exe (PID: 6740 cmdline: "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe" MD5: FFF69B0890FC5C9C754E17D06DEB5216)

8tvMmyxveyzFcnJ.exe (PID: 7152 cmdline: "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe" MD5: FFF69B0890FC5C9C754E17D06DEB5216)

8tvMmyxveyzFcnJ.exe (PID: 7164 cmdline: "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe" MD5: FFF69B0890FC5C9C754E17D06DEB5216)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

autofmt.exe (PID: 180 cmdline: "C:\Windows\SysWOW64\autofmt.exe" MD5: C72D80A976B7EB40534E8464957A979F)

netsh.exe (PID: 396 cmdline: "C:\Windows\SysWOW64\netsh.exe" MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 5676 cmdline: /c del "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.sainikshiksha.com/mc10/"], "decoy": ["sttcorp.one", "jack88.lat", "owl-protect.com", "hnszrrn.com", "at89v2.com", "h147.top", "takle4creators.com", "fondsa.xyz", "mantenopolice.com", "shophansler.com", "dessertt.com", "thecollisionmagazine.com", "tatesfluffyfrenchies.com", "h1f2v.rest", "bluewandltd.com", "cuplaho2003.shop", "2thetcleaningservice.com", "yc85w.top", "natursache.shop", "allmyabilities.com", "sorteioagora.shop", "291van.fun", "bforeplay.com", "playcoy99.com", "grapplegrid.app", "machaiproductions.com", "bjcysadz.xyz", "hg44a.com", "english4u.online", "w15hh.rest", "kurainu.xyz", "psycrowolgy.com", "quantron.xyz", "realtors.biz", "hjjhggh.top", "767jogo.com", "inspirationandhumor.com", "basedawgz.live", "jigofort.com", "bonjourmignon.com", "huttonsidel.online", "iffacosmetics.com", "483yes.com", "motolimod.com", "xatapartners.com", "laurelhw.com", "sztopsports.com", "ethermail-register.com", "ust-online.com", "theofficescowork.com", "arkonwheels.com", "projectorvibe.com", "xpanas.black", "gemaroke2.shop", "sofiastory.store", "dealerxai.com", "zerolength.xyz", "marketmaventesfayellc.site", "instrumentsurvey-dinarjatim.com", "ajansyapai.net", "llngx.com", "onwardgrowth.com", "useprize.com", "zaki-argan.com"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6bc1:$a1: 3C 30 50 4F 53 54 74 09 40 0x34fe1:$a1: 3C 30 50 4F 53 54 74 09 40 0x62401:$a1: 3C 30 50 4F 53 54 74 09 40 0x1d530:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x4b950:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x78d70:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xb33f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x3975f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x66b7f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x16227:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x44647:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x71a67:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa278:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa4f2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x38698:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x38912:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x65ab8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x65d32:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16025:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x44445:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x71865:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15b11:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x43f31:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x71351:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16127:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x44547:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x71967:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1629f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x446bf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x71adf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaf0a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x3932a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x6674a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x191b9:$sqlite3step: 68 34 1C 7B E1 0x192cc:$sqlite3step: 68 34 1C 7B E1 0x475d9:$sqlite3step: 68 34 1C 7B E1 0x476ec:$sqlite3step: 68 34 1C 7B E1 0x749f9:$sqlite3step: 68 34 1C 7B E1 0x74b0c:$sqlite3step: 68 34 1C 7B E1 0x191e8:$sqlite3text: 68 38 2A 90 C5 0x1930d:$sqlite3text: 68 38 2A 90 C5 0x47608:$sqlite3text: 68 38 2A 90 C5 0x4772d:$sqlite3text: 68 38 2A 90 C5 0x74a28:$sqlite3text: 68 38 2A 90 C5 0x74b4d:$sqlite3text: 68 38 2A 90 C5 0x191fb:$sqlite3blob: 68 53 D8 7F 8C 0x19323:$sqlite3blob: 68 53 D8 7F 8C 0x4761b:$sqlite3blob: 68 53 D8 7F 8C 0x47743:$sqlite3blob: 68 53 D8 7F 8C 0x74a3b:$sqlite3blob: 68 53 D8 7F 8C 0x74b63:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.4157684455.000000000F8A5000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_772cc62d	unknown	unknown	0xaa2:$a2: pass 0xaa8:$a3: email 0xaaf:$a4: login 0xab6:$a5: signin 0xac7:$a6: persistent 0xc9a:$r1: C:\Users\user\AppData\Roaming\J9APTAPR\J9Alog.ini
00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: 8tvMmyxveyzFcnJ.exe PID: 6740	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 8tvMmyxveyzFcnJ.exe PID: 6740	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x33bff:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: 8tvMmyxveyzFcnJ.exe PID: 7164	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x7c5a:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: netsh.exe PID: 396	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xf9e:$a1: 3C 30 50 4F 53 54 74 09 40 0x9d5c2:$a1: 3C 30 50 4F 53 54 74 09 40 0xa161c:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bdc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bcf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14ab7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 5 entries

Snort Signatures

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 3.64.163.50

Timestamp:	07/10/24-12:11:01.020125
SID:	2031412
Source Port:	50630
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 198.185.159.144

Timestamp:	07/10/24-12:13:25.925017
SID:	2031412
Source Port:	50634
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 103.224.212.213

Timestamp:	07/10/24-12:11:21.261447
SID:	2031412
Source Port:	50631
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 103.191.209.34

Timestamp:	07/10/24-12:11:42.251746
SID:	2031412
Source Port:	50632
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	07/10/24-12:10:40.094311
SID:	2031412
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 3.33.130.190

Timestamp:	07/10/24-12:12:01.865030
SID:	2031412
Source Port:	50633
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://www.tatesfluffyfrenchies.com/mc10/	Avira URL Cloud: Label: phishing
Source: http://www.shophansler.com/mc10/:	Avira URL Cloud: Label: phishing
Source: http://www.tatesfluffyfrenchies.com/mc10/www.dealerxai.com	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.sainikshiksha.com/mc10/"], "decoy": ["sttcorp.one", "jack88.lat", "owl-protect.com", "hnszrrn.com", "at89v2.com", "h147.top", "takle4creators.com", "fondsa.xyz", "mantenopolice.com", "shophansler.com", "dessertt.com", "thecollisionmagazine.com", "tatesfluffyfrenchies.com", "h1f2v.rest", "bluewandltd.com", "cuplaho2003.shop", "2thetcleaningservice.com", "yc85w.top", "natursache.shop", "allmyabilities.com", "sorteioagora.shop", "291van.fun", "bforeplay.com", "playcoy99.com", "grapplegrid.app", "machaiproductions.com", "bjcysadz.xyz", "hg44a.com", "english4u.online", "w15hh.rest", "kurainu.xyz", "psycrowolgy.com", "quantron.xyz", "realtors.biz", "hjjhggh.top", "767jogo.com", "inspirationandhumor.com", "basedawgz.live", "jigofort.com", "bonjourmignon.com", "huttonsidel.online", "iffacosmetics.com", "483yes.com", "motolimod.com", "xatapartners.com", "laurelhw.com", "sztopsports.com", "ethermail-register.com", "ust-online.com", "theofficescowork.com", "arkonwheels.com", "projectorvibe.com", "xpanas.black", "gemaroke2.shop", "sofiastory.store", "dealerxai.com", "zerolength.xyz", "marketmaventesfayellc.site", "instrumentsurvey-dinarjatim.com", "ajansyapai.net", "llngx.com", "onwardgrowth.com", "useprize.com", "zaki-argan.com"]}

Multi AV Scanner detection for submitted file

Source: 8tvMmyxveyzFcnJ.exe	ReversingLabs: Detection: 52%
Source: 8tvMmyxveyzFcnJ.exe	Virustotal: Detection: 49%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 8tvMmyxveyzFcnJ.exe

Joe Sandbox ML: detected

Source: 8tvMmyxveyzFcnJ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8tvMmyxveyzFcnJ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: netsh.pdb source: 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1754981698.0000000000F35000.00000004.00000020.00020000.00000000.sdmp, 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1754981698.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1755379848.0000000001330000.00000040.10000000.00040000.00000000.sdmp, netsh.exe, netsh.exe, 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: netsh.pdbGCTL source: 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1754981698.0000000000F35000.00000004.00000020.00020000.00000000.sdmp, 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1754981698.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1755379848.0000000001330000.00000040.10000000.00040000.00000000.sdmp, netsh.exe, 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 00000006.00000003.1756812796.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 00000006.00000003.1754917189.00000000009B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 8tvMmyxveyzFcnJ.exe, 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, netsh.exe, 00000006.00000003.1756812796.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 00000006.00000003.1754917189.00000000009B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AYIS.pdb source: 8tvMmyxveyzFcnJ.exe
Source:	Binary string: \|.pDb source: 8tvMmyxveyzFcnJ.exe
Source:	Binary string: AYIS.pdbSHA256M source: 8tvMmyxveyzFcnJ.exe

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 4x nop then pop edi		3_2_00416CDF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 4x nop then pop edi		6_2_00416CDF

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49743 -> 188.114.97.3:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:50630 -> 3.64.163.50:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:50631 -> 103.224.212.213:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:50632 -> 103.191.209.34:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:50633 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:50634 -> 198.185.159.144:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.sainikshiksha.com/mc10/

Performs DNS queries to domains with low reputation

Source:

DNS query: www.fondsa.xyz

Source: global traffic	HTTP traffic detected: GET /mc10/?M6=0jqVw3fXhgUe9S01oU54GSyQct+tyOMGPM4Q+l1hxxFHWjnqq7dqR8wNeV12RES6q9dV&sZ=Ynzp6xUh HTTP/1.1Host: www.291van.funConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /mc10/?M6=vFB2baQv3F/rJ4Poxnbh3E5xW9PPAAbphga1xIFZj8yJGRkxzOANKPapIG+pOmwhUo5D&sZ=Ynzp6xUh HTTP/1.1Host: www.motolimod.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /mc10/?M6=+PshiMmsD3s2EuJ9KF3baeU+rJnvgbutDGTUYWD/T/xNi6HtTgrR7YeDwlLM6QRR03T9&sZ=Ynzp6xUh HTTP/1.1Host: www.at89v2.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	IP Address: 103.224.212.213 103.224.212.213
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: TRELLIAN-AS-APTrellianPtyLimitedAU TRELLIAN-AS-APTrellianPtyLimitedAU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	TCP traffic detected without corresponding DNS query: 3.64.163.50
Source: unknown	TCP traffic detected without corresponding DNS query: 3.64.163.50
Source: unknown	TCP traffic detected without corresponding DNS query: 3.64.163.50
Source: unknown	TCP traffic detected without corresponding DNS query: 3.64.163.50
Source: unknown	TCP traffic detected without corresponding DNS query: 3.64.163.50
Source: unknown	TCP traffic detected without corresponding DNS query: 3.64.163.50
Source: unknown	TCP traffic detected without corresponding DNS query: 3.64.163.50
Source: unknown	TCP traffic detected without corresponding DNS query: 3.64.163.50
Source: unknown	TCP traffic detected without corresponding DNS query: 3.64.163.50
Source: unknown	TCP traffic detected without corresponding DNS query: 3.64.163.50
Source: unknown	TCP traffic detected without corresponding DNS query: 3.64.163.50
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\explorer.exe

Code function: 4_2_0F88DF82 getaddrinfo,setsockopt,recv,

4_2_0F88DF82

Source: global traffic	HTTP traffic detected: GET /mc10/?M6=0jqVw3fXhgUe9S01oU54GSyQct+tyOMGPM4Q+l1hxxFHWjnqq7dqR8wNeV12RES6q9dV&sZ=Ynzp6xUh HTTP/1.1Host: www.291van.funConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /mc10/?M6=vFB2baQv3F/rJ4Poxnbh3E5xW9PPAAbphga1xIFZj8yJGRkxzOANKPapIG+pOmwhUo5D&sZ=Ynzp6xUh HTTP/1.1Host: www.motolimod.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /mc10/?M6=+PshiMmsD3s2EuJ9KF3baeU+rJnvgbutDGTUYWD/T/xNi6HtTgrR7YeDwlLM6QRR03T9&sZ=Ynzp6xUh HTTP/1.1Host: www.at89v2.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic	DNS traffic detected: DNS query: www.basedawgz.live
Source: global traffic	DNS traffic detected: DNS query: www.thecollisionmagazine.com
Source: global traffic	DNS traffic detected: DNS query: www.291van.fun
Source: global traffic	DNS traffic detected: DNS query: www.motolimod.com
Source: global traffic	DNS traffic detected: DNS query: www.at89v2.com
Source: global traffic	DNS traffic detected: DNS query: www.sainikshiksha.com
Source: global traffic	DNS traffic detected: DNS query: www.fondsa.xyz
Source: global traffic	DNS traffic detected: DNS query: www.huttonsidel.online
Source: global traffic	DNS traffic detected: DNS query: www.llngx.com
Source: global traffic	DNS traffic detected: DNS query: www.ajansyapai.net
Source: global traffic	DNS traffic detected: DNS query: www.tatesfluffyfrenchies.com

Source: explorer.exe, 00000004.00000000.1703761960.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4146493757.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3111563665.0000000009834000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3464304091.0000000009834000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000004.00000000.1703761960.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4146493757.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3111563665.0000000009834000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3464304091.0000000009834000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000004.00000000.1703761960.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4146493757.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3111563665.0000000009834000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3464304091.0000000009834000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000004.00000000.1703761960.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4146493757.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3111563665.0000000009834000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3464304091.0000000009834000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000004.00000000.1703761960.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000004.00000000.1703761960.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mi
Source: explorer.exe, 00000004.00000000.1703761960.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micr
Source: explorer.exe, 00000004.00000000.1706494215.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.1704923328.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.1704462653.0000000007F40000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.291van.fun
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.291van.fun/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.291van.fun/mc10/www.motolimod.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.291van.funReferer:
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ajansyapai.net
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ajansyapai.net/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ajansyapai.net/mc10/www.tatesfluffyfrenchies.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ajansyapai.netReferer:
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.at89v2.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.at89v2.com/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.at89v2.com/mc10/www.sainikshiksha.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.at89v2.comReferer:
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.basedawgz.live
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.basedawgz.live/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.basedawgz.live/mc10/www.thecollisionmagazine.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.basedawgz.liveReferer:
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bjcysadz.xyz
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bjcysadz.xyz/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bjcysadz.xyz/mc10/www.zaki-argan.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bjcysadz.xyzReferer:
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dealerxai.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dealerxai.com/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dealerxai.com/mc10/www.bjcysadz.xyz
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dealerxai.comReferer:
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fondsa.xyz
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fondsa.xyz/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fondsa.xyz/mc10/www.huttonsidel.online
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.fondsa.xyzReferer:
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.huttonsidel.online
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.huttonsidel.online/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.huttonsidel.online/mc10/www.llngx.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.huttonsidel.onlineReferer:
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.kurainu.xyz
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.kurainu.xyz/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.kurainu.xyz/mc10/www.291van.fun
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.kurainu.xyzReferer:
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.llngx.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.llngx.com/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.llngx.com/mc10/www.ajansyapai.net
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.llngx.comReferer:
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.motolimod.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.motolimod.com/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.motolimod.com/mc10/www.at89v2.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.motolimod.comReferer:
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sainikshiksha.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sainikshiksha.com/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sainikshiksha.com/mc10/www.fondsa.xyz
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sainikshiksha.comReferer:
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703686104.0000000005690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comne
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.shophansler.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.shophansler.com/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.shophansler.com/mc10/:
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.shophansler.comReferer:
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.tatesfluffyfrenchies.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.tatesfluffyfrenchies.com/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.tatesfluffyfrenchies.com/mc10/www.dealerxai.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.tatesfluffyfrenchies.comReferer:
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.thecollisionmagazine.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.thecollisionmagazine.com/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.thecollisionmagazine.com/mc10/www.kurainu.xyz
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.thecollisionmagazine.comReferer:
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.zaki-argan.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.zaki-argan.com/mc10/
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.zaki-argan.com/mc10/www.shophansler.com
Source: explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.zaki-argan.comReferer:
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: explorer.exe, 00000004.00000000.1707756779.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000004.00000000.1703761960.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000004.00000000.1703761960.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000004.00000002.4153126684.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1707756779.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000004.00000003.3114554074.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4146493757.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000004.00000003.3114554074.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4146493757.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000004.00000000.1701959899.0000000001248000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4142165391.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1702684644.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4141036678.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000004.00000003.3114554074.0000000009701000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4146493757.0000000009702000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3114554074.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4146493757.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000004.00000003.3114554074.0000000009701000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4146493757.0000000009702000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000004.00000000.1703761960.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000004.00000000.1703761960.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 00000004.00000002.4153126684.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1707756779.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000004.00000000.1703761960.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: explorer.exe, 00000004.00000002.4153126684.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1707756779.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000004.00000002.4153126684.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1707756779.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000004.00000000.1707756779.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4153126684.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000004.00000002.4153126684.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1707756779.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000004.00000000.1703761960.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000004.00000002.4143507586.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.4157684455.000000000F8A5000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
Source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: 8tvMmyxveyzFcnJ.exe PID: 6740, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: 8tvMmyxveyzFcnJ.exe PID: 7164, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: netsh.exe PID: 396, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

.NET source code contains very large array initializations

Source: 0.2.8tvMmyxveyzFcnJ.exe.2b55708.2.raw.unpack, SizeParameters.cs	Large array initialization: : array initializer size 15142
Source: 0.2.8tvMmyxveyzFcnJ.exe.5610000.13.raw.unpack, SizeParameters.cs	Large array initialization: : array initializer size 15142

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041A360 NtCreateFile,	3_2_0041A360
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041A410 NtReadFile,	3_2_0041A410
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041A490 NtClose,	3_2_0041A490
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041A540 NtAllocateVirtualMemory,	3_2_0041A540
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041A35F NtCreateFile,	3_2_0041A35F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041A40A NtReadFile,	3_2_0041A40A
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041A48A NtClose,	3_2_0041A48A
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041A53A NtAllocateVirtualMemory,	3_2_0041A53A
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2B60 NtClose,LdrInitializeThunk,	3_2_013F2B60
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_013F2BF0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2AD0 NtReadFile,LdrInitializeThunk,	3_2_013F2AD0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2D30 NtUnmapViewOfSection,LdrInitializeThunk,	3_2_013F2D30
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2D10 NtMapViewOfSection,LdrInitializeThunk,	3_2_013F2D10
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_013F2DF0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2DD0 NtDelayExecution,LdrInitializeThunk,	3_2_013F2DD0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_013F2C70
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2CA0 NtQueryInformationToken,LdrInitializeThunk,	3_2_013F2CA0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2F30 NtCreateSection,LdrInitializeThunk,	3_2_013F2F30
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2FB0 NtResumeThread,LdrInitializeThunk,	3_2_013F2FB0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2F90 NtProtectVirtualMemory,LdrInitializeThunk,	3_2_013F2F90
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2FE0 NtCreateFile,LdrInitializeThunk,	3_2_013F2FE0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,	3_2_013F2EA0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2E80 NtReadVirtualMemory,LdrInitializeThunk,	3_2_013F2E80
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F3010 NtOpenDirectoryObject,	3_2_013F3010
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F3090 NtSetValueKey,	3_2_013F3090
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F4340 NtSetContextThread,	3_2_013F4340
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F35C0 NtCreateMutant,	3_2_013F35C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F4650 NtSuspendThread,	3_2_013F4650
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F39B0 NtGetContextThread,	3_2_013F39B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2BA0 NtEnumerateValueKey,	3_2_013F2BA0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2B80 NtQueryInformationFile,	3_2_013F2B80
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2BE0 NtQueryValueKey,	3_2_013F2BE0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2AB0 NtWaitForSingleObject,	3_2_013F2AB0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2AF0 NtWriteFile,	3_2_013F2AF0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F3D10 NtOpenProcessToken,	3_2_013F3D10
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2D00 NtSetInformationFile,	3_2_013F2D00
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F3D70 NtOpenThread,	3_2_013F3D70
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2DB0 NtEnumerateKey,	3_2_013F2DB0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2C00 NtQueryInformationProcess,	3_2_013F2C00
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2C60 NtCreateKey,	3_2_013F2C60
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2CF0 NtOpenProcess,	3_2_013F2CF0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2CC0 NtQueryVirtualMemory,	3_2_013F2CC0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2F60 NtCreateProcessEx,	3_2_013F2F60
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2FA0 NtQuerySection,	3_2_013F2FA0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2E30 NtWriteVirtualMemory,	3_2_013F2E30
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F2EE0 NtQueueApcThread,	3_2_013F2EE0
Source: C:\Windows\explorer.exe	Code function: 4_2_0F88EE12 NtProtectVirtualMemory,	4_2_0F88EE12
Source: C:\Windows\explorer.exe	Code function: 4_2_0F88D232 NtCreateFile,	4_2_0F88D232
Source: C:\Windows\explorer.exe	Code function: 4_2_0F88EE0A NtProtectVirtualMemory,	4_2_0F88EE0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92AD0 NtReadFile,LdrInitializeThunk,	6_2_00D92AD0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92B60 NtClose,LdrInitializeThunk,	6_2_00D92B60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_00D92CA0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_00D92C70
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92C60 NtCreateKey,LdrInitializeThunk,	6_2_00D92C60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92DD0 NtDelayExecution,LdrInitializeThunk,	6_2_00D92DD0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_00D92DF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_00D92D10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,	6_2_00D92EA0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92FE0 NtCreateFile,LdrInitializeThunk,	6_2_00D92FE0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92F30 NtCreateSection,LdrInitializeThunk,	6_2_00D92F30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D935C0 NtCreateMutant,LdrInitializeThunk,	6_2_00D935C0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D94340 NtSetContextThread,	6_2_00D94340
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D94650 NtSuspendThread,	6_2_00D94650
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92AF0 NtWriteFile,	6_2_00D92AF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92AB0 NtWaitForSingleObject,	6_2_00D92AB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92BF0 NtAllocateVirtualMemory,	6_2_00D92BF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92BE0 NtQueryValueKey,	6_2_00D92BE0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92B80 NtQueryInformationFile,	6_2_00D92B80
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92BA0 NtEnumerateValueKey,	6_2_00D92BA0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92CC0 NtQueryVirtualMemory,	6_2_00D92CC0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92CF0 NtOpenProcess,	6_2_00D92CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92C00 NtQueryInformationProcess,	6_2_00D92C00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92DB0 NtEnumerateKey,	6_2_00D92DB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92D00 NtSetInformationFile,	6_2_00D92D00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92D30 NtUnmapViewOfSection,	6_2_00D92D30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92EE0 NtQueueApcThread,	6_2_00D92EE0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92E80 NtReadVirtualMemory,	6_2_00D92E80
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92E30 NtWriteVirtualMemory,	6_2_00D92E30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92F90 NtProtectVirtualMemory,	6_2_00D92F90
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92FB0 NtResumeThread,	6_2_00D92FB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92FA0 NtQuerySection,	6_2_00D92FA0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D92F60 NtCreateProcessEx,	6_2_00D92F60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D93090 NtSetValueKey,	6_2_00D93090
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D93010 NtOpenDirectoryObject,	6_2_00D93010
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D939B0 NtGetContextThread,	6_2_00D939B0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D93D70 NtOpenThread,	6_2_00D93D70
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D93D10 NtOpenProcessToken,	6_2_00D93D10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_0041A360 NtCreateFile,	6_2_0041A360
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_0041A410 NtReadFile,	6_2_0041A410
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_0041A490 NtClose,	6_2_0041A490
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_0041A35F NtCreateFile,	6_2_0041A35F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_0041A40A NtReadFile,	6_2_0041A40A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_0041A48A NtClose,	6_2_0041A48A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BBA036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,RtlQueueApcWow64Thread,NtResumeThread,	6_2_00BBA036
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BB9BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,	6_2_00BB9BAF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BBA042 NtQueryInformationProcess,	6_2_00BBA042
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BB9BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	6_2_00BB9BB2

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 0_2_0297DF74	0_2_0297DF74
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 0_2_050C0006	0_2_050C0006
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 0_2_050C0040	0_2_050C0040
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 0_2_050C0A10	0_2_050C0A10
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 0_2_0749C718	0_2_0749C718
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 0_2_0749A7D0	0_2_0749A7D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 0_2_0749C2E0	0_2_0749C2E0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 0_2_074921D7	0_2_074921D7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 0_2_074921E8	0_2_074921E8
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 0_2_0749B040	0_2_0749B040
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 0_2_0749AC08	0_2_0749AC08
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0040102D	3_2_0040102D
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_00401030	3_2_00401030
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_00401208	3_2_00401208
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041DB5F	3_2_0041DB5F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_00402D87	3_2_00402D87
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_00402D90	3_2_00402D90
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_00409E5C	3_2_00409E5C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_00409E60	3_2_00409E60
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041E729	3_2_0041E729
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_00402FB0	3_2_00402FB0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01448158	3_2_01448158
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0148B16B	3_2_0148B16B
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B0100	3_2_013B0100
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F516C	3_2_013F516C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145A118	3_2_0145A118
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014781CC	3_2_014781CC
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CB1B0	3_2_013CB1B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014801AA	3_2_014801AA
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146F0CC	3_2_0146F0CC
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147F0E0	3_2_0147F0E0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014770E9	3_2_014770E9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147A352	3_2_0147A352
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147132D	3_2_0147132D
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AD34C	3_2_013AD34C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014803E6	3_2_014803E6
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CE3F0	3_2_013CE3F0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0140739A	3_2_0140739A
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014402C0	3_2_014402C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C52A0	3_2_013C52A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DD2F0	3_2_013DD2F0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DB2C0	3_2_013DB2C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C0535	3_2_013C0535
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01477571	3_2_01477571
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01480591	3_2_01480591
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145D5B0	3_2_0145D5B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01472446	3_2_01472446
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B1460	3_2_013B1460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147F43F	3_2_0147F43F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146E4F6	3_2_0146E4F6
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C0770	3_2_013C0770
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E4750	3_2_013E4750
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147F7B0	3_2_0147F7B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BC7C0	3_2_013BC7C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014716CC	3_2_014716CC
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DC6E0	3_2_013DC6E0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D6962	3_2_013D6962
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C9950	3_2_013C9950
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DB950	3_2_013DB950
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C29A0	3_2_013C29A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0148A9A6	3_2_0148A9A6
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0142D800	3_2_0142D800
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CA840	3_2_013CA840
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C2840	3_2_013C2840
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A68B8	3_2_013A68B8
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EE8F0	3_2_013EE8F0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C38E0	3_2_013C38E0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147AB40	3_2_0147AB40
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147FB76	3_2_0147FB76
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01476BD7	3_2_01476BD7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01435BF0	3_2_01435BF0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DFB80	3_2_013DFB80
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013FDBF9	3_2_013FDBF9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01477A46	3_2_01477A46
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147FA49	3_2_0147FA49
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01433A6C	3_2_01433A6C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146DAC6	3_2_0146DAC6
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BEA80	3_2_013BEA80
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01405AA0	3_2_01405AA0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145DAAC	3_2_0145DAAC
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01471D5A	3_2_01471D5A
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01477D73	3_2_01477D73
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CAD00	3_2_013CAD00
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C3D40	3_2_013C3D40
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D8DBF	3_2_013D8DBF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BADE0	3_2_013BADE0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DFDC0	3_2_013DFDC0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C0C00	3_2_013C0C00
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01439C32	3_2_01439C32
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147FCF2	3_2_0147FCF2
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B0CF2	3_2_013B0CF2
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460CB5	3_2_01460CB5
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01434F40	3_2_01434F40
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E0F30	3_2_013E0F30
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147FF09	3_2_0147FF09
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01402F28	3_2_01402F28
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1F92	3_2_013C1F92
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143EFA0	3_2_0143EFA0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B2FC8	3_2_013B2FC8
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147FFB1	3_2_0147FFB1
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147EE26	3_2_0147EE26
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C0E59	3_2_013C0E59
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C9EB0	3_2_013C9EB0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147EEDB	3_2_0147EEDB
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D2E90	3_2_013D2E90
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147CE93	3_2_0147CE93
Source: C:\Windows\explorer.exe	Code function: 4_2_0F38FB30	4_2_0F38FB30
Source: C:\Windows\explorer.exe	Code function: 4_2_0F38FB32	4_2_0F38FB32
Source: C:\Windows\explorer.exe	Code function: 4_2_0F395232	4_2_0F395232
Source: C:\Windows\explorer.exe	Code function: 4_2_0F392912	4_2_0F392912
Source: C:\Windows\explorer.exe	Code function: 4_2_0F38CD02	4_2_0F38CD02
Source: C:\Windows\explorer.exe	Code function: 4_2_0F3985CD	4_2_0F3985CD
Source: C:\Windows\explorer.exe	Code function: 4_2_0F394036	4_2_0F394036
Source: C:\Windows\explorer.exe	Code function: 4_2_0F38B082	4_2_0F38B082
Source: C:\Windows\explorer.exe	Code function: 4_2_0F88D232	4_2_0F88D232
Source: C:\Windows\explorer.exe	Code function: 4_2_0F8905CD	4_2_0F8905CD
Source: C:\Windows\explorer.exe	Code function: 4_2_0F884D02	4_2_0F884D02
Source: C:\Windows\explorer.exe	Code function: 4_2_0F88A912	4_2_0F88A912
Source: C:\Windows\explorer.exe	Code function: 4_2_0F887B30	4_2_0F887B30
Source: C:\Windows\explorer.exe	Code function: 4_2_0F887B32	4_2_0F887B32
Source: C:\Windows\explorer.exe	Code function: 4_2_0F883082	4_2_0F883082
Source: C:\Windows\explorer.exe	Code function: 4_2_0F88C036	4_2_0F88C036
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DF2000	6_2_00DF2000
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E181CC	6_2_00E181CC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E141A2	6_2_00E141A2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E201AA	6_2_00E201AA
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DE8158	6_2_00DE8158
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DFA118	6_2_00DFA118
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D50100	6_2_00D50100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DE02C0	6_2_00DE02C0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E00274	6_2_00E00274
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E203E6	6_2_00E203E6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D6E3F0	6_2_00D6E3F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1A352	6_2_00E1A352
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E0E4F6	6_2_00E0E4F6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E12446	6_2_00E12446
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E04420	6_2_00E04420
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E20591	6_2_00E20591
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D60535	6_2_00D60535
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D7C6E0	6_2_00D7C6E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D5C7C0	6_2_00D5C7C0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D84750	6_2_00D84750
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D60770	6_2_00D60770
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D8E8F0	6_2_00D8E8F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D468B8	6_2_00D468B8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D62840	6_2_00D62840
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D6A840	6_2_00D6A840
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E2A9A6	6_2_00E2A9A6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D629A0	6_2_00D629A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D76962	6_2_00D76962
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D5EA80	6_2_00D5EA80
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E16BD7	6_2_00E16BD7
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1AB40	6_2_00E1AB40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D50CF2	6_2_00D50CF2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E00CB5	6_2_00E00CB5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D60C00	6_2_00D60C00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D5ADE0	6_2_00D5ADE0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D78DBF	6_2_00D78DBF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DFCD1F	6_2_00DFCD1F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D6AD00	6_2_00D6AD00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1EEDB	6_2_00E1EEDB
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D72E90	6_2_00D72E90
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1CE93	6_2_00E1CE93
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D60E59	6_2_00D60E59
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1EE26	6_2_00E1EE26
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D52FC8	6_2_00D52FC8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DDEFA0	6_2_00DDEFA0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DD4F40	6_2_00DD4F40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E02F30	6_2_00E02F30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D80F30	6_2_00D80F30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DA2F28	6_2_00DA2F28
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1F0E0	6_2_00E1F0E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E170E9	6_2_00E170E9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D670C0	6_2_00D670C0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E0F0CC	6_2_00E0F0CC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D6B1B0	6_2_00D6B1B0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E2B16B	6_2_00E2B16B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D4F172	6_2_00D4F172
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D9516C	6_2_00D9516C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E012ED	6_2_00E012ED
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D7B2C0	6_2_00D7B2C0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D7D2F0	6_2_00D7D2F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D652A0	6_2_00D652A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DA739A	6_2_00DA739A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D4D34C	6_2_00D4D34C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1132D	6_2_00E1132D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D51460	6_2_00D51460
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1F43F	6_2_00E1F43F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E295C3	6_2_00E295C3
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DFD5B0	6_2_00DFD5B0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E17571	6_2_00E17571
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E116CC	6_2_00E116CC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DA5630	6_2_00DA5630
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1F7B0	6_2_00E1F7B0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D638E0	6_2_00D638E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DCD800	6_2_00DCD800
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D69950	6_2_00D69950
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D7B950	6_2_00D7B950
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DF5910	6_2_00DF5910
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E0DAC6	6_2_00E0DAC6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E01AA3	6_2_00E01AA3
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DFDAAC	6_2_00DFDAAC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DA5AA0	6_2_00DA5AA0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E17A46	6_2_00E17A46
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1FA49	6_2_00E1FA49
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DD3A6C	6_2_00DD3A6C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D9DBF9	6_2_00D9DBF9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DD5BF0	6_2_00DD5BF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D7FB80	6_2_00D7FB80
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1FB76	6_2_00E1FB76
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1FCF2	6_2_00E1FCF2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00DD9C32	6_2_00DD9C32
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D7FDC0	6_2_00D7FDC0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E17D73	6_2_00E17D73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D63D40	6_2_00D63D40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E11D5A	6_2_00E11D5A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D65EC0	6_2_00D65EC0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D69EB0	6_2_00D69EB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D23FD2	6_2_00D23FD2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D23FD5	6_2_00D23FD5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D61F92	6_2_00D61F92
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1FFB1	6_2_00E1FFB1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00E1FF09	6_2_00E1FF09
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_01565EB0	6_2_01565EB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_0041E729	6_2_0041E729
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00402D87	6_2_00402D87
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00402D90	6_2_00402D90
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00409E5C	6_2_00409E5C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00409E60	6_2_00409E60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00402FB0	6_2_00402FB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BBA036	6_2_00BBA036
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BB1082	6_2_00BB1082
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BB8912	6_2_00BB8912
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BBB232	6_2_00BBB232
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BB5B32	6_2_00BB5B32
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BB5B30	6_2_00BB5B30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BBE5CD	6_2_00BBE5CD
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BB2D02	6_2_00BB2D02

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: String function: 01407E54 appears 95 times
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: String function: 013F5130 appears 36 times
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: String function: 0142EA12 appears 86 times
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: String function: 0143F290 appears 103 times
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: String function: 013AB970 appears 254 times
Source: C:\Windows\SysWOW64\netsh.exe	Code function: String function: 00DDF290 appears 103 times
Source: C:\Windows\SysWOW64\netsh.exe	Code function: String function: 00DA7E54 appears 107 times
Source: C:\Windows\SysWOW64\netsh.exe	Code function: String function: 00D95130 appears 58 times
Source: C:\Windows\SysWOW64\netsh.exe	Code function: String function: 00DCEA12 appears 86 times
Source: C:\Windows\SysWOW64\netsh.exe	Code function: String function: 00D4B970 appears 262 times

Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1700497812.0000000000E7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 8tvMmyxveyzFcnJ.exe
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1701635552.0000000003D0E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 8tvMmyxveyzFcnJ.exe
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1704689007.00000000074A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 8tvMmyxveyzFcnJ.exe
Source: 8tvMmyxveyzFcnJ.exe, 00000000.00000002.1701121808.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCAA.dll4 vs 8tvMmyxveyzFcnJ.exe
Source: 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1754981698.0000000000F53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenetsh.exej% vs 8tvMmyxveyzFcnJ.exe
Source: 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1755379848.000000000134C000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamenetsh.exej% vs 8tvMmyxveyzFcnJ.exe
Source: 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1754981698.0000000000F35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenetsh.exej% vs 8tvMmyxveyzFcnJ.exe
Source: 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1755522703.00000000014AD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 8tvMmyxveyzFcnJ.exe
Source: 8tvMmyxveyzFcnJ.exe	Binary or memory string: OriginalFilenameAYIS.exe6 vs 8tvMmyxveyzFcnJ.exe

Source: 8tvMmyxveyzFcnJ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.4157684455.000000000F8A5000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
Source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: 8tvMmyxveyzFcnJ.exe PID: 6740, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: 8tvMmyxveyzFcnJ.exe PID: 7164, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: netsh.exe PID: 396, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: 8tvMmyxveyzFcnJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	Security API names: _0020.SetAccessControl
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	Security API names: _0020.AddAccessRule
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	Security API names: _0020.SetAccessControl
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	Security API names: _0020.AddAccessRule
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, jqNmxmQCLUwegVa6lt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, jqNmxmQCLUwegVa6lt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, jqNmxmQCLUwegVa6lt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	Security API names: _0020.SetAccessControl
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	Security API names: _0020.AddAccessRule

Source: 0.2.8tvMmyxveyzFcnJ.exe.2d8fb98.6.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.8tvMmyxveyzFcnJ.exe.7460000.15.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.8tvMmyxveyzFcnJ.exe.2dac47c.9.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.evad.winEXE@285/1@14/3

Source: C:\Windows\SysWOW64\netsh.exe

Code function: 6_2_01567DFA FormatMessageW,GetLastError,wprintf,GetStdHandle,LocalFree,

6_2_01567DFA

Source: C:\Windows\SysWOW64\netsh.exe

Code function: 6_2_01568D48 CoInitializeEx,CoCreateInstance,SysAllocString,SysAllocString,SysAllocString,SysAllocString,SysAllocString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysAllocString,SysAllocString,VariantChangeType,VariantChangeType,VariantChangeType,VariantChangeType,VariantChangeType,VariantChangeType,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,CoUninitialize,

6_2_01568D48

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8tvMmyxveyzFcnJ.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7156:120:WilError_03

Source: 8tvMmyxveyzFcnJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 8tvMmyxveyzFcnJ.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 8tvMmyxveyzFcnJ.exe	ReversingLabs: Detection: 52%
Source: 8tvMmyxveyzFcnJ.exe	Virustotal: Detection: 49%

Source: unknown	Process created: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process created: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process created: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autofmt.exe "C:\Windows\SysWOW64\autofmt.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\SysWOW64\netsh.exe"
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process created: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process created: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\autofmt.exe "C:\Windows\SysWOW64\autofmt.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\SysWOW64\netsh.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wininet.dll	Jump to behavior

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 8tvMmyxveyzFcnJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 8tvMmyxveyzFcnJ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 8tvMmyxveyzFcnJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: netsh.pdb source: 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1754981698.0000000000F35000.00000004.00000020.00020000.00000000.sdmp, 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1754981698.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1755379848.0000000001330000.00000040.10000000.00040000.00000000.sdmp, netsh.exe, netsh.exe, 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: netsh.pdbGCTL source: 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1754981698.0000000000F35000.00000004.00000020.00020000.00000000.sdmp, 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1754981698.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1755379848.0000000001330000.00000040.10000000.00040000.00000000.sdmp, netsh.exe, 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 00000006.00000003.1756812796.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 00000006.00000003.1754917189.00000000009B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 8tvMmyxveyzFcnJ.exe, 8tvMmyxveyzFcnJ.exe, 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, netsh.exe, 00000006.00000003.1756812796.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 00000006.00000003.1754917189.00000000009B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AYIS.pdb source: 8tvMmyxveyzFcnJ.exe
Source:	Binary string: \|.pDb source: 8tvMmyxveyzFcnJ.exe
Source:	Binary string: AYIS.pdbSHA256M source: 8tvMmyxveyzFcnJ.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	.Net Code: wxZ6pF2jRt System.Reflection.Assembly.Load(byte[])
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	.Net Code: wxZ6pF2jRt System.Reflection.Assembly.Load(byte[])
Source: 0.2.8tvMmyxveyzFcnJ.exe.2b55708.2.raw.unpack, PingPong.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	.Net Code: wxZ6pF2jRt System.Reflection.Assembly.Load(byte[])
Source: 0.2.8tvMmyxveyzFcnJ.exe.5610000.13.raw.unpack, PingPong.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: 8tvMmyxveyzFcnJ.exe

Static PE information: 0xE84465C2 [Thu Jun 25 19:30:10 2093 UTC]

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 0_2_074811BD push FFFFFF8Bh; iretd	0_2_074811BF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041D4B5 push eax; ret	3_2_0041D508
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041D56C push eax; ret	3_2_0041D572
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041D502 push eax; ret	3_2_0041D508
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0041D50B push eax; ret	3_2_0041D572
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B09AD push ecx; mov dword ptr [esp], ecx	3_2_013B09B6
Source: C:\Windows\explorer.exe	Code function: 4_2_0F398B1E push esp; retn 0000h	4_2_0F398B1F
Source: C:\Windows\explorer.exe	Code function: 4_2_0F398B02 push esp; retn 0000h	4_2_0F398B03
Source: C:\Windows\explorer.exe	Code function: 4_2_0F3989B5 push esp; retn 0000h	4_2_0F398AE7
Source: C:\Windows\explorer.exe	Code function: 4_2_0F8909B5 push esp; retn 0000h	4_2_0F890AE7
Source: C:\Windows\explorer.exe	Code function: 4_2_0F890B02 push esp; retn 0000h	4_2_0F890B03
Source: C:\Windows\explorer.exe	Code function: 4_2_0F890B1E push esp; retn 0000h	4_2_0F890B1F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D2225F pushad ; ret	6_2_00D227F9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D227FA pushad ; ret	6_2_00D227F9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D2283D push eax; iretd	6_2_00D22858
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D509AD push ecx; mov dword ptr [esp], ecx	6_2_00D509B6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D2135E push eax; iretd	6_2_00D21369
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00D29939 push es; iretd	6_2_00D29940
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_01569C4D push ecx; ret	6_2_01569C60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_0041D4B5 push eax; ret	6_2_0041D508
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_0041D56C push eax; ret	6_2_0041D572
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_0041D502 push eax; ret	6_2_0041D508
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_0041D50B push eax; ret	6_2_0041D572
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BBE9B5 push esp; retn 0000h	6_2_00BBEAE7
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BBEB1E push esp; retn 0000h	6_2_00BBEB1F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_00BBEB02 push esp; retn 0000h	6_2_00BBEB03

Source: 8tvMmyxveyzFcnJ.exe

Static PE information: section name: .text entropy: 7.982529796574812

Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, onEMYZPssEM9ipODqah.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'E89cPH9Hju', 'RQNcvKmLcJ', 'D00cliKtTj', 'WopcONCktE', 'tPicZZOl22', 'Y4LcIb4kpx', 'NEbcRp16VR'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, Nm8B0UVPYgNp4iEWC3.cs	High entropy of concatenated method names: 'fGYU8D0fT7', 'AHUUHf093S', 'g7uANNlqFW', 'C3wAKjloRG', 'T8ZUYog6Xw', 'eqCUgDrmSx', 'afrU2xIKer', 'eowUPwroHc', 'E4uUvZ9ZZk', 'yBlUlFsUaC'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, URuq7t1pp4AeVpLfjp.cs	High entropy of concatenated method names: 'uGXpvJHi9', 'AV4k76gcZ', 'MFlj9DetZ', 'GU7boBVGN', 'IpD75u7KT', 'WWLLCPZ7E', 'J7eT3UCtnbv7OM7ixk', 'SdbOpjF0pIFxlMa9Hl', 'YIlABuoG3', 'hqKcZC9uF'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	High entropy of concatenated method names: 'Lelw9Iu72t', 'cC9wCl81lD', 'E5bwMe9gyt', 'WPCwWDnpFc', 'f1wwt9hyXZ', 'N2swGhPFAN', 'kGdwm4EI3q', 'g76whZi0J5', 'VupwDOGJ0J', 'iyBwSLhvJb'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, B9GVVKPIXwO0PmUQSxH.cs	High entropy of concatenated method names: 'bSLd1ZpQ1f', 'G0adqwWTRP', 'NxSdpvZAQy', 'YgFdkBew3Y', 'wJEdT3CZGL', 'lMAdjTBY57', 'BaFdbhWhO4', 'IBYdoOcBeG', 'K7rd7DTgTs', 'yGidLCUfcw'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, HGhi0FUsOXLFOeMsQC.cs	High entropy of concatenated method names: 'lTntT97akN', 'kj8tbOW9lW', 'kW0Wux1Gdy', 'pM9W0Sl4nl', 'XSXWxU4JDB', 'xfuWBnMrKh', 'DG6WrTxi0G', 'uhnWnvuSLE', 'Vg6W5VNHJS', 's7cW3s7T8c'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, r7j8ZUoBba3UAsBfuS.cs	High entropy of concatenated method names: 'kHudKkrqQe', 'jPmdwj2DWA', 'Aepd6Vfvyr', 'feydCllhAv', 'LR5dMFPFFZ', 'r7CdtK3TLx', 'G0qdGyvqQS', 'bdUAR946j7', 'SwyA85R2O9', 'FQKAF3rvXB'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, xI3VeQzRCXx8dlXd6g.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zamdVy242s', 'IFwdJv9MJR', 'cfadfy4pCC', 'mPAdUNsJkS', 'hvCdARttF9', 'S5IddHgTvE', 'mRZdctfCPY'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, I5ZtjtJ1PnhkfciJih.cs	High entropy of concatenated method names: 'rLDKmMmsoX', 'RmQKhEpjMR', 'SPDKSsM4u2', 'vvgKa0RIUm', 'znjKJOUnqB', 'IbMKfsKkXH', 'VPAB09uyEsTX31gJy3', 'aqU3o73n8sN2Qa1IZI', 'TxgKK7XerO', 'hKqKwL8eYF'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, LYSI6xYvfggcO86VAO.cs	High entropy of concatenated method names: 'PErVoLcPIb', 'keMV7D6tJT', 'hWuVyQeQkf', 'IX5Ve8ipBA', 'FFYV07HmrL', 'NOgVxi8YV7', 'kyOVrgpUJD', 'h7TVnMextZ', 'ejDV3qYfRx', 'eU1VYt6HQm'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, Cg6qJ4qwJswk0QmDWw.cs	High entropy of concatenated method names: 'UqrAC310Nv', 'DWKAMK5sE2', 'A6BAWLA7Fa', 'o0KAtOho3L', 'K5QAGrllOV', 'ti4AmOeTFY', 'BsQAhvw8SP', 'bHvADUSK1U', 'zuSASm2RtN', 'nXEAaF9t7q'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, A2eePvWE5tr18r7jM1.cs	High entropy of concatenated method names: 'lgnm1sauva', 'nO3mqGRVV7', 'm5emp9hu6a', 'z2emkki1MC', 'qa8mT6aA0C', 'KRkmjU5b3p', 'zegmbp7ok4', 'ekPmo9lOdl', 'hPQm7B7wZt', 'gJ8mLLXXFr'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, IIgmn1SW54HltgqZDT.cs	High entropy of concatenated method names: 'DhcWkIQfOm', 'U8nWjOgM4j', 'wALWoWlCmQ', 'JhPW72Y2r5', 'xfCWJLHJmk', 'uTKWfPdR3a', 'bXOWU2ELJJ', 'LuhWArDIOZ', 'HxuWdYoaso', 'MvYWcd5XZO'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, O6odxcCQeE0weh2llR.cs	High entropy of concatenated method names: 'VwZmC8yrey', 'NCEmWqLEwo', 'fLmmG33gRW', 'wExGHmuXmI', 'Xf1Gzix6ib', 'GHQmNTW09r', 'JYamKaVvn4', 'Hlsm4NTJ23', 'tSTmwJZdK1', 'fmxm62nEBr'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, jqNmxmQCLUwegVa6lt.cs	High entropy of concatenated method names: 'nfGMPKIphn', 'FYNMvd8YcH', 'vOpMl6MfG0', 'ffvMOYLghP', 'r1JMZDO82U', 'pJyMIvxOy5', 'eCsMRSLjif', 'xt6M8W1s96', 'E2SMFAm0ej', 'zogMHc0HoO'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, TrAdDgxbkPWXYdDAZX.cs	High entropy of concatenated method names: 'EqEG9kk4LW', 'su4GMBoaor', 'eUyGtxNArj', 'rQMGmd5qZw', 'LCfGhivMp5', 'nUUtZ5QHpC', 'jbetIYyyBd', 'j9StRTe9B6', 'HEqt8tD7Pq', 'GHTtFRLlAf'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, nsP6jHEVKbm0qMSRnq.cs	High entropy of concatenated method names: 'ToString', 'VcNfYRC8xs', 'KmKfeLqcSc', 'lHAfuBB0rM', 'O9bf0uIWcj', 'dsjfxcrIh1', 'KjqfBFPrQG', 'xwUfrh2CeX', 'ug7fn9HGyf', 'Xgsf5ouLMj'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, M8wl9t3SXMjI2strfx.cs	High entropy of concatenated method names: 'qiCUSnQcMp', 'Q54UainyaL', 'ToString', 'PWtUC20CJu', 'IKIUMkXtQE', 'Mg1UW3gJx4', 'laBUtgg5qy', 'MdJUG6Jqjy', 'Ot7UmNERfQ', 's8PUhhSYGE'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, oo1wXhGh2OZsvE9xUc.cs	High entropy of concatenated method names: 'VexJ3DLS2T', 'naLJgSWTHn', 'xEaJPXrhZ6', 'i9IJvY7m8Q', 'DNGJeLk3cn', 'PsRJuOE25o', 'MLyJ0OqBrh', 'BKbJxs6LtG', 'BchJB2WLxj', 'TZ8Jr71te6'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3ee0350.12.raw.unpack, TPBvMOHpYMDE4rXdmn.cs	High entropy of concatenated method names: 'Dispose', 'bU1KF2bPlQ', 'CYB4eSx32M', 'I1ysstjJah', 'yGIKH00bMB', 'FKkKzEcdjd', 'ProcessDialogKey', 'B0i4Nah8lp', 'Q8I4KEStLf', 'qDN44hvc1s'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, onEMYZPssEM9ipODqah.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'E89cPH9Hju', 'RQNcvKmLcJ', 'D00cliKtTj', 'WopcONCktE', 'tPicZZOl22', 'Y4LcIb4kpx', 'NEbcRp16VR'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, Nm8B0UVPYgNp4iEWC3.cs	High entropy of concatenated method names: 'fGYU8D0fT7', 'AHUUHf093S', 'g7uANNlqFW', 'C3wAKjloRG', 'T8ZUYog6Xw', 'eqCUgDrmSx', 'afrU2xIKer', 'eowUPwroHc', 'E4uUvZ9ZZk', 'yBlUlFsUaC'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, URuq7t1pp4AeVpLfjp.cs	High entropy of concatenated method names: 'uGXpvJHi9', 'AV4k76gcZ', 'MFlj9DetZ', 'GU7boBVGN', 'IpD75u7KT', 'WWLLCPZ7E', 'J7eT3UCtnbv7OM7ixk', 'SdbOpjF0pIFxlMa9Hl', 'YIlABuoG3', 'hqKcZC9uF'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	High entropy of concatenated method names: 'Lelw9Iu72t', 'cC9wCl81lD', 'E5bwMe9gyt', 'WPCwWDnpFc', 'f1wwt9hyXZ', 'N2swGhPFAN', 'kGdwm4EI3q', 'g76whZi0J5', 'VupwDOGJ0J', 'iyBwSLhvJb'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, B9GVVKPIXwO0PmUQSxH.cs	High entropy of concatenated method names: 'bSLd1ZpQ1f', 'G0adqwWTRP', 'NxSdpvZAQy', 'YgFdkBew3Y', 'wJEdT3CZGL', 'lMAdjTBY57', 'BaFdbhWhO4', 'IBYdoOcBeG', 'K7rd7DTgTs', 'yGidLCUfcw'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, HGhi0FUsOXLFOeMsQC.cs	High entropy of concatenated method names: 'lTntT97akN', 'kj8tbOW9lW', 'kW0Wux1Gdy', 'pM9W0Sl4nl', 'XSXWxU4JDB', 'xfuWBnMrKh', 'DG6WrTxi0G', 'uhnWnvuSLE', 'Vg6W5VNHJS', 's7cW3s7T8c'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, r7j8ZUoBba3UAsBfuS.cs	High entropy of concatenated method names: 'kHudKkrqQe', 'jPmdwj2DWA', 'Aepd6Vfvyr', 'feydCllhAv', 'LR5dMFPFFZ', 'r7CdtK3TLx', 'G0qdGyvqQS', 'bdUAR946j7', 'SwyA85R2O9', 'FQKAF3rvXB'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, xI3VeQzRCXx8dlXd6g.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zamdVy242s', 'IFwdJv9MJR', 'cfadfy4pCC', 'mPAdUNsJkS', 'hvCdARttF9', 'S5IddHgTvE', 'mRZdctfCPY'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, I5ZtjtJ1PnhkfciJih.cs	High entropy of concatenated method names: 'rLDKmMmsoX', 'RmQKhEpjMR', 'SPDKSsM4u2', 'vvgKa0RIUm', 'znjKJOUnqB', 'IbMKfsKkXH', 'VPAB09uyEsTX31gJy3', 'aqU3o73n8sN2Qa1IZI', 'TxgKK7XerO', 'hKqKwL8eYF'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, LYSI6xYvfggcO86VAO.cs	High entropy of concatenated method names: 'PErVoLcPIb', 'keMV7D6tJT', 'hWuVyQeQkf', 'IX5Ve8ipBA', 'FFYV07HmrL', 'NOgVxi8YV7', 'kyOVrgpUJD', 'h7TVnMextZ', 'ejDV3qYfRx', 'eU1VYt6HQm'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, Cg6qJ4qwJswk0QmDWw.cs	High entropy of concatenated method names: 'UqrAC310Nv', 'DWKAMK5sE2', 'A6BAWLA7Fa', 'o0KAtOho3L', 'K5QAGrllOV', 'ti4AmOeTFY', 'BsQAhvw8SP', 'bHvADUSK1U', 'zuSASm2RtN', 'nXEAaF9t7q'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, A2eePvWE5tr18r7jM1.cs	High entropy of concatenated method names: 'lgnm1sauva', 'nO3mqGRVV7', 'm5emp9hu6a', 'z2emkki1MC', 'qa8mT6aA0C', 'KRkmjU5b3p', 'zegmbp7ok4', 'ekPmo9lOdl', 'hPQm7B7wZt', 'gJ8mLLXXFr'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, IIgmn1SW54HltgqZDT.cs	High entropy of concatenated method names: 'DhcWkIQfOm', 'U8nWjOgM4j', 'wALWoWlCmQ', 'JhPW72Y2r5', 'xfCWJLHJmk', 'uTKWfPdR3a', 'bXOWU2ELJJ', 'LuhWArDIOZ', 'HxuWdYoaso', 'MvYWcd5XZO'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, O6odxcCQeE0weh2llR.cs	High entropy of concatenated method names: 'VwZmC8yrey', 'NCEmWqLEwo', 'fLmmG33gRW', 'wExGHmuXmI', 'Xf1Gzix6ib', 'GHQmNTW09r', 'JYamKaVvn4', 'Hlsm4NTJ23', 'tSTmwJZdK1', 'fmxm62nEBr'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, jqNmxmQCLUwegVa6lt.cs	High entropy of concatenated method names: 'nfGMPKIphn', 'FYNMvd8YcH', 'vOpMl6MfG0', 'ffvMOYLghP', 'r1JMZDO82U', 'pJyMIvxOy5', 'eCsMRSLjif', 'xt6M8W1s96', 'E2SMFAm0ej', 'zogMHc0HoO'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, TrAdDgxbkPWXYdDAZX.cs	High entropy of concatenated method names: 'EqEG9kk4LW', 'su4GMBoaor', 'eUyGtxNArj', 'rQMGmd5qZw', 'LCfGhivMp5', 'nUUtZ5QHpC', 'jbetIYyyBd', 'j9StRTe9B6', 'HEqt8tD7Pq', 'GHTtFRLlAf'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, nsP6jHEVKbm0qMSRnq.cs	High entropy of concatenated method names: 'ToString', 'VcNfYRC8xs', 'KmKfeLqcSc', 'lHAfuBB0rM', 'O9bf0uIWcj', 'dsjfxcrIh1', 'KjqfBFPrQG', 'xwUfrh2CeX', 'ug7fn9HGyf', 'Xgsf5ouLMj'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, M8wl9t3SXMjI2strfx.cs	High entropy of concatenated method names: 'qiCUSnQcMp', 'Q54UainyaL', 'ToString', 'PWtUC20CJu', 'IKIUMkXtQE', 'Mg1UW3gJx4', 'laBUtgg5qy', 'MdJUG6Jqjy', 'Ot7UmNERfQ', 's8PUhhSYGE'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, oo1wXhGh2OZsvE9xUc.cs	High entropy of concatenated method names: 'VexJ3DLS2T', 'naLJgSWTHn', 'xEaJPXrhZ6', 'i9IJvY7m8Q', 'DNGJeLk3cn', 'PsRJuOE25o', 'MLyJ0OqBrh', 'BKbJxs6LtG', 'BchJB2WLxj', 'TZ8Jr71te6'
Source: 0.2.8tvMmyxveyzFcnJ.exe.3e70530.11.raw.unpack, TPBvMOHpYMDE4rXdmn.cs	High entropy of concatenated method names: 'Dispose', 'bU1KF2bPlQ', 'CYB4eSx32M', 'I1ysstjJah', 'yGIKH00bMB', 'FKkKzEcdjd', 'ProcessDialogKey', 'B0i4Nah8lp', 'Q8I4KEStLf', 'qDN44hvc1s'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, onEMYZPssEM9ipODqah.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'E89cPH9Hju', 'RQNcvKmLcJ', 'D00cliKtTj', 'WopcONCktE', 'tPicZZOl22', 'Y4LcIb4kpx', 'NEbcRp16VR'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, Nm8B0UVPYgNp4iEWC3.cs	High entropy of concatenated method names: 'fGYU8D0fT7', 'AHUUHf093S', 'g7uANNlqFW', 'C3wAKjloRG', 'T8ZUYog6Xw', 'eqCUgDrmSx', 'afrU2xIKer', 'eowUPwroHc', 'E4uUvZ9ZZk', 'yBlUlFsUaC'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, URuq7t1pp4AeVpLfjp.cs	High entropy of concatenated method names: 'uGXpvJHi9', 'AV4k76gcZ', 'MFlj9DetZ', 'GU7boBVGN', 'IpD75u7KT', 'WWLLCPZ7E', 'J7eT3UCtnbv7OM7ixk', 'SdbOpjF0pIFxlMa9Hl', 'YIlABuoG3', 'hqKcZC9uF'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, HMGOMwjOIIDnmkZuPO.cs	High entropy of concatenated method names: 'Lelw9Iu72t', 'cC9wCl81lD', 'E5bwMe9gyt', 'WPCwWDnpFc', 'f1wwt9hyXZ', 'N2swGhPFAN', 'kGdwm4EI3q', 'g76whZi0J5', 'VupwDOGJ0J', 'iyBwSLhvJb'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, B9GVVKPIXwO0PmUQSxH.cs	High entropy of concatenated method names: 'bSLd1ZpQ1f', 'G0adqwWTRP', 'NxSdpvZAQy', 'YgFdkBew3Y', 'wJEdT3CZGL', 'lMAdjTBY57', 'BaFdbhWhO4', 'IBYdoOcBeG', 'K7rd7DTgTs', 'yGidLCUfcw'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, HGhi0FUsOXLFOeMsQC.cs	High entropy of concatenated method names: 'lTntT97akN', 'kj8tbOW9lW', 'kW0Wux1Gdy', 'pM9W0Sl4nl', 'XSXWxU4JDB', 'xfuWBnMrKh', 'DG6WrTxi0G', 'uhnWnvuSLE', 'Vg6W5VNHJS', 's7cW3s7T8c'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, r7j8ZUoBba3UAsBfuS.cs	High entropy of concatenated method names: 'kHudKkrqQe', 'jPmdwj2DWA', 'Aepd6Vfvyr', 'feydCllhAv', 'LR5dMFPFFZ', 'r7CdtK3TLx', 'G0qdGyvqQS', 'bdUAR946j7', 'SwyA85R2O9', 'FQKAF3rvXB'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, xI3VeQzRCXx8dlXd6g.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zamdVy242s', 'IFwdJv9MJR', 'cfadfy4pCC', 'mPAdUNsJkS', 'hvCdARttF9', 'S5IddHgTvE', 'mRZdctfCPY'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, I5ZtjtJ1PnhkfciJih.cs	High entropy of concatenated method names: 'rLDKmMmsoX', 'RmQKhEpjMR', 'SPDKSsM4u2', 'vvgKa0RIUm', 'znjKJOUnqB', 'IbMKfsKkXH', 'VPAB09uyEsTX31gJy3', 'aqU3o73n8sN2Qa1IZI', 'TxgKK7XerO', 'hKqKwL8eYF'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, LYSI6xYvfggcO86VAO.cs	High entropy of concatenated method names: 'PErVoLcPIb', 'keMV7D6tJT', 'hWuVyQeQkf', 'IX5Ve8ipBA', 'FFYV07HmrL', 'NOgVxi8YV7', 'kyOVrgpUJD', 'h7TVnMextZ', 'ejDV3qYfRx', 'eU1VYt6HQm'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, Cg6qJ4qwJswk0QmDWw.cs	High entropy of concatenated method names: 'UqrAC310Nv', 'DWKAMK5sE2', 'A6BAWLA7Fa', 'o0KAtOho3L', 'K5QAGrllOV', 'ti4AmOeTFY', 'BsQAhvw8SP', 'bHvADUSK1U', 'zuSASm2RtN', 'nXEAaF9t7q'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, A2eePvWE5tr18r7jM1.cs	High entropy of concatenated method names: 'lgnm1sauva', 'nO3mqGRVV7', 'm5emp9hu6a', 'z2emkki1MC', 'qa8mT6aA0C', 'KRkmjU5b3p', 'zegmbp7ok4', 'ekPmo9lOdl', 'hPQm7B7wZt', 'gJ8mLLXXFr'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, IIgmn1SW54HltgqZDT.cs	High entropy of concatenated method names: 'DhcWkIQfOm', 'U8nWjOgM4j', 'wALWoWlCmQ', 'JhPW72Y2r5', 'xfCWJLHJmk', 'uTKWfPdR3a', 'bXOWU2ELJJ', 'LuhWArDIOZ', 'HxuWdYoaso', 'MvYWcd5XZO'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, O6odxcCQeE0weh2llR.cs	High entropy of concatenated method names: 'VwZmC8yrey', 'NCEmWqLEwo', 'fLmmG33gRW', 'wExGHmuXmI', 'Xf1Gzix6ib', 'GHQmNTW09r', 'JYamKaVvn4', 'Hlsm4NTJ23', 'tSTmwJZdK1', 'fmxm62nEBr'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, jqNmxmQCLUwegVa6lt.cs	High entropy of concatenated method names: 'nfGMPKIphn', 'FYNMvd8YcH', 'vOpMl6MfG0', 'ffvMOYLghP', 'r1JMZDO82U', 'pJyMIvxOy5', 'eCsMRSLjif', 'xt6M8W1s96', 'E2SMFAm0ej', 'zogMHc0HoO'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, TrAdDgxbkPWXYdDAZX.cs	High entropy of concatenated method names: 'EqEG9kk4LW', 'su4GMBoaor', 'eUyGtxNArj', 'rQMGmd5qZw', 'LCfGhivMp5', 'nUUtZ5QHpC', 'jbetIYyyBd', 'j9StRTe9B6', 'HEqt8tD7Pq', 'GHTtFRLlAf'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, nsP6jHEVKbm0qMSRnq.cs	High entropy of concatenated method names: 'ToString', 'VcNfYRC8xs', 'KmKfeLqcSc', 'lHAfuBB0rM', 'O9bf0uIWcj', 'dsjfxcrIh1', 'KjqfBFPrQG', 'xwUfrh2CeX', 'ug7fn9HGyf', 'Xgsf5ouLMj'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, M8wl9t3SXMjI2strfx.cs	High entropy of concatenated method names: 'qiCUSnQcMp', 'Q54UainyaL', 'ToString', 'PWtUC20CJu', 'IKIUMkXtQE', 'Mg1UW3gJx4', 'laBUtgg5qy', 'MdJUG6Jqjy', 'Ot7UmNERfQ', 's8PUhhSYGE'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, oo1wXhGh2OZsvE9xUc.cs	High entropy of concatenated method names: 'VexJ3DLS2T', 'naLJgSWTHn', 'xEaJPXrhZ6', 'i9IJvY7m8Q', 'DNGJeLk3cn', 'PsRJuOE25o', 'MLyJ0OqBrh', 'BKbJxs6LtG', 'BchJB2WLxj', 'TZ8Jr71te6'
Source: 0.2.8tvMmyxveyzFcnJ.exe.74a0000.16.raw.unpack, TPBvMOHpYMDE4rXdmn.cs	High entropy of concatenated method names: 'Dispose', 'bU1KF2bPlQ', 'CYB4eSx32M', 'I1ysstjJah', 'yGIKH00bMB', 'FKkKzEcdjd', 'ProcessDialogKey', 'B0i4Nah8lp', 'Q8I4KEStLf', 'qDN44hvc1s'

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 8tvMmyxveyzFcnJ.exe PID: 6740, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	API/Special instruction interceptor: Address: 7FFE22210774
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	API/Special instruction interceptor: Address: 7FFE2220D8A4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	API/Special instruction interceptor: Address: 7FFE2220DA44
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\netsh.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\netsh.exe	API/Special instruction interceptor: Address: 7FFE22210774
Source: C:\Windows\SysWOW64\netsh.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\netsh.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\netsh.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\netsh.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\netsh.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\netsh.exe	API/Special instruction interceptor: Address: 7FFE2220D8A4
Source: C:\Windows\SysWOW64\netsh.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	RDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	RDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\netsh.exe	RDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\netsh.exe	RDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Memory allocated: 2970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Memory allocated: 2B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Memory allocated: 4B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Memory allocated: 7860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Memory allocated: 8860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Memory allocated: 8A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Memory allocated: 9A10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Code function: 3_2_00409AB0 rdtsc

3_2_00409AB0

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 8472	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1473	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 886	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 860	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Window / User API: threadDelayed 9843	Jump to behavior

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_4-13832

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	API coverage: 1.8 %
Source: C:\Windows\SysWOW64\netsh.exe	API coverage: 1.4 %

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe TID: 6820	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5064	Thread sleep count: 8472 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5064	Thread sleep time: -16944000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5064	Thread sleep count: 1473 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5064	Thread sleep time: -2946000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe TID: 7100	Thread sleep count: 128 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe TID: 7100	Thread sleep time: -256000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe TID: 7100	Thread sleep count: 9843 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe TID: 7100	Thread sleep time: -19686000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\netsh.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\netsh.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: explorer.exe, 00000004.00000000.1706307837.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000004.00000000.1703761960.00000000078A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000004.00000002.4146493757.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000004.00000000.1706307837.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000004.00000002.4141036678.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000004.00000003.3108324353.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000004.00000002.4143507586.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000004.00000002.4146493757.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: explorer.exe, 00000004.00000002.4146493757.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3114554074.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3114554074.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4146493757.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000004.00000003.3108324353.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000004.00000002.4143507586.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000004.00000000.1705502686.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000004.00000002.4141036678.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000004.00000002.4141036678.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Code function: 3_2_00409AB0 rdtsc

3_2_00409AB0

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Code function: 3_2_0040ACF0 LdrLoadDll,

3_2_0040ACF0

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01444144 mov eax, dword ptr fs:[00000030h]	3_2_01444144
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01444144 mov eax, dword ptr fs:[00000030h]	3_2_01444144
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01444144 mov ecx, dword ptr fs:[00000030h]	3_2_01444144
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01444144 mov eax, dword ptr fs:[00000030h]	3_2_01444144
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01444144 mov eax, dword ptr fs:[00000030h]	3_2_01444144
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01443140 mov eax, dword ptr fs:[00000030h]	3_2_01443140
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01443140 mov eax, dword ptr fs:[00000030h]	3_2_01443140
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01443140 mov eax, dword ptr fs:[00000030h]	3_2_01443140
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B1131 mov eax, dword ptr fs:[00000030h]	3_2_013B1131
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B1131 mov eax, dword ptr fs:[00000030h]	3_2_013B1131
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AB136 mov eax, dword ptr fs:[00000030h]	3_2_013AB136
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AB136 mov eax, dword ptr fs:[00000030h]	3_2_013AB136
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AB136 mov eax, dword ptr fs:[00000030h]	3_2_013AB136
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AB136 mov eax, dword ptr fs:[00000030h]	3_2_013AB136
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01485152 mov eax, dword ptr fs:[00000030h]	3_2_01485152
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E0124 mov eax, dword ptr fs:[00000030h]	3_2_013E0124
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01448158 mov eax, dword ptr fs:[00000030h]	3_2_01448158
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01449179 mov eax, dword ptr fs:[00000030h]	3_2_01449179
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AF172 mov eax, dword ptr fs:[00000030h]	3_2_013AF172
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01470115 mov eax, dword ptr fs:[00000030h]	3_2_01470115
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145A118 mov ecx, dword ptr fs:[00000030h]	3_2_0145A118
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145A118 mov eax, dword ptr fs:[00000030h]	3_2_0145A118
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145A118 mov eax, dword ptr fs:[00000030h]	3_2_0145A118
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145A118 mov eax, dword ptr fs:[00000030h]	3_2_0145A118
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B7152 mov eax, dword ptr fs:[00000030h]	3_2_013B7152
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AC156 mov eax, dword ptr fs:[00000030h]	3_2_013AC156
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B6154 mov eax, dword ptr fs:[00000030h]	3_2_013B6154
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B6154 mov eax, dword ptr fs:[00000030h]	3_2_013B6154
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A9148 mov eax, dword ptr fs:[00000030h]	3_2_013A9148
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A9148 mov eax, dword ptr fs:[00000030h]	3_2_013A9148
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A9148 mov eax, dword ptr fs:[00000030h]	3_2_013A9148
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A9148 mov eax, dword ptr fs:[00000030h]	3_2_013A9148
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014851CB mov eax, dword ptr fs:[00000030h]	3_2_014851CB
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014761C3 mov eax, dword ptr fs:[00000030h]	3_2_014761C3
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014761C3 mov eax, dword ptr fs:[00000030h]	3_2_014761C3
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CB1B0 mov eax, dword ptr fs:[00000030h]	3_2_013CB1B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0142E1D0 mov eax, dword ptr fs:[00000030h]	3_2_0142E1D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0142E1D0 mov eax, dword ptr fs:[00000030h]	3_2_0142E1D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0142E1D0 mov ecx, dword ptr fs:[00000030h]	3_2_0142E1D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0142E1D0 mov eax, dword ptr fs:[00000030h]	3_2_0142E1D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0142E1D0 mov eax, dword ptr fs:[00000030h]	3_2_0142E1D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AA197 mov eax, dword ptr fs:[00000030h]	3_2_013AA197
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AA197 mov eax, dword ptr fs:[00000030h]	3_2_013AA197
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AA197 mov eax, dword ptr fs:[00000030h]	3_2_013AA197
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014861E5 mov eax, dword ptr fs:[00000030h]	3_2_014861E5
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F0185 mov eax, dword ptr fs:[00000030h]	3_2_013F0185
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014571F9 mov esi, dword ptr fs:[00000030h]	3_2_014571F9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E01F8 mov eax, dword ptr fs:[00000030h]	3_2_013E01F8
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146C188 mov eax, dword ptr fs:[00000030h]	3_2_0146C188
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146C188 mov eax, dword ptr fs:[00000030h]	3_2_0146C188
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01407190 mov eax, dword ptr fs:[00000030h]	3_2_01407190
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D51EF mov eax, dword ptr fs:[00000030h]	3_2_013D51EF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B51ED mov eax, dword ptr fs:[00000030h]	3_2_013B51ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143019F mov eax, dword ptr fs:[00000030h]	3_2_0143019F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143019F mov eax, dword ptr fs:[00000030h]	3_2_0143019F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143019F mov eax, dword ptr fs:[00000030h]	3_2_0143019F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143019F mov eax, dword ptr fs:[00000030h]	3_2_0143019F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014611A4 mov eax, dword ptr fs:[00000030h]	3_2_014611A4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014611A4 mov eax, dword ptr fs:[00000030h]	3_2_014611A4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014611A4 mov eax, dword ptr fs:[00000030h]	3_2_014611A4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014611A4 mov eax, dword ptr fs:[00000030h]	3_2_014611A4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013ED1D0 mov eax, dword ptr fs:[00000030h]	3_2_013ED1D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013ED1D0 mov ecx, dword ptr fs:[00000030h]	3_2_013ED1D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01436050 mov eax, dword ptr fs:[00000030h]	3_2_01436050
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AA020 mov eax, dword ptr fs:[00000030h]	3_2_013AA020
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AC020 mov eax, dword ptr fs:[00000030h]	3_2_013AC020
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145705E mov ebx, dword ptr fs:[00000030h]	3_2_0145705E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145705E mov eax, dword ptr fs:[00000030h]	3_2_0145705E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01485060 mov eax, dword ptr fs:[00000030h]	3_2_01485060
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CE016 mov eax, dword ptr fs:[00000030h]	3_2_013CE016
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CE016 mov eax, dword ptr fs:[00000030h]	3_2_013CE016
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CE016 mov eax, dword ptr fs:[00000030h]	3_2_013CE016
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CE016 mov eax, dword ptr fs:[00000030h]	3_2_013CE016
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143106E mov eax, dword ptr fs:[00000030h]	3_2_0143106E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0142D070 mov ecx, dword ptr fs:[00000030h]	3_2_0142D070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01434000 mov ecx, dword ptr fs:[00000030h]	3_2_01434000
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov eax, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov ecx, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov eax, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov eax, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov eax, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov eax, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov eax, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov eax, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov eax, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov eax, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov eax, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov eax, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C1070 mov eax, dword ptr fs:[00000030h]	3_2_013C1070
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DC073 mov eax, dword ptr fs:[00000030h]	3_2_013DC073
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B2050 mov eax, dword ptr fs:[00000030h]	3_2_013B2050
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DB052 mov eax, dword ptr fs:[00000030h]	3_2_013DB052
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01446030 mov eax, dword ptr fs:[00000030h]	3_2_01446030
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147903E mov eax, dword ptr fs:[00000030h]	3_2_0147903E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147903E mov eax, dword ptr fs:[00000030h]	3_2_0147903E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147903E mov eax, dword ptr fs:[00000030h]	3_2_0147903E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147903E mov eax, dword ptr fs:[00000030h]	3_2_0147903E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0142D0C0 mov eax, dword ptr fs:[00000030h]	3_2_0142D0C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0142D0C0 mov eax, dword ptr fs:[00000030h]	3_2_0142D0C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014850D9 mov eax, dword ptr fs:[00000030h]	3_2_014850D9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014320DE mov eax, dword ptr fs:[00000030h]	3_2_014320DE
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E909C mov eax, dword ptr fs:[00000030h]	3_2_013E909C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014360E0 mov eax, dword ptr fs:[00000030h]	3_2_014360E0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B5096 mov eax, dword ptr fs:[00000030h]	3_2_013B5096
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DD090 mov eax, dword ptr fs:[00000030h]	3_2_013DD090
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DD090 mov eax, dword ptr fs:[00000030h]	3_2_013DD090
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B208A mov eax, dword ptr fs:[00000030h]	3_2_013B208A
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AD08D mov eax, dword ptr fs:[00000030h]	3_2_013AD08D
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143D080 mov eax, dword ptr fs:[00000030h]	3_2_0143D080
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143D080 mov eax, dword ptr fs:[00000030h]	3_2_0143D080
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AC0F0 mov eax, dword ptr fs:[00000030h]	3_2_013AC0F0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F20F0 mov ecx, dword ptr fs:[00000030h]	3_2_013F20F0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B80E9 mov eax, dword ptr fs:[00000030h]	3_2_013B80E9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D50E4 mov eax, dword ptr fs:[00000030h]	3_2_013D50E4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D50E4 mov ecx, dword ptr fs:[00000030h]	3_2_013D50E4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AA0E3 mov ecx, dword ptr fs:[00000030h]	3_2_013AA0E3
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D90DB mov eax, dword ptr fs:[00000030h]	3_2_013D90DB
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014480A8 mov eax, dword ptr fs:[00000030h]	3_2_014480A8
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov ecx, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov ecx, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov ecx, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov ecx, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C70C0 mov eax, dword ptr fs:[00000030h]	3_2_013C70C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014760B8 mov eax, dword ptr fs:[00000030h]	3_2_014760B8
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014760B8 mov ecx, dword ptr fs:[00000030h]	3_2_014760B8
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01485341 mov eax, dword ptr fs:[00000030h]	3_2_01485341
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A7330 mov eax, dword ptr fs:[00000030h]	3_2_013A7330
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01432349 mov eax, dword ptr fs:[00000030h]	3_2_01432349
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147A352 mov eax, dword ptr fs:[00000030h]	3_2_0147A352
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DF32A mov eax, dword ptr fs:[00000030h]	3_2_013DF32A
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143035C mov eax, dword ptr fs:[00000030h]	3_2_0143035C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143035C mov eax, dword ptr fs:[00000030h]	3_2_0143035C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143035C mov eax, dword ptr fs:[00000030h]	3_2_0143035C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143035C mov ecx, dword ptr fs:[00000030h]	3_2_0143035C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143035C mov eax, dword ptr fs:[00000030h]	3_2_0143035C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143035C mov eax, dword ptr fs:[00000030h]	3_2_0143035C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146F367 mov eax, dword ptr fs:[00000030h]	3_2_0146F367
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AC310 mov ecx, dword ptr fs:[00000030h]	3_2_013AC310
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D0310 mov ecx, dword ptr fs:[00000030h]	3_2_013D0310
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EA30B mov eax, dword ptr fs:[00000030h]	3_2_013EA30B
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EA30B mov eax, dword ptr fs:[00000030h]	3_2_013EA30B
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EA30B mov eax, dword ptr fs:[00000030h]	3_2_013EA30B
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145437C mov eax, dword ptr fs:[00000030h]	3_2_0145437C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143930B mov eax, dword ptr fs:[00000030h]	3_2_0143930B
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143930B mov eax, dword ptr fs:[00000030h]	3_2_0143930B
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143930B mov eax, dword ptr fs:[00000030h]	3_2_0143930B
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B7370 mov eax, dword ptr fs:[00000030h]	3_2_013B7370
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B7370 mov eax, dword ptr fs:[00000030h]	3_2_013B7370
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B7370 mov eax, dword ptr fs:[00000030h]	3_2_013B7370
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A9353 mov eax, dword ptr fs:[00000030h]	3_2_013A9353
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A9353 mov eax, dword ptr fs:[00000030h]	3_2_013A9353
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147132D mov eax, dword ptr fs:[00000030h]	3_2_0147132D
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147132D mov eax, dword ptr fs:[00000030h]	3_2_0147132D
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AD34C mov eax, dword ptr fs:[00000030h]	3_2_013AD34C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AD34C mov eax, dword ptr fs:[00000030h]	3_2_013AD34C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014363C0 mov eax, dword ptr fs:[00000030h]	3_2_014363C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146C3CD mov eax, dword ptr fs:[00000030h]	3_2_0146C3CD
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146B3D0 mov ecx, dword ptr fs:[00000030h]	3_2_0146B3D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D33A5 mov eax, dword ptr fs:[00000030h]	3_2_013D33A5
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E33A0 mov eax, dword ptr fs:[00000030h]	3_2_013E33A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E33A0 mov eax, dword ptr fs:[00000030h]	3_2_013E33A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146F3E6 mov eax, dword ptr fs:[00000030h]	3_2_0146F3E6
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A8397 mov eax, dword ptr fs:[00000030h]	3_2_013A8397
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A8397 mov eax, dword ptr fs:[00000030h]	3_2_013A8397
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A8397 mov eax, dword ptr fs:[00000030h]	3_2_013A8397
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AE388 mov eax, dword ptr fs:[00000030h]	3_2_013AE388
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AE388 mov eax, dword ptr fs:[00000030h]	3_2_013AE388
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AE388 mov eax, dword ptr fs:[00000030h]	3_2_013AE388
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D438F mov eax, dword ptr fs:[00000030h]	3_2_013D438F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D438F mov eax, dword ptr fs:[00000030h]	3_2_013D438F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014853FC mov eax, dword ptr fs:[00000030h]	3_2_014853FC
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E63FF mov eax, dword ptr fs:[00000030h]	3_2_013E63FF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CE3F0 mov eax, dword ptr fs:[00000030h]	3_2_013CE3F0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CE3F0 mov eax, dword ptr fs:[00000030h]	3_2_013CE3F0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CE3F0 mov eax, dword ptr fs:[00000030h]	3_2_013CE3F0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0148539D mov eax, dword ptr fs:[00000030h]	3_2_0148539D
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C03E9 mov eax, dword ptr fs:[00000030h]	3_2_013C03E9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C03E9 mov eax, dword ptr fs:[00000030h]	3_2_013C03E9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C03E9 mov eax, dword ptr fs:[00000030h]	3_2_013C03E9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C03E9 mov eax, dword ptr fs:[00000030h]	3_2_013C03E9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C03E9 mov eax, dword ptr fs:[00000030h]	3_2_013C03E9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C03E9 mov eax, dword ptr fs:[00000030h]	3_2_013C03E9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C03E9 mov eax, dword ptr fs:[00000030h]	3_2_013C03E9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C03E9 mov eax, dword ptr fs:[00000030h]	3_2_013C03E9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0140739A mov eax, dword ptr fs:[00000030h]	3_2_0140739A
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0140739A mov eax, dword ptr fs:[00000030h]	3_2_0140739A
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BA3C0 mov eax, dword ptr fs:[00000030h]	3_2_013BA3C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BA3C0 mov eax, dword ptr fs:[00000030h]	3_2_013BA3C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BA3C0 mov eax, dword ptr fs:[00000030h]	3_2_013BA3C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BA3C0 mov eax, dword ptr fs:[00000030h]	3_2_013BA3C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BA3C0 mov eax, dword ptr fs:[00000030h]	3_2_013BA3C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BA3C0 mov eax, dword ptr fs:[00000030h]	3_2_013BA3C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B83C0 mov eax, dword ptr fs:[00000030h]	3_2_013B83C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B83C0 mov eax, dword ptr fs:[00000030h]	3_2_013B83C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B83C0 mov eax, dword ptr fs:[00000030h]	3_2_013B83C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B83C0 mov eax, dword ptr fs:[00000030h]	3_2_013B83C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01438243 mov eax, dword ptr fs:[00000030h]	3_2_01438243
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01438243 mov ecx, dword ptr fs:[00000030h]	3_2_01438243
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A823B mov eax, dword ptr fs:[00000030h]	3_2_013A823B
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146B256 mov eax, dword ptr fs:[00000030h]	3_2_0146B256
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146B256 mov eax, dword ptr fs:[00000030h]	3_2_0146B256
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147D26B mov eax, dword ptr fs:[00000030h]	3_2_0147D26B
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0147D26B mov eax, dword ptr fs:[00000030h]	3_2_0147D26B
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274 mov eax, dword ptr fs:[00000030h]	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274 mov eax, dword ptr fs:[00000030h]	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274 mov eax, dword ptr fs:[00000030h]	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274 mov eax, dword ptr fs:[00000030h]	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274 mov eax, dword ptr fs:[00000030h]	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274 mov eax, dword ptr fs:[00000030h]	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274 mov eax, dword ptr fs:[00000030h]	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274 mov eax, dword ptr fs:[00000030h]	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274 mov eax, dword ptr fs:[00000030h]	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274 mov eax, dword ptr fs:[00000030h]	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274 mov eax, dword ptr fs:[00000030h]	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01460274 mov eax, dword ptr fs:[00000030h]	3_2_01460274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E7208 mov eax, dword ptr fs:[00000030h]	3_2_013E7208
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E7208 mov eax, dword ptr fs:[00000030h]	3_2_013E7208
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D9274 mov eax, dword ptr fs:[00000030h]	3_2_013D9274
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F1270 mov eax, dword ptr fs:[00000030h]	3_2_013F1270
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013F1270 mov eax, dword ptr fs:[00000030h]	3_2_013F1270
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A826B mov eax, dword ptr fs:[00000030h]	3_2_013A826B
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B4260 mov eax, dword ptr fs:[00000030h]	3_2_013B4260
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B4260 mov eax, dword ptr fs:[00000030h]	3_2_013B4260
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B4260 mov eax, dword ptr fs:[00000030h]	3_2_013B4260
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B6259 mov eax, dword ptr fs:[00000030h]	3_2_013B6259
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AA250 mov eax, dword ptr fs:[00000030h]	3_2_013AA250
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01485227 mov eax, dword ptr fs:[00000030h]	3_2_01485227
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E724D mov eax, dword ptr fs:[00000030h]	3_2_013E724D
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A9240 mov eax, dword ptr fs:[00000030h]	3_2_013A9240
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A9240 mov eax, dword ptr fs:[00000030h]	3_2_013A9240
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C02A0 mov eax, dword ptr fs:[00000030h]	3_2_013C02A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C02A0 mov eax, dword ptr fs:[00000030h]	3_2_013C02A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C52A0 mov eax, dword ptr fs:[00000030h]	3_2_013C52A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C52A0 mov eax, dword ptr fs:[00000030h]	3_2_013C52A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C52A0 mov eax, dword ptr fs:[00000030h]	3_2_013C52A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C52A0 mov eax, dword ptr fs:[00000030h]	3_2_013C52A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E329E mov eax, dword ptr fs:[00000030h]	3_2_013E329E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E329E mov eax, dword ptr fs:[00000030h]	3_2_013E329E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014852E2 mov eax, dword ptr fs:[00000030h]	3_2_014852E2
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014612ED mov eax, dword ptr fs:[00000030h]	3_2_014612ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EE284 mov eax, dword ptr fs:[00000030h]	3_2_013EE284
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EE284 mov eax, dword ptr fs:[00000030h]	3_2_013EE284
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146F2F8 mov eax, dword ptr fs:[00000030h]	3_2_0146F2F8
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01430283 mov eax, dword ptr fs:[00000030h]	3_2_01430283
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01430283 mov eax, dword ptr fs:[00000030h]	3_2_01430283
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01430283 mov eax, dword ptr fs:[00000030h]	3_2_01430283
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A92FF mov eax, dword ptr fs:[00000030h]	3_2_013A92FF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01485283 mov eax, dword ptr fs:[00000030h]	3_2_01485283
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C02E1 mov eax, dword ptr fs:[00000030h]	3_2_013C02E1
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C02E1 mov eax, dword ptr fs:[00000030h]	3_2_013C02E1
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C02E1 mov eax, dword ptr fs:[00000030h]	3_2_013C02E1
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014792A6 mov eax, dword ptr fs:[00000030h]	3_2_014792A6
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014792A6 mov eax, dword ptr fs:[00000030h]	3_2_014792A6
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014792A6 mov eax, dword ptr fs:[00000030h]	3_2_014792A6
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014792A6 mov eax, dword ptr fs:[00000030h]	3_2_014792A6
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014462A0 mov eax, dword ptr fs:[00000030h]	3_2_014462A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014462A0 mov ecx, dword ptr fs:[00000030h]	3_2_014462A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014462A0 mov eax, dword ptr fs:[00000030h]	3_2_014462A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014462A0 mov eax, dword ptr fs:[00000030h]	3_2_014462A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014462A0 mov eax, dword ptr fs:[00000030h]	3_2_014462A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014462A0 mov eax, dword ptr fs:[00000030h]	3_2_014462A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014472A0 mov eax, dword ptr fs:[00000030h]	3_2_014472A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014472A0 mov eax, dword ptr fs:[00000030h]	3_2_014472A0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AB2D3 mov eax, dword ptr fs:[00000030h]	3_2_013AB2D3
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AB2D3 mov eax, dword ptr fs:[00000030h]	3_2_013AB2D3
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AB2D3 mov eax, dword ptr fs:[00000030h]	3_2_013AB2D3
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DF2D0 mov eax, dword ptr fs:[00000030h]	3_2_013DF2D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DF2D0 mov eax, dword ptr fs:[00000030h]	3_2_013DF2D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BA2C3 mov eax, dword ptr fs:[00000030h]	3_2_013BA2C3
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BA2C3 mov eax, dword ptr fs:[00000030h]	3_2_013BA2C3
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BA2C3 mov eax, dword ptr fs:[00000030h]	3_2_013BA2C3
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BA2C3 mov eax, dword ptr fs:[00000030h]	3_2_013BA2C3
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BA2C3 mov eax, dword ptr fs:[00000030h]	3_2_013BA2C3
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DB2C0 mov eax, dword ptr fs:[00000030h]	3_2_013DB2C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DB2C0 mov eax, dword ptr fs:[00000030h]	3_2_013DB2C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DB2C0 mov eax, dword ptr fs:[00000030h]	3_2_013DB2C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DB2C0 mov eax, dword ptr fs:[00000030h]	3_2_013DB2C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DB2C0 mov eax, dword ptr fs:[00000030h]	3_2_013DB2C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DB2C0 mov eax, dword ptr fs:[00000030h]	3_2_013DB2C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DB2C0 mov eax, dword ptr fs:[00000030h]	3_2_013DB2C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B92C5 mov eax, dword ptr fs:[00000030h]	3_2_013B92C5
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B92C5 mov eax, dword ptr fs:[00000030h]	3_2_013B92C5
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014392BC mov eax, dword ptr fs:[00000030h]	3_2_014392BC
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014392BC mov eax, dword ptr fs:[00000030h]	3_2_014392BC
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014392BC mov ecx, dword ptr fs:[00000030h]	3_2_014392BC
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014392BC mov ecx, dword ptr fs:[00000030h]	3_2_014392BC
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE53E mov eax, dword ptr fs:[00000030h]	3_2_013DE53E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE53E mov eax, dword ptr fs:[00000030h]	3_2_013DE53E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE53E mov eax, dword ptr fs:[00000030h]	3_2_013DE53E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE53E mov eax, dword ptr fs:[00000030h]	3_2_013DE53E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE53E mov eax, dword ptr fs:[00000030h]	3_2_013DE53E
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C0535 mov eax, dword ptr fs:[00000030h]	3_2_013C0535
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C0535 mov eax, dword ptr fs:[00000030h]	3_2_013C0535
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C0535 mov eax, dword ptr fs:[00000030h]	3_2_013C0535
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C0535 mov eax, dword ptr fs:[00000030h]	3_2_013C0535
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C0535 mov eax, dword ptr fs:[00000030h]	3_2_013C0535
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013C0535 mov eax, dword ptr fs:[00000030h]	3_2_013C0535
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013ED530 mov eax, dword ptr fs:[00000030h]	3_2_013ED530
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013ED530 mov eax, dword ptr fs:[00000030h]	3_2_013ED530
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BD534 mov eax, dword ptr fs:[00000030h]	3_2_013BD534
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BD534 mov eax, dword ptr fs:[00000030h]	3_2_013BD534
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BD534 mov eax, dword ptr fs:[00000030h]	3_2_013BD534
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BD534 mov eax, dword ptr fs:[00000030h]	3_2_013BD534
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BD534 mov eax, dword ptr fs:[00000030h]	3_2_013BD534
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013BD534 mov eax, dword ptr fs:[00000030h]	3_2_013BD534
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E7505 mov eax, dword ptr fs:[00000030h]	3_2_013E7505
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E7505 mov ecx, dword ptr fs:[00000030h]	3_2_013E7505
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01446500 mov eax, dword ptr fs:[00000030h]	3_2_01446500
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01484500 mov eax, dword ptr fs:[00000030h]	3_2_01484500
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01484500 mov eax, dword ptr fs:[00000030h]	3_2_01484500
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01484500 mov eax, dword ptr fs:[00000030h]	3_2_01484500
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01484500 mov eax, dword ptr fs:[00000030h]	3_2_01484500
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01484500 mov eax, dword ptr fs:[00000030h]	3_2_01484500
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01484500 mov eax, dword ptr fs:[00000030h]	3_2_01484500
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01484500 mov eax, dword ptr fs:[00000030h]	3_2_01484500
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EB570 mov eax, dword ptr fs:[00000030h]	3_2_013EB570
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EB570 mov eax, dword ptr fs:[00000030h]	3_2_013EB570
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E656A mov eax, dword ptr fs:[00000030h]	3_2_013E656A
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E656A mov eax, dword ptr fs:[00000030h]	3_2_013E656A
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E656A mov eax, dword ptr fs:[00000030h]	3_2_013E656A
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AB562 mov eax, dword ptr fs:[00000030h]	3_2_013AB562
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145F525 mov eax, dword ptr fs:[00000030h]	3_2_0145F525
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145F525 mov eax, dword ptr fs:[00000030h]	3_2_0145F525
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145F525 mov eax, dword ptr fs:[00000030h]	3_2_0145F525
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145F525 mov eax, dword ptr fs:[00000030h]	3_2_0145F525
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145F525 mov eax, dword ptr fs:[00000030h]	3_2_0145F525
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145F525 mov eax, dword ptr fs:[00000030h]	3_2_0145F525
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0145F525 mov eax, dword ptr fs:[00000030h]	3_2_0145F525
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146B52F mov eax, dword ptr fs:[00000030h]	3_2_0146B52F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B8550 mov eax, dword ptr fs:[00000030h]	3_2_013B8550
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B8550 mov eax, dword ptr fs:[00000030h]	3_2_013B8550
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01485537 mov eax, dword ptr fs:[00000030h]	3_2_01485537
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014855C9 mov eax, dword ptr fs:[00000030h]	3_2_014855C9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D45B1 mov eax, dword ptr fs:[00000030h]	3_2_013D45B1
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D45B1 mov eax, dword ptr fs:[00000030h]	3_2_013D45B1
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DF5B0 mov eax, dword ptr fs:[00000030h]	3_2_013DF5B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DF5B0 mov eax, dword ptr fs:[00000030h]	3_2_013DF5B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DF5B0 mov eax, dword ptr fs:[00000030h]	3_2_013DF5B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DF5B0 mov eax, dword ptr fs:[00000030h]	3_2_013DF5B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DF5B0 mov eax, dword ptr fs:[00000030h]	3_2_013DF5B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DF5B0 mov eax, dword ptr fs:[00000030h]	3_2_013DF5B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DF5B0 mov eax, dword ptr fs:[00000030h]	3_2_013DF5B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DF5B0 mov eax, dword ptr fs:[00000030h]	3_2_013DF5B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DF5B0 mov eax, dword ptr fs:[00000030h]	3_2_013DF5B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0142D5D0 mov eax, dword ptr fs:[00000030h]	3_2_0142D5D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0142D5D0 mov ecx, dword ptr fs:[00000030h]	3_2_0142D5D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D15A9 mov eax, dword ptr fs:[00000030h]	3_2_013D15A9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D15A9 mov eax, dword ptr fs:[00000030h]	3_2_013D15A9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D15A9 mov eax, dword ptr fs:[00000030h]	3_2_013D15A9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D15A9 mov eax, dword ptr fs:[00000030h]	3_2_013D15A9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D15A9 mov eax, dword ptr fs:[00000030h]	3_2_013D15A9
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014835D7 mov eax, dword ptr fs:[00000030h]	3_2_014835D7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014835D7 mov eax, dword ptr fs:[00000030h]	3_2_014835D7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014835D7 mov eax, dword ptr fs:[00000030h]	3_2_014835D7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EE59C mov eax, dword ptr fs:[00000030h]	3_2_013EE59C
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A758F mov eax, dword ptr fs:[00000030h]	3_2_013A758F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A758F mov eax, dword ptr fs:[00000030h]	3_2_013A758F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013A758F mov eax, dword ptr fs:[00000030h]	3_2_013A758F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E4588 mov eax, dword ptr fs:[00000030h]	3_2_013E4588
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B2582 mov eax, dword ptr fs:[00000030h]	3_2_013B2582
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B2582 mov ecx, dword ptr fs:[00000030h]	3_2_013B2582
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D15F4 mov eax, dword ptr fs:[00000030h]	3_2_013D15F4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D15F4 mov eax, dword ptr fs:[00000030h]	3_2_013D15F4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D15F4 mov eax, dword ptr fs:[00000030h]	3_2_013D15F4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D15F4 mov eax, dword ptr fs:[00000030h]	3_2_013D15F4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D15F4 mov eax, dword ptr fs:[00000030h]	3_2_013D15F4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D15F4 mov eax, dword ptr fs:[00000030h]	3_2_013D15F4
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EC5ED mov eax, dword ptr fs:[00000030h]	3_2_013EC5ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EC5ED mov eax, dword ptr fs:[00000030h]	3_2_013EC5ED
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143B594 mov eax, dword ptr fs:[00000030h]	3_2_0143B594
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143B594 mov eax, dword ptr fs:[00000030h]	3_2_0143B594
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	3_2_013DE5E7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	3_2_013DE5E7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	3_2_013DE5E7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	3_2_013DE5E7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	3_2_013DE5E7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	3_2_013DE5E7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	3_2_013DE5E7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	3_2_013DE5E7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B25E0 mov eax, dword ptr fs:[00000030h]	3_2_013B25E0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014305A7 mov eax, dword ptr fs:[00000030h]	3_2_014305A7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014305A7 mov eax, dword ptr fs:[00000030h]	3_2_014305A7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014305A7 mov eax, dword ptr fs:[00000030h]	3_2_014305A7
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D95DA mov eax, dword ptr fs:[00000030h]	3_2_013D95DA
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B65D0 mov eax, dword ptr fs:[00000030h]	3_2_013B65D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EA5D0 mov eax, dword ptr fs:[00000030h]	3_2_013EA5D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EA5D0 mov eax, dword ptr fs:[00000030h]	3_2_013EA5D0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EE5CF mov eax, dword ptr fs:[00000030h]	3_2_013EE5CF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013EE5CF mov eax, dword ptr fs:[00000030h]	3_2_013EE5CF
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0144D5B0 mov eax, dword ptr fs:[00000030h]	3_2_0144D5B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0144D5B0 mov eax, dword ptr fs:[00000030h]	3_2_0144D5B0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146F5BE mov eax, dword ptr fs:[00000030h]	3_2_0146F5BE
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014435BA mov eax, dword ptr fs:[00000030h]	3_2_014435BA
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014435BA mov eax, dword ptr fs:[00000030h]	3_2_014435BA
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014435BA mov eax, dword ptr fs:[00000030h]	3_2_014435BA
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_014435BA mov eax, dword ptr fs:[00000030h]	3_2_014435BA
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E55C0 mov eax, dword ptr fs:[00000030h]	3_2_013E55C0
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0146F453 mov eax, dword ptr fs:[00000030h]	3_2_0146F453
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AE420 mov eax, dword ptr fs:[00000030h]	3_2_013AE420
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AE420 mov eax, dword ptr fs:[00000030h]	3_2_013AE420
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AE420 mov eax, dword ptr fs:[00000030h]	3_2_013AE420
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013AC427 mov eax, dword ptr fs:[00000030h]	3_2_013AC427
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0143C460 mov ecx, dword ptr fs:[00000030h]	3_2_0143C460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013D340D mov eax, dword ptr fs:[00000030h]	3_2_013D340D
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_0148547F mov eax, dword ptr fs:[00000030h]	3_2_0148547F
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E8402 mov eax, dword ptr fs:[00000030h]	3_2_013E8402
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E8402 mov eax, dword ptr fs:[00000030h]	3_2_013E8402
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013E8402 mov eax, dword ptr fs:[00000030h]	3_2_013E8402
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DA470 mov eax, dword ptr fs:[00000030h]	3_2_013DA470
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DA470 mov eax, dword ptr fs:[00000030h]	3_2_013DA470
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013DA470 mov eax, dword ptr fs:[00000030h]	3_2_013DA470
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01437410 mov eax, dword ptr fs:[00000030h]	3_2_01437410
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B1460 mov eax, dword ptr fs:[00000030h]	3_2_013B1460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B1460 mov eax, dword ptr fs:[00000030h]	3_2_013B1460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B1460 mov eax, dword ptr fs:[00000030h]	3_2_013B1460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B1460 mov eax, dword ptr fs:[00000030h]	3_2_013B1460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013B1460 mov eax, dword ptr fs:[00000030h]	3_2_013B1460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CF460 mov eax, dword ptr fs:[00000030h]	3_2_013CF460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CF460 mov eax, dword ptr fs:[00000030h]	3_2_013CF460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CF460 mov eax, dword ptr fs:[00000030h]	3_2_013CF460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CF460 mov eax, dword ptr fs:[00000030h]	3_2_013CF460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CF460 mov eax, dword ptr fs:[00000030h]	3_2_013CF460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_013CF460 mov eax, dword ptr fs:[00000030h]	3_2_013CF460
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01436420 mov eax, dword ptr fs:[00000030h]	3_2_01436420
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01436420 mov eax, dword ptr fs:[00000030h]	3_2_01436420
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01436420 mov eax, dword ptr fs:[00000030h]	3_2_01436420
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01436420 mov eax, dword ptr fs:[00000030h]	3_2_01436420
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Code function: 3_2_01436420 mov eax, dword ptr fs:[00000030h]	3_2_01436420

Source: C:\Windows\SysWOW64\netsh.exe

Code function: 6_2_01564068 GetProcessHeap,HeapFree,

6_2_01564068

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_015696E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		6_2_015696E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 6_2_01569930 SetUnhandledExceptionFilter,		6_2_01569930

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	NtQueueApcThread: Indirect: 0x131A4F2			Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	NtClose: Indirect: 0x131A56C

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Memory written: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: NULL target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Section loaded: NULL target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Thread register set: target process: 2580			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Thread register set: target process: 2580			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Section unmapped: C:\Windows\SysWOW64\netsh.exe base address: 1560000

Jump to behavior

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process created: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Process created: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"	Jump to behavior

Source: explorer.exe, 00000004.00000000.1702259506.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.1703558154.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4141580919.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.1702259506.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.4141580919.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.1701959899.0000000001248000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4141036678.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000004.00000000.1702259506.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.4141580919.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.1702259506.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000002.4141580919.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\netsh.exe

Code function: 6_2_01569B55 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

6_2_01569B55

Source: C:\Windows\SysWOW64\netsh.exe

Code function: 6_2_015692E8 memset,GetVersionExW,

6_2_015692E8

Source: C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\SysWOW64\netsh.exe"

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8tvMmyxveyzFcnJ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Shared Modules	1 DLL Side-Loading	512 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	512 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8tvMmyxveyzFcnJ.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.Taskun
8tvMmyxveyzFcnJ.exe	49%	Virustotal		Browse
8tvMmyxveyzFcnJ.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
www.at89v2.com	0%	Virustotal	Browse
fondsa.xyz	2%	Virustotal	Browse
sainikshiksha.com	0%	Virustotal	Browse
www.291van.fun	2%	Virustotal	Browse
ext-sq.squarespace.com	0%	Virustotal	Browse
www.sainikshiksha.com	0%	Virustotal	Browse
www.tatesfluffyfrenchies.com	0%	Virustotal	Browse
www.thecollisionmagazine.com	0%	Virustotal	Browse
www.motolimod.com	0%	Virustotal	Browse
www.ajansyapai.net	0%	Virustotal	Browse
www.basedawgz.live	0%	Virustotal	Browse
www.huttonsidel.online	0%	Virustotal	Browse
www.llngx.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.at89v2.com/mc10/?M6=+PshiMmsD3s2EuJ9KF3baeU+rJnvgbutDGTUYWD/T/xNi6HtTgrR7YeDwlLM6QRR03T9&sZ=Ynzp6xUh	0%	Avira URL Cloud	safe
http://www.motolimod.com/mc10/?M6=vFB2baQv3F/rJ4Poxnbh3E5xW9PPAAbphga1xIFZj8yJGRkxzOANKPapIG+pOmwhUo5D&sZ=Ynzp6xUh	0%	Avira URL Cloud	safe
http://www.ajansyapai.netReferer:	0%	Avira URL Cloud	safe
https://aka.ms/odirmr	0%	Avira URL Cloud	safe
http://www.huttonsidel.online	0%	Avira URL Cloud	safe
http://www.huttonsidel.online	0%	Virustotal		Browse
https://aka.ms/odirmr	0%	Virustotal		Browse
http://www.bjcysadz.xyz/mc10/	0%	Avira URL Cloud	safe
http://www.ajansyapai.net	0%	Avira URL Cloud	safe
http://www.ajansyapai.net	0%	Virustotal		Browse
http://www.huttonsidel.online/mc10/	1%	Virustotal		Browse
http://www.motolimod.com	0%	Avira URL Cloud	safe
http://www.zaki-argan.com	0%	Avira URL Cloud	safe
http://www.huttonsidel.online/mc10/	0%	Avira URL Cloud	safe
http://www.bjcysadz.xyz/mc10/	1%	Virustotal		Browse
http://www.ajansyapai.net/mc10/	0%	Avira URL Cloud	safe
http://www.fondsa.xyzReferer:	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	0%	Avira URL Cloud	safe
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	Avira URL Cloud	safe
http://www.motolimod.com	0%	Virustotal		Browse
http://www.ajansyapai.net/mc10/	1%	Virustotal		Browse
http://www.shophansler.comReferer:	0%	Avira URL Cloud	safe
http://www.zaki-argan.com	0%	Virustotal		Browse
http://www.at89v2.com/mc10/www.sainikshiksha.com	0%	Avira URL Cloud	safe
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	Virustotal		Browse
http://www.sainikshiksha.com/mc10/	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	0%	Avira URL Cloud	safe
http://www.kurainu.xyz	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	0%	Avira URL Cloud	safe
http://www.dealerxai.com/mc10/www.bjcysadz.xyz	0%	Avira URL Cloud	safe
http://www.motolimod.com/mc10/www.at89v2.com	0%	Avira URL Cloud	safe
http://www.kurainu.xyz	0%	Virustotal		Browse
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	0%	Virustotal		Browse
https://wns.windows.com/L	0%	Avira URL Cloud	safe
http://www.sainikshiksha.com/mc10/	1%	Virustotal		Browse
http://www.291van.fun	0%	Avira URL Cloud	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	0%	Virustotal		Browse
http://www.fondsa.xyz	0%	Avira URL Cloud	safe
http://www.llngx.com/mc10/www.ajansyapai.net	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	0%	Virustotal		Browse
http://www.291van.fun	2%	Virustotal		Browse
https://word.office.com	0%	Avira URL Cloud	safe
http://www.sainikshiksha.com/mc10/www.fondsa.xyz	0%	Avira URL Cloud	safe
http://www.ajansyapai.net/mc10/www.tatesfluffyfrenchies.com	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	0%	Avira URL Cloud	safe
http://www.zaki-argan.comReferer:	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	0%	Avira URL Cloud	safe
http://www.tatesfluffyfrenchies.com/mc10/	100%	Avira URL Cloud	phishing
http://schemas.micr	0%	Avira URL Cloud	safe
http://www.thecollisionmagazine.com/mc10/	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	0%	Avira URL Cloud	safe
http://www.dealerxai.com	0%	Avira URL Cloud	safe
http://www.shophansler.com/mc10/:	100%	Avira URL Cloud	phishing
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	0%	Avira URL Cloud	safe
http://www.motolimod.com/mc10/	0%	Avira URL Cloud	safe
http://www.sainikshiksha.comReferer:	0%	Avira URL Cloud	safe
https://www.rd.com/list/polite-habits-campers-dislike/	0%	Avira URL Cloud	safe
http://www.tatesfluffyfrenchies.com/mc10/www.dealerxai.com	100%	Avira URL Cloud	phishing
http://www.thecollisionmagazine.comReferer:	0%	Avira URL Cloud	safe
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	Avira URL Cloud	safe
http://www.basedawgz.liveReferer:	0%	Avira URL Cloud	safe
https://outlook.com_	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	0%	Avira URL Cloud	safe
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	0%	Avira URL Cloud	safe
http://schemas.mi	0%	Avira URL Cloud	safe
http://www.zaki-argan.com/mc10/	0%	Avira URL Cloud	safe
http://www.huttonsidel.onlineReferer:	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	0%	Avira URL Cloud	safe
http://www.at89v2.com	0%	Avira URL Cloud	safe
http://www.motolimod.comReferer:	0%	Avira URL Cloud	safe
http://www.kurainu.xyzReferer:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.at89v2.com	103.224.212.213	true	true	0%, Virustotal, Browse	unknown
fondsa.xyz	3.33.130.190	true	true	2%, Virustotal, Browse	unknown
sainikshiksha.com	103.191.209.34	true	true	0%, Virustotal, Browse	unknown
www.291van.fun	188.114.97.3	true	true	2%, Virustotal, Browse	unknown
ext-sq.squarespace.com	198.185.159.144	true	true	0%, Virustotal, Browse	unknown
www.sainikshiksha.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.llngx.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.tatesfluffyfrenchies.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.fondsa.xyz	unknown	unknown	true		unknown
www.basedawgz.live	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.motolimod.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.huttonsidel.online	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.thecollisionmagazine.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.ajansyapai.net	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.motolimod.com/mc10/?M6=vFB2baQv3F/rJ4Poxnbh3E5xW9PPAAbphga1xIFZj8yJGRkxzOANKPapIG+pOmwhUo5D&sZ=Ynzp6xUh	true	Avira URL Cloud: safe	unknown
http://www.at89v2.com/mc10/?M6=+PshiMmsD3s2EuJ9KF3baeU+rJnvgbutDGTUYWD/T/xNi6HtTgrR7YeDwlLM6QRR03T9&sZ=Ynzp6xUh	true	Avira URL Cloud: safe	unknown
http://www.291van.fun/mc10/?M6=0jqVw3fXhgUe9S01oU54GSyQct+tyOMGPM4Q+l1hxxFHWjnqq7dqR8wNeV12RES6q9dV&sZ=Ynzp6xUh	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000004.00000000.1703761960.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.huttonsidel.online	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ajansyapai.netReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3114554074.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4146493757.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ajansyapai.net	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.bjcysadz.xyz/mc10/	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.huttonsidel.online/mc10/	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.motolimod.com	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.zaki-argan.com	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ajansyapai.net/mc10/	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fondsa.xyzReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://excel.office.com	explorer.exe, 00000004.00000002.4153126684.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1707756779.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.shophansler.comReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.at89v2.com/mc10/www.sainikshiksha.com	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sainikshiksha.com/mc10/	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.kurainu.xyz	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000004.00000000.1703761960.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.dealerxai.com/mc10/www.bjcysadz.xyz	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000004.00000000.1707756779.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.motolimod.com/mc10/www.at89v2.com	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wns.windows.com/L	explorer.exe, 00000004.00000000.1707756779.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4153126684.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.291van.fun	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fondsa.xyz	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.llngx.com/mc10/www.ajansyapai.net	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.com	explorer.exe, 00000004.00000002.4153126684.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1707756779.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sainikshiksha.com/mc10/www.fondsa.xyz	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ajansyapai.net/mc10/www.tatesfluffyfrenchies.com	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000004.00000000.1703761960.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zaki-argan.comReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tatesfluffyfrenchies.com/mc10/	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.micr	explorer.exe, 00000004.00000000.1703761960.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.thecollisionmagazine.com/mc10/	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dealerxai.com	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.shophansler.com/mc10/:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.motolimod.com/mc10/	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sainikshiksha.comReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000004.00000002.4153126684.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1707756779.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tatesfluffyfrenchies.com/mc10/www.dealerxai.com	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.thecollisionmagazine.comReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000004.00000000.1703761960.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.basedawgz.liveReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com_	explorer.exe, 00000004.00000002.4153126684.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1707756779.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.mi	explorer.exe, 00000004.00000000.1703761960.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4143507586.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zaki-argan.com/mc10/	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.huttonsidel.onlineReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000004.00000002.4143507586.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.at89v2.com	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://powerpoint.office.comcember	explorer.exe, 00000004.00000002.4153126684.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1707756779.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.motolimod.comReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kurainu.xyzReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bjcysadz.xyzReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.llngx.comReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.291van.fun/mc10/www.motolimod.com	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.comne	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703686104.0000000005690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.kurainu.xyz/mc10/	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000004.00000000.1706494215.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.1704923328.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000004.00000000.1704462653.0000000007F40000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.llngx.com	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.bjcysadz.xyz/mc10/www.zaki-argan.com	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/q	explorer.exe, 00000004.00000003.3114554074.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000002.4146493757.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1705502686.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.291van.funReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kurainu.xyz/mc10/www.291van.fun	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tatesfluffyfrenchies.comReferer:	explorer.exe, 00000004.00000002.4148743202.00000000098A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3463983042.000000000991A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000003.3110883714.000000000991A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000004.00000002.4143507586.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000004.00000000.1703761960.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	8tvMmyxveyzFcnJ.exe, 00000000.00000002.1703711818.0000000006D22000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.224.212.213	www.at89v2.com	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	true
188.114.97.3	www.291van.fun	European Union	13335	CLOUDFLARENETUS	true
3.64.163.50	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1470721
Start date and time:	2024-07-10 12:08:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	8tvMmyxveyzFcnJ.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@285/1@14/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 118 Number of non-executed functions: 327
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:09:00	API Interceptor	1x Sleep call for process: 8tvMmyxveyzFcnJ.exe modified
06:09:09	API Interceptor	8917497x Sleep call for process: explorer.exe modified
06:09:45	API Interceptor	8330821x Sleep call for process: netsh.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.224.212.213	tYEY1UeurGz0Mjb.exe	Get hash	malicious	FormBook	Browse	www.serco2020.com/dy13/?IR=7H41Cx9M/9Klm4wO2KyYkeGFvajkB7bQdwjfmZPzOjV6ZXjzQq6V6P6jcCKZla+kGSS1&nL=S4247TXPfxsLR
	yPURXYpFVuXra2o.exe	Get hash	malicious	FormBook	Browse	www.bolinkpass.club/cr12/?XDHHT=vl9/KZA8hSVZlZYYRwiRPHDwK+fMeRW7mLcdcO2HrZ8WCY+A9QkbN6YtC02r8Olco4RS&MZt0=njKl2H4htFXPs
	Ajanlatkeres_2024.05.29.PDF.exe	Get hash	malicious	FormBook, Lokibot	Browse	www.vivaness.club/dn03/?KvOx3=rTguiTyPWe+LQ3wbOsvLrlRt5HkRD6mO+8zHcQ1TTPZ93ZKF8Svri6qQbYlnCi86X6wl&LhEx=ODKXZDVpY2w8gpmp
	Solicitud de pedido Documento No 168646080.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.yassa-hany.online/pz08/?cx=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMZpBqNAn8DKeRhHzw==&CR=_DHhAtX
	DHL Factura Electronica Pendiente documento No 04BB25083.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.yassa-hany.online/pz08/?N6Ahw=3ffl2F0Punah42&Ap=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuP1PGrx4qdiR
	PaDQmSw2ud.dll	Get hash	malicious	Laplas Clipper	Browse	searchseedphase.online/bot/regex
	PaDQmSw2ud.dll	Get hash	malicious	Laplas Clipper	Browse	searchseedphase.online/bot/regex
	Documento de confirmacion de orden de compra OC 1580070060.exe	Get hash	malicious	FormBook	Browse	www.yassa-hany.online/pz08/?mzrPV4R=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMVpBqNDhq+c&Rl=8pFP0r98Chvt5p5P
	2024-09C33T37.exe	Get hash	malicious	FormBook	Browse	www.jeffwertdesign.com/ve92/?K2M8bVC=FFlo4/TKNXAR7V12oAudCGusg/tK2zFE/4uuQQ9Wgy0sGP4AKi+QV1PLyZgh2gAJGU7I&tXC=BDK02VJ87dHtUzo
	rBCPcomprobante.exe	Get hash	malicious	FormBook	Browse	www.yassa-hany.online/pz08/?CrFT7j=ftx8Clc09Ned3F&pR-l7PfH=QdC7EAnI8ZBK6KsnIEDwiNoe1wSidTgePl3trAKN/Agbi7tcJn0SHRDVuMVQNLhAw6fb
188.114.97.3	Packing List,BL & Final Invoice.xls	Get hash	malicious	Lokibot	Browse	sini.la/c40mh
	HSOwUsZ7hs6Pm4m.exe	Get hash	malicious	FormBook	Browse	www.artfulfusionhub.lat/qogc/
	j2vPH4wfF2YxEja.exe	Get hash	malicious	FormBook	Browse	www.artfulfusionhub.lat/qogc/
	DY3AojqquRfcmp5.exe	Get hash	malicious	FormBook	Browse	www.9muyiutyt.online/39t8/
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.8256.26893.rtf	Get hash	malicious	FormBook	Browse	www.exporationgenius.sbs/x06k/
	PO2767.xls	Get hash	malicious	FormBook	Browse	sini.la/53zqx
	vV389MGvCt9jWzm.exe	Get hash	malicious	Lokibot	Browse	gitak.top/evie2/five/fre.php
	offertfrfrgan.xls	Get hash	malicious	Unknown	Browse	sini.la/9m28x
	Inquiry PR#27957.bat.exe	Get hash	malicious	FormBook	Browse	www.globaltrend.xyz/srh8/?lv-=IQYINTaWkaojOw8AeeCEPfEIeYkq+BJ0MxZ2KDKAvD89Td2DcEp1Lez+9d6wDeiGuMtHeyxXV+kcq5RzRjH8Tl/MEdpNR0v4ePERtHY07mFLqmHNNg==&GJtTF=-FH8yJw
	http://threemanshop.com	Get hash	malicious	Unknown	Browse	threemanshop.com/cdn-cgi/images/cf-icon-server.png

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.291van.fun	327vRde1h3nsEEG.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
www.291van.fun	disjR92Xrrnc3aZ.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
ext-sq.squarespace.com	5.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	327vRde1h3nsEEG.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	Scan405.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	ScanPDF_102.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	tYEY1UeurGz0Mjb.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	Orden de compra 0307AR24.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	Att00173994.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	disjR92Xrrnc3aZ.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	2024 Lusail Fence-WITH STICKER-2-003.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	INVOICE - MV CNC BANGKOK - ST24PJ-278.exe	Get hash	malicious	FormBook	Browse	198.185.159.144

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://github.com/blackcoffe74/blackcoffe74/releases/tag/lat	Get hash	malicious	LummaC, BiFrost, LummaC Stealer	Browse	188.114.96.3
	MV ALEXOS_VESSEL'S DESC.docx.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://my.vrca.ca/_alcd/etr.ashx?etuid=B6EC5EC3-A3FA-4276-9728-F0F26D555086&p=https://microsoft.com@invstrategy.com/DocuSign.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://m.exactag.com/ai.aspx?tc=d9282403bc40b07205bbd26a23a8d2e6b6b4f9&url=//onlygod.pages.dev/#Y2Fyb2xpbmUudmlhbm5hQGdsb2JhbGZvdW5kcmllcy5jb20=	Get hash	malicious	Unknown	Browse	104.17.25.14
	ScowanElectronic RECEIPT #11782.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://in.xero.com/otg9csffpxao6afkqb3xwrugoatdbpeduijycctc	Get hash	malicious	Unknown	Browse	162.247.243.29
	SecuriteInfo.com.Trojan.PackedNET.2944.29161.19818.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	https://forms.promo-pharmacies.gr/6659c886cdd608959f27a71a	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://materialesvite.com.mx/upload/QebqNQebqN/QebqN/YWxiZXJ0by5kb3Npb0B0aGFsZXNhbGVuaWFzcGFjZS5jb20=	Get hash	malicious	Greatness Phishing Kit, HTMLPhisher	Browse	104.18.11.207
	http://protingent.com	Get hash	malicious	Unknown	Browse	1.1.1.1
TRELLIAN-AS-APTrellianPtyLimitedAU	Arrival Notice_AWB 4560943391.vbe	Get hash	malicious	FormBook, GuLoader	Browse	103.224.212.216
	NGL 700800.exe	Get hash	malicious	FormBook	Browse	103.224.182.250
	http://sectocarewl.online/mona-michelle/	Get hash	malicious	Unknown	Browse	103.224.212.210
	tYEY1UeurGz0Mjb.exe	Get hash	malicious	FormBook	Browse	103.224.212.213
	SOA 020724.exe	Get hash	malicious	FormBook	Browse	103.224.182.250
	Inquiry No PJO-4010574.exe	Get hash	malicious	FormBook	Browse	103.224.182.250
	http://pollyfill.io	Get hash	malicious	Unknown	Browse	103.224.182.252
	rPRESUPUESTO.exe	Get hash	malicious	FormBook	Browse	103.224.182.246
	INVOICE - MV CNC BANGKOK - ST24PJ-278.exe	Get hash	malicious	FormBook	Browse	103.224.182.210
	PO - 04755 .bat.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
AMAZON-02US	https://in.xero.com/otg9csffpxao6afkqb3xwrugoatdbpeduijycctc	Get hash	malicious	Unknown	Browse	34.252.40.201
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	143.204.215.115
	qRNC6mtGhI.exe	Get hash	malicious	FormBook	Browse	3.64.163.50
	https://tg-pixel.gitbook.io/2	Get hash	malicious	Unknown	Browse	13.32.121.27
	O5XVFL6XD2.elf	Get hash	malicious	Mirai	Browse	13.253.0.127
	bolonetwork.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	54.250.200.83
	https://securama.es/	Get hash	malicious	Unknown	Browse	13.33.187.70
	http://securama.es	Get hash	malicious	Unknown	Browse	13.33.187.70
	bolonetwork.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	54.212.28.245
	bolonetwork.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	13.56.37.32

Process:	C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.977023701616568
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	8tvMmyxveyzFcnJ.exe
File size:	574'976 bytes
MD5:	fff69b0890fc5c9c754e17d06deb5216
SHA1:	e3b4644bd7f114a830ec649edbed92a437a81673
SHA256:	a8fe32e805d1e0a0a61e2763308b01be24656f9bd356a863b174ce61e32d9a7e
SHA512:	a799abf32f8ede0cf805cff84961ded989b899ccfa44214ad17d4a9912ee650cac6f75b1462fbcc465b47397578eecb5f5998ee24c9694bfe2a7929549040088
SSDEEP:	12288:DHch5SCsLxfmoaaKB0eN3lvGIW4CO7MEMVbQsJeo6Bcd0Xp4e:zIfQHNKB0e9luIybQKXLd0m
TLSH:	A9C42344B7E8D786F96A9334029FAB010B353D4AE4AADE45DCE710D81D2BF405A92B37
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....eD...............0.............F.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x48db46
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE84465C2 [Thu Jun 25 19:30:10 2093 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8daf4	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8e000	0x5b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x90000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8c450	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8bb4c	0x8bc00	14375216bc51e2d92f7b470c8cf1dfef	False	0.9766341262298748	data	7.982529796574812	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8e000	0x5b4	0x600	62081b28fd455e530dcb6e5a73f2dd7d	False	0.4303385416666667	data	4.115698753386909	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x90000	0xc	0x200	c9c1c03f94044dbfbf9a1c8b1edc6b75	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x8e090	0x324	data			0.44154228855721395
RT_MANIFEST	0x8e3c4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/10/24-12:11:01.020125	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	50630	80	192.168.2.4	3.64.163.50
07/10/24-12:13:25.925017	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	50634	80	192.168.2.4	198.185.159.144
07/10/24-12:11:21.261447	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	50631	80	192.168.2.4	103.224.212.213
07/10/24-12:11:42.251746	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	50632	80	192.168.2.4	103.191.209.34
07/10/24-12:10:40.094311	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49743	80	192.168.2.4	188.114.97.3
07/10/24-12:12:01.865030	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	50633	80	192.168.2.4	3.33.130.190

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 10, 2024 12:10:40.088527918 CEST	49743	80	192.168.2.4	188.114.97.3
Jul 10, 2024 12:10:40.094005108 CEST	80	49743	188.114.97.3	192.168.2.4
Jul 10, 2024 12:10:40.094167948 CEST	49743	80	192.168.2.4	188.114.97.3
Jul 10, 2024 12:10:40.094310999 CEST	49743	80	192.168.2.4	188.114.97.3
Jul 10, 2024 12:10:40.099308968 CEST	80	49743	188.114.97.3	192.168.2.4
Jul 10, 2024 12:10:40.595596075 CEST	49743	80	192.168.2.4	188.114.97.3
Jul 10, 2024 12:10:40.601835012 CEST	80	49743	188.114.97.3	192.168.2.4
Jul 10, 2024 12:10:40.601917028 CEST	49743	80	192.168.2.4	188.114.97.3
Jul 10, 2024 12:11:01.015033960 CEST	50630	80	192.168.2.4	3.64.163.50
Jul 10, 2024 12:11:01.019965887 CEST	80	50630	3.64.163.50	192.168.2.4
Jul 10, 2024 12:11:01.020025015 CEST	50630	80	192.168.2.4	3.64.163.50
Jul 10, 2024 12:11:01.020124912 CEST	50630	80	192.168.2.4	3.64.163.50
Jul 10, 2024 12:11:01.025218010 CEST	80	50630	3.64.163.50	192.168.2.4
Jul 10, 2024 12:11:01.534713984 CEST	50630	80	192.168.2.4	3.64.163.50
Jul 10, 2024 12:11:02.000772953 CEST	50630	80	192.168.2.4	3.64.163.50
Jul 10, 2024 12:11:02.288122892 CEST	80	50630	3.64.163.50	192.168.2.4
Jul 10, 2024 12:11:02.288304090 CEST	80	50630	3.64.163.50	192.168.2.4
Jul 10, 2024 12:11:02.288310051 CEST	80	50630	3.64.163.50	192.168.2.4
Jul 10, 2024 12:11:02.288314104 CEST	80	50630	3.64.163.50	192.168.2.4
Jul 10, 2024 12:11:02.288407087 CEST	50630	80	192.168.2.4	3.64.163.50
Jul 10, 2024 12:11:02.288407087 CEST	50630	80	192.168.2.4	3.64.163.50
Jul 10, 2024 12:11:02.288407087 CEST	50630	80	192.168.2.4	3.64.163.50
Jul 10, 2024 12:11:02.288531065 CEST	50630	80	192.168.2.4	3.64.163.50
Jul 10, 2024 12:11:02.293514013 CEST	80	50630	3.64.163.50	192.168.2.4
Jul 10, 2024 12:11:02.293519974 CEST	80	50630	3.64.163.50	192.168.2.4
Jul 10, 2024 12:11:02.293586969 CEST	50630	80	192.168.2.4	3.64.163.50
Jul 10, 2024 12:11:02.293586969 CEST	50630	80	192.168.2.4	3.64.163.50
Jul 10, 2024 12:11:21.256373882 CEST	50631	80	192.168.2.4	103.224.212.213
Jul 10, 2024 12:11:21.261297941 CEST	80	50631	103.224.212.213	192.168.2.4
Jul 10, 2024 12:11:21.261368990 CEST	50631	80	192.168.2.4	103.224.212.213
Jul 10, 2024 12:11:21.261446953 CEST	50631	80	192.168.2.4	103.224.212.213
Jul 10, 2024 12:11:21.266251087 CEST	80	50631	103.224.212.213	192.168.2.4
Jul 10, 2024 12:11:21.750828981 CEST	50631	80	192.168.2.4	103.224.212.213
Jul 10, 2024 12:11:21.756529093 CEST	80	50631	103.224.212.213	192.168.2.4
Jul 10, 2024 12:11:21.757118940 CEST	50631	80	192.168.2.4	103.224.212.213

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 10, 2024 12:09:40.065268040 CEST	58415	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:09:40.514588118 CEST	53	58415	1.1.1.1	192.168.2.4
Jul 10, 2024 12:09:59.876291037 CEST	59726	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:09:59.897070885 CEST	53	59726	1.1.1.1	192.168.2.4
Jul 10, 2024 12:10:40.050688982 CEST	62693	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:10:40.086332083 CEST	53	62693	1.1.1.1	192.168.2.4
Jul 10, 2024 12:11:00.504188061 CEST	61617	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:11:00.512017012 CEST	53	61617	1.1.1.1	192.168.2.4
Jul 10, 2024 12:11:20.923656940 CEST	58845	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:11:21.255609989 CEST	53	58845	1.1.1.1	192.168.2.4
Jul 10, 2024 12:11:41.376701117 CEST	57612	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:11:42.218935013 CEST	53	57612	1.1.1.1	192.168.2.4
Jul 10, 2024 12:12:01.830740929 CEST	51372	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:12:01.850331068 CEST	53	51372	1.1.1.1	192.168.2.4
Jul 10, 2024 12:12:22.373477936 CEST	63654	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:12:22.384119987 CEST	53	63654	1.1.1.1	192.168.2.4
Jul 10, 2024 12:12:42.857923031 CEST	55432	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:12:43.862828016 CEST	55432	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:12:44.877207994 CEST	55432	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:12:46.902784109 CEST	55432	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:12:48.722023964 CEST	53	55432	1.1.1.1	192.168.2.4
Jul 10, 2024 12:12:48.722038984 CEST	53	55432	1.1.1.1	192.168.2.4
Jul 10, 2024 12:12:48.722381115 CEST	53	55432	1.1.1.1	192.168.2.4
Jul 10, 2024 12:12:48.723553896 CEST	53	55432	1.1.1.1	192.168.2.4
Jul 10, 2024 12:13:03.397139072 CEST	53259	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:13:03.408982038 CEST	53	53259	1.1.1.1	192.168.2.4
Jul 10, 2024 12:13:25.860891104 CEST	65413	53	192.168.2.4	1.1.1.1
Jul 10, 2024 12:13:25.919226885 CEST	53	65413	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 10, 2024 12:09:40.065268040 CEST	192.168.2.4	1.1.1.1	0xd319	Standard query (0)	www.basedawgz.live	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:09:59.876291037 CEST	192.168.2.4	1.1.1.1	0xb570	Standard query (0)	www.thecollisionmagazine.com	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:10:40.050688982 CEST	192.168.2.4	1.1.1.1	0x390b	Standard query (0)	www.291van.fun	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:11:00.504188061 CEST	192.168.2.4	1.1.1.1	0x5bad	Standard query (0)	www.motolimod.com	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:11:20.923656940 CEST	192.168.2.4	1.1.1.1	0x9fab	Standard query (0)	www.at89v2.com	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:11:41.376701117 CEST	192.168.2.4	1.1.1.1	0x1b7b	Standard query (0)	www.sainikshiksha.com	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:01.830740929 CEST	192.168.2.4	1.1.1.1	0x3212	Standard query (0)	www.fondsa.xyz	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:22.373477936 CEST	192.168.2.4	1.1.1.1	0xd729	Standard query (0)	www.huttonsidel.online	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:42.857923031 CEST	192.168.2.4	1.1.1.1	0x3e9e	Standard query (0)	www.llngx.com	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:43.862828016 CEST	192.168.2.4	1.1.1.1	0x3e9e	Standard query (0)	www.llngx.com	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:44.877207994 CEST	192.168.2.4	1.1.1.1	0x3e9e	Standard query (0)	www.llngx.com	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:46.902784109 CEST	192.168.2.4	1.1.1.1	0x3e9e	Standard query (0)	www.llngx.com	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:13:03.397139072 CEST	192.168.2.4	1.1.1.1	0xa372	Standard query (0)	www.ajansyapai.net	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:13:25.860891104 CEST	192.168.2.4	1.1.1.1	0x1d62	Standard query (0)	www.tatesfluffyfrenchies.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 10, 2024 12:09:40.514588118 CEST	1.1.1.1	192.168.2.4	0xd319	Name error (3)	www.basedawgz.live	none	none	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:09:59.897070885 CEST	1.1.1.1	192.168.2.4	0xb570	Name error (3)	www.thecollisionmagazine.com	none	none	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:10:40.086332083 CEST	1.1.1.1	192.168.2.4	0x390b	No error (0)	www.291van.fun		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:10:40.086332083 CEST	1.1.1.1	192.168.2.4	0x390b	No error (0)	www.291van.fun		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:11:21.255609989 CEST	1.1.1.1	192.168.2.4	0x9fab	No error (0)	www.at89v2.com		103.224.212.213	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:11:42.218935013 CEST	1.1.1.1	192.168.2.4	0x1b7b	No error (0)	www.sainikshiksha.com	sainikshiksha.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 10, 2024 12:11:42.218935013 CEST	1.1.1.1	192.168.2.4	0x1b7b	No error (0)	sainikshiksha.com		103.191.209.34	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:01.850331068 CEST	1.1.1.1	192.168.2.4	0x3212	No error (0)	www.fondsa.xyz	fondsa.xyz		CNAME (Canonical name)	IN (0x0001)	false
Jul 10, 2024 12:12:01.850331068 CEST	1.1.1.1	192.168.2.4	0x3212	No error (0)	fondsa.xyz		3.33.130.190	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:01.850331068 CEST	1.1.1.1	192.168.2.4	0x3212	No error (0)	fondsa.xyz		15.197.148.33	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:22.384119987 CEST	1.1.1.1	192.168.2.4	0xd729	Name error (3)	www.huttonsidel.online	none	none	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:48.722023964 CEST	1.1.1.1	192.168.2.4	0x3e9e	Server failure (2)	www.llngx.com	none	none	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:48.722038984 CEST	1.1.1.1	192.168.2.4	0x3e9e	Server failure (2)	www.llngx.com	none	none	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:48.722381115 CEST	1.1.1.1	192.168.2.4	0x3e9e	Server failure (2)	www.llngx.com	none	none	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:12:48.723553896 CEST	1.1.1.1	192.168.2.4	0x3e9e	Server failure (2)	www.llngx.com	none	none	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:13:03.408982038 CEST	1.1.1.1	192.168.2.4	0xa372	Name error (3)	www.ajansyapai.net	none	none	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:13:25.919226885 CEST	1.1.1.1	192.168.2.4	0x1d62	No error (0)	www.tatesfluffyfrenchies.com	ext-sq.squarespace.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 10, 2024 12:13:25.919226885 CEST	1.1.1.1	192.168.2.4	0x1d62	No error (0)	ext-sq.squarespace.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:13:25.919226885 CEST	1.1.1.1	192.168.2.4	0x1d62	No error (0)	ext-sq.squarespace.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:13:25.919226885 CEST	1.1.1.1	192.168.2.4	0x1d62	No error (0)	ext-sq.squarespace.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Jul 10, 2024 12:13:25.919226885 CEST	1.1.1.1	192.168.2.4	0x1d62	No error (0)	ext-sq.squarespace.com		198.49.23.144	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.291van.fun

www.motolimod.com

www.at89v2.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	188.114.97.3	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jul 10, 2024 12:10:40.094310999 CEST	155	OUT	GET /mc10/?M6=0jqVw3fXhgUe9S01oU54GSyQct+tyOMGPM4Q+l1hxxFHWjnqq7dqR8wNeV12RES6q9dV&sZ=Ynzp6xUh HTTP/1.1 Host: www.291van.fun Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	50630	3.64.163.50	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jul 10, 2024 12:11:01.020124912 CEST	158	OUT	GET /mc10/?M6=vFB2baQv3F/rJ4Poxnbh3E5xW9PPAAbphga1xIFZj8yJGRkxzOANKPapIG+pOmwhUo5D&sZ=Ynzp6xUh HTTP/1.1 Host: www.motolimod.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 10, 2024 12:11:02.288122892 CEST	291	IN	HTTP/1.1 410 Gone Server: openresty Date: Wed, 10 Jul 2024 10:11:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 37 0d 0a 3c 68 74 6d 6c 3e 0a 0d 0a 39 0d 0a 20 20 3c 68 65 61 64 3e 0a 0d 0a 34 64 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 30 3b 20 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 6f 74 6f 6c 69 6d 6f 64 2e 63 6f 6d 2f 27 20 2f 3e 0a 0d 0a 61 0d 0a 20 20 3c 2f 68 65 61 64 3e 0a 0d 0a 38 0d 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7<html>9 <head>4d <meta http-equiv='refresh' content='0; url=http://www.motolimod.com/' />a </head>8</html>0
Jul 10, 2024 12:11:02.288314104 CEST	291	IN	HTTP/1.1 410 Gone Server: openresty Date: Wed, 10 Jul 2024 10:11:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 37 0d 0a 3c 68 74 6d 6c 3e 0a 0d 0a 39 0d 0a 20 20 3c 68 65 61 64 3e 0a 0d 0a 34 64 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 30 3b 20 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 6f 74 6f 6c 69 6d 6f 64 2e 63 6f 6d 2f 27 20 2f 3e 0a 0d 0a 61 0d 0a 20 20 3c 2f 68 65 61 64 3e 0a 0d 0a 38 0d 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7<html>9 <head>4d <meta http-equiv='refresh' content='0; url=http://www.motolimod.com/' />a </head>8</html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	50631	103.224.212.213	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Jul 10, 2024 12:11:21.261446953 CEST	155	OUT	GET /mc10/?M6=+PshiMmsD3s2EuJ9KF3baeU+rJnvgbutDGTUYWD/T/xNi6HtTgrR7YeDwlLM6QRR03T9&sZ=Ynzp6xUh HTTP/1.1 Host: www.at89v2.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Target ID:	0
Start time:	06:08:59
Start date:	10/07/2024
Path:	C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"
Imagebase:	0x7a0000
File size:	574'976 bytes
MD5 hash:	FFF69B0890FC5C9C754E17D06DEB5216
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.1701635552.0000000003B39000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:09:02
Start date:	10/07/2024
Path:	C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"
Imagebase:	0x180000
File size:	574'976 bytes
MD5 hash:	FFF69B0890FC5C9C754E17D06DEB5216
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:09:02
Start date:	10/07/2024
Path:	C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"
Imagebase:	0x850000
File size:	574'976 bytes
MD5 hash:	FFF69B0890FC5C9C754E17D06DEB5216
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:09:02
Start date:	10/07/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000004.00000002.4157684455.000000000F8A5000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	06:09:05
Start date:	10/07/2024
Path:	C:\Windows\SysWOW64\autofmt.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysWOW64\autofmt.exe"
Imagebase:	0xb90000
File size:	822'272 bytes
MD5 hash:	C72D80A976B7EB40534E8464957A979F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:09:05
Start date:	10/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\netsh.exe"
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.4141366009.0000000000AB0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.4141417095.0000000000AE0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:09:08
Start date:	10/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Users\user\Desktop\8tvMmyxveyzFcnJ.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:09:08
Start date:	10/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.7%
Total number of Nodes:	192
Total number of Limit Nodes:	20

Executed Functions

Function 0749D410 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0749D646

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 28e076635467d96318c83c3d4e5d67bd2abee3b04b51f236aa5987633fbc49bc
Instruction ID: cef66778235114d0d82b379d1f7ff123bb68edd76c7cff7d15d71714fd365652
Opcode Fuzzy Hash: 28e076635467d96318c83c3d4e5d67bd2abee3b04b51f236aa5987633fbc49bc
Instruction Fuzzy Hash: C8916DB1E0061ADFDF14DF68C940BDEBBB2BF48314F1485AAD849A7240DB749985CF92

Function 0749D40A Relevance: 1.7, APIs: 1, Instructions: 242
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0749D646

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 88801660c0b200b734457ee6085eabc2edea6a0b4d63b96b1201c0a6cf8ec099
Instruction ID: 3256b8d0c26914b5331863b6b6375c0ce28ad12f631c87b0e3ce013282de6bc1
Opcode Fuzzy Hash: 88801660c0b200b734457ee6085eabc2edea6a0b4d63b96b1201c0a6cf8ec099
Instruction Fuzzy Hash: 01916DB1E0061ADFDF14CF68C9407EEBBB2BF48314F1485AAD849A7240DB749985CF92

Function 0297B130 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0297B386

Memory Dump Source

Source File: 00000000.00000002.1700878260.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a9a60823d183f401612d56ca27235c795a669e7da19dc4137b946209dc410758
Instruction ID: a4a5c75132dbc3bcb1174e3cac0d772b19600b531fdd9adfaccb3ad5cd15ebe4
Opcode Fuzzy Hash: a9a60823d183f401612d56ca27235c795a669e7da19dc4137b946209dc410758
Instruction Fuzzy Hash: F57143B0A00B058FD724DF69D55575ABBF6FF88308F008A2DE08ADBA50DB34E945CB90

Function 050C0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 050C4381

Memory Dump Source

Source File: 00000000.00000002.1703155717.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 31f3be69c70676d486650a763c06925e8f415de708c5ee7d617f903e09b91b5c
Instruction ID: 50527f70274e54092af1d0e23b923cd3869d2979371573d4a8a31144a5b88a49
Opcode Fuzzy Hash: 31f3be69c70676d486650a763c06925e8f415de708c5ee7d617f903e09b91b5c
Instruction Fuzzy Hash: 5C4108B49002058FCB14CF99D898AAEBBF5FB89315F24C599D519AB321D774A841CFA0

Function 029744B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 029759C9

Memory Dump Source

Source File: 00000000.00000002.1700878260.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 645cc956e53ba90ba7f7ec719087223fe77232e00d49ce9b1f28a00452cf8311
Instruction ID: ece1b6ce2bdcd407077b1ddc9982ff4b4b5e9ff43f0a801278c0a7f1558870c9
Opcode Fuzzy Hash: 645cc956e53ba90ba7f7ec719087223fe77232e00d49ce9b1f28a00452cf8311
Instruction Fuzzy Hash: AA41D2B0C00719CFDB24CFAAC884B9DBBF5BF49304F6480AAD408AB255DB755945CF90

Function 0297590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 029759C9

Memory Dump Source

Source File: 00000000.00000002.1700878260.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f367dd917ff0452e907b6fa5ce6f720497100bfcd830deb657119bc29f119c75
Instruction ID: 73167ab3bf5d8b65cdf51cacd4d84ca9b6103ed9c05c38e06b79654c6950a6df
Opcode Fuzzy Hash: f367dd917ff0452e907b6fa5ce6f720497100bfcd830deb657119bc29f119c75
Instruction Fuzzy Hash: 1F41B2B1C00619CFDB24CFAAC984B8EBBF5BF49704F64806AD408AB255DB756946CF90

Function 0749D188 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0749D218

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 96493eeb4b968fc3badc542424aa65d64591a826390bb751ed9409c5cacab2e0
Instruction ID: f5b7876d4d61f4c0877be158fd5d407981042641a880c9cd5ebe0f556109af18
Opcode Fuzzy Hash: 96493eeb4b968fc3badc542424aa65d64591a826390bb751ed9409c5cacab2e0
Instruction Fuzzy Hash: CF2124B59003599FCB10CFAAC885BDEBBF5FF48310F10882AE959A7250C7789944CFA4

Function 0749D180 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0749D218

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d5a3f2a783bbcde5cd45aee4f97f909cd21b0a5b39355514639abff8ac8009e5
Instruction ID: b5c9df49e1a67f00eac083d405cd6ab898d875c2ef25fc97bcb6db1f46b76958
Opcode Fuzzy Hash: d5a3f2a783bbcde5cd45aee4f97f909cd21b0a5b39355514639abff8ac8009e5
Instruction Fuzzy Hash: 9F2137B59002199FCF00CFA9C985BDEBBF1FF48310F10842AE519A7251C7749555CFA4

Function 0297CCA0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0297D5C6,?,?,?,?,?), ref: 0297D687

Memory Dump Source

Source File: 00000000.00000002.1700878260.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bd621b35ecf494a19f04cc564000c3fbdb46060f9f2cf885783db8eee663eba4
Instruction ID: 044a3f74dc1085b3f3baf962aaa5825239d7448b9900a9917e9089e4c60ca227
Opcode Fuzzy Hash: bd621b35ecf494a19f04cc564000c3fbdb46060f9f2cf885783db8eee663eba4
Instruction Fuzzy Hash: D521E6B5900348DFDB10CF9AD584AEEBBF4EF48310F14845AE918A7310D374A940CFA4

Function 0749D271 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0749D2F8

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: bc23093e62854801be2bb5c5b3edcd57f9c96577404a026e9c41ac5f2664c5b2
Instruction ID: c16b006632203620cae5d1198d50c5e0ac977b9dc6e65037f224e273d034ab60
Opcode Fuzzy Hash: bc23093e62854801be2bb5c5b3edcd57f9c96577404a026e9c41ac5f2664c5b2
Instruction Fuzzy Hash: AF2134B6D002599FCB10CFA9C980BEEBBF1FF48320F10882AE519A7250D7789545CFA0

Function 0297D5FA Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0297D5C6,?,?,?,?,?), ref: 0297D687

Memory Dump Source

Source File: 00000000.00000002.1700878260.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ccb4e47cda2b5ea7e610ff9c9cb72657a9232fb06cae00b631ac80c83369c400
Instruction ID: 1cf43e1c9ab7428ba3a76c59b79674c74af8d9af66fbaf870df0837944c0fa66
Opcode Fuzzy Hash: ccb4e47cda2b5ea7e610ff9c9cb72657a9232fb06cae00b631ac80c83369c400
Instruction Fuzzy Hash: 7021B3B59002589FDB10CF9AD984ADEBBF8FB48314F14841AE958A7350D374A944CFA5

Function 0749D278 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0749D2F8

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d331bf4256a8beb0732e6d6226e1383be66760e654bacee72fd323341cfe59bf
Instruction ID: 9f3ac9874d5586a1604d3652930f60b52ec832a856d9ac426d65fa24c0411aba
Opcode Fuzzy Hash: d331bf4256a8beb0732e6d6226e1383be66760e654bacee72fd323341cfe59bf
Instruction Fuzzy Hash: 302114B1D002599FCB10DFAAC880AEEBBF5FF48320F10842AE559A7250C7789944CBA4

Function 0749CFF0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0749D06E

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f01abed220488d5d22119083cf27b7ab22a891cc2819e2d5cf21a36bfdb8cbdd
Instruction ID: 09ecc205d953cf15d5a92bd074dd6cfdcd2964c2c687a251d427d94bff58538d
Opcode Fuzzy Hash: f01abed220488d5d22119083cf27b7ab22a891cc2819e2d5cf21a36bfdb8cbdd
Instruction Fuzzy Hash: DA2118B1D002098FDB10DFAAC485BEEBBF4EF88324F14842AD559A7241D7789945CFA5

Function 0749CFE9 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0749D06E

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b83af40c6ce72c377719d0f510eb6dc9e5b87c200011b866b6d801dac9e3b828
Instruction ID: 51b888e87cd4479471f41f00a2b53e82c70d615323e804200197d79ada212a53
Opcode Fuzzy Hash: b83af40c6ce72c377719d0f510eb6dc9e5b87c200011b866b6d801dac9e3b828
Instruction Fuzzy Hash: 772138B1D00209CFDB10DFA9C585BEEBBF4EF88314F14842AD459A7241C7789945CFA4

Function 0297AB70 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0297B401,00000800,00000000,00000000), ref: 0297B612

Memory Dump Source

Source File: 00000000.00000002.1700878260.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e566ab5dc3bebb9f0700cea6c68b8bea147e71c6b0afad83092643112921d314
Instruction ID: cbb8fc7cab5ccd0b3df3289906b4456d85aed792e0d8dda8d2a860a93453023d
Opcode Fuzzy Hash: e566ab5dc3bebb9f0700cea6c68b8bea147e71c6b0afad83092643112921d314
Instruction Fuzzy Hash: EF1114B69003488FDB10CF9AC444ADEFBF4EB48324F14842AD519A7210C375A545CFA4

Function 0749D0C8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0749D136

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b5055c39e688c0f3278e73f8a62d736a5ba703712ccb5a5343513b3a6c9ade70
Instruction ID: 00038be19981e7c044497db3b058bf229fbc4e43e12827a9a118a3bf1876249b
Opcode Fuzzy Hash: b5055c39e688c0f3278e73f8a62d736a5ba703712ccb5a5343513b3a6c9ade70
Instruction Fuzzy Hash: 591126B29002499FCB10DFAAC845BDEBFF5EB88320F10842AE559A7250C775A544CFA4

Function 0297B5A0 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0297B401,00000800,00000000,00000000), ref: 0297B612

Memory Dump Source

Source File: 00000000.00000002.1700878260.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: daaf17fe1d482ba04dff1f55f5e394e737959274d585c7fffce3e3f6ef343009
Instruction ID: 01cdd5e74c762da97d709bbd3fa78aca8ae53f47791ba8bee85e0c6246d28f75
Opcode Fuzzy Hash: daaf17fe1d482ba04dff1f55f5e394e737959274d585c7fffce3e3f6ef343009
Instruction Fuzzy Hash: 9411F3B6D003498FDB10CF9AC944BEEFBF9EB48324F14842AE559A7210C379A545CFA4

Function 0749D0C1 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0749D136

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: aa1b54a18b84fd28d54f567add09b25958da1d1c45bd3cc298cf1167271c6b04
Instruction ID: 543b5da7ffaf8b88911dbd01419c9df46d47b3f71f01b387e59970cd11f86fde
Opcode Fuzzy Hash: aa1b54a18b84fd28d54f567add09b25958da1d1c45bd3cc298cf1167271c6b04
Instruction Fuzzy Hash: 301156B6900249CFCB10DFA9C945BDEBFF5EF88320F14881AD559A7250C735A544CFA4

Function 0749CF38 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0749CFA2

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 46da298c0c4d956226e8cc29147014dd52fd724e54f39e3d30bdc7e85912c2af
Instruction ID: 4c06d6f40e2417260b6cedb6964e41003068994c745b1225b9bd9406f06098f0
Opcode Fuzzy Hash: 46da298c0c4d956226e8cc29147014dd52fd724e54f39e3d30bdc7e85912c2af
Instruction Fuzzy Hash: 5A1158B1D002498FCB20DFAAC445BDEFFF4EF88324F24842AD419A7240D774A944CBA4

Function 0749CF40 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0749CFA2

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 56b372b016e9f4ee7ea6b9b908d69969adf7325ef8144a1603b2e35387833024
Instruction ID: 8eb9d54d62a8400f1cc8de4ba1c8c9fe4522106fb14cc01db5246a254a05ecde
Opcode Fuzzy Hash: 56b372b016e9f4ee7ea6b9b908d69969adf7325ef8144a1603b2e35387833024
Instruction Fuzzy Hash: 791125B19002498FCB20DFAAC4457DEFFF4EB88324F20842AD459A7250DB75A944CBA4

Function 0297B320 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0297B386

Memory Dump Source

Source File: 00000000.00000002.1700878260.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c705d16c0636d15df15983e6132b1fe398369a6b6a072c43456d95efd0e75e6f
Instruction ID: 4fefff87cd48e7910e69c16ea0982b74a26affb89a15fbcb4991dfe238b47b26
Opcode Fuzzy Hash: c705d16c0636d15df15983e6132b1fe398369a6b6a072c43456d95efd0e75e6f
Instruction Fuzzy Hash: DA11DFB5D007498FCB14DF9AC444ADEFBF8AB88328F10846AD459A7210C375A585CFA5

Function 07496150 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0749FB5D

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8c2f27513691a26d62891fbcb6251fe4024bdbfe583f94c49bd4fb605976f677
Instruction ID: b1e44dcc041da30756dd80413717a3ae615cb870335eda00a0aa5e9f171df4f4
Opcode Fuzzy Hash: 8c2f27513691a26d62891fbcb6251fe4024bdbfe583f94c49bd4fb605976f677
Instruction Fuzzy Hash: 0711F5B58003499FCB10DF9AD485BEEBFF8EB48310F10845AE558A7200D375A944CFA5

Function 00E3D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700129539.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e3d000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3fcb6fb83ff8fd004dddd6029baf4d923fa7a3c78eeef9e9903283c5793892b
Instruction ID: a053d95d6b0b92a61337410774579f7804fb389b040902e4695184aea9b56098
Opcode Fuzzy Hash: f3fcb6fb83ff8fd004dddd6029baf4d923fa7a3c78eeef9e9903283c5793892b
Instruction Fuzzy Hash: 01213771508240EFCB05DF14EDC8B27BF65FB98318F20C569E8095B256C336D856CBA1

Function 00E3D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700129539.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e3d000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5fe7f6c16ff749fb6012b6e043bf18f9ba53723f70895e82c4af26e9c26e3c
Instruction ID: 754cb8568b403c4cd182a901b411dc7676a6b61f4fdea7e12c27543662cb4a10
Opcode Fuzzy Hash: 3d5fe7f6c16ff749fb6012b6e043bf18f9ba53723f70895e82c4af26e9c26e3c
Instruction Fuzzy Hash: 5A213771508204DFDB05DF14EDC8B2ABF65FB98328F20C169E9095B256C336E856CBA2

Function 00E4D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700236197.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b7f206f719da5e48fb2c444ad7e470da88c525b2aebfdc7c41623dd46eeb40
Instruction ID: 6536643e8ada61f01ab5b7063d48cf7e115563ec4f9ea71099230ec67ab213ab
Opcode Fuzzy Hash: 00b7f206f719da5e48fb2c444ad7e470da88c525b2aebfdc7c41623dd46eeb40
Instruction Fuzzy Hash: 63214971608200DFCB01DF14EDC0B26BBA5FB84318F20C66DE8095B361C3B6D846CA65

Function 00E4D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700236197.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce9282064178758bc62402a70ecb47ee6d9f10896dd51401f164a95f04a30f73
Instruction ID: 2bd4ec3892e04f8fcea28390ad8970b9e78b11edf460b9306d494c8e297fb27b
Opcode Fuzzy Hash: ce9282064178758bc62402a70ecb47ee6d9f10896dd51401f164a95f04a30f73
Instruction Fuzzy Hash: 2B210471608200DFCB14DF14E9C4B26BFA6FB84318F20C56DD80A5B396C33AD847CA61

Function 00E4D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700236197.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b94599b01788595bb2177a67f003f7a866502216f715daa2e07db1e370a68ef
Instruction ID: adb6b0bf64ec70dded88b1d22e990cdd1801fd421b2966916b7e00c5b5dbe626
Opcode Fuzzy Hash: 6b94599b01788595bb2177a67f003f7a866502216f715daa2e07db1e370a68ef
Instruction Fuzzy Hash: 7821837550D3808FCB02CF24D994715BF71EB46314F28C5EAD8498F2A7C33A980ACB62

Function 00E3D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700129539.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e3d000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 5ef47d6b489b8f543017d49d86300702a16d40700cfbe5d93199277d323aa85b
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 9811E676504280DFCB16CF14E9C4B16BF71FB94328F24C6A9DC494B656C336D85ACBA1

Function 00E3D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700129539.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e3d000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: fccfd203ef65d855980b47aeefe8fe0bb93abf8b86b91b30d17630bd30eb301f
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 34110372404240CFCB12CF10E9C4B16BF71FB94328F24C2A9D8090B256C33AE85ACBA1

Function 00E4D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700236197.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 62537df0891861fb48ec09580f84bc6a283946371a911ed30dd4b22f9d164ef6
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: C011BB75908280DFCB02CF50D9C4B15BBA1FB84318F24C6AAD8494B6A6C37AD81ACB61

Function 07480258 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704630207.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf47e03c4b3b2196ba212dca2d36be4d2bc92fc9a95961787a84bb98d84cac78
Instruction ID: e46d7314dbc3b1b6deb6ba4f56ddb71137986b45aba3f2b347b9ec51a7f075e0
Opcode Fuzzy Hash: bf47e03c4b3b2196ba212dca2d36be4d2bc92fc9a95961787a84bb98d84cac78
Instruction Fuzzy Hash: BE015EB491425ADFCB11DFA4C4487EEBFF0AB07301F1844DAA464B72E2C7784A45DB55

Function 07480268 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704630207.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054c8f6e27a1472df81a12d145d8878a9f5cd1c3d73efcb6178ddb95597487d2
Instruction ID: d2858e91c6944b2c0192a707ad68ad392244a2a4e6d00afd4c80c1a1acb672d7
Opcode Fuzzy Hash: 054c8f6e27a1472df81a12d145d8878a9f5cd1c3d73efcb6178ddb95597487d2
Instruction Fuzzy Hash: 62012CB4D04219DFCB54DFA5C808BFEBBF0AB4A301F0484AAA469B32A1D7B44A44DF54

Non-executed Functions

Function 050C0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703155717.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ed7e0bc570795156885bc95d34eabb2ae852f5857d2162224d0766b46339a0
Instruction ID: 714c5f8ec2b1a3da1312d4b1adf67ad5c46bcc2ff9342c1f277a86a6e62780c0
Opcode Fuzzy Hash: d3ed7e0bc570795156885bc95d34eabb2ae852f5857d2162224d0766b46339a0
Instruction Fuzzy Hash: 4C1260B0422B468ED7208F65ED4E18D7EB1BBC5398B504209E2656F6E1DFBC114BCF4A

Function 0749C718 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983afac40b8e04d06fc2bb7cbb83192d905570a74b352573c42670dc40974765
Instruction ID: 87357e1392516a8de61aa5711a8bdddf862cee10d8e17a6935147a300f55aac7
Opcode Fuzzy Hash: 983afac40b8e04d06fc2bb7cbb83192d905570a74b352573c42670dc40974765
Instruction Fuzzy Hash: C4E1C8B4E001198FDB14DFA9C5809AEFBF2FF89305F24816AD415A7356DB31A941CFA1

Function 0749A7D0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83eb545878c00f1456da30ca9721dc12370f007bf3278caf41a34ae3812539b
Instruction ID: c9ffb5b7a54ce3f0a63004be2c9653e9fdefdbab552d7617079af06d3e7daa65
Opcode Fuzzy Hash: e83eb545878c00f1456da30ca9721dc12370f007bf3278caf41a34ae3812539b
Instruction Fuzzy Hash: F6E1D7B4E001198FCB14DF99C6849AEBBF2FB89305F24C16AD415AB356DB31AD41CFA0

Function 0749C2E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd2c18c2c7bfd4c35103e6c9090045e0fa995d32483818d3a330e3bb77d69b7
Instruction ID: 7069789fc5e90408ec057f66804a9e21ea9fb5974ed97de4a988ea1d44d4772f
Opcode Fuzzy Hash: 7bd2c18c2c7bfd4c35103e6c9090045e0fa995d32483818d3a330e3bb77d69b7
Instruction Fuzzy Hash: A1E1EAB4E001198FDB14DFA9C6809AEBBF2FF89305F24916AD415A7356DB31AD41CFA0

Function 0749B040 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d6ba9997b18190713fd53ffcad2236d93ccf9c1c93029e9a62ad390c4cd8d8
Instruction ID: 50de2d8d9153eb251d2f54090cb8b4d35422b914037fb9b8eab840633acb6d58
Opcode Fuzzy Hash: 18d6ba9997b18190713fd53ffcad2236d93ccf9c1c93029e9a62ad390c4cd8d8
Instruction Fuzzy Hash: 1FE1E9B4E001198FCB14DFA9D5819AEBBF2FF89305F24816AD414AB356DB31AD41CF61

Function 0749AC08 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ceb2f675c34c775fe7606daffcc40fea6035c94cb4bff4b596d6a136cccf3a
Instruction ID: cfcad7aac58f43a3467fb9792de0a2a605db59e062b943e7b544de4d5ccad66e
Opcode Fuzzy Hash: a9ceb2f675c34c775fe7606daffcc40fea6035c94cb4bff4b596d6a136cccf3a
Instruction Fuzzy Hash: 92E1B9B4E001198FDB14DFA9D5809AEBBF2FF89305F24C16AD414AB355DB31A941CFA1

Function 074921D7 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b9a00e621be191c8e44e5ba0585c06d6cde92c14f8f57357eaa53008dcca2d7
Instruction ID: 19756d17738cb997ad04fc60d119b57a91e80ece1a4fbe224671d24d123a36e9
Opcode Fuzzy Hash: 8b9a00e621be191c8e44e5ba0585c06d6cde92c14f8f57357eaa53008dcca2d7
Instruction Fuzzy Hash: 7DD1EA31920B5A9ACB11EB64D990A9DF7B1FF95300F109B9AE00937615EB70AAC9CF41

Function 0297DF74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1700878260.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe07af77917a23e3bd594b8093f6bf22a6ede1e7f4a9520bade21f7a14531a5
Instruction ID: dc9db5f6aaba5a28372b3a29f2bbbd619fed15573aea66c47dbd09aaa0947f3a
Opcode Fuzzy Hash: fbe07af77917a23e3bd594b8093f6bf22a6ede1e7f4a9520bade21f7a14531a5
Instruction Fuzzy Hash: 57A17E32A10205CFCF15DFB4C9805AEBBB6FF84300B1585AAE805BB265DB75E946CF90

Function 074921E8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704650898.0000000007490000.00000040.00000800.00020000.00000000.sdmp, Offset: 07490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7490000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b38acf0520ac0832f7c90cec9085b11b4027330eaf7878b765de6bf44cde4d00
Instruction ID: 7dd4db5edc0b8a52357312a906446fcfa37f7a525df93d7ca7f834b1a0a96efe
Opcode Fuzzy Hash: b38acf0520ac0832f7c90cec9085b11b4027330eaf7878b765de6bf44cde4d00
Instruction Fuzzy Hash: 5DD1E931920B5A9ACB11EF64D990A9DF7B1FF95300F10DB9AE00937615EB70AAC9CF41

Function 050C0A10 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703155717.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5137e40d1f2bb78d52288ab9bd848512f0b375c67f82ca89333f4a6fa2f35f8
Instruction ID: f5e5ec2330e7e222a230b51fdca46b35da738b2b0c86df3380d540cd850fae9b
Opcode Fuzzy Hash: a5137e40d1f2bb78d52288ab9bd848512f0b375c67f82ca89333f4a6fa2f35f8
Instruction Fuzzy Hash: D1A100B1D147499FCB14CFA9D884ADEBBB1FF89300F24826EE419AB251D7709885CF91

Function 050C0006 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1703155717.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50c0000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c94320e7c7166d47883e2115fd0c5b591918a54c4fd1498281be4384cc2ee97
Instruction ID: 4b8406cc0c7e490a8985f5aaac011560371d2739247b4dc3823fa3e7064903d0
Opcode Fuzzy Hash: 7c94320e7c7166d47883e2115fd0c5b591918a54c4fd1498281be4384cc2ee97
Instruction Fuzzy Hash: 76C1C1B0821B468ED720CF65EC4A28D7FB1BBC5368B554209E1616F6E1DFB8144BCF4A

Analysis Process: 8tvMmyxveyzFcnJ.exePID: 7164, Parent PID: 6740COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	2.7%
Signature Coverage:	5.8%
Total number of Nodes:	549
Total number of Limit Nodes:	66

Executed Functions

Function 0041A40A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A455

Strings

rMA, xrefs: 0041A432, 0041A440
1JA, xrefs: 0041A42C, 0041A438
rMA, xrefs: 0041A44D, 0041A454

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: 1JA$rMA$rMA
API String ID: 2738559852-782607585
Opcode ID: da9dca5e340969b0e19fdfb2769eff91311bbc90f038b01d9c4a8653d3c13b5c
Instruction ID: d9f3efcc6fba735fe827f6fd57d323a72c1d16cfd7affead5f3e42ca52de0d7b
Opcode Fuzzy Hash: da9dca5e340969b0e19fdfb2769eff91311bbc90f038b01d9c4a8653d3c13b5c
Instruction Fuzzy Hash: 81F0A9B2200208AFCB14DF99DC81DEB77A9EF8C754F158249BA1DA7241D634E951CBE4

Function 0041A410 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A455

Strings

rMA, xrefs: 0041A432, 0041A440
1JA, xrefs: 0041A42C, 0041A438
rMA, xrefs: 0041A44D, 0041A454

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: 1JA$rMA$rMA
API String ID: 2738559852-782607585
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: c6e97d42c3e85b78cd3a41c20c82dd28da71633a8e67c8174f08c115ef6e08ba
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 87F0B7B2200208AFCB14DF89DC81EEB77ADEF8C754F158249BE1D97241D630E851CBA4

Function 0040ACF0 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD62

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
Instruction ID: bd03027937dafe21d6f438616a486266aae6a772261e1344982784e00def1180
Opcode Fuzzy Hash: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
Instruction Fuzzy Hash: 80015EB5E0020DBBDF10DBA1DC42FDEB3789F54308F0045AAA908A7281F634EB548B95

Function 0041A35F Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00409CF3,?,00414BB7,00409CF3,FFFFFFFF,?,?,FFFFFFFF,00409CF3,00414BB7,?,00409CF3,00000060,00000000,00000000), ref: 0041A3AD

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4049a3bf42b563136c493a9652f10bd73eeb14a36f32a88b936d0f677cb3cfab
Instruction ID: b0ea305ca0179594be26f88849999d72c403b9e7c25092e2012cfb502ab0554f
Opcode Fuzzy Hash: 4049a3bf42b563136c493a9652f10bd73eeb14a36f32a88b936d0f677cb3cfab
Instruction Fuzzy Hash: FEF0BDB2205208AFCB48CF88DC85EEB37EDAF8C754F158248BA0DD7241D630E8518BA4

Function 0041A360 Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00409CF3,?,00414BB7,00409CF3,FFFFFFFF,?,?,FFFFFFFF,00409CF3,00414BB7,?,00409CF3,00000060,00000000,00000000), ref: 0041A3AD

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 1571a74e51eef41835f20cf1113afde9e84efeac6e640e2865a3d9423fa4fe5b
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: FEF0BDB2201208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Function 0041A53A Relevance: 1.5, APIs: 1, Instructions: 32
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B134,?,00000000,?,00003000,00000040,00000000,00000000,00409CF3), ref: 0041A579

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 5c48dbb4db2addaba0cea100d782742fbf10658976ab14c12c095cf639fd573d
Instruction ID: 82a71e247ab1e51189810cadd825386097fb7f7a34c392186ae9d553c9c6a0ab
Opcode Fuzzy Hash: 5c48dbb4db2addaba0cea100d782742fbf10658976ab14c12c095cf639fd573d
Instruction Fuzzy Hash: 5EF058B2200208AFDB14DF99CC81EEB77B9EF88354F158558FE4DA7241C630E821CBA0

Function 0041A540 Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B134,?,00000000,?,00003000,00000040,00000000,00000000,00409CF3), ref: 0041A579

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: 60dc777ab2a5703fe93ec60752bbea5a413bae98553eb5929f98badcd8fbe991
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: B2F015B2200208ABCB14DF89CC81EEB77ADEF8C754F158149BE0897241C630F811CBA4

Function 0041A48A Relevance: 1.5, APIs: 1, Instructions: 23nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A4B5

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: cd4cd9b3938568fcee11681b6c846c76ac88f6db5cd9fb966552161bd42c3cf2
Instruction ID: eea82b31076ec0d138028a2a42476fb395de81841b37d259ef3cf74a12bfe863
Opcode Fuzzy Hash: cd4cd9b3938568fcee11681b6c846c76ac88f6db5cd9fb966552161bd42c3cf2
Instruction Fuzzy Hash: 93E086712001147FD711DFA8DC45EE73B6CEF88730F244559B91D97291D130E6118790

Function 0041A490 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A4B5

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: a008c5d5ec14fa9f5013d94ab86a46559dd82bf248144eb087863a0ac6a31d62
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: F7D01776200218ABD710EB99CC85EE77BACEF48B64F158499BA1C9B242C530FA1086E0

Function 013F2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2B6A

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d208d12b4b75d97e9a929b357e383fee6bb45a784ed539da1641cc64d77f1b62
Instruction ID: b04462930b64444472992489cf7867f9500ee920909b320a7d27ae53cfb9f1af
Opcode Fuzzy Hash: d208d12b4b75d97e9a929b357e383fee6bb45a784ed539da1641cc64d77f1b62
Instruction Fuzzy Hash: 4990026161280143410671594514616400A97F0201B55C032E10145D5DC63589D16625

Function 013F2BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2BFA

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9a4d2e2a829355d9e8d2ea84772a699bd1bad711a484aa17fce7e11ee2075261
Instruction ID: 9dd3d6852a32a5dc1681b0446b91f4ea8ada641ffe62a0c62f8b351ad2be71a0
Opcode Fuzzy Hash: 9a4d2e2a829355d9e8d2ea84772a699bd1bad711a484aa17fce7e11ee2075261
Instruction Fuzzy Hash: 2E90023161180942D1817159450464A000597E1301F95C026A0025699DCB358B997BA1

Function 013F2AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2ADA

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b2218faa09ebe26234943c544ffabbafc8a17aee03803644d226be50c7dc1afe
Instruction ID: b94ff99e4ae1cf3893ccb3da1d07755c33cba2f4c002eceb066e6a52469c29f0
Opcode Fuzzy Hash: b2218faa09ebe26234943c544ffabbafc8a17aee03803644d226be50c7dc1afe
Instruction Fuzzy Hash: 4F900225621801430106B5590704507004697E5351355C032F1015595CD73189A15621

Function 013F2D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2D3A

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2a095cb38ca433d3508dee535f10912eff9a6ab77af6e71cf74236239f02510d
Instruction ID: 1a73d034470c272ec62f72be95b3df8f1b9e506cb41fd57f39028bdb9bc80c12
Opcode Fuzzy Hash: 2a095cb38ca433d3508dee535f10912eff9a6ab77af6e71cf74236239f02510d
Instruction Fuzzy Hash: 1990022171180143D141715955186064005E7F1301F55D022E0414599CDA3589965722

Function 013F2D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2D1A

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0a3e9d628daddd4a5c7b3c783b0aee48db092d28d1c6cadd91bb84d07f7615c6
Instruction ID: 77900da0c02f8d5bed2c7325aef9f96b2ca3627c205a286beeed864687099072
Opcode Fuzzy Hash: 0a3e9d628daddd4a5c7b3c783b0aee48db092d28d1c6cadd91bb84d07f7615c6
Instruction Fuzzy Hash: C990022962380142D1817159550860A000597E1202F95D426A001559DCCA3589A95721

Function 013F2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2DFA

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 56a08a3936f89341aba5a2d687c57eb08a992b10046c0bbf8e0dd95a94d0ec11
Instruction ID: c1f91a5473c388d4e295ec2b9208c2d6c648bfc0214ac60bfb8534ea61156d2d
Opcode Fuzzy Hash: 56a08a3936f89341aba5a2d687c57eb08a992b10046c0bbf8e0dd95a94d0ec11
Instruction Fuzzy Hash: 0F90023161180553D11271594604707000997E0241F95C423A042459DDD7768A92A621

Function 013F2DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2DDA

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 72cde6163dae4f3f70a6ba2d8bd77392838c8edf73eeb2587db24ab7ade9bdcb
Instruction ID: ae56a6fc7267ee771b6fd9efa93172b67a0dd7ace343ebfed6081d6e1a7f7561
Opcode Fuzzy Hash: 72cde6163dae4f3f70a6ba2d8bd77392838c8edf73eeb2587db24ab7ade9bdcb
Instruction Fuzzy Hash: D9900221652842925546B15945045074006A7F0241795C023A1414995CC6369996DB21

Function 013F2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2C7A

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 26abf816c0bd0d527bd554ced65dc960d12b95e29249d2c296c8777527dcfe12
Instruction ID: 588fe6cd9f00427923295f1e6f00f600b68916a487e5e663b196aed6db70798d
Opcode Fuzzy Hash: 26abf816c0bd0d527bd554ced65dc960d12b95e29249d2c296c8777527dcfe12
Instruction Fuzzy Hash: 8390023161188942D1117159850474A000597E0301F59C422A442469DDC7B589D17621

Function 013F2CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2CAA

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 629aba4f87020cc04c501b4c1f5e0876edfc5168b70f85239aba709ecbce8861
Instruction ID: f3e51471236954a8844cd96be8afc5d239b5dbb3e72e5230e4107833c4f73e97
Opcode Fuzzy Hash: 629aba4f87020cc04c501b4c1f5e0876edfc5168b70f85239aba709ecbce8861
Instruction Fuzzy Hash: E590023161180542D10175995508646000597F0301F55D022A502459AEC77589D16631

Function 013F2F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2F3A

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ad21fef94bac7f0e79fb4939eb4f24c05dbbbdd16aa91b6548710ab53a1d94a6
Instruction ID: fb92b34038529c54098faeb211e5e05ff32b140b6076f0cb61388313516acff6
Opcode Fuzzy Hash: ad21fef94bac7f0e79fb4939eb4f24c05dbbbdd16aa91b6548710ab53a1d94a6
Instruction Fuzzy Hash: 3890026175180582D10171594514B060005D7F1301F55C026E1064599DC739CD926626

Function 013F2FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2FBA

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 828b5acacdfa36c9fbb949f903d4449613c81e7b35289ee2dd40660ede63364b
Instruction ID: c2b5fc2d5a20dbc90f76d067d55e38de03c518b919734ca72a028cb1cf4b5cb0
Opcode Fuzzy Hash: 828b5acacdfa36c9fbb949f903d4449613c81e7b35289ee2dd40660ede63364b
Instruction Fuzzy Hash: E0900221A11801824141716989449064005BBF1211755C132A0998595DC67989A55B65

Function 013F2F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2F9A

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 77d5fdf32d889c85e7123603595057a7bef3e6d3636ca9e9617c98da67963b6d
Instruction ID: a7c696121c9ce28c566e8f2a823ff29dd7cadda9083a310d9dc51ad92fc3f755
Opcode Fuzzy Hash: 77d5fdf32d889c85e7123603595057a7bef3e6d3636ca9e9617c98da67963b6d
Instruction Fuzzy Hash: 2E900231611C0542D1017159491470B000597E0302F55C022A116459ADC73589916A71

Function 013F2FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2FEA

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cc1187fdac668db936ee0ec9bca2f1f97f7f15f4d3c2bcbcff0047bf87a88e21
Instruction ID: b759bf00f82472ca03463fdc274b13b8128b21af2243890893ae4fbf17d392d6
Opcode Fuzzy Hash: cc1187fdac668db936ee0ec9bca2f1f97f7f15f4d3c2bcbcff0047bf87a88e21
Instruction Fuzzy Hash: 4B900221621C0182D20175694D14B07000597E0303F55C126A0154599CCA3589A15A21

Function 013F2EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2EAA

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6baadb38c815acfd41156cf3241b88e2f11f97e86d70f2d39bdd9235a0e3aa97
Instruction ID: d60d58dc601e7c5d857c73e2f9e4762801d51b0af1150357633be40b7a96df7b
Opcode Fuzzy Hash: 6baadb38c815acfd41156cf3241b88e2f11f97e86d70f2d39bdd9235a0e3aa97
Instruction Fuzzy Hash: 0B90027161180542D14171594504746000597E0301F55C022A5064599EC7798ED56B65

Function 013F2E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2E8A

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2c532ceadafe775573fa0acf4455da864b0a68356b5ef2935d6e608f65ffe58a
Instruction ID: 5bda666a619403412e6fef4579ff928c7c6938de5f9018f84788daef187ef303
Opcode Fuzzy Hash: 2c532ceadafe775573fa0acf4455da864b0a68356b5ef2935d6e608f65ffe58a
Instruction Fuzzy Hash: 2D900221A1180642D10271594504616000A97E0241F95C033A102459AECB358AD2A631

Function 00409AB0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf70d19deb8b7dbf65a1c14f2d3141162741e3067e6603a799ea80fa30cdc1c2
Instruction ID: 0b46cc9625fd597f0f1293e0fe630cc8c1f9f1e3f005c30533d49d025d22dd75
Opcode Fuzzy Hash: bf70d19deb8b7dbf65a1c14f2d3141162741e3067e6603a799ea80fa30cdc1c2
Instruction Fuzzy Hash: 97210AB2D4020857CB25D674AD52BFF73BCAB54314F04007FE949A3182F638BE498BA5

Function 0041A630 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(6EA,?,00414CAF,00414CAF,?,00414536,?,?,?,?,?,00000000,00409CF3,?), ref: 0041A65D

Strings

6EA, xrefs: 0041A652, 0041A65C

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: 6EA
API String ID: 1279760036-1400015478
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: b63900df46c74d48569035b2bcc9be016157083d4ef88d1b541c797289a4eec1
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 46E012B1200208ABDB14EF99CC41EA777ACEF88664F158559BA085B242C630F9118AB0

Function 00408308 Relevance: 1.6, APIs: 1, Instructions: 58
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: ad6e92db074ec06a213529fc4cf0a505365d433dce961343fd20306699894531
Instruction ID: 5992b9be4baf2c7b566ef3647458cd36ce21ba925a148f2579bd006564dde71f
Opcode Fuzzy Hash: ad6e92db074ec06a213529fc4cf0a505365d433dce961343fd20306699894531
Instruction Fuzzy Hash: 9601D871A9032877E721A6959C43FFE7B6C9B44F94F04011DFF04BA1C2EAE8690543EA

Function 00408310 Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: eeb461d9a93cfa80389428809ed4c10d2a707c26e4e5d313531af448f679d8da
Instruction ID: fe648ddaccc693dff6b318d6e20673cc1517f8ca6da234ac2c2ad493b9bfa733
Opcode Fuzzy Hash: eeb461d9a93cfa80389428809ed4c10d2a707c26e4e5d313531af448f679d8da
Instruction Fuzzy Hash: FF018431A8032C76E721A6959C43FFE776C5B40F54F05011AFF04BA1C2EAA8690546EA

Function 0041A663 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A69D

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c6bfbd0e50fad47e42f28fde3aa2b8a84a11a10a947687da3d496739955b5f60
Instruction ID: 24307b1b16fdc674b1b2a46e27d06997c9a9b4145e39e254628283c940cb61d2
Opcode Fuzzy Hash: c6bfbd0e50fad47e42f28fde3aa2b8a84a11a10a947687da3d496739955b5f60
Instruction Fuzzy Hash: 37E065B51142146FD724DF68CC48E9B776CDF48A54F118659B95857291C530E91087A0

Function 0041A7C9 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A800

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6eef14145c37bd4ce939ac30feff25a05528fb10757d3c4a07bdb24ae85c2ea4
Instruction ID: af75529915aef102090087d8ecb2994e73b38dbc4dd88fb73fd8a3c03c61f894
Opcode Fuzzy Hash: 6eef14145c37bd4ce939ac30feff25a05528fb10757d3c4a07bdb24ae85c2ea4
Instruction Fuzzy Hash: 28E06DB12002086FCB24DF65CC85EDB3769EF49350F118158F90D97241CA35E8118BB0

Function 0041A670 Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A69D

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 086aab0bc8c344d6c60c9bbd5a0512cabfd8005857d16272e4a7e29987098a06
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: C1E012B1200208ABDB18EF99CC49EA777ACEF88764F118559BA085B242C630E9108AB0

Function 0041A7D0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A800

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 3f9aab8e47c10174471559fee5d267dc63a882ce56825bdd12c8e63267ac542a
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 23E01AB12002086BDB10DF49CC85EE737ADEF88654F118155BA0C57241C934E8118BF5

Function 0041A6B0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6D8

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 671013aba82168957284564a3a9f05bc2528e3e40ec9789e05460755300894f7
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 68D017726002187BD620EB99CC85FD777ACDF48BA4F1580A9BA1C6B242C531BA108AE1

Function 013F2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013F2C24

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: be1a45ff1c783afca4ed5f8db2847d83c70a74692a8304be6e2f9e853d9c4056
Instruction ID: 40f17b9abc4e5a11b7234fde54eca58a87b5f9aed2c49df71f13bedcf31bee13
Opcode Fuzzy Hash: be1a45ff1c783afca4ed5f8db2847d83c70a74692a8304be6e2f9e853d9c4056
Instruction Fuzzy Hash: 26B09B71D019C5C5DE12E76447087177900B7D0705F15C076D3030686F8738C1D1E675

Non-executed Functions

Function 01432349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON

Download Yara Rule

Strings

@, xrefs: 01432B74
UseImpersonatedDeviceMap, xrefs: 0143251C
MaxDeadActivationContexts, xrefs: 01432D82
FrontEndHeapDebugOptions, xrefs: 01432489
RaiseExceptionOnPossibleDeadlock, xrefs: 01432579
ExecuteOptions, xrefs: 014325A0
DisableExceptionChainValidation, xrefs: 0143275F
ShutdownFlags, xrefs: 014324A1
UnloadEventTraceDepth, xrefs: 014324C0
LdrpInitializeExecutionOptions, xrefs: 0143317D
MaxLoaderThreads, xrefs: 014324EC
CFGOptions, xrefs: 01432967
GlobalFlag, xrefs: 01432F3F, 01433059
TracingFlags, xrefs: 01432549
GlobalFlag2, xrefs: 01432FC0
@, xrefs: 01432942
DisableHeapLookaside, xrefs: 0143246D
Initializing the application verifier package failed with status 0x%08lx, xrefs: 01433176
MinimumStackCommitInBytes, xrefs: 01432BB0
minkernel\ntdll\ldrinit.c, xrefs: 01433187

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
API String ID: 0-2160512332
Opcode ID: 57a4aaba3fd7b6091dec39b91a55d8271e8afc12d2db20e78ca99cf338697e31
Instruction ID: 0690fbc85b6e39226d86efc5590c0ad3a02e0fd217d974e5ad1ae8dc7e2427fc
Opcode Fuzzy Hash: 57a4aaba3fd7b6091dec39b91a55d8271e8afc12d2db20e78ca99cf338697e31
Instruction Fuzzy Hash: 33928E71604342ABE725DF29C841F6BBBE8BB88754F04491EFA94D7360D7B0E845CB92

Function 014612ED Relevance: 11.8, Strings: 9, Instructions: 515COMMON

Download Yara Rule

Strings

Heap block at %p is not last block in segment (%p), xrefs: 014617B7
Heap block at %p has incorrect segment offset (%x), xrefs: 0146181A
HEAP[%wZ]: , xrefs: 014616CD, 014616F9, 01461749, 0146179B, 014617FC, 01461840, 014618D9
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 014618A5
HEAP: , xrefs: 01461706, 01461756, 014617A8, 01461809, 0146184D, 01461895, 014618E6
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 0146176D
Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 0146186B
Free Heap block %p modified at %p after it was freed, xrefs: 0146171B
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 014618F8

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 0-3591852110
Opcode ID: 4915862e755b5d441fcfc379916cf48e33ee602334ef286fedebb6e85405fea6
Instruction ID: 68d097e5d54a4c8e506d4ad0f3b3e78698075fc68937b6e9b385581a2c2b37a5
Opcode Fuzzy Hash: 4915862e755b5d441fcfc379916cf48e33ee602334ef286fedebb6e85405fea6
Instruction Fuzzy Hash: 5D12AE34600642DFD7259F29C441BBABBF9FF99B18F08845EE4868B761D734E881CB52

Function 013AD34C Relevance: 11.6, Strings: 9, Instructions: 312COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 013AD4B8, 013AD4C5
@, xrefs: 013AD49D
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 013AD3B6
@, xrefs: 013AD3E9
PreferredUILanguagesPending, xrefs: 0140A8DE
MachinePreferredUILanguages, xrefs: 013AD685
Control Panel\Desktop, xrefs: 013AD45D
@, xrefs: 013AD663
Control Panel\Desktop\MuiCached, xrefs: 013AD62B

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 0-3532704233
Opcode ID: 34c37e292e05164fbad1cd06f4efc8544435590ce4a97bb17eb6b689e3f279a3
Instruction ID: 6ae12e2d8854cba3bc5ae6f3c957366b5808588e5582c8c233b91e07c791a81d
Opcode Fuzzy Hash: 34c37e292e05164fbad1cd06f4efc8544435590ce4a97bb17eb6b689e3f279a3
Instruction Fuzzy Hash: 8AB1AE72508316DFD712DF69C440A6FBBE8FB84758F81492EF989D7650D730DA088B92

Function 01449179 Relevance: 10.4, Strings: 8, Instructions: 401COMMON

Download Yara Rule

Strings

%s\%u-%u-%u-%u, xrefs: 01449422
%s\%ld\%s, xrefs: 0144948D
Global\Session\%ld%s, xrefs: 014494C5
\Sessions, xrefs: 01449488
AppContainerNamedObjects, xrefs: 0144946E, 014494D6
\AppContainerNamedObjects, xrefs: 014494AB, 014494B9
\BaseNamedObjects, xrefs: 0144949E
BaseNamedObjects, xrefs: 01449477, 0144947C

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
API String ID: 2994545307-3063724069
Opcode ID: dd98bd57004843a992c65b2a92de11ecca23545d91531ea4c9d551a671290922
Instruction ID: 52ccd32fc9c0b4e5ea16d3f99f73da2fbb9c5f2885a5eae5da7f6c08236d9d7c
Opcode Fuzzy Hash: dd98bd57004843a992c65b2a92de11ecca23545d91531ea4c9d551a671290922
Instruction Fuzzy Hash: F4D1D672804312AFE721DB58C841B6BBBE8AF9871CF05492EFA4897260D770DD04DBD2

Function 01460274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON

Download Yara Rule

Strings

About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 014604D3
Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 0146069F
Just reallocated block at %p to %Ix bytes, xrefs: 014605F1
HEAP[%wZ]: , xrefs: 01460399, 014604A8, 014605D0, 01460675, 014606CC
RtlReAllocateHeap, xrefs: 014602BF, 01460362
HEAP: , xrefs: 014603A6, 014604B5, 014605DD, 01460682, 014606D9
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 014606EA
About to reallocate block at %p to %Ix bytes, xrefs: 014603BA

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 0-1700792311
Opcode ID: 57093da51908d81df11aaeaa0210e04ba23896f2377dd0e531e55acd8252b015
Instruction ID: b9d25775df8f3bec36b9a7d97ee2736350246d0534ea61ce727dd6b9cf81ecd5
Opcode Fuzzy Hash: 57093da51908d81df11aaeaa0210e04ba23896f2377dd0e531e55acd8252b015
Instruction Fuzzy Hash: 3DD1DD35600686DFDB22DF68C440AAEBFF5FF5A718F48805AF4499B362C7749981CB12

Function 013AD08D Relevance: 10.2, Strings: 8, Instructions: 249COMMON

Download Yara Rule

Strings

Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 013AD262
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 013AD2C3
@, xrefs: 013AD0FD
@, xrefs: 013AD2AF
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 013AD0CF
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 013AD146
Control Panel\Desktop\LanguageConfiguration, xrefs: 013AD196
@, xrefs: 013AD313

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 0-1356375266
Opcode ID: 37bcf4e0af278629c74e301bc32e1a45078e4b69ee6170e18d30b21f3c32d20e
Instruction ID: 78f246aa82a6b90506e4ca1b8572a988be96393510948816cef293dacddba3ef
Opcode Fuzzy Hash: 37bcf4e0af278629c74e301bc32e1a45078e4b69ee6170e18d30b21f3c32d20e
Instruction Fuzzy Hash: 84A18E719083069FE721DF69C480B5BBBE8FB94719F40892EFA9897640D774D908CB53

Function 013AF172 Relevance: 8.2, Strings: 6, Instructions: 684COMMON

Download Yara Rule

Strings

((LONG)FreeEntry->Size > 1), xrefs: 0140E0B3
HEAP[%wZ]: , xrefs: 0140DF57, 0140E09B, 0140E279, 0140E391
HEAP: , xrefs: 0140DF64, 0140E0A8, 0140E286, 0140E39E
(UCRBlock != NULL), xrefs: 0140DF6F
(LONG)FreeEntry->Size > 1, xrefs: 0140E291
(!TrailingUCR), xrefs: 0140E3A9

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: 9fa64a871dd1609ee34004f62048962be7cc86bd9895aaf41e4c19c8bf1064e5
Instruction ID: 5a7eeedc4c056a49677285b29cbc0860edfd7d0e9ff3c27184fa8d32ea761be7
Opcode Fuzzy Hash: 9fa64a871dd1609ee34004f62048962be7cc86bd9895aaf41e4c19c8bf1064e5
Instruction Fuzzy Hash: F5420135208382DFD716DF29C484B6BBBE9FF94608F48896EE4858B3A1D734D845CB52

Function 013CB1B0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON

Download Yara Rule

Strings

DLL %wZ was redirected to %wZ by %s, xrefs: 014183FC
SxS, xrefs: 014183ED
minkernel\ntdll\ldrutil.c, xrefs: 0141840D, 014184E1
API set, xrefs: 014183F4, 014183F9
LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 014184D0
LdrpPreprocessDllName, xrefs: 01418403, 014184D7

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: 650a76e42dca2ef35073c8089afcfd0bed0d6494cea27a289d5038eead138a7f
Instruction ID: f28cef6970d6bc2c317879fc0b06dabe901369a6bbaa1bc6bf072f3d5c11422a
Opcode Fuzzy Hash: 650a76e42dca2ef35073c8089afcfd0bed0d6494cea27a289d5038eead138a7f
Instruction Fuzzy Hash: 9FC15C31A0021A9BDB259B6CC88277FFBA5AF54B48F14406EED05AB799EB74CC44C390

Function 013E63FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 014241FE
_LdrpInitialize, xrefs: 014240DF, 01424141, 01424205, 0142425F
Process initialization failed with status 0x%08lx, xrefs: 0142413A
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 014240D8
Delaying execution failed with status 0x%08lx, xrefs: 01424258
minkernel\ntdll\ldrinit.c, xrefs: 014240E9, 0142414B, 0142420F, 01424269

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: 70adba60383f69168338aa6bf0f6c4fe64e78b19432e356e512c424e8f44889b
Instruction ID: 1a96a10b67b10378efb5adae298eaf91ef77a47454da24aa39fbc36052c7b2c3
Opcode Fuzzy Hash: 70adba60383f69168338aa6bf0f6c4fe64e78b19432e356e512c424e8f44889b
Instruction Fuzzy Hash: C8915AB0B00335DBDB25DF19D849BAA7FA5EB61B18F99402EE5007B7E1D7709841CB90

Function 0145F525 Relevance: 7.7, Strings: 6, Instructions: 231COMMON

Download Yara Rule

Strings

RtlAllocateHeap, xrefs: 0145F56D
HEAP[%wZ]: , xrefs: 0145F6E7, 0145F794, 0145F7EB
HEAP: , xrefs: 0145F6F4, 0145F7A1, 0145F7F8
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 0145F809
Just allocated block at %p for %Ix bytes, xrefs: 0145F708
Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 0145F7BE

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 0-1745908468
Opcode ID: 2b803026aacd427dc479934efa987506601ce2d2a4106db22aa8f475e34228f0
Instruction ID: 9dab62ca4a5c76bacf26d2afb6fbe4d4c62ef68161b33ce37624f0d3105b08c3
Opcode Fuzzy Hash: 2b803026aacd427dc479934efa987506601ce2d2a4106db22aa8f475e34228f0
Instruction Fuzzy Hash: 0E91DC35A00641DFDB12DF69C440AAEBBF1FF59708F58801EE8459B372CB71A989CB12

Function 013DF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 014202E7
RTL: Re-Waiting, xrefs: 0142031E
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 014202BD

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: 29e83d5a3b1d43d2b23175c35cfb8ee0c85cf13ac9c3b174e13404390dc6151f
Instruction ID: 83de9d0a39da752d50b8821818be2ffe1f7f1a867784b3b1dee619b13df22e98
Opcode Fuzzy Hash: 29e83d5a3b1d43d2b23175c35cfb8ee0c85cf13ac9c3b174e13404390dc6151f
Instruction Fuzzy Hash: 78E1CE316047419FD725CF28D884B2ABBE4BB84328F140A1EF5A6CB7E1D774D986CB52

Function 013D51EF Relevance: 6.7, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

Kernel-MUI-Number-Allowed, xrefs: 013D5247
Kernel-MUI-Language-Allowed, xrefs: 013D527B
Kernel-MUI-Language-SKU, xrefs: 013D542B
Kernel-MUI-Language-Disallowed, xrefs: 013D5352
WindowsExcludedProcs, xrefs: 013D522A

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 6f15eb89ebfa1fb1d5327868bc776abdaa31a05a5eaa07228821fe2ca64f3861
Instruction ID: e891a1605cd543f23a2f73c63a36432a7cfe0b9e3bc267aedeaadc2078d60834
Opcode Fuzzy Hash: 6f15eb89ebfa1fb1d5327868bc776abdaa31a05a5eaa07228821fe2ca64f3861
Instruction Fuzzy Hash: 8AF14B76D00219EFCF16DFA9D980AEEBBB9FF18654F15406AE505E7210EB709E018B90

Function 013C70C0 Relevance: 6.0, Strings: 3, Instructions: 2248COMMON

Download Yara Rule

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 013C7C96, 013C8696
HEAP[%wZ]: , xrefs: 013C7C6D, 013C8670
HEAP: , xrefs: 013C7C7C, 013C867F

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: b5c53fcf53e236dc8b2e3f647223f129d2b135b4231df5deb247347d79f4b527
Instruction ID: 14a1c7f63cb0c6977ced31bfa0d17ea7b23cc0e679c40c94c9564e806d37dc60
Opcode Fuzzy Hash: b5c53fcf53e236dc8b2e3f647223f129d2b135b4231df5deb247347d79f4b527
Instruction Fuzzy Hash: 7E139C70A0065ACFEB25CF68C8807A9BBF1BF59708F1481ADD949AB781D734AD45CF90

Function 013C1070 Relevance: 5.9, Strings: 4, Instructions: 940COMMON

Download Yara Rule

Strings

!(CheckedFlags & ~HEAP_CREATE_VALID_MASK), xrefs: 0141588F
@, xrefs: 01415A53
HEAP[%wZ]: , xrefs: 01415877
HEAP: , xrefs: 01415884

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID: !(CheckedFlags & ~HEAP_CREATE_VALID_MASK)$@$HEAP: $HEAP[%wZ]:
API String ID: 2994545307-3570731704
Opcode ID: 93a1c9132689da85042dc49c7e5ec1ee7e2d97695c5e839cc6565ef07c92e837
Instruction ID: 2b06aefd3d7bf09cde5da5c72a1693b3e0f9ab5703fd9a403c57dbf48f8a39a1
Opcode Fuzzy Hash: 93a1c9132689da85042dc49c7e5ec1ee7e2d97695c5e839cc6565ef07c92e837
Instruction Fuzzy Hash: 8C924A71A01229CFEB25CF18C840BAAB7B5BF85718F1581EED949AB352D7309E80CF51

Function 013BA3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

LdrResFallbackLangList Exit, xrefs: 013BA3FF
6, xrefs: 013BA3F7
8, xrefs: 013BA3E7
LdrResFallbackLangList Enter, xrefs: 013BA3EF

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: b936a69a956a5b809b72d2fcefa2840e337b5b561dc28410621688620a92d8d6
Instruction ID: 786604cfd91ef9c855d166213a8a5669a2d7753fcbfdd1baf2431fbf1c35e263
Opcode Fuzzy Hash: b936a69a956a5b809b72d2fcefa2840e337b5b561dc28410621688620a92d8d6
Instruction Fuzzy Hash: 7AC16A7410878ACFD711CF58C080BAAB7E4BB84708F04496AFA95DBB51F778CA49CB56

Function 013E8402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 013E855E
LdrpInitializeProcess, xrefs: 013E8422
@, xrefs: 013E8591
minkernel\ntdll\ldrinit.c, xrefs: 013E8421

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: 60a4c51c5d86a5d9ba55e73044b4df72b05823da0d8a7976efe0585455cd5f0a
Instruction ID: fc50f15fddd6381689740081e8451f6f036be5922e6e8d3ca65fa3d17cf65974
Opcode Fuzzy Hash: 60a4c51c5d86a5d9ba55e73044b4df72b05823da0d8a7976efe0585455cd5f0a
Instruction Fuzzy Hash: 63919A71908355EFD721EF69CC44EABBAECFF84748F40096EFA8496190E734D9448B62

Function 013D15F4 Relevance: 5.2, Strings: 4, Instructions: 166COMMON

Download Yara Rule

Strings

Could not validate the crypto signature for DLL %wZ, xrefs: 0141A589
LdrpCompleteMapModule, xrefs: 0141A590
minkernel\ntdll\ldrmap.c, xrefs: 0141A59A
MZER, xrefs: 013D16E8

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$MZER$minkernel\ntdll\ldrmap.c
API String ID: 0-1409021520
Opcode ID: 2350c5afb22ee109b0300595628bd2e492c69798f1a8ab3194bd17e834a6f263
Instruction ID: dd59d1e7d85cccbe03d09401556700ece48e20e6c2a63ffd0b6011a900c27cc3
Opcode Fuzzy Hash: 2350c5afb22ee109b0300595628bd2e492c69798f1a8ab3194bd17e834a6f263
Instruction Fuzzy Hash: AB5159726057859BEB22CB6CD944B2A7BE8FF00728F180569FE519B7E6D774E800C740

Function 014611A4 Relevance: 5.1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

Strings

This is located in the %s field of the heap header., xrefs: 014612D6
HEAP[%wZ]: , xrefs: 0146123D, 014612B7
HEAP: , xrefs: 0146124A, 0146125D, 0146125F, 014612C4
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 01461261

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 2994545307-336120773
Opcode ID: 9ff1f820a6292c3b4af4ee0b317164416f78730fc3ccb45736e1fc1516f628af
Instruction ID: a545205f300226bcb3017422fba141c74712ddb47c325805a8e87517c894c6bd
Opcode Fuzzy Hash: 9ff1f820a6292c3b4af4ee0b317164416f78730fc3ccb45736e1fc1516f628af
Instruction Fuzzy Hash: A231B0B1200241EFD711DB9DC885FA7B7ECEF85A68F14005AF501EB3B1DA70AD85CA66

Function 013A9148 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

VirtualQuery Failed 0x%p %x, xrefs: 0140BAF7
HEAP[%wZ]: , xrefs: 0140BAA0, 0140BADD
HEAP: , xrefs: 0140BAAD, 0140BAEA
VirtualProtect Failed 0x%p %x, xrefs: 0140BABA

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 2994545307-1391187441
Opcode ID: 1677e3332cff380c861932ab7df81a34549b205826a95ac1e0b9054741b244fd
Instruction ID: e2c26a0bd40074723aac39be112ff0ed10f5ce520e6c03824a9c410e0bcc9a99
Opcode Fuzzy Hash: 1677e3332cff380c861932ab7df81a34549b205826a95ac1e0b9054741b244fd
Instruction Fuzzy Hash: 2231A636600205EFDB12DB5ACC89F9BBBB8EF45728F544069E915A72A1D770ED80CB60

Function 013B1460 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 013B1728
HEAP[%wZ]: , xrefs: 013B1712
HEAP: , xrefs: 013B1596

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 6b9c469fe76ad2fce12bab4838096023fc8b17a22f16b812a6ba095e58945620
Instruction ID: 7698b26bc50173ae5943bb557dc120933699091925f129c4eb911a3da8756332
Opcode Fuzzy Hash: 6b9c469fe76ad2fce12bab4838096023fc8b17a22f16b812a6ba095e58945620
Instruction Fuzzy Hash: 2CE13730A042459FD725CF2DD4A17BABBF5EF44318F18846EEA96CBA95E734D840C750

Function 013AA197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

FilterFullPath, xrefs: 0140C2E6
\??\, xrefs: 0140C1E4
UseFilter, xrefs: 013AA1C1

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: 2a70e88bec6f0a6142f807adca75dd233c7a5a14dcdf3182d5b96f6a036575f5
Instruction ID: 5771c9fc42a61e4189008d2b1536b4daba44001371faf4aa269bca735bcbec6d
Opcode Fuzzy Hash: 2a70e88bec6f0a6142f807adca75dd233c7a5a14dcdf3182d5b96f6a036575f5
Instruction Fuzzy Hash: 2AA15F72911629DBDB32DF69CC88BAAB7B8FF44704F1141EAE908A7250D7359E84CF50

Function 01437410 Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

VirtualAlloc, xrefs: 014375FC
Objects>%4u, xrefs: 014375D5
Objects=%4u, xrefs: 014375EA

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: Objects=%4u$Objects>%4u$VirtualAlloc
API String ID: 0-3870751728
Opcode ID: 28b4f4fa97b44a2f8edb2f685775d35c8d1a66ee9c4357f0f1f80b2d0e5a7497
Instruction ID: e622c4f9aaee351d3d55bcd0182eb4d6a2e84ecf0a1f5ba8d4f18301a7c0a90d
Opcode Fuzzy Hash: 28b4f4fa97b44a2f8edb2f685775d35c8d1a66ee9c4357f0f1f80b2d0e5a7497
Instruction Fuzzy Hash: 4D914DB0E002059FEB18CF69C490BADBBF1BF98315F14C16AD949AB3A1E7759842CF54

Function 013E909C Relevance: 3.9, Strings: 3, Instructions: 199COMMON

Download Yara Rule

Strings

@, xrefs: 013E9148
&, xrefs: 01425CF8
%, xrefs: 01425D3F

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: %$&$@
API String ID: 0-1537733988
Opcode ID: f61ff5a678931c7b04531980ae8d314a5b26db121936322e7020cb993b9adf88
Instruction ID: 509c26e5b42f9c856a8f6d30189ab19e6f820c258323d301fa565cc95dad70fb
Opcode Fuzzy Hash: f61ff5a678931c7b04531980ae8d314a5b26db121936322e7020cb993b9adf88
Instruction Fuzzy Hash: 5971F17050831A9FCB10DF29C588B6FBBE9FF9461CF108A1EE49A476A1D730D845CB92

Function 013A758F Relevance: 3.9, Strings: 3, Instructions: 132COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 0140AFAB
HEAP: , xrefs: 0140AFB8
Invalid address specified to %s( %p, %p ), xrefs: 0140AFCB

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 0-1151232445
Opcode ID: 5c33975b2ce2cc7662adc5021c9f66da9481cd09960b54ea1779730238cfa973
Instruction ID: bc7e30ad3e86468346b658f20fafc0341f43cfb73d81f2af5172ecac6f4ccc08
Opcode Fuzzy Hash: 5c33975b2ce2cc7662adc5021c9f66da9481cd09960b54ea1779730238cfa973
Instruction Fuzzy Hash: 6141D6703003808FEB26CA5EC0E47BA7BA4DF02258FA8446ED9468B6F6D675D485C752

Function 0146C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 0146C212
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0146C1C5
@, xrefs: 0146C1F1

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 0-2968386058
Opcode ID: d44b02483116f3e632dff15b7d50a7a5461e1b599dff7d72af70863989c650a9
Instruction ID: a150486e8eb63ff13dc0714f9924d3a23a45c620a103b11abf7f0bcc787cabdc
Opcode Fuzzy Hash: d44b02483116f3e632dff15b7d50a7a5461e1b599dff7d72af70863989c650a9
Instruction Fuzzy Hash: 09416271E0020AEBDF11DBD8C881BEFBBBCAB14718F14406BEA49A7260D7749A458B51

Function 01444144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

LdrpResValidateFilePath Exit, xrefs: 01444172
LdrpResValidateFilePath Enter, xrefs: 01444160
@, xrefs: 01444225

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
API String ID: 0-1373925480
Opcode ID: 8b551baaaf282075f38f594e85aedec1363ccde1b69c85d4464242a5d74af159
Instruction ID: 55a1426ecdee01a6f9fa44f7773059998c906e9108f7eef81f3461b12dc79824
Opcode Fuzzy Hash: 8b551baaaf282075f38f594e85aedec1363ccde1b69c85d4464242a5d74af159
Instruction Fuzzy Hash: AC411371A046488BFB22DBD9C844BAEBBB4FF55384F18045BD901EB7A1D7349901CB11

Function 013E33A0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON

Download Yara Rule

Strings

RtlCreateActivationContext, xrefs: 014229F9
Actx , xrefs: 013E33AC
SXS: %s() passed the empty activation context data, xrefs: 014229FE

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
API String ID: 0-859632880
Opcode ID: 4bdfc2a7d2a6ad3ce840957cebfe775435fe21521195deccf9a14efd1068ef75
Instruction ID: a5d1b772605d32b2b68bbe22a4bc2d22df90535e58b34c773cf88fb2aa5540f8
Opcode Fuzzy Hash: 4bdfc2a7d2a6ad3ce840957cebfe775435fe21521195deccf9a14efd1068ef75
Instruction Fuzzy Hash: 2F3116326003269FEB26DF58D884F967BE4BB44728F45846AED04AF791DB71D881CB90

Function 0143B594 Relevance: 3.9, Strings: 3, Instructions: 107COMMON

Download Yara Rule

Strings

GlobalFlag, xrefs: 0143B68F
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 0143B632
@, xrefs: 0143B670

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
API String ID: 0-4192008846
Opcode ID: ca1b682cb585e2db3857c2decda2643e5573ac5c1685465aba02ae59701088d1
Instruction ID: ff315aea19ebb0b12d9e1a52f2adba16e8e9865ffe65c6a80a5e7cfa398064a1
Opcode Fuzzy Hash: ca1b682cb585e2db3857c2decda2643e5573ac5c1685465aba02ae59701088d1
Instruction Fuzzy Hash: 3A313EB1A00209AFDB10EF99CC80BEFBB78EF48748F14446AE605A7251D7749E04DBA4

Function 013F1270 Relevance: 3.8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

Strings

BuildLabEx, xrefs: 013F130F
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 013F127B
@, xrefs: 013F12A5

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 0-3051831665
Opcode ID: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
Instruction ID: 8c2852070cb1bac0ce0e76af1728379211e00c14f92ac1899ed86aabba8271c1
Opcode Fuzzy Hash: 4dd0507e6de23adeaafdd13239ae3a95ee5485203228978708ef77071a5cdf2e
Instruction Fuzzy Hash: 3C317E7290061EEBDF12EB99CC44EDFBFBDEB94658F00442AEA14A7260D730DE059B50

Function 014320DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON

Download Yara Rule

Strings

LdrpInitializationFailure, xrefs: 014320FA
Process initialization failed with status 0x%08lx, xrefs: 014320F3
minkernel\ntdll\ldrinit.c, xrefs: 01432104

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 0-2986994758
Opcode ID: 2b9a557a82f890365b654b6d2082ea2bf7b50d718ce48c9bb448b0615042058f
Instruction ID: 0019028c5fe3d3319bbd215de92dd5e86541822ad5e929f12089fb6fc8041514
Opcode Fuzzy Hash: 2b9a557a82f890365b654b6d2082ea2bf7b50d718ce48c9bb448b0615042058f
Instruction Fuzzy Hash: 98F0C875640309BBEB24EA4DDD42F977F68EB84B58F51005AF6047B395D1F0A940CA91

Function 013C03E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 01414D8A

Strings

#%u, xrefs: 01414D82

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: ___swprintf_l
String ID: #%u
API String ID: 48624451-232158463
Opcode ID: c44021722dcdeeb37e6e979136a1a689c7e9ced5938e9a38de0850c675eeabd5
Instruction ID: 2c32e8ba161e594422a84261333b95273137a595c7bdd94b8ca1ba5925cff950
Opcode Fuzzy Hash: c44021722dcdeeb37e6e979136a1a689c7e9ced5938e9a38de0850c675eeabd5
Instruction Fuzzy Hash: 44715C71A0014A9FDB05DFA9C994BAEB7F8FF18704F15406AE905E7261EB34ED01CBA0

Function 013C52A0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON

Download Yara Rule

Strings

@, xrefs: 013C5445
@, xrefs: 013C55A3

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 2adc094d79025e6195ac2082cb023928f9fa73ff0d44353ddd21d1164dc74100
Instruction ID: 83e041db54c5b9d9fc5f91e1848bf03dae0b1de2ccdfbcf9a33e2a785d95b0d1
Opcode Fuzzy Hash: 2adc094d79025e6195ac2082cb023928f9fa73ff0d44353ddd21d1164dc74100
Instruction Fuzzy Hash: 96327B716083128BDB24CF18C48077FBBE5EF84B58F15491EEA85976A0E774EC94CB52

Function 0147A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON

Download Yara Rule

Strings

`, xrefs: 0147A551
`, xrefs: 0147A44B

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction ID: cab5d24b21fc1038804d125b04219d735143ff7776ed248051fa0ef0d873dd02
Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction Fuzzy Hash: 2FC1D4312043429BE724CF29C845BAFBBE5AFD4718F284A2EF695CB2A0D775D505CB41

Function 013BA2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Exit, xrefs: 013BA309
RtlpResUltimateFallbackInfo Enter, xrefs: 013BA2FB

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: a4b9492d2527830f8fc6696e7f79288922565c926503e5e41b343519d8b7fc84
Instruction ID: 86d3173767fc187c5f0be1c2aa6b1ec80f9ec9d16f90057553be64f24ac8a37c
Opcode Fuzzy Hash: a4b9492d2527830f8fc6696e7f79288922565c926503e5e41b343519d8b7fc84
Instruction Fuzzy Hash: F341B031A05A59DBDB11DF5DC480BAE7BB4FF84708F24406AEA08DBBA5E3B5D900CB50

Function 014435BA Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

LdrResGetRCConfig Exit, xrefs: 014435FE
LdrResGetRCConfig Enter, xrefs: 014435EC

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
API String ID: 0-118005554
Opcode ID: 0c103e3a7c229be3006f931b665704e2294283c3be59d8b83f8abb2be2eaa064
Instruction ID: 1768788b4a94275ae8b37962a3f1263ba876ca1abab8c9fd643e5b43c90ec43c
Opcode Fuzzy Hash: 0c103e3a7c229be3006f931b665704e2294283c3be59d8b83f8abb2be2eaa064
Instruction Fuzzy Hash: D43180312087529BE321DF68D454B2ABBE4FF95B14F15086AFD588B3A0E631D905CB52

Function 013E329E Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

.Local\, xrefs: 013E32B5
@, xrefs: 013E330D

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: .Local\$@
API String ID: 0-380025441
Opcode ID: ab25d92dfcb30259de117d6d834897b6df020f57c101632ccd87fab90b006458
Instruction ID: 3c2d199ea048f0d0bd4d0ad47753664c4522e85c85a94d0ccefbad5f116f9dc9
Opcode Fuzzy Hash: ab25d92dfcb30259de117d6d834897b6df020f57c101632ccd87fab90b006458
Instruction Fuzzy Hash: 9D317072548315AFD721DF28C484EABBBE8FF85658F44092EF99583390DA31DD04CB92

Function 013EA5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

Threadpool!, xrefs: 013EA5E9
Cleanup Group, xrefs: 013EA5E4

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID: Cleanup Group$Threadpool!
API String ID: 2994545307-4008356553
Opcode ID: 3f7c34b7d31cf3c587593949c98b315699cbe95d3d2420713857caa99ad077ed
Instruction ID: 0597a406809cbf1e97d95ed8206166a20244d445aa1b20ac56fc4b2bc1c218da
Opcode Fuzzy Hash: 3f7c34b7d31cf3c587593949c98b315699cbe95d3d2420713857caa99ad077ed
Instruction Fuzzy Hash: 1E01D1B2250704AFD311DF24CE49B167BE8F785729F068979A658C71D0E334D804CB46

Function 013B7370 Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b7decdb014c5d9cacd0c49c188d4fbd0d3edc9ecc092ca555aa40324efc598d
Instruction ID: 7ef8a6ea21f7689215e1be43b01f73ebe1309a051793abef9361e8ed9fa866fe
Opcode Fuzzy Hash: 3b7decdb014c5d9cacd0c49c188d4fbd0d3edc9ecc092ca555aa40324efc598d
Instruction Fuzzy Hash: 12A15971608346CFC321DF28C480A6ABBE9FBD8718F15492EE68597791E730E945CB92

Function 01436420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

, xrefs: 014365C1

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: a86e51bef6377dd8b10edc2a8e52850e01924d5493fdb97b4d5e5ec5890aaa9a
Instruction ID: 1b07fe068d89d35f33d288629efcc27ccca211ac7c99e2a337f69595e1446181
Opcode Fuzzy Hash: a86e51bef6377dd8b10edc2a8e52850e01924d5493fdb97b4d5e5ec5890aaa9a
Instruction Fuzzy Hash: 2191637290021ABFEB21DB99DC85FAE7BB8EF58B54F154065F604AB1A0D674AD00CB60

Function 0146B256 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 0146B28F

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: PreferredUILanguages
API String ID: 0-1884656846
Opcode ID: e0ff4c08ceeee7da92d403674dd28f4dc8191e213d2a578e931940a668727d9e
Instruction ID: 54c68f2de02a2ea2910ff4ebbb8ca3a9d8cda8077b91cb2fd7ecfe3184953c4f
Opcode Fuzzy Hash: e0ff4c08ceeee7da92d403674dd28f4dc8191e213d2a578e931940a668727d9e
Instruction Fuzzy Hash: E5419632F00219ABDB11EA98C840AEFB7BDEF54658F054167EE11E7360E630DE80C7A1

Function 0145705E Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

kLsE, xrefs: 014570A4

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: kLsE
API String ID: 0-3058123920
Opcode ID: 5f7f7cce33f6701824b315c8b9e563a398799964678513f3fa4f3fb8c9c9bc2c
Instruction ID: 0d61fe92bd44ebf87166b327615a667bd8f31672309ad4e78bb18f34ff9a322f
Opcode Fuzzy Hash: 5f7f7cce33f6701824b315c8b9e563a398799964678513f3fa4f3fb8c9c9bc2c
Instruction Fuzzy Hash: 60419E7150135247E731AB79E8847AA3FD4A710B68F9F012EEE504B2FACBB40482C791

Function 013E7505 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

#, xrefs: 01424622

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
Instruction ID: 28b29160cc6234be826418eba8cf61c1dbf74430296fb40ab0089bf1a04313fb
Opcode Fuzzy Hash: 4bc324cfbfa2083798c26090082f3552f5e90ae9522e24348f396a2005f93b47
Instruction Fuzzy Hash: 8341CF75A0026AEBCF21DF88C494BBEB7B5FF44709F00445AE945A7290DB34D982CBE1

Function 013B5096 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Actx , xrefs: 013B50BF

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 56a2d9bcf915c55503884ead6ae718bdd344e276f012ef4825e6012b7bf9e475
Instruction ID: 2f2340dd00b5364a632c63ebc4ae8d350bdba68fd9a31cc7e8887320035e00f2
Opcode Fuzzy Hash: 56a2d9bcf915c55503884ead6ae718bdd344e276f012ef4825e6012b7bf9e475
Instruction Fuzzy Hash: 2B11E63074420A8BEB245D0D88D06F6B799EB9122CF34813AEB62CBF91F671DC408380

Function 0143106E Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

LdrCreateEnclave, xrefs: 014310F7

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: LdrCreateEnclave
API String ID: 0-3262589265
Opcode ID: e75c0daf433e35a39b23494cd0ad26ef9d880b3f54dbaca45365933156c2abbf
Instruction ID: 87f20f2cf76d5305dd8a61ab69b2f7d9f7bd23f9ba724f7986e1299b780c7cdb
Opcode Fuzzy Hash: e75c0daf433e35a39b23494cd0ad26ef9d880b3f54dbaca45365933156c2abbf
Instruction Fuzzy Hash: 5121F5B15083449BC710DF1A8844A9BFBE8FBE9B50F404A1FB99497360E7B09504CB92

Function 0140739A Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 349887e03f75cdfeef95afdfcdc773d17030fcb9e035a7094b9ea67d4665657e
Instruction ID: bf6539c57c50760eca8720b8bdab49c58a49add30d0f731d5fd3a589914d7c45
Opcode Fuzzy Hash: 349887e03f75cdfeef95afdfcdc773d17030fcb9e035a7094b9ea67d4665657e
Instruction Fuzzy Hash: AA42B171A006168FDB16CF5EC4805BEBBB2FF88315B14856ED586AB3A0D734F842CB91

Function 013DB2C0 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703dda2d071d682e881af16b4bbb8468bd006442056d8181e151cb6e3eb56902
Instruction ID: cfc9c55156cf0b2e5e626bca5f746cccda22f845300494d6337194dd22922edb
Opcode Fuzzy Hash: 703dda2d071d682e881af16b4bbb8468bd006442056d8181e151cb6e3eb56902
Instruction Fuzzy Hash: 2332A076E00219DBDF14CFA8D880BAEBBB5FF55718F1A002DE905AB395E7359901CB90

Function 01448158 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc8d9ce34d43c1312ea6fbccf285083efd2a83be0dd7e6433cf837f405aadd5
Instruction ID: 07379212290d5343c860e2aa76d84ee4256dd383e6d49ce479dd5b4698ea8c61
Opcode Fuzzy Hash: afc8d9ce34d43c1312ea6fbccf285083efd2a83be0dd7e6433cf837f405aadd5
Instruction Fuzzy Hash: 18424E75A0021A8FEB25CFA9C841BAEBBF5BF48304F14809AE949AB251D7349D85CF50

Function 0145A118 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77828ba64fff03b37547fa4e5d3e442368ce97206aa831e8fd6ab5823cfeaf62
Instruction ID: 31693a9e7d725d8395b0686ede8bd8cd50d418a57adb348ba8c55ff7d2b19e1a
Opcode Fuzzy Hash: 77828ba64fff03b37547fa4e5d3e442368ce97206aa831e8fd6ab5823cfeaf62
Instruction Fuzzy Hash: 5822CE702046618BEBA5CF29C094772BBE1AF45344F28865BED868F3A7E735D442CB61

Function 013B65D0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6953a03bb36781df7cc7ffd60fc7a301d35e47afa8436831e1a3baa431a8be5e
Instruction ID: 0e5b7902f26de3929fcfbae9ce4e1622b67bb8185a15036367489a84fb67251a
Opcode Fuzzy Hash: 6953a03bb36781df7cc7ffd60fc7a301d35e47afa8436831e1a3baa431a8be5e
Instruction Fuzzy Hash: 65E181B1608341CFC715CF28C5D1AAABBE0FF89318F05896DE69587752EB31E905CB92

Function 013A8397 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58086cd98e11042ae540ee16d7503be1de2eefa00fb89b8f55806e40a4fe1cc5
Instruction ID: c5666e317972d7f94bf33756eedd99ef4f934b1f55f2ec7d4844e4d2fdb5ba91
Opcode Fuzzy Hash: 58086cd98e11042ae540ee16d7503be1de2eefa00fb89b8f55806e40a4fe1cc5
Instruction Fuzzy Hash: 80D10371A0020A8BDB15DF29C880EBB7BB5FF54309F4446AEEA16DB2D0EB34D951CB50

Function 01438243 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction ID: 3634af39eba01431c25e9dbab5995feffe0a222d2431b9bc0873dbd9d115a000
Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction Fuzzy Hash: 8AB16274A006069FDF24DB99C940AABFBB9FFD8304F10456EBA12977E1DA35E905CB10

Function 013CF460 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc38fa213b06585c4fab493a5cc968d33a7c11d23d26c94aade595ef69f189ab
Instruction ID: 4c7844fe7d491dc0148c672f07529e0a7711cb19d05667117a3216ce11d76b54
Opcode Fuzzy Hash: fc38fa213b06585c4fab493a5cc968d33a7c11d23d26c94aade595ef69f189ab
Instruction Fuzzy Hash: C5C13531A00215CBDB25CF2DC4947B9BBAAFB54B2CF1A416EED469B3A6D7308D50CB50

Function 013C0535 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction ID: bae3b0c6569c1a4ce69d3e20fa99864372206e039fb20f66be35b0e0ed6a4a73
Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction Fuzzy Hash: 41B13635604686DFDB19CBA8C850BBEBBFAAF84708F18015AE6529B395D730ED41CB50

Function 013D90DB Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e01857df817c528634ad1907237f996d9fb6082fb984a8a5b9e11f511b120e85
Instruction ID: de64bbb5e94c61586bb51450c5ce40c27bb41021385806b5079f40147e7d61f4
Opcode Fuzzy Hash: e01857df817c528634ad1907237f996d9fb6082fb984a8a5b9e11f511b120e85
Instruction Fuzzy Hash: 1BA12CB190021AAFEF129FA8CC45BAF7BB9AF55754F014058FA04AB2A0D775DC51CBA0

Function 013B83C0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b2497953fc54c89ea9e2a2afd4017126234c780e25a03c6eeab11129acdbd7b
Instruction ID: 1650673bd1b780b339df0a0d7546776a040494a6c24fe9eec15f3a877b7ebcef
Opcode Fuzzy Hash: 8b2497953fc54c89ea9e2a2afd4017126234c780e25a03c6eeab11129acdbd7b
Instruction Fuzzy Hash: 50C14774208341CFD764DF19C484BABB7E8BF88708F44496EEA8987791E774E904CB92

Function 013AC427 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079831cf5c8cf3111051660c41a96b51c658fcf3ea2b5971434d89ab5d073fe8
Instruction ID: dc7c8b87994a9070705a072a4cf637f69aa0c02711669dc76d9b4638a0846e68
Opcode Fuzzy Hash: 079831cf5c8cf3111051660c41a96b51c658fcf3ea2b5971434d89ab5d073fe8
Instruction Fuzzy Hash: 24B19470A002698BDB25CF59C890BA9B7B5EF44704F5485EAE54AEB391EB30DDC5CF20

Function 013DE5E7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34dc1c2184b4cfdb7738cf7ce6ffb5eb93e1f120de47ce4170a0c9aedfe2164
Instruction ID: f4372e71fab28224e28841624a4077d71157d4047697cb242cf28602bd330a20
Opcode Fuzzy Hash: a34dc1c2184b4cfdb7738cf7ce6ffb5eb93e1f120de47ce4170a0c9aedfe2164
Instruction Fuzzy Hash: 70A12832E006199FEB21DB5CD844BAEBFB4BB00758F050126EA10AB2E5D7749D4ACBD1

Function 013F0185 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a83b1cfeeeb902fd9047c3e37d6912410631e46aabfb7531a63fae07fbf3d9d
Instruction ID: 9f6e04e2cab45b0f821a9d3206604490161b1caa754e383bd2045b3d90fa16e0
Opcode Fuzzy Hash: 0a83b1cfeeeb902fd9047c3e37d6912410631e46aabfb7531a63fae07fbf3d9d
Instruction Fuzzy Hash: 26A1C771B00626DBDB29CF6DC590B6AB7E6FF54318F04402EEB05A7292DB74E851CB50

Function 01484500 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfab03839409a98775ecefc0060bcaeaa9ed57a4bb767fab53f067dd99276101
Instruction ID: 6a5c4765c2292b3294126db13a5f7d5515c0f805843a2f15706b6e757d250d6e
Opcode Fuzzy Hash: bfab03839409a98775ecefc0060bcaeaa9ed57a4bb767fab53f067dd99276101
Instruction Fuzzy Hash: 38A1CC72A10212DFC711EF18C980B6ABBE9FF58708F4A452EE6499B760D734ED01CB91

Function 014360E0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8b6248c274fedfa11aeadd91f522b0b208a1f5b36fbac44cc7f07c9a7da5fd
Instruction ID: 736a6d833cfbef1ec66fe06ae8b6d56f8ef6017a90a30e58949a52f2937e4c3a
Opcode Fuzzy Hash: cc8b6248c274fedfa11aeadd91f522b0b208a1f5b36fbac44cc7f07c9a7da5fd
Instruction Fuzzy Hash: 02917371D00216BFDF15DF68D884BAEBFB5AB88710F16415AE610EB361D734EA019BA0

Function 013CE3F0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b64e278abaf5b661dbdbc0148e723686cad9b2c3e5da3cc03db8479f23089f
Instruction ID: a4387c32ef07413e9243568ba2159843c7aa2b27d4767fdb18dc47828a605437
Opcode Fuzzy Hash: 94b64e278abaf5b661dbdbc0148e723686cad9b2c3e5da3cc03db8479f23089f
Instruction Fuzzy Hash: E2910532A00616CBEB24DB5DC444B7ABFA6EFA4B18F19407EED05AB394EA34DD01C751

Function 013B1131 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ceadc8c3e614101b41ec007358249d5b1a313bb2aeafe6560887a0c9cc73ae
Instruction ID: 6b5caa3f3e20117937c1ec1e0a143bd02ca6b46b235f3af90053a2a1cf66ec6d
Opcode Fuzzy Hash: 59ceadc8c3e614101b41ec007358249d5b1a313bb2aeafe6560887a0c9cc73ae
Instruction Fuzzy Hash: 5BB103B15083418FD365CF29C580A6AFBF1BB88704F18496EF999DB362D731E945CB42

Function 0146B52F Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
Instruction ID: 390ea26a94d4e394747926b6a820cdb0083b18223b5591ae91601c724ea03659
Opcode Fuzzy Hash: 14aa7f2389c0c2f4a5e39dfbb016f189343e77270b8e137ddafeb974bf5cdc5c
Instruction Fuzzy Hash: 1F718075B0021A9BDB20CE69C480ABFBBFDEF54749F59412BD940DB361E338D9418B92

Function 013DD090 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction ID: 42acf3c58d9424869c6018f4d12e062031473511952c7545df9df82aeefdafd7
Opcode Fuzzy Hash: 2f57846fa6853ce2eba42e0856427c3c37140fe7ac7bc1e87bfd5d4bd44f03bd
Instruction Fuzzy Hash: AE81A37AE002168BDF16CFACC9817AEBBB2FB84314F19416BCD15B7358D6319941CB91

Function 013EE284 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4fbd3eb5823a89f300f09b32e0072868763e74a8fcbb7597a04a69d326c5367
Instruction ID: 66746a1cc2814f5e71a467deabf7eaff4ea1200506d1e34174fee62cfc16f1d0
Opcode Fuzzy Hash: b4fbd3eb5823a89f300f09b32e0072868763e74a8fcbb7597a04a69d326c5367
Instruction Fuzzy Hash: A8814C71A00719EFDB25DFA9C884AEEBBF9FF48358F10442AE555A7290D730AC45CB60

Function 0143035C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction ID: d4fde9f263bcdcbb8656af537e9bae2d6440d553b61b5f1f165d39b18b824483
Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction Fuzzy Hash: 7E715F71A0061AAFDB11DFA9C944EDEBBB9FF98704F10456AE505E7290DB34EE01CB50

Function 014462A0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5787a0b256033e9685c60b23c3805b0118e54d637e14bde8b5f137ac46d32ae6
Instruction ID: e7f6dc49a5b1e5c75d399b4f9c31d256325678b236bf5cd6e429d7b4deb50d07
Opcode Fuzzy Hash: 5787a0b256033e9685c60b23c3805b0118e54d637e14bde8b5f137ac46d32ae6
Instruction Fuzzy Hash: 9271EF32200B01EFFB22DF18C844F5BBBA6EB45724F16852AE6168B2B0D774E945CB50

Function 0147132D Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e824c7c32eaefa59481bcf1344a69adb7f52077e42e33188d32a01a06c55484
Instruction ID: 2a943e7eee87bf5743182c3d2cfcd665dbd9970c949f592eb461712f62a2712e
Opcode Fuzzy Hash: 6e824c7c32eaefa59481bcf1344a69adb7f52077e42e33188d32a01a06c55484
Instruction Fuzzy Hash: 63818F75A00205DFCB09CF59C490AAEBBF1FF48300F1581AAD859EB355D734EA41CB90

Function 0147903E Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7955e938a1f56324dc5f713f29338af34a4947bd7a684247d157419489a5a4
Instruction ID: 318a938ac4ee252ba84b8fcab06a7fa3056df1cc31a3a6212dbdf6496b049c62
Opcode Fuzzy Hash: 1c7955e938a1f56324dc5f713f29338af34a4947bd7a684247d157419489a5a4
Instruction Fuzzy Hash: 3361E371600616AFD715DF69C884BEBBBA8FF98728F00461EF85887360DB30E915CB91

Function 014792A6 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec05105601918f2792d8c260beb411986c7eb98ff7ec60db322d406e8810d66
Instruction ID: 86d2f68efa2d134907c5ffb2e3310ebe3e6303f2482dbc603bde5c210844aa73
Opcode Fuzzy Hash: fec05105601918f2792d8c260beb411986c7eb98ff7ec60db322d406e8810d66
Instruction Fuzzy Hash: CA61D8312087428BE315DF69C454BEBBBE1FF94728F18486EE9858B3A1D735E806C781

Function 013AB2D3 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c10ec8f88881599d335c6b66d99623015c7bee168cbc8059c009de8a094ca0e
Instruction ID: d479422028e2e135696a0fee4ae1a37fa88d2c05675d1d0eeb561d314de4fb9e
Opcode Fuzzy Hash: 8c10ec8f88881599d335c6b66d99623015c7bee168cbc8059c009de8a094ca0e
Instruction Fuzzy Hash: 20410671240601EFDB269F1DD880B6BFBA9FF54758F51843EE9199B2A5DB30DC018B90

Function 013EB570 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f9c93ed7adaa018ad7e9039085064a03e2abe3777adf0ca59931962059b9f4
Instruction ID: a80b5ab14e12fbe6e79ff3cede22d8e442253cf1825443cef4ca35130a4297b2
Opcode Fuzzy Hash: 50f9c93ed7adaa018ad7e9039085064a03e2abe3777adf0ca59931962059b9f4
Instruction Fuzzy Hash: 2C51E3712003529FD321EF68C981F6B7BE8EB64729F54062EFA11872E1D734E841CBA1

Function 0142D5D0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
Instruction ID: 67162fa90577004f4e0247606469f4475550828e51b42eaa1083baaef60774b2
Opcode Fuzzy Hash: 421d61e5bc4c825cfb3b344d513b1230fd482de7481e25e13c6dc44851e8f620
Instruction Fuzzy Hash: 0F51FD76A003639BCB119FE88C4097B7BE5EFD4644F44442AFA49C7361E734C896D7A2

Function 013D95DA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d96df7921d37aa44484037a14c40cbc3e022dbfcdab807f207d57b1b1ca21c1c
Instruction ID: 8899f9cdb00352132fe8cb368a5c641d55934c34570c209f74747027460dd6a0
Opcode Fuzzy Hash: d96df7921d37aa44484037a14c40cbc3e022dbfcdab807f207d57b1b1ca21c1c
Instruction Fuzzy Hash: 4E519271900209AFEF219FB9CD80BEEBBB9FF05318F20452AE694A7151EB719844DF10

Function 013B7152 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0d454c8bfe22940f570cfc125a23486b4cb8fb2b3a0d1d8b151af04c573352
Instruction ID: 068c30ebe6f6a35abb5c11d5da634aeaa8618b6ae1645237af3a46e07637ca8e
Opcode Fuzzy Hash: 6d0d454c8bfe22940f570cfc125a23486b4cb8fb2b3a0d1d8b151af04c573352
Instruction Fuzzy Hash: B651E731A0060AEFEB15DB78C9847BEB7B5FF54719F10406AD61297BE0E7709901CB90

Function 013D45B1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction ID: 9f169ad0d8b54efed807d694a4cc22d7b3c5bf6a8a682739692a6800eea6ee4c
Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction Fuzzy Hash: BC51B272E0020AABDF15DF98D440BEEBBB9EF44758F05406AEA15AB750D734DD44CBA0

Function 0147D26B Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
Instruction ID: 3cc21c51575c78ef8d074fc3f9c84ab25ee9af133e4b720d224208abe25294f3
Opcode Fuzzy Hash: e34a641792a2e79be6bf0067dfbea21fe876c0422c27924c31e583a14ba6783b
Instruction Fuzzy Hash: F8516C726183429FD310CF68C880B9BBBE5FF98254F04892EF99597391D734E906CB52

Function 01443140 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f70fb0e595edc4486e52bb48c29138ee74db08a6760aa7d8c30d8f2e558c57c
Instruction ID: 049dc3d593f49a7d91767a2f044ef9783cdc81570dd6bd9e3b05d6f3b59c0f0a
Opcode Fuzzy Hash: 2f70fb0e595edc4486e52bb48c29138ee74db08a6760aa7d8c30d8f2e558c57c
Instruction Fuzzy Hash: 2C518C72604221DFE711CF18C840AAAB7F4FF88B14F05852AF9549B360D374ED45CB92

Function 013B51ED Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a842e5803ee822ec75fa2529be6130ba5c6762b10e3ea17648e2526c05f36570
Instruction ID: d0af395ee82a4f0082a2654da778b8dbff85f0a1c1d4bc2f89d1827d9c62f72b
Opcode Fuzzy Hash: a842e5803ee822ec75fa2529be6130ba5c6762b10e3ea17648e2526c05f36570
Instruction Fuzzy Hash: 8B518131A02219DFEF22DBACC880BEEB7B4BB14718F150019E615EB761E7B49940CB51

Function 014835D7 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
Instruction ID: a0410ca8397c5b69b39b51ca5d3d644c895ef458fca95592ecb523418f8f3466
Opcode Fuzzy Hash: b2c300d7f86a03933703e09635872856e70952263eb4647515a482bdea46eec2
Instruction Fuzzy Hash: 95516D71600606EFDB16DF18C580A9ABBB5FF45708F15C0AAE9089F362E371E946CF90

Function 013E01F8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04673717a628686bc3cf269c0c1b261f41c666d291e4debc3c989aecf9a430f
Instruction ID: b3d067335f0cc8773dc54797923cd5f813c0870d56d272de2b956cb461b45911
Opcode Fuzzy Hash: c04673717a628686bc3cf269c0c1b261f41c666d291e4debc3c989aecf9a430f
Instruction Fuzzy Hash: 3D41BC31A012299BDB19DF98C444AEEB7F4AF48618F14812AF815F7290D7B49C42CBA4

Function 013BD534 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a561bd1dcd62ec14cc96b7fb34e438beff1c0a333f850eb415cd6dab7a6a2c5a
Instruction ID: e96fa59bf6722b4f7b166446de9fbe0cd576e855fce08dd478aea8e38c60b831
Opcode Fuzzy Hash: a561bd1dcd62ec14cc96b7fb34e438beff1c0a333f850eb415cd6dab7a6a2c5a
Instruction Fuzzy Hash: 2351DE32704685CFD722CF5CC494BAA77A5BB44B6CF0900A6FA418BBA5E734DC44C761

Function 013B6154 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7795e176363a1b2b24a0610728efcc31c4cf3bd9df28aa1caec962265d9a0f91
Instruction ID: 9ef1f181e0637dbee364f8fe5e98df158aab89932bb17d4c071d70e4a5804060
Opcode Fuzzy Hash: 7795e176363a1b2b24a0610728efcc31c4cf3bd9df28aa1caec962265d9a0f91
Instruction Fuzzy Hash: EB51FCB0900116DBEB25CB2CCC41BE9BBB5FF15318F1582A9D6199B6D6E73459C1CF40

Function 013AB136 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430d1a597e5199e5176d18c1cd723cd29318120c3ba55589c098f89d5326d695
Instruction ID: c3ff8815d106c628703b840eacd2a1e2a6a8b724a790295182cb0331ab857f70
Opcode Fuzzy Hash: 430d1a597e5199e5176d18c1cd723cd29318120c3ba55589c098f89d5326d695
Instruction Fuzzy Hash: 9E41D271640306EFDB22AF69C880B6BBBE8EF50798F41447AE515DB6A4D770DC40CB90

Function 013DA470 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4336cb4546881da184ef288ccfa97a4a2fd3470ed3198150d40fbb1136b32947
Instruction ID: a87561f55a2eaafa1b16872887bdb2a8932fc8f8ebf3b40f79c5a9b6a1d0390d
Opcode Fuzzy Hash: 4336cb4546881da184ef288ccfa97a4a2fd3470ed3198150d40fbb1136b32947
Instruction Fuzzy Hash: 0F41D132900209CFDB21DF6CE6947EE7BB5FB54318F99015AE411B73A5DB749900CBA0

Function 013AA020 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction ID: 1ec7b0c9c74e322dd0f88ce1f5a4bd4d78dec4b00badf4da9f77c4956ab97959
Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction Fuzzy Hash: 99418E36A00215DBDB22DE2E8454BBBBB71EB50758F95807FE944CB380D6339D40CB90

Function 014305A7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c39533236ed01f7c0cb168aba669d95881252f1caaa7cd5a619cd8495c118b2
Instruction ID: a188d8e4583dfcb4714653f7f6ab92c2e8b3b9d2f35d9bbe0943167f344fdad2
Opcode Fuzzy Hash: 5c39533236ed01f7c0cb168aba669d95881252f1caaa7cd5a619cd8495c118b2
Instruction Fuzzy Hash: 5D4191726046429BD320DF6CD840A6BB7A9BFC8700F14462EF95997690E730E915C7A6

Function 013C02E1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction ID: 4c0d2d8ab51ec870495d4a52ad77e5a8bc175d2da610622dbce3008cc6f39702
Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction Fuzzy Hash: CE311531A04284EBDB118B6CCC84BDBBFE8AF14754F0441AAF455D7352D774D844CBA0

Function 013D9274 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 651310eab571f5cf1f4f884f25c14e26c74eb023f5ce043734b7678d9be81c76
Instruction ID: dd120027f836b8d6017e294a892dd8f13e8807145ad702b8c3b3df1a1b4c22d3
Opcode Fuzzy Hash: 651310eab571f5cf1f4f884f25c14e26c74eb023f5ce043734b7678d9be81c76
Instruction Fuzzy Hash: E9319372A0032DAFDB259B68DC40B9ABBB9EF85718F5101E9E54CA7280DB309D45CF51

Function 013B4260 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd458167635d97cb393e9808a2c7b08de5307c74580c99d397b2cd06a53e96b
Instruction ID: aac9193ddd4f4ca670b34a1fe8c10b58bd1113161d798bf006c81aa8e634e9cb
Opcode Fuzzy Hash: 7bd458167635d97cb393e9808a2c7b08de5307c74580c99d397b2cd06a53e96b
Instruction Fuzzy Hash: 4641BD71200B09DFD722CF28C880BD67BE8AB54318F15842EEA9A8B761D730E844CB54

Function 013D50E4 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction ID: ad20679729d6a4cb654550f562bbe7ae2823a7f438cff98888957d28bb27c371
Opcode Fuzzy Hash: 9736ef1e2d2fe6ed3e8edd6ff05ccc53a0216fb05e956db353e68a80ecb75403
Instruction Fuzzy Hash: CB31F7327083469BEF21DA3CD800767BBF9AB85798F08852AF5958B795D374CC41C792

Function 014761C3 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da30078468123cdf560a8743dc050c09aa25e981cf3baef64204c2539a7dc03
Instruction ID: e0423f66c9242823732c7b8c01937d6ab1e76b4b06a096c34a3c36978d6198d6
Opcode Fuzzy Hash: 8da30078468123cdf560a8743dc050c09aa25e981cf3baef64204c2539a7dc03
Instruction Fuzzy Hash: 6731E475A00616ABEB15DF98CC40BEEB7B6FB44B44F464169E904EB254D770ED00CBA4

Function 014760B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e03966873de51317aae75398429c0d3157a53757b3dd990f65d25adeb4e555f
Instruction ID: 9e3170075c0b9cf5a19ad8a3146acc911b387f4d0a9332fe67b9c794d40e9385
Opcode Fuzzy Hash: 0e03966873de51317aae75398429c0d3157a53757b3dd990f65d25adeb4e555f
Instruction Fuzzy Hash: E831E471700A02EBEB229F6DD840AAFBBBAEB54754F06406EE505DB361DA70DC018B90

Function 013B8550 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38633e412598917eed8f7116907cccb78f426435f31d4a4c48be7742b7587c2
Instruction ID: f121b43ffb83d7844401b47ee0964afcfffea26c3b8d87b0d2e9f4a8be6036f8
Opcode Fuzzy Hash: f38633e412598917eed8f7116907cccb78f426435f31d4a4c48be7742b7587c2
Instruction Fuzzy Hash: C2316DB16053018FE720CF19C840B5BBBE9EB98704F154A6EEA84D7765E7B0E944CB91

Function 01407190 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction ID: b31de68b107259ffde0dc2e5f5e34cc125a3f4dc97dadf1e60398e438b075cce
Opcode Fuzzy Hash: 3d9f232daa6456112ef7cca9ac13d1ecc1d2608bc40d33be58fee952b0e99bbe
Instruction Fuzzy Hash: 39316975604206CFC711CF1DC480956BBF6FF89314B2585AAEA989B3A5E730FD06CB92

Function 013D438F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de5be3463e86c2994d1bbc938289a3ef49795ddb47401bda7305b9d53a4380b
Instruction ID: 4bc1f2c7254af6373c296f50ba42f3cb3f502cbbb44b7d787550c19c4924dc5d
Opcode Fuzzy Hash: 9de5be3463e86c2994d1bbc938289a3ef49795ddb47401bda7305b9d53a4380b
Instruction Fuzzy Hash: 4631E572B002059FDB20DFB8D981A6EBBF9EF94708F00852AD515E7A54D730ED81CB91

Function 013B92C5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction ID: 63666a8410291e4803b78962f725fb342bc15f9fbb262b48df5447d1f459ffd2
Opcode Fuzzy Hash: 2963604b138b45d82781e0a3e479f75d70978de019cd50ff7a7906112cbdd64f
Instruction Fuzzy Hash: 54318AB160820A8FC701DF18D880A9A7BE9EF99718F11056AFA59D73A1D631DC05CBA2

Function 013AC156 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4ef613e177d791b5c6df4c79e7fd56d4b2dbd4c1dd245cf9cbd09607d48e00
Instruction ID: e5c0682cddc2c17f4ff0c8c6471e9ad8f5e9800acf4f26a7aeefe8d7e9949588
Opcode Fuzzy Hash: ee4ef613e177d791b5c6df4c79e7fd56d4b2dbd4c1dd245cf9cbd09607d48e00
Instruction Fuzzy Hash: 9E312C719003018BD722AF9DCC41BBA7774EF51318F94817EDD499B392DE34998ACB90

Function 0146C3CD Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction ID: 985c7a4c619d28932009536de9aec48e0557baa35e65617367d12050300d7d0e
Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction Fuzzy Hash: 58213036600652B6CF15EB998C40ABBBBB8EF50758F40802FFAD5876A1E634D950C361

Function 013AE420 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98cf2b8d3c7ed155bd212e5154d0433a22f118b67e1cab665c331f18b7cab7fc
Instruction ID: 36a6e2ab4c28393ebffa1183463bde254463ccfe049ab55ac3e585a089d0c540
Opcode Fuzzy Hash: 98cf2b8d3c7ed155bd212e5154d0433a22f118b67e1cab665c331f18b7cab7fc
Instruction Fuzzy Hash: 7C31C332A0152C9BDB31DF18DC81FEEB7BDEB15758F4101B5E645A7290E674AE808FA0

Function 013E4588 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
Instruction ID: 7ac9966356dbd5a04011791ef0fb7e1deeb6f8a7c37e1365dd4323e3b5732948
Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
Instruction Fuzzy Hash: F0216031A00719EBCF15CF58C984A8ABBF5FF48728F108469EE15DB281D675EA058F90

Function 013AE388 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction ID: ff34038ee11906bccbed973e0e7f7ea814c3a7197823b66c32b4e5345fe08459
Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction Fuzzy Hash: D0317831600609EFE721CFA9C984F6AB7B9EF85358F1045B9E5529B690E770EE02CB50

Function 013ED530 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd77728b812fe637ad69e36196e97374b94c2f1296bec21253dc2c6140d8ae63
Instruction ID: 6854c9d891dfdfbd1c7558ea8f2f57bd2ac496bb4e78b770ac57f5ca62be2191
Opcode Fuzzy Hash: dd77728b812fe637ad69e36196e97374b94c2f1296bec21253dc2c6140d8ae63
Instruction Fuzzy Hash: 91212C715143169BD720EB6CD904F5B7BECAB6465CF86082AFA08D76E0EB34DC04CB91

Function 013DF32A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction ID: ba1460d9c091d33bbd4cc935ad9c14a9872cc583e54afb44c344ea4262112c83
Opcode Fuzzy Hash: e1acee25a86a18db778833508db53c8429f7f2c8d9f42c0ea70f9f679245ea3d
Instruction Fuzzy Hash: 0F21B0722002059FC71ACF19D481B66BBA9EF85368F15816DE1078B390EB70E802CB94

Function 0143019F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1241f421b723f7e5aef3859370989be57e3f9b62c4b2159b404ecdc93fa6cc
Instruction ID: 064b010200b0e995f13bf83d328d493ff077b1af23547892dffcc616588ea0aa
Opcode Fuzzy Hash: 0b1241f421b723f7e5aef3859370989be57e3f9b62c4b2159b404ecdc93fa6cc
Instruction Fuzzy Hash: E821BA71600605AFDB15DB6CC840F6AB7A8FF88B44F14416AF904DB7A1D635ED00CBA8

Function 014571F9 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e6ca7296a28441116d14f7ea7e56efeeee5444c357038b45dd6947b331c3d5
Instruction ID: 05dbbf011cf5e0ca40a30e1a1259f4b5b3ad15554ca3d1f8841ab611719764f2
Opcode Fuzzy Hash: c2e6ca7296a28441116d14f7ea7e56efeeee5444c357038b45dd6947b331c3d5
Instruction Fuzzy Hash: 90214830A047418BC321DF298840B2BBBE9AFE1295F54493EFCA693262CB70A8458791

Function 01430283 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9588cc4778babc9c3506c6ff02bb40bad2fd91cbff4acd8485f3523e7bd6c984
Instruction ID: 9dcf8664cf781ee971f4752a6d296fc4e3cc178d9ad93c115d1588a26c9fb3a7
Opcode Fuzzy Hash: 9588cc4778babc9c3506c6ff02bb40bad2fd91cbff4acd8485f3523e7bd6c984
Instruction Fuzzy Hash: 7921D0729043469BD711EF6DC844B9BBBDCAFD5644F08465BBD80C7261D730D909C7A2

Function 0142D0C0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
Instruction ID: fb1936d49f198901fdfdd8cd85ea5bfe846006c7e9484c74ae9b580c71ff514c
Opcode Fuzzy Hash: a31c2c23b4517fa83190f2f071b075dcb825627450a6f94414447da29f9bb9ec
Instruction Fuzzy Hash: 7921C272A44715ABD3119F1CCC41B6BBBA4FB88764F50012EF949DB7A0D734E8418BA9

Function 013EA30B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3887b96118671fcf25a45eb3dafa71c8685f854922821e42329c586ba707507b
Instruction ID: 3941749885bc15d2ba21dca4a808cd015261ebd759b02161ad6f0eb7d28ca97b
Opcode Fuzzy Hash: 3887b96118671fcf25a45eb3dafa71c8685f854922821e42329c586ba707507b
Instruction Fuzzy Hash: DF219A352017119BCB25DF29C800B56B7E5AF18B08F25846DE509CBB61E371EC82CF94

Function 014480A8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction ID: e1cede6c536f9661848e2557268e6bf2cd2e0201b348b284f1466a9941247df0
Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction Fuzzy Hash: D4218C72A0020AEFEF129F98CC40BAEBBB9EF98710F20441AF945A7261D734DD519B50

Function 013D15A9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
Instruction ID: e9204f3ff84230adac2416fa6b8b6befa10f3d155d4991862c53338e3b595ddd
Opcode Fuzzy Hash: 29802a1ca24c6965babefc6623953e4fc32110ab479eab20bfca4cc576a297b9
Instruction Fuzzy Hash: 41212632606685DFE722CB6DD948B627BE9AF44658F2900A2ED058B766E738DC00C750

Function 013E0124 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction ID: e819b3cf22ac70db579ed8387aaa656ae5bbfe08d5aa84010ae7a8051e2e2a4d
Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction Fuzzy Hash: 2811E276600716EFD72A9B58CC85F9ABBB8EB80758F100029F6049F1C0D6B1ED44CB50

Function 0143D080 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972cc1f7cebe0660563bcd3cc0e35513c443efff407736a22d0b072bff9250bb
Instruction ID: 9e5f5e76e488702a3ce99db366623141f2ca101a2d8ff2eb8d7881ddd33e1bbe
Opcode Fuzzy Hash: 972cc1f7cebe0660563bcd3cc0e35513c443efff407736a22d0b072bff9250bb
Instruction Fuzzy Hash: 5A1129715502519BCB32AF6DCC40F27BBA8EBE5A68F55442EFA045B2A1DB319C01C794

Function 013B80E9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592fb6933ec0ec0de1c6595d464d8ba42db88469a328848a514ab681e996ea9b
Instruction ID: c7187b81ab00449559e73aaaad092c5fa42692781a61fd680cbb417b602fe872
Opcode Fuzzy Hash: 592fb6933ec0ec0de1c6595d464d8ba42db88469a328848a514ab681e996ea9b
Instruction Fuzzy Hash: 79219F31A01209DFCB14CF58C580AAEBBB9FB88318F2441ADD205A7710D771AD06CBD0

Function 0144D5B0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
Instruction ID: 5cb7b1099eb6c1a22cbfae05fd1bcd2353aa2334efc314ef59435392d1aa2785
Opcode Fuzzy Hash: 227256db81d375ecfc13626cb2ab5827bd77baaff17ec571dfb7d10958618551
Instruction Fuzzy Hash: 0211B631610710AFEB22DF68CD50F9BB7A9EFA4764F10441AE4499B690EB74F901CBA4

Function 013A9240 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a6d256cec124ba17b69986062fd93afba7a5bd98b17576fb7320c876b558bc
Instruction ID: 065f90c14385d1237be207594e373b7fb2636154f4c329032972d468aebcd780
Opcode Fuzzy Hash: 97a6d256cec124ba17b69986062fd93afba7a5bd98b17576fb7320c876b558bc
Instruction Fuzzy Hash: AD11083A010105ABD7359F65D801A723FB8FB64B84F968029D9049B7B8E334DD01CB54

Function 013DB052 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f760c972aa3a3560b20614ae39c9a1d77eb3ad99500487a10f144300de1bdd8
Instruction ID: 806db12f44ebfe692a3d3c86bac7938b942b77af2fde628593a6b862ca594f34
Opcode Fuzzy Hash: 7f760c972aa3a3560b20614ae39c9a1d77eb3ad99500487a10f144300de1bdd8
Instruction Fuzzy Hash: B5019273B00305ABE720ABAEAC81F6BBAECDF95618F050469F705D7241EB70E9018661

Function 013A7330 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a509b8fc5e4a0b131e5320f5aaf1c68798ef52bd24e5b63395f53874855d62
Instruction ID: 7f67fc9e74a34b4d2ea4b5b7444e86ec5fd439c89bb36fda078889f8597f460e
Opcode Fuzzy Hash: c7a509b8fc5e4a0b131e5320f5aaf1c68798ef52bd24e5b63395f53874855d62
Instruction Fuzzy Hash: 7D118272600615DFE721CF69C886BAB77E8EF44358F464429EA85C7251D736EC04CBA1

Function 013DE53E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction ID: fd94151d5d2a29b8b9075fb867bf6ba447ff2278fbf49edadcd4c23d29d8d0d9
Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction Fuzzy Hash: AB11C6732056C6DBE722971CD544B663F95AB0078CF1900B1DE418BB62F339DC4BC250

Function 013DF2D0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d37714369831d8f2725e0c2bad63a6126ab21d68edbb01a7e27fe2af1a6f9c3
Instruction ID: 5203dddc7ef84ef05bb0da5191d9276fc16ea43137dbd9917552adb26d27e6bc
Opcode Fuzzy Hash: 0d37714369831d8f2725e0c2bad63a6126ab21d68edbb01a7e27fe2af1a6f9c3
Instruction Fuzzy Hash: B2110EB26006489BD720DF6DE884BAEBBE8FF44704F45007AEA02EB751DA39ED41C750

Function 014472A0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction ID: 5183d71704eef54d5792f8973fe9fc9c601a045affa1dfbf45cdd9ae0e69a405
Opcode Fuzzy Hash: 1e850f2c6b8a62aa57273bc2e4efeca7cc81b0ea7f022921ea7aa6f1d3ab38ae
Instruction Fuzzy Hash: AA01807214050ABFEB11AF5ACC80E93FB6DFB64795B50452AF25442570C731ECA1CBA4

Function 013AA250 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction ID: 5ce834fc687a841b557ae80fcd4a7c83043195a40c5debc836bce51ebdb19fa3
Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction Fuzzy Hash: D50149335047269BCB318F19D840A727BF8FF55B64740852DFD958B681C332D820CB60

Function 0142E1D0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dffb11c3178d60765fe17c8b3786c6f187e5e8bfb9f0e502a08943c1fcf66a74
Instruction ID: 8630a5a0a1c244a63bbc1f3043b4f700fba82b7cc8a7bb25d12f3b7525a2264c
Opcode Fuzzy Hash: dffb11c3178d60765fe17c8b3786c6f187e5e8bfb9f0e502a08943c1fcf66a74
Instruction Fuzzy Hash: 6A118B32241641EFDB15EF19CD80F56BBB8FF54B48F240069EA069B661C235ED01CBA0

Function 013B6259 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e10dfd7eedb423a4d7a7d52272b4998c2eb671cb64f33dadaa54e33c03c00ed
Instruction ID: a54b752835416f37a10495b4ad96a3cac61c5438b2c0a746921130e816bf3acc
Opcode Fuzzy Hash: 8e10dfd7eedb423a4d7a7d52272b4998c2eb671cb64f33dadaa54e33c03c00ed
Instruction Fuzzy Hash: A4115E7054122DABEB25AF68CD42FE97274BF04714F5041D9A719AA1E1D6709E81CF84

Function 01436050 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dec23d32ad359fc31f792185c587ae461355fe732c4b58cc01011a88ae491e2
Instruction ID: 7e1949b4d10b70e19d3b84a0e6adceca71c0cb9b6109ec10d21cc4df23bd9e9f
Opcode Fuzzy Hash: 3dec23d32ad359fc31f792185c587ae461355fe732c4b58cc01011a88ae491e2
Instruction Fuzzy Hash: 93111BB2900119BBCB15DB98CC85DDFBB7CEF58258F054166E506A7211EA34EA15CBE0

Function 013B208A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction ID: 928ba87456a1e3615b2072fd475a4c8e4bd8ee3c4a4b5d5b42c2ea06683ce1e0
Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction Fuzzy Hash: B20128322001018BDF229A5DD8C0BD3776BBFC8704F1642BAEE018F696EA71EC85C790

Function 01446500 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9481dd13eb01ac3bc310d64caad36ef99f79c1bfb7ec7c531f35d914a704f70
Instruction ID: 78ddb7178751d933d30d8c7fa698fcee8332b1780738f47b97fa30e91416d2f5
Opcode Fuzzy Hash: f9481dd13eb01ac3bc310d64caad36ef99f79c1bfb7ec7c531f35d914a704f70
Instruction Fuzzy Hash: 0511C8726441459FD711CF58D400BA6BBB5FB56314F09815AE848CF325D731EC41CBE0

Function 013AC020 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction ID: b9219fcea9fd629e41070a5bef63747355720ffcbfc683e88444df12b0f57711
Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction Fuzzy Hash: AB012D321007099FDB23D6AEC400FA777EDFFD5214F44842EA94687590DA71E405C750

Function 013F20F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88aba59d343352953394e05ffc393e111508a43674d88f690dae6063d5880fa4
Instruction ID: 35d8118cc363e95f6c2a644f8be4e2ca80bb7b51ce013eda2b3fde888739c3c4
Opcode Fuzzy Hash: 88aba59d343352953394e05ffc393e111508a43674d88f690dae6063d5880fa4
Instruction Fuzzy Hash: 2D116D75A0020DEBCB05DF68C850FAF7BB9EB44654F10405DEA119B290D635EE51CB90

Function 013EE5CF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54489f0445556c24ccec85383a83a56c61557c02e48bc1783b46bdea2e6dacd4
Instruction ID: e84b909ee17c10b77808ddaf0f56c71890171c4fcfb2355f15070269b25ee334
Opcode Fuzzy Hash: 54489f0445556c24ccec85383a83a56c61557c02e48bc1783b46bdea2e6dacd4
Instruction Fuzzy Hash: 26018472201615BBD711AB6DCD40E57B7ACFF65A58B05052EB10593661DF34EC01C7A4

Function 013A9353 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction ID: 090021bf9b5848d0f4270056ba72c62577ff1657edd0de4b81410ff99d205ea9
Opcode Fuzzy Hash: 16eb1e9227c9ca53ee971aeba792c6b4be561f846bb8a1c766c052503132072f
Instruction Fuzzy Hash: 16118B32810A02DFDB229E1AC880B22B7F4FF5076AF15C86DD5895A5E6C379E880CB10

Function 0143C460 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7be68f3f5a3c906bf63e2a734ac0e96aeef37c3af1f28cf03ed712db713fd74
Instruction ID: 3a30d784db775f6cd88f070333448605dacc8d97cb40bf6601838af7d79f27c0
Opcode Fuzzy Hash: f7be68f3f5a3c906bf63e2a734ac0e96aeef37c3af1f28cf03ed712db713fd74
Instruction Fuzzy Hash: AB115B71A00209ABDB15EF68C884EAE7BB6EB98344F00406AFD01A7390DA35ED11CB90

Function 013ED1D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction ID: 401b445a005865d55e2291711e2ee88ea77ab26c7cc144193ffe5d5643e39057
Opcode Fuzzy Hash: 2103513d2fbd223765d54b27d59d1ce24549dd4e977acd5ce3c70b0a80ca45ab
Instruction Fuzzy Hash: 62014772A002299BDB119B98E808F6A77E9EB94A38F10811AFE118B7D0DB34DD40C780

Function 013D33A5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction ID: ea780e3d6e15dc81327d2f35846eaee14e738c4667d8070edc4e8be561ae4354
Opcode Fuzzy Hash: 5807426d3854de8340053ba828383e613f6f2126caef2cc0c9319ce74fae2529
Instruction Fuzzy Hash: D801D6B7700215E7CB129AAEED00EDB7EBCBF84658B144429BA05E7160EA34DD21C760

Function 0146F5BE Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8afb38b0d4643e661460643aede2a56aa4cd7f4aa145da614565e93e730a40d
Instruction ID: 30388ec02eb39deba52ef008ff53d54e6285a88f4c61b776d198f3af353ebdfd
Opcode Fuzzy Hash: b8afb38b0d4643e661460643aede2a56aa4cd7f4aa145da614565e93e730a40d
Instruction Fuzzy Hash: 04017171A00249AFDB14EF6DE855FAEBBB8EF44704F40406ABA04EB390D674DE05CB95

Function 0146F453 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41e2a7159d3294b7b464b13d6704fc390fbc29d6c6108173eb9ec316644563f
Instruction ID: 4fb90b5812085ad213e9cca02bf107a7d6e8ed7f23feb04fcbc7d5c881bbf345
Opcode Fuzzy Hash: a41e2a7159d3294b7b464b13d6704fc390fbc29d6c6108173eb9ec316644563f
Instruction Fuzzy Hash: 94019E71A10249ABCB04EF69D841FAEBBB8EF54714F00402ABA00EB390D674DE01CB95

Function 013CE016 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction ID: 9d30a6bb58c3f4aba6e5a3f2a6165d4f755b157129362e8da3e6f4b354d5a18d
Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction Fuzzy Hash: EE0171322005849FE323961EC948F277BDCEB48B58F0904BAF909CBAE2D678DC40C761

Function 013A826B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f101604201a769b87ad1ed5f224663f0e476a8f8b05854be2570ee5c5fbb71
Instruction ID: 87664f27c7a5ae1c4a62bd235563009365805d28927b74610441b6e2a903ee70
Opcode Fuzzy Hash: 84f101604201a769b87ad1ed5f224663f0e476a8f8b05854be2570ee5c5fbb71
Instruction Fuzzy Hash: CC01F731B00509DBD714EB6EDC04ABEBBB8FF94618B8540AA9901A7690EE30DC01C390

Function 0146F367 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1eadadb7851d6c619ae9065c73f824f55945f0a7ea34a09d45b573c856997ef
Instruction ID: 683b040c90348978a4417a155f9fbc74fb524937a64ab19d7f41b99e5d78157b
Opcode Fuzzy Hash: e1eadadb7851d6c619ae9065c73f824f55945f0a7ea34a09d45b573c856997ef
Instruction Fuzzy Hash: 06018471A10259ABDB10EBA9D855FAF7BB8EF54704F00406AB901EB390D674DD01C794

Function 013B2582 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91105e73277b044bb7b8307ef0fce50160c4af814082fb7178c8a8be46413ee6
Instruction ID: 838df75588f911cba9f1923c20ea198a2fb566971883b578ccaee92e759cdc6f
Opcode Fuzzy Hash: 91105e73277b044bb7b8307ef0fce50160c4af814082fb7178c8a8be46413ee6
Instruction Fuzzy Hash: ACF0F932741610B7C7319B5ACD80F97BAADEB84E94F104029A60597A50D630ED01CBA0

Function 01485152 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012a5b3a74993839f79ac27599c535b8865c693d0ac05eab6e9f03c82281eacf
Instruction ID: c99da5547f0da49cef23ea5a43c6d4f5b91f55373516c35529a51fc3a2760d9a
Opcode Fuzzy Hash: 012a5b3a74993839f79ac27599c535b8865c693d0ac05eab6e9f03c82281eacf
Instruction Fuzzy Hash: 7B012CB1A10209ABDB01DFA9D941AEEBBF8FF58704F10405AEA01E7350D634AA018BA4

Function 01485060 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f38969ea0935cbab9974d9146881b9b061ed53e8162ec635f400903ac2100e
Instruction ID: f36c306255a2bfcf0e68bd5d7c4f378ff86b7414abf5d0df16e9f35a7ea75734
Opcode Fuzzy Hash: 38f38969ea0935cbab9974d9146881b9b061ed53e8162ec635f400903ac2100e
Instruction Fuzzy Hash: 0D0121B5A10209ABCB04DF69D9419EEBBF8FF59704F10405AFA01EB351D634A901CBA5

Function 013DC073 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction ID: 3945e2fe34d5abce96465902a1916ead0e3a6f8d8a1d0673686cf91bb81e7319
Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction Fuzzy Hash: A7F0AFB3600611ABD324CF4D9940E57FBEADBD1A84F04812CA609CB220EA31ED04CB90

Function 014850D9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04bb4ea291159b79020716f10da0ebd80c27215d961349f3fcc1356505eff240
Instruction ID: d24e6eddc8b778ab50f61f1174c21ddf6db15367e25bdc3deb9a5b1f6a71bdac
Opcode Fuzzy Hash: 04bb4ea291159b79020716f10da0ebd80c27215d961349f3fcc1356505eff240
Instruction Fuzzy Hash: 480121B1A00209ABDB00DF69D9459EEBBF8FF58704F50405AEA01F7350D674AD018BA4

Function 013AC310 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction ID: f7432a287601c55e961a0a46cc38984667ba4ccf26c6ca04cff9282506125e5d
Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction Fuzzy Hash: 3BF021732046379FD733565D4840F6BA799CFE1A6DF591035F2099B680C978CD0157D0

Function 01485537 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e772c4da8e9cfbcea1bce1facaba059c180a90cc0c778dc01bff935356a6746
Instruction ID: 15295efdb72fabf1c23b62d949a717e29bbe76ac43e0c01662ac2558516e5195
Opcode Fuzzy Hash: 1e772c4da8e9cfbcea1bce1facaba059c180a90cc0c778dc01bff935356a6746
Instruction Fuzzy Hash: CC111B70A1024ADFDB04DFA9D541BAEBBF4FF08304F04426AE509EB382E634D941CB90

Function 014861E5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294031d94d33b47ba24aafe6818abaf8d9355bcabaedf87303f46e01283a9da8
Instruction ID: b85480a92cbb50ed5f98596542c261450705d320b385f7f6151869a1c11f0edc
Opcode Fuzzy Hash: 294031d94d33b47ba24aafe6818abaf8d9355bcabaedf87303f46e01283a9da8
Instruction Fuzzy Hash: FD018F71A00249ABCB00EFADD545AEEBBF8FF58314F15405AE901E7390D734EA01CB95

Function 014363C0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
Instruction ID: 9580748ff691170fc3f420a4b125232c1889174a585add12eb0b093de45b857a
Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
Instruction Fuzzy Hash: 72F01D7220001EBFEF019F95DD81DEF7B7EEB99698B114129FA1192160D631DE21ABA0

Function 0146F2F8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27fd18d23705088b66c7b70ebcb53c52a33b6640a9d85b8e3348e083609bfad
Instruction ID: 75c1f58bc24cd109054982d35f3cdde8e2a24686f27abf7b5de671b86e5e9d92
Opcode Fuzzy Hash: d27fd18d23705088b66c7b70ebcb53c52a33b6640a9d85b8e3348e083609bfad
Instruction Fuzzy Hash: 9CF0C872B10349ABDB04DFBDD415AEFB7B8EF54714F00806AE501E7290DA74D9058751

Function 013E724D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction ID: f792de79d625bb0511567bd704696598f8c919b97239e47b6b1db54a2ed9ea96
Opcode Fuzzy Hash: 44620c8b90c707c3135ebb5afdba643e124f7b09bfea536c61b6b3c3b840e391
Instruction Fuzzy Hash: D8F0F671E01366ABEB10D7AD8944FAFBBE89F90618F088155BA01972C5D630EA41C6D4

Function 013AC0F0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b58b7d418acbc0c9331d03e75a7973c337ea41616530f3fbd47e6e21c3b5e0d
Instruction ID: 004faac7c1e4d27fb12524c85db5b53744463f59d83113834f86aa93392080fb
Opcode Fuzzy Hash: 1b58b7d418acbc0c9331d03e75a7973c337ea41616530f3fbd47e6e21c3b5e0d
Instruction Fuzzy Hash: 01F024713043419BF754A7199C01B22329AE7D065CFB5902AEB058FBC1F970EC01C3A4

Function 014853FC Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4f3671af180dce07c960d09172bd3b99eb85f6f91b5469d8002b50eea8c4d9
Instruction ID: 9ece821c25b5118b081c8f5513ac4206ac61f04b860160bdfaa0b4eb6f295b2d
Opcode Fuzzy Hash: dc4f3671af180dce07c960d09172bd3b99eb85f6f91b5469d8002b50eea8c4d9
Instruction Fuzzy Hash: 73011E70A0020A9FDB04DFADD545B9EB7F4FF08704F14827AA519EB391E6749A418B90

Function 013E656A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3eeae725b1dc7524cbab7bb81dae14bfb5b20985d21849e47bdbcfac2f6493e
Instruction ID: b7bcf68dfa066a757853b8742706dd6ce0cb131395e0714b943dbc331a26da35
Opcode Fuzzy Hash: c3eeae725b1dc7524cbab7bb81dae14bfb5b20985d21849e47bdbcfac2f6493e
Instruction Fuzzy Hash: 1B01A9B0304795DFE322972CCD4DB663BD8FB54B48F894155FA018BAE6D778D8418610

Function 0145437C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction ID: 6393dca41cc5717d3b384ec9b1f10d47e78d74e465e1d21dd78f873402a1c3ce
Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction Fuzzy Hash: 9EF0E931341A1347EBB6AB2E9410B2BA6959F90D40B0D053E9D05CF7B7EF30DC918780

Function 0146F3E6 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ffe42ac60b26c2e4bacd506d8ff25441b81c47d5fec3502f081dc69f84d191
Instruction ID: 6240c68d3c89863d5b3c860b27b281fa0bb511bb0f48a3da8e8633c1ecc3c98a
Opcode Fuzzy Hash: c4ffe42ac60b26c2e4bacd506d8ff25441b81c47d5fec3502f081dc69f84d191
Instruction Fuzzy Hash: 5BF04F71A00249AFCB04EFADD555A9EBBF4FF18304F40806AB945EB391E674EA01CB55

Function 013A92FF Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d85095ca0abddfa66f5252e143d96c94dc045b4959eba41ed34088ca514b47
Instruction ID: 5e29498715ab06a8de5eafed73af98fe874d561e27ae85c41441e85fe40fe57c
Opcode Fuzzy Hash: 20d85095ca0abddfa66f5252e143d96c94dc045b4959eba41ed34088ca514b47
Instruction Fuzzy Hash: E3F0FA32200340AFD732AB09CC04F9ABBFDEF94B08F48011CA542A30E0CAA0F908C760

Function 014855C9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdbcbc66fc5f42dc6808cc320c63fd576321d2f3143fc9fb471b32a5e6276358
Instruction ID: 656b43f7ec124a5796e3f7187d87280912ca598ac922ae5ef66ea3278ed7f7f6
Opcode Fuzzy Hash: fdbcbc66fc5f42dc6808cc320c63fd576321d2f3143fc9fb471b32a5e6276358
Instruction Fuzzy Hash: C1F04474A00249EFDB04EF68D545A9EB7F4FF18304F50446AB905EB390D674DA00CB54

Function 01470115 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e61892505c85066fd458535fe71f3db05c60aabd1a82a7395c13fb7f4f7f75af
Instruction ID: 03782e0ecd1dc77e1ac28afad6896ad7a22d60cc120fa1dda90bf5dbb9559729
Opcode Fuzzy Hash: e61892505c85066fd458535fe71f3db05c60aabd1a82a7395c13fb7f4f7f75af
Instruction Fuzzy Hash: 73F0A76A4176850ACB326B3C74602D26F5CE762114F5F244BE4A157339C6759883C365

Function 0148539D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c12963be130f29428f57290d2b972580bd03e106c18975fa56f6fef744a9191
Instruction ID: 377146fe1837fb1954948704b19e7a82c808ddd92e311b052aa2521b867ad32d
Opcode Fuzzy Hash: 2c12963be130f29428f57290d2b972580bd03e106c18975fa56f6fef744a9191
Instruction Fuzzy Hash: 68F05470A1024DAFDB04EB79D545BAEB7B4EF14704F508059E601EB291DA74D901CB14

Function 014852E2 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f241991d315a36be0c888875ae1d57925e87fdc0788512157f95031c7da2b747
Instruction ID: 726dcdc5694e4c72a2877871eee3f59bd80bc8eabac1668b5fa52812791b8a85
Opcode Fuzzy Hash: f241991d315a36be0c888875ae1d57925e87fdc0788512157f95031c7da2b747
Instruction Fuzzy Hash: 5EF08270A10249AFDB04EFB9E545EAEB7F4FF14704F444469B901EB391EA74E901CB54

Function 01485283 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d2401a229aba84a938b6f4f6923a03006f1c933bcbe5da04d9a846888db65b1
Instruction ID: af3deb6a8802c868c11865df4a15b7905dacbd2e28f97fac7ea466cd517bf88b
Opcode Fuzzy Hash: 0d2401a229aba84a938b6f4f6923a03006f1c933bcbe5da04d9a846888db65b1
Instruction Fuzzy Hash: 90F05E70A10249ABDB04EBA9D545AAEB7F4FF14704F404469B941EB391EA34E901CB54

Function 013EC5ED Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d85934003ede1059b1b21168d7b1a2326998f994a22bebd915d3bfd348677107
Instruction ID: 169bf3ca00dc4ea5925757219d44aeaa86e234c296281eb64f9f5058d3cc188d
Opcode Fuzzy Hash: d85934003ede1059b1b21168d7b1a2326998f994a22bebd915d3bfd348677107
Instruction Fuzzy Hash: 7FF0E2715117719FE722971CC14CB2B7BE89B817BCF0CB426D44A875D2C264F880CE50

Function 014851CB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71aebc94ce20b2f4bb17eee6215d30cceb05781eefe71a0bbbe38d753dde6f54
Instruction ID: e993e8f56b75a70cf8785d5a006f4ac25fc6014294f653f45bb3b100ef8d414c
Opcode Fuzzy Hash: 71aebc94ce20b2f4bb17eee6215d30cceb05781eefe71a0bbbe38d753dde6f54
Instruction Fuzzy Hash: F9F082B0A10249ABDB04EBA8D505E6E77B4FF14708F440059BA01EB2D0EA74E901CB58

Function 0142D070 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
Instruction ID: 53e894d4dd2886081b1912644b5c0719f0c4cd77c3b8825e6edc9633a23e320f
Opcode Fuzzy Hash: 29a6642c7ef7ed3592a36acdccc95c3bae471711bc0d42908ddba4b2807d0017
Instruction Fuzzy Hash: 01F0A03250461467C220AA4D8C05F9BBBACDBE5B74F20421ABA249A1E0DA70A901C7D6

Function 01485341 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe5951801be3d8feed463fe0ba5904d0b5511ca47471be3b50b5766d668e6eb
Instruction ID: 2b1a32d0e5703aede9fa8b4bbc1defa73248b1c87f3a7ee7b13cef2ea8763b08
Opcode Fuzzy Hash: cfe5951801be3d8feed463fe0ba5904d0b5511ca47471be3b50b5766d668e6eb
Instruction Fuzzy Hash: 1DF0A770A04249ABDB04EBBDD545E9E77F4EF19304F500069E502EB3E0EA74DD00C714

Function 013E7208 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5826c18cbd6844583afc2e664889989a305ed9334bad5eeb38c81b04bb0f2f3c
Instruction ID: 9bb4bd711db3aa4e079563cfeaaa373a809e145178dc26ec52d68729fa2b9779
Opcode Fuzzy Hash: 5826c18cbd6844583afc2e664889989a305ed9334bad5eeb38c81b04bb0f2f3c
Instruction Fuzzy Hash: 85F0EC719116B59FD722DB1CC084B2377D8DB00A74F4C8066E6898BA22C338C8C0C290

Function 01485227 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65e769bd2cb0068da41ed9c347893c26f25268c4d5a5a991218f2396a33dbfa
Instruction ID: 5721663beac4c48aa282043d4476d19ab474de1c2cd461ba5ad335cf96713cbf
Opcode Fuzzy Hash: b65e769bd2cb0068da41ed9c347893c26f25268c4d5a5a991218f2396a33dbfa
Instruction Fuzzy Hash: 4AF08270A14249ABDB14EBA8D545EAE77F4EF14704F440059BA01EB291EA74D901C758

Function 0148547F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd916579428a0adf112d52873696c96d36b3f3569bb4696268c10f17664a706
Instruction ID: adbb8d726fc24cdf807a3373277b721efa4d2a49b8893a73df11127a8e777d56
Opcode Fuzzy Hash: 3bd916579428a0adf112d52873696c96d36b3f3569bb4696268c10f17664a706
Instruction Fuzzy Hash: 45F08270A01249ABDB04EBADD945F9E77B4EF08704F500069E601EB390EA34DD01C759

Function 01446030 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
Instruction ID: d5b340264fb88544fb9868809f9ee43145c6a0c45ddc57922b1aec52796f902c
Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
Instruction Fuzzy Hash: B5F030B22042049FF321CF19D944F52B7F8EB06765F46C02AE6099B661D379EC40CFA4

Function 013E55C0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
Instruction ID: 10670984aa342c2d56356e98799d8bee41680fab05e632bce8e9d68fc92fc25c
Opcode Fuzzy Hash: 09511f6a5b3cabbe784265c74914248b525a176bb6667c193042ebcc910e885d
Instruction Fuzzy Hash: 5EE0E533150628EBC7211A0AD804F13BBA9FF60BB4F11811AE559579D08B74EC11CBD4

Function 013B25E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 28ad104e2467c1ac3c9fe56e56b3a75ce598539cf0216739e9b15fef42dbc502
Instruction ID: 95782c724809c4579b8608fc96056f2b7c6b2055db94052b51d2530b983d4b10
Opcode Fuzzy Hash: 28ad104e2467c1ac3c9fe56e56b3a75ce598539cf0216739e9b15fef42dbc502
Instruction Fuzzy Hash: 87E092321006549BC721BB2DDD41FCB7B9AEB60768F014619B216575A0CA34BC10C788

Function 01434000 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction ID: 2fb42a6b0bad78e1a0a67301157314bdcc1a88640e5c2275868dd8664dd61c3d
Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction Fuzzy Hash: F4E0AE783002058BE715CF19C040BA6BBB6BFD9A10F28C069A9488F305EB32A8428A40

Function 0146B3D0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction ID: 8a93dd2cd5332d2ee9999d7a96268374ea7747b2edb2980c74714c8bc64f1ca0
Opcode Fuzzy Hash: 2862d5c95079e8f9bdfc17701203be164f113e2c7109adcb0461f4fb661a1a8a
Instruction Fuzzy Hash: 25E0CD31344515B7DB221A44CC00F697719DB50794F108032FA089A661C5719C92D7D4

Function 013A823B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction ID: 4a30b52426f787834521b9b49024a63e14529cdeb9a2df423d89aadd7b31225d
Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction Fuzzy Hash: 19E0C231040A18EFDB322F1ADC00F627AA5FF64B19F1088AEE581164A48775AC81CB48

Function 013B2050 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e920b33842b3b1b58b5c4b29eec32200999ff3ac35fb018e5c8f9939a067b04a
Instruction ID: 1837fa0251535bd3c913ff51660c3fd688b863b8db9b09e985faeea903b8192c
Opcode Fuzzy Hash: e920b33842b3b1b58b5c4b29eec32200999ff3ac35fb018e5c8f9939a067b04a
Instruction Fuzzy Hash: 1AE0C2321005506BC711FB5DDD40F8A779EEFA4674F054225F255876E0DA64BC00C798

Function 014392BC Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b345828cea4ae2f7661c57da593f4dbe4229053cf5b2594d58558f8560136028
Instruction ID: 6427ab910e42b71764ce19fbc9e72b5539db855d616aebf45126184edb7f07be
Opcode Fuzzy Hash: b345828cea4ae2f7661c57da593f4dbe4229053cf5b2594d58558f8560136028
Instruction Fuzzy Hash: 6EF0C275251B80CBE62ACF08C1A1B527BB9FB89B44F910459D4468BBB1C73AA942CB40

Function 00416CDF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1754363752.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_8tvMmyxveyzFcnJ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ed30485ee156589cc09cee3f989b21959fe3ff06b4209647fdcd8b03d6f1ff
Instruction ID: b6ca71a3a445652a7c1287e37f3cc59af650bfdb15589a2f04875aca8e7b7fae
Opcode Fuzzy Hash: b3ed30485ee156589cc09cee3f989b21959fe3ff06b4209647fdcd8b03d6f1ff
Instruction Fuzzy Hash: 88C012A7A8D2AA54D7265964AC012B8EB65E7D7124F08629FC645A70815147D02241DE

Function 013AB562 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
Instruction ID: 0ff076150bd1bdb3d1e0757bd125db214a2faa12ae88425d3e0ded2aa1c6183e
Opcode Fuzzy Hash: 513c018af8093926a425ffcf59a89caa6ba2b1d98b48f3b0c5e1abf4a0335a68
Instruction Fuzzy Hash: E0D05E31161760EFDB326F1AEE09F86BAB5EFA0F14F450528B141264F486A1ED84C690

Function 013EE59C Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
Instruction ID: e7e52e1b379b1f0a91e681c74e5b3b474ac0d3b178459751523f96599d0d5bb1
Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
Instruction Fuzzy Hash: 09D0A932204620ABDB32AA1CFC00FC333E8BB88B24F06485AF008C7160C360AC81CA84

Function 013AA0E3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction ID: eeada259240b784fde6f7d6fb13c9212a6b3f428319cb02013a146dcb611cf59
Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction Fuzzy Hash: 93D01233216071A7DF29965A6914FAB7919EB81A98F5A006D750A93900C5158C42D7E0

Function 013C02A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction ID: 78c6488fbad90ceeced9a964c0609815d71b53cf859088330c8e4d5b70199d9c
Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction Fuzzy Hash: 44D09239216A80CFD61A8B0CC5A4B1533A4BB44F48F850494E402CBB22E628D940CA00

Function 0143930B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction ID: 43860568984e52481357fb5e707ee2baac86d9c078d35f5c13faa490420c0d9d
Opcode Fuzzy Hash: 73b68ca8792e09d39eb84bf204166a27678a7482029cab1375adc9e7cd32c121
Instruction Fuzzy Hash: AFD05E75941AC4CFE72BCB08C1A5B917BF4F749B44F851099E04247BB2C3BC9984CB00

Function 013D0310 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: 6d20ff4b66340af3b182f13df9c560f7245d070a51125b8c88c31ef2c01e25d0
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: 04D01237100248EFCB05DF55D890D9A772AFBD8B10F148019FD19076108A31ED62DA50

Function 013D340D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
Instruction ID: c936b0bfe57e4fad418618e2d4c62fad0b8ed2ecc37df25f0fc7504711a4f554
Opcode Fuzzy Hash: 228d46562787cc6ef91b6aff40b17c30ce715ed8b58bcfbb69b93c396a4a2043
Instruction Fuzzy Hash: 67C08CBE1455816AEF2B5708D900B2C3A60BB00A0EF84019CAB40394A2C36C9D028318

Function 013F3010 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2c0aefab2774f8efb7948ad7096eaa7d3f4c0676fe3d5245457c29fa918cd6
Instruction ID: 89e2eaa11390b30660717246aa9444964a4284c5bc96abf6ee458975ea2d2151
Opcode Fuzzy Hash: eb2c0aefab2774f8efb7948ad7096eaa7d3f4c0676fe3d5245457c29fa918cd6
Instruction Fuzzy Hash: 17900221611C4582D14172594904B0F410597F1202F95C02AA4156599CCA3589955B21

Function 013F3090 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33521097ac396ee985c714fe3da55397a4b27f815dd371e7881f5c75bb71f5e7
Instruction ID: 58bb3377fcd5e9d9ace7bfc92bf1e2f4d22637031f6f1550a5077231ddd654d5
Opcode Fuzzy Hash: 33521097ac396ee985c714fe3da55397a4b27f815dd371e7881f5c75bb71f5e7
Instruction Fuzzy Hash: C490022165180942D141715985147070006D7E0601F55C022A0024599DC7368AA56BB1

Function 013F4340 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 315b56235793a4ff83693dd552e47942ded2f97b60770189c501ba2b76daffa8
Instruction ID: 8469c1706fcb50e79350726d4c7b0ccf0aa039624c279d16d40117a3b06a1b88
Opcode Fuzzy Hash: 315b56235793a4ff83693dd552e47942ded2f97b60770189c501ba2b76daffa8
Instruction Fuzzy Hash: A7900231A15C01529141715949845464005A7F0301B55C022E0424599CCB348A965761

Function 013F35C0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13047b5916f0e40fbb8aa3128b199226f046787430d704161e68e72d7ed6b819
Instruction ID: 2ece09d45874a90a8061e125b3e37cba69ffaea4bc08337e837f6e70ec38ee91
Opcode Fuzzy Hash: 13047b5916f0e40fbb8aa3128b199226f046787430d704161e68e72d7ed6b819
Instruction Fuzzy Hash: A0900231A1590542D10171594614706100597E0201F65C422A04245ADDC7B58A916AA2

Function 013F4650 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00f7ee34179cccd38fafb43b98e32f235d2ffdd87bd332cabed24ad562e101e
Instruction ID: 33c75decb325abbf84cbd9190303221393f2cde13f4fe1e5c18940c8e07ad830
Opcode Fuzzy Hash: b00f7ee34179cccd38fafb43b98e32f235d2ffdd87bd332cabed24ad562e101e
Instruction Fuzzy Hash: 17900261A11901824141715949044066005A7F1301395C126A05545A5CC73889959769

Function 013F39B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afd2569c607fa7087656b0dee9c7b7fa4e82ac553f87ca788d43d4621ed106a
Instruction ID: 04190991d24e56e217bd33ca31ecfc8ac14408b18a35db71920830b364cde46e
Opcode Fuzzy Hash: 7afd2569c607fa7087656b0dee9c7b7fa4e82ac553f87ca788d43d4621ed106a
Instruction Fuzzy Hash: FF90022165585242D151715D45046164005B7F0201F55C032A08145D9DC67589956721

Function 013F2BA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0172a97c8cc9fb7ba94f456c6be15e650d6867c27d4d0cc00f544d8bd074179d
Instruction ID: b96ad40fe35e8bebdf48de07c67f251601ae7d362cd7117d4dbeb59ce0b994a5
Opcode Fuzzy Hash: 0172a97c8cc9fb7ba94f456c6be15e650d6867c27d4d0cc00f544d8bd074179d
Instruction Fuzzy Hash: 55900231A1580942D15171594514746000597E0301F55C022A0024699DC7758B957BA1

Function 013F2B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abbb7940e2c32701ff455b4e36f7cb13125a7e54e5e1819b2cd585a73c37b3ff
Instruction ID: 28e5ec760b18d01cca8f8be5cd3875bb9f306357cd2faa592a70dbc62ecdec59
Opcode Fuzzy Hash: abbb7940e2c32701ff455b4e36f7cb13125a7e54e5e1819b2cd585a73c37b3ff
Instruction Fuzzy Hash: 3A90023161180942D10571594904686000597E0301F55C022A602469AED77589D17631

Function 013F2BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e11263f7bad6ce8444b5475dfedb57d9781d1869519df45fb1d946accfd98f8b
Instruction ID: d33fa0c9382c139496f0553caab48c15a7bc1822531a1f54af83d45ddc3379b8
Opcode Fuzzy Hash: e11263f7bad6ce8444b5475dfedb57d9781d1869519df45fb1d946accfd98f8b
Instruction Fuzzy Hash: 0D90023161584982D14171594504A46001597E0305F55C022A00646D9DD7358E95BB61

Function 013F2AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486307118a430810d6ee875a7382dbd2f39c399b69afeeac4b5f6e607a6e439c
Instruction ID: 65ab20091e75a018b813950cdd6c67e4537c653f0f97551cbed0d0a019e18c1e
Opcode Fuzzy Hash: 486307118a430810d6ee875a7382dbd2f39c399b69afeeac4b5f6e607a6e439c
Instruction Fuzzy Hash: 169002A1611941D24501B2598504B0A450597F0201B55C027E10545A5CC63589919635

Function 013F2AF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dcfda585560fe09f4163377864a0c14ec17689b54e04f0460cca8731aa912b1
Instruction ID: 15214d5a2468f97fa5b82da981066b10f284d1a7a360b69c633bea709f235a40
Opcode Fuzzy Hash: 3dcfda585560fe09f4163377864a0c14ec17689b54e04f0460cca8731aa912b1
Instruction Fuzzy Hash: 37900225631801420146B559070450B0445A7E6351395C026F14165D5CC73189A55721

Function 013F3D10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079800e406bf3852353c7496a7d5395e7ca6d454c50807a16a0df7f8eb131d23
Instruction ID: c0b61582e1b32f655ed733ececc800e056ca20837d3d7696f6b57bfb1b20af7e
Opcode Fuzzy Hash: 079800e406bf3852353c7496a7d5395e7ca6d454c50807a16a0df7f8eb131d23
Instruction Fuzzy Hash: F290023161280282954172595904A4E410597F1302B95D426A0015599CCA3489A15721

Function 013F2D00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb8bd70de23cb6c9dcee17e4e55b0209365d34de0df70830e0dd77284c59450
Instruction ID: a7952a107aea66a7cd87766fee67fd4af5745959eb5bbcb6891a6b66621189fd
Opcode Fuzzy Hash: ebb8bd70de23cb6c9dcee17e4e55b0209365d34de0df70830e0dd77284c59450
Instruction Fuzzy Hash: 3390022161584582D10175595508A06000597E0205F55D022A10645DADC7358991A631

Function 013F3D70 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9362f415fb383a38b28dd5fcc239714f39f6cbec9d7e0ec492675f4129432e4
Instruction ID: e3c0f023725922a206ae8b394d79783418174d1d430981880d8a1b3d5c88a48b
Opcode Fuzzy Hash: f9362f415fb383a38b28dd5fcc239714f39f6cbec9d7e0ec492675f4129432e4
Instruction Fuzzy Hash: F990023561180542D51171595904646004697E0301F55D422A042459DDC77489E1A621

Function 013F2DB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab8b18b770c2c1fe4a2bb4c878972c18155beca60b4ce096360867348c65342
Instruction ID: 3af549ea60d6b52ff773385fefc78c2028f9bcc24c641735d7faa73b405e07be
Opcode Fuzzy Hash: bab8b18b770c2c1fe4a2bb4c878972c18155beca60b4ce096360867348c65342
Instruction Fuzzy Hash: A390023165180542D142715945046060009A7E0241F95C023A0424599EC7758B96AF61

Function 013F2C60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7cbee4deec236d4425c5b16431b8ee10c1851e7d040ff56d6b0db5d9f266ac0
Instruction ID: ba6cecc19f339aca31390c538274fe0752e5b7287e384e9f3eccad53184dabb9
Opcode Fuzzy Hash: a7cbee4deec236d4425c5b16431b8ee10c1851e7d040ff56d6b0db5d9f266ac0
Instruction Fuzzy Hash: 1A90023161180982D10171594504B46000597F0301F55C027A0124699DC735C9917A21

Function 013F2CF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e2c91276b9c188a0739f7d5e0f476b97b442e9f02a50141151f61f50310753
Instruction ID: 753c5fd15aa66a9bdb35fe970e931007f48f93b3630c73d705e2de8876551e77
Opcode Fuzzy Hash: 28e2c91276b9c188a0739f7d5e0f476b97b442e9f02a50141151f61f50310753
Instruction Fuzzy Hash: 3A90023161180543D10171595608707000597E0201F55D422A042459DDD77689916621

Function 013F2CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b52a326b3546928e2d6b18e3a03cfa4ac46dafa42f61b4c2787f559b9c20014c
Instruction ID: 9fa4e54edd74b412fdf0c5df0fc9c53f4f7a3c332cc74be897372181559e2dde
Opcode Fuzzy Hash: b52a326b3546928e2d6b18e3a03cfa4ac46dafa42f61b4c2787f559b9c20014c
Instruction Fuzzy Hash: 9E900221A1580542D14171595518706001597E0201F55D022A0024599DC7798B956BA1

Function 013F2F60 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1103f37c585e65fb2b523d52210dc0ad494f41013091e17d69161c8b0507eca8
Instruction ID: affdeab2f724a0c5912e178e8a8c41035c687710df746d5e138ed948ddc4cd77
Opcode Fuzzy Hash: 1103f37c585e65fb2b523d52210dc0ad494f41013091e17d69161c8b0507eca8
Instruction Fuzzy Hash: D390026162180182D10571594504706004597F1201F55C023A2154599CC6398DA15625

Function 013F2FA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2266a76b47d3bf2a2d0d6f194ac9cb033b7ac89f5ed6cc41bb9c29e78cc15f1f
Instruction ID: a1091cbeb686316517bc844c5b2e529672ff1e15a1f8768d77cf280f47c138f2
Opcode Fuzzy Hash: 2266a76b47d3bf2a2d0d6f194ac9cb033b7ac89f5ed6cc41bb9c29e78cc15f1f
Instruction Fuzzy Hash: 66900231611C0542D10171594908747000597E0302F55C022A516459AEC775C9D16A31

Function 013F2E30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cad8e289d5f6c99701f0e10c218dc21be724928e7637dd8a5f10eeac9c364f0
Instruction ID: 90330c20661c63f0ac9b86242fa71860f4210550e732bd6e1a9af00a2efaad45
Opcode Fuzzy Hash: 9cad8e289d5f6c99701f0e10c218dc21be724928e7637dd8a5f10eeac9c364f0
Instruction Fuzzy Hash: CB90022171180542D103715945146060009D7E1345F95C023E142459ADC7358A93A632

Function 013F2EE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71296ffb3c4f9be620fddc2bad126d3ae3d7cfcd0b2a9e187cac689105b69932
Instruction ID: 5402445b3ace3a1da0fe62cd1424fcce05f216c351e1132ed56542df47d6df06
Opcode Fuzzy Hash: 71296ffb3c4f9be620fddc2bad126d3ae3d7cfcd0b2a9e187cac689105b69932
Instruction Fuzzy Hash: 59900261611C0543D14175594904607000597E0302F55C022A206459AECB398D916635

Function 013F2C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: faa3bc59d46e19ae98341e378f68584edea85760f0a4875d322f4af6ff072fb0
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Function 013F2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 013F293C
___swprintf_l.LIBCMT ref: 013F295E
___swprintf_l.LIBCMT ref: 013F29A3
___swprintf_l.LIBCMT ref: 0142A52E

Strings

::ffff:0:%u.%u.%u.%u, xrefs: 0142A54E
:%u.%u.%u.%u, xrefs: 0142A5B8
ffff:, xrefs: 0142A504
::%hs%u.%u.%u.%u, xrefs: 0142A527

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 1244f56d97af716811ddd555e34c987ca927a22b16d8ce629dd22015651e8d28
Instruction ID: a266b93fb5b0c99f81f6d290c39fc841dc06b73669f5991b5f6ee6d91bda4f52
Opcode Fuzzy Hash: 1244f56d97af716811ddd555e34c987ca927a22b16d8ce629dd22015651e8d28
Instruction Fuzzy Hash: 8651E6B6A00256BFCB11DFAD889097FFBB8BB08244B54826EF565D7A41D334DE5087E0

Function 01462410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 014624A6
___swprintf_l.LIBCMT ref: 014624E2
___swprintf_l.LIBCMT ref: 0146257D
___swprintf_l.LIBCMT ref: 014625A3
___swprintf_l.LIBCMT ref: 014625C8
___swprintf_l.LIBCMT ref: 01462608

Strings

::%hs%u.%u.%u.%u, xrefs: 0146249E
ffff:, xrefs: 0146247D, 0146249D
:%u.%u.%u.%u, xrefs: 014625FF
::ffff:0:%u.%u.%u.%u, xrefs: 014624DA

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 05e39ef9031ce2fec27fb0bf44520a13806ded3187d72957e25f11329f7f395a
Instruction ID: f8efc385ed3ec2e773829c9eb5b5935babcb0e74d25c0de1713a568a52301c8e
Opcode Fuzzy Hash: 05e39ef9031ce2fec27fb0bf44520a13806ded3187d72957e25f11329f7f395a
Instruction Fuzzy Hash: 25510371A00646BACB30DF9DC990D7FBBBCEB44208B40842BE4D6D7791E6B4DA408761

Function 013E7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

Execute=1, xrefs: 01424713
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 01424655
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 014246FC
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 01424742
ExecuteOptions, xrefs: 014246A0
CLIENT(ntdll): Processing section info %ws..., xrefs: 01424787
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 01424725

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: f5720daf4d80a7e41b5c1d3c7c388ea0e12336b8aa7608e19e6113d068406302
Instruction ID: 11faaafb5c500d36b2864bd0e7888c6171748580a3c3028787132119c45e0d9f
Opcode Fuzzy Hash: f5720daf4d80a7e41b5c1d3c7c388ea0e12336b8aa7608e19e6113d068406302
Instruction Fuzzy Hash: 46512D3160032ABAEF21ABA9DC89FFA77E8EF5431CF44009DD605AB1D1D7719A458F90

Function 013FB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 013FB6BF

Strings

+, xrefs: 013FB65A
0, xrefs: 013FB695
0, xrefs: 013FB66F
-, xrefs: 013FB650

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction ID: 9bb8804a780b6066669730f2c663ed6393cb39a9b6b08c9fe89c0bd8fbe894c0
Opcode Fuzzy Hash: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction Fuzzy Hash: 6281D2B0E052498EEF258E6CC8517FEFFB6AF85368F18411DDA61A7299C7348840CB61

Function 013EBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Resource at %p, xrefs: 01427B8E
RTL: Re-Waiting, xrefs: 01427BAC
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01427B7F

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: 06453a71e0cc922cf444c97b90c55802d08b7bc534851c5eb2f5c55e57faf66c
Instruction ID: c1ac3d1430c5b654c7c720bd93a52d2b674140b5de215feed1962bd9980d021c
Opcode Fuzzy Hash: 06453a71e0cc922cf444c97b90c55802d08b7bc534851c5eb2f5c55e57faf66c
Instruction Fuzzy Hash: 8C4125317007169FDB21CE29C840B27B7E5EF98715F000A1EFA5AD7790DB31E84A8B91

Function 013EB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0142728C

Strings

RTL: Resource at %p, xrefs: 014272A3
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 01427294
RTL: Re-Waiting, xrefs: 014272C1

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 999527f9837cf713b0891e26e501961bb2672c17ed5e57845da7b24f36e06e2c
Instruction ID: 7054f2fa225822dde4af37501e61fad5d78da4e837064f67b4bfdc68c9880aaa
Opcode Fuzzy Hash: 999527f9837cf713b0891e26e501961bb2672c17ed5e57845da7b24f36e06e2c
Instruction Fuzzy Hash: E7411031600326ABD722CF29CC41B26B7A5FBA5715F10061AF945EB3A0DB31E8528BE1

Function 01462300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0146238D
___swprintf_l.LIBCMT ref: 014623B3

Strings

]:%u, xrefs: 014623AA
%%%u, xrefs: 01462384

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 33e3c4aa68d691d2a633beebf391008f02696f59e6037772c1e34b2382ef84f3
Instruction ID: 29cdd1b7ad2176b50c8a595699087541749713fb89703c1eeb08ef207d646bb7
Opcode Fuzzy Hash: 33e3c4aa68d691d2a633beebf391008f02696f59e6037772c1e34b2382ef84f3
Instruction Fuzzy Hash: 85318472A00219AFDB60DE3DCC40FEF77BCEB54654F84055BE949E3250EB709A848BA1

Function 013F7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 013F7E8B

Strings

-, xrefs: 013F7DDD
+, xrefs: 013F7DE8

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction ID: b741cee594843c46f6816475e7e011b76d5b36f70382c164fa2da48695b9921c
Opcode Fuzzy Hash: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction Fuzzy Hash: 1D91B171E0030A9BEF24DF6DC881ABEBBA5EF44328F54461EEB65E72C0D73099458B11

Function 013B9126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

$, xrefs: 013B9191
@, xrefs: 013B9175

Memory Dump Source

Source File: 00000003.00000002.1755522703.0000000001380000.00000040.00001000.00020000.00000000.sdmp, Offset: 01380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_8tvMmyxveyzFcnJ.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: 09ded741acb4b3bbb7aaac159a7e0f6777b34abdd2358d0b194b68fa15e537c5
Instruction ID: 4a2408a5372249086fbc920484b452fca8ab5367028de4c8a4f784e2cdf99e16
Opcode Fuzzy Hash: 09ded741acb4b3bbb7aaac159a7e0f6777b34abdd2358d0b194b68fa15e537c5
Instruction Fuzzy Hash: 9A811B71D002699BDB359B54CC44BEEBBB4AF08714F1041EAEA1DB7690E7705E85CFA0

Analysis Process: explorer.exePID: 2580, Parent PID: 7164COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	446
Total number of Limit Nodes:	17

Executed Functions

Function 0F88DF82 Relevance: 23.6, APIs: 3, Strings: 10, Instructions: 815
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 0F88E12E
setsockopt.WS2_32 ref: 0F88E830
recv.WS2_32 ref: 0F88E859

Strings

tion, xrefs: 0F88E331
dat=, xrefs: 0F88E290
&br=, xrefs: 0F88E509
GET , xrefs: 0F88E318
nnec, xrefs: 0F88E32A
: cl, xrefs: 0F88E338
Co, xrefs: 0F88E323
&un=, xrefs: 0F88E4F1
ose, xrefs: 0F88E33F
&sql, xrefs: 0F88E471

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: getaddrinforecvsetsockopt
String ID: Co$&br=$&sql$&un=$: cl$GET $dat=$nnec$ose$tion
API String ID: 1564272048-1117930895
Opcode ID: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
Instruction ID: 4ee0617f0ada0a758aaaef213ba5aa49d31a0f1d6c9401e7d0466aaa182c6249
Opcode Fuzzy Hash: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
Instruction Fuzzy Hash: CB525D31618B089BDB69FFA8C4847E9B7E1FB54300F50462ED4AFCB146DA34B54ACB91

Function 0F88D232 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 642
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL ref: 0F88D449

Strings

`, xrefs: 0F88D41D

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: CreateFile
String ID: `
API String ID: 823142352-2679148245
Opcode ID: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
Instruction ID: 00c723ef8b97546b1b6f2207209b76a276dd0c49c0fb22507bdd55583ba3deb5
Opcode Fuzzy Hash: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
Instruction Fuzzy Hash: D7224D71A18F099FCB59EF28C4946EAF7E1FB98305F40062ED45EDB291DB30A452CB81

Function 0F88EE12 Relevance: 1.6, APIs: 1, Instructions: 59
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 0F88EE67

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
Instruction ID: 68695919169100be61413d40be98948c9613c28d1035b55f612633d550f3aaff
Opcode Fuzzy Hash: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
Instruction Fuzzy Hash: D8019E30668B884F8B88EF6C948416AB7E4FBCA314F000B3EA99AC7251EB64C5424742

Function 0F88EE0A Relevance: 1.6, APIs: 1, Instructions: 52
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 0F88EE67

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
Instruction ID: 3e8cda23d1dd32a9e24537d15d9047e81262b43cf466e5e19d44bf013ec1c96f
Opcode Fuzzy Hash: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
Instruction Fuzzy Hash: 0601A234668B884B8B48EB7C94452A6B3E5FBCE314F000B3EE9DAC3241DB65D5024782

Function 0F8888C2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ObtainUserAgentString.URLMON ref: 0F8889A0

Strings

on.d, xrefs: 0F888902
User-Agent: , xrefs: 0F888935, 0F888948
urlmon.dll, xrefs: 0F888959
nt: , xrefs: 0F88891E

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: AgentObtainStringUser
String ID: User-Agent: $nt: $on.d$urlmon.dll
API String ID: 2681117516-319646191
Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
Instruction ID: d43ea991e24da732c58620305bb92735984369d7f6d6782ca871c36ea30fa93a
Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
Instruction Fuzzy Hash: DD31BF31614A4C9ECB04FFA8C8847EDB7E1FF98205F40022AD44EDB241DF789646879A

Function 0F8888BE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ObtainUserAgentString.URLMON ref: 0F8889A0

Strings

on.d, xrefs: 0F888902
User-Agent: , xrefs: 0F888935, 0F888948
urlmon.dll, xrefs: 0F888959
nt: , xrefs: 0F88891E

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: AgentObtainStringUser
String ID: User-Agent: $nt: $on.d$urlmon.dll
API String ID: 2681117516-319646191
Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
Instruction ID: e69d68584b83d8604f939e9d41b6e83fd32a8e0bda6b5057892db4c9cbfa1066
Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
Instruction Fuzzy Hash: 5321C330610B4C9ECF04FFA8C8447ED7BE1FF58205F40421AD45ADB251DF7896068796

Function 0F884B66 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32 ref: 0F884CCA

Strings

el32, xrefs: 0F884BA0
.dll, xrefs: 0F884BCD
kern, xrefs: 0F884B99

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: CreateMutex
String ID: .dll$el32$kern
API String ID: 1964310414-1222553051
Opcode ID: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
Instruction ID: d43be35701fe8a9083cfd06a747dd8dfbc7491a52bb77235900fac2f7573f357
Opcode Fuzzy Hash: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
Instruction Fuzzy Hash: FB417C71918A088FDB54FFA8C8987ED77E1FF98300F40417AC84ADB256EE349946CB85

Function 0F884B72 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32 ref: 0F884CCA

Strings

el32, xrefs: 0F884BA0
.dll, xrefs: 0F884BCD
kern, xrefs: 0F884B99

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: CreateMutex
String ID: .dll$el32$kern
API String ID: 1964310414-1222553051
Opcode ID: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
Instruction ID: bcc6962ff600a4874bcb407f6f3f2c147e1538a81ae5997d437adf9cc144a8ff
Opcode Fuzzy Hash: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
Instruction Fuzzy Hash: F3415A70918A088FDB94EFA8C8987ED77E1FF98300F44416AC84ADB256DE349946CB95

Function 0F88A72E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32 ref: 0F88A791

Strings

ect, xrefs: 0F88A761
conn, xrefs: 0F88A75A

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: connect
String ID: conn$ect
API String ID: 1959786783-716201944
Opcode ID: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
Instruction ID: 70f9250e48ba67af5b26d2846bebbaf8ed50721e65ffd3fca907f0c577b968fa
Opcode Fuzzy Hash: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
Instruction Fuzzy Hash: 5E015E30618B188FCB98EF1CE088B55B7E0FB58314F1545AED90DCB266C674D8818BC2

Function 0F88A732 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32 ref: 0F88A791

Strings

ect, xrefs: 0F88A761
conn, xrefs: 0F88A75A

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: connect
String ID: conn$ect
API String ID: 1959786783-716201944
Opcode ID: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
Instruction ID: 25990bdcbbf9e331d2bf4c99255472ff1078e2a066be37eb38e6b03cde4ef2ce
Opcode Fuzzy Hash: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
Instruction Fuzzy Hash: EB014F70618A1C8FCB98EF5CE488B55B7E0FB59314F1541AEE80DCB266CB74C9818BC2

Function 0F88A6B2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32 ref: 0F88A713

Strings

send, xrefs: 0F88A6DA

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: send
String ID: send
API String ID: 2809346765-2809346765
Opcode ID: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
Instruction ID: d872af9fc1c771cfd086953f746ee64060d7df00069279e4cb3af22f33bb589f
Opcode Fuzzy Hash: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
Instruction Fuzzy Hash: 40015270558A088FCB88EF1CD088B2577E0EB58314F1541AED85DCB267C670D8818B81

Function 0F88A5B2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 0F88A611

Strings

sock, xrefs: 0F88A5D9

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: socket
String ID: sock
API String ID: 98920635-2415254727
Opcode ID: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
Instruction ID: 2eaaa398ab592b1c96003caf5b86c86925e275be6b2138cfacb7479163fd54d5
Opcode Fuzzy Hash: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
Instruction Fuzzy Hash: 880121706186188FCB84EF1CD048B54BBE0FB59314F1545AED45EDB266C7B4C981CB86

Function 0F8822DD Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0F88232D

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
Instruction ID: 927ec922dcbbecb1521a6fae5e8776e9fe483df87cb0c7767152b7ab03d8f969
Opcode Fuzzy Hash: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
Instruction Fuzzy Hash: A4316C70554B49DEDB68BF2980582E5B7A1FB54301F8442BFC91DCE117C774A052CF92

Function 0F882412 Relevance: 1.5, APIs: 1, Instructions: 46
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32 ref: 0F882461

Memory Dump Source

Source File: 00000004.00000002.4157684455.000000000F7A0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0F7A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7a0000_explorer.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
Instruction ID: 138796a11d6052dfbb0bc7e5a2585d51993b937bf9148ddc80ec0be21e323300
Opcode Fuzzy Hash: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
Instruction Fuzzy Hash: 08F0C230268B484FD788EF2CD84566AB3D0EBE8214F44463EA94DC7265DA29C5824716

Non-executed Functions

Function 0F38CD02 Relevance: 14.2, Strings: 11, Instructions: 404COMMON

Download Yara Rule

Strings

wini, xrefs: 0F38CF72
S, xrefs: 0F38D073
dll, xrefs: 0F38CF4C
user, xrefs: 0F38CF03
32.d, xrefs: 0F38CF0B
ll, xrefs: 0F38CF13
kern, xrefs: 0F38CF5A
net., xrefs: 0F38CF44
el32, xrefs: 0F38CF27
M, xrefs: 0F38D082
.dll, xrefs: 0F38CF2F

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: .dll$32.d$M$S$dll$el32$kern$ll$net.$user$wini
API String ID: 0-393284711
Opcode ID: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
Instruction ID: 6b1f95104078e9c3fcd5addf3b28c9e46a6870cb96a7ec21a7a57bf67d961c8f
Opcode Fuzzy Hash: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
Instruction Fuzzy Hash: 0FE16870618F488FDBA5EF68C4847AAB7E0FF58311F404A2E959BC7246DF34A541CB89

Function 0F38F792 Relevance: 21.6, Strings: 17, Instructions: 321COMMON

Download Yara Rule

Strings

guid, xrefs: 0F38F7CE
ypte, xrefs: 0F38F8A5
dUse, xrefs: 0F38F8AD
Fiel, xrefs: 0F38F884
Subm, xrefs: 0F38F855
e, xrefs: 0F38F8BD
name, xrefs: 0F38F87D
encr, xrefs: 0F38F8D2
d, xrefs: 0F38F8F2
ypte, xrefs: 0F38F8DA
encr, xrefs: 0F38F89D
dPas, xrefs: 0F38F8E2
itUR, xrefs: 0F38F85D
form, xrefs: 0F38F84D
swor, xrefs: 0F38F8EA
user, xrefs: 0F38F876
rnam, xrefs: 0F38F8B5

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: Fiel$Subm$d$dPas$dUse$e$encr$encr$form$guid$itUR$name$rnam$swor$user$ypte$ypte
API String ID: 0-2916316912
Opcode ID: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
Instruction ID: fe9012f01df85cb2d2816c7120c2f22f3e503bc2fc37fe3e659a6a9fab9a779a
Opcode Fuzzy Hash: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
Instruction Fuzzy Hash: F8B16930628B488EDB59EF68C485AEEB7F1FF98300F50451ED49AC7252EF74A505CB86

Function 0F38D622 Relevance: 21.4, Strings: 17, Instructions: 151COMMON

Download Yara Rule

Strings

d, xrefs: 0F38D6A5
l, xrefs: 0F38D682
w, xrefs: 0F38D6B3
n, xrefs: 0F38D6BA
p, xrefs: 0F38D690
l, xrefs: 0F38D6D6
d, xrefs: 0F38D67B
l, xrefs: 0F38D6AC
e, xrefs: 0F38D66D
t, xrefs: 0F38D6C8
c, xrefs: 0F38D697
u, xrefs: 0F38D661
i, xrefs: 0F38D69E
2, xrefs: 0F38D674
d, xrefs: 0F38D6CF
s, xrefs: 0F38D689
n, xrefs: 0F38D6C1

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: 2$c$d$d$d$e$i$l$l$l$n$n$p$s$t$u$w
API String ID: 0-1539916866
Opcode ID: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
Instruction ID: a3d00b491dc8b1bdf93dee7f7efdb36227573b42bbcefb1806a62e0c79b486bc
Opcode Fuzzy Hash: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
Instruction Fuzzy Hash: 9D41B470A18B088FDB14EF88A4456BD7BE2FB48714F40025EE409D3286DBB99D46CBD6

Function 0F394AB2 Relevance: 17.8, Strings: 14, Instructions: 339COMMON

Download Yara Rule

Strings

[, xrefs: 0F394C2D
l, xrefs: 0F394C35
c, xrefs: 0F394C0B
[, xrefs: 0F394C66
], xrefs: 0F394CA8
e, xrefs: 0F394CA0
[, xrefs: 0F394C90
D, xrefs: 0F394CDA
[, xrefs: 0F394CCD
], xrefs: 0F394C3D
[, xrefs: 0F394BF6
l, xrefs: 0F394CE2
n, xrefs: 0F394C98
b, xrefs: 0F394C73

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: D$[$[$[$[$[$]$]$b$c$e$l$l$n
API String ID: 0-355182820
Opcode ID: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
Instruction ID: ffe0c434a4dd35cebdcfba224263d819f23d03c5c66f37bfd5d198172648431d
Opcode Fuzzy Hash: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
Instruction Fuzzy Hash: C0C15A70618B099FCB58EF28C485AEAF3E1FB94314F40472ED49AC7251DF34A656CB86

Function 0F394F12 Relevance: 15.2, Strings: 12, Instructions: 201COMMON

Download Yara Rule

Strings

r, xrefs: 0F394FB8
r, xrefs: 0F394FB0
n, xrefs: 0F394F6B
r, xrefs: 0F394FA0
r, xrefs: 0F394FC0
r, xrefs: 0F394FA8
., xrefs: 0F394F63
0, xrefs: 0F394F5B
r, xrefs: 0F394F90
r, xrefs: 0F394F98
r, xrefs: 0F394F88
c, xrefs: 0F394FC8

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: .$0$c$n$r$r$r$r$r$r$r$r
API String ID: 0-97273177
Opcode ID: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
Instruction ID: 5a7cc5cf9083a44fea710dd2336b38340a5a3d48884e7eb4c528b7d74da2ef83
Opcode Fuzzy Hash: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
Instruction Fuzzy Hash: B851F53111C7488FDB5ADF18D8812AAB7E5FBC5710F541A2EE8CBC7242DBB49546CB82

Function 0F38E2F2 Relevance: 10.4, Strings: 8, Instructions: 380COMMON

Download Yara Rule

Strings

4.dl, xrefs: 0F38E4DB
l, xrefs: 0F38E4E2
dragon_s.dll, xrefs: 0F38E614
sspi, xrefs: 0F38E320
nspr, xrefs: 0F38E4D4
opera_browser.dll, xrefs: 0F38E629
dll, xrefs: 0F38E32E
cli., xrefs: 0F38E327

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
API String ID: 0-639201278
Opcode ID: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
Instruction ID: 06b44c4bb1c1cd959940dd7233cc59426dd3ed01e114d825396b537dc8170bbf
Opcode Fuzzy Hash: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
Instruction Fuzzy Hash: 43C18370618B198FCB58FF68D495AEAB3E1FB94310F944329844EC7252DF38E942CB85

Function 0F38E2F4 Relevance: 10.4, Strings: 8, Instructions: 380COMMON

Download Yara Rule

Strings

4.dl, xrefs: 0F38E4DB
l, xrefs: 0F38E4E2
dragon_s.dll, xrefs: 0F38E614
sspi, xrefs: 0F38E320
nspr, xrefs: 0F38E4D4
opera_browser.dll, xrefs: 0F38E629
dll, xrefs: 0F38E32E
cli., xrefs: 0F38E327

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
API String ID: 0-639201278
Opcode ID: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
Instruction ID: cfb5e6a9a69e54a5c98ab7e25a3edfc8ca4acdabec51ec6bbeefd501e9ac82e1
Opcode Fuzzy Hash: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
Instruction Fuzzy Hash: B8C18370618B198FCB58FF68D495AEAB3E1FB94310F944329844ED7252DF38E942CB85

Function 0F38FCD4 Relevance: 9.0, Strings: 7, Instructions: 299COMMON

Download Yara Rule

Strings

L: , xrefs: 0F38FD66
word, xrefs: 0F38FD9E
UR, xrefs: 0F38FD5F
2, xrefs: 0F38FDE1
Pass, xrefs: 0F38FD97
User, xrefs: 0F38FDAB
name, xrefs: 0F38FDB2

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: UR$2$L: $Pass$User$name$word
API String ID: 0-2058692283
Opcode ID: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
Instruction ID: c3e6ec76c8b1c6d33d6faeb270108ec00100ad8efdc9828ccb7d721494753f6a
Opcode Fuzzy Hash: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
Instruction Fuzzy Hash: BBA18F7061C7488BDB19EFA894447EEB7E1FF88310F40462DE48AD7292EF749546C789

Function 0F38FCE2 Relevance: 9.0, Strings: 7, Instructions: 288COMMON

Download Yara Rule

Strings

L: , xrefs: 0F38FD66
word, xrefs: 0F38FD9E
UR, xrefs: 0F38FD5F
2, xrefs: 0F38FDE1
Pass, xrefs: 0F38FD97
User, xrefs: 0F38FDAB
name, xrefs: 0F38FDB2

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: UR$2$L: $Pass$User$name$word
API String ID: 0-2058692283
Opcode ID: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
Instruction ID: de983772bd34c9a4f7b3e98d53e1450c10d940adf379fd4433fc8aa8d0ab5464
Opcode Fuzzy Hash: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
Instruction Fuzzy Hash: 9E918F7061C7488BDB19EFA8D444BEEB7E1FB88310F40462DE48AD7292EB749546C785

Function 0F38F352 Relevance: 6.5, Strings: 5, Instructions: 242COMMON

Download Yara Rule

Strings

v, xrefs: 0F38F4A0
, xrefs: 0F38F47C
., xrefs: 0F38F3B0
e, xrefs: 0F38F48E
n, xrefs: 0F38F3E7

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: $.$e$n$v
API String ID: 0-1849617553
Opcode ID: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
Instruction ID: 775310e8caae77d328f77d85472131922b55e8b063324ccae162f17f1c3b7d41
Opcode Fuzzy Hash: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
Instruction Fuzzy Hash: 94719431618B498FDB58EF68C4847AAB7F1FF58314F00063ED44AC7262EB75E9468B85

Function 0F38AC32 Relevance: 6.4, Strings: 5, Instructions: 175COMMON

Download Yara Rule

Strings

2.dl, xrefs: 0F38AC64
shel, xrefs: 0F38AC90
ole3, xrefs: 0F38AC5D
l32., xrefs: 0F38AC97
dll, xrefs: 0F38AC9E

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: 2.dl$dll$l32.$ole3$shel
API String ID: 0-1970020201
Opcode ID: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
Instruction ID: 4278a62081fd83035e4812e5d12533de23058d138ff64f3420b2f75880ec84d9
Opcode Fuzzy Hash: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
Instruction Fuzzy Hash: F55159B0918B4C8BDB65EFA4C045AEEB7E1FF58311F404A2ED49AE7214EF3495418B89

Function 0F38B86F Relevance: 6.4, Strings: 5, Instructions: 157COMMON

Download Yara Rule

Strings

dll, xrefs: 0F38B8F4
4, xrefs: 0F38B9E9
ion., xrefs: 0F38B8EC
vers, xrefs: 0F38B8E4
\, xrefs: 0F38B9E0

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: 4$\$dll$ion.$vers
API String ID: 0-1610437797
Opcode ID: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
Instruction ID: 8b5a9a763deffd397541b4f321b90c834a303f5193b08f74c2e285904e544407
Opcode Fuzzy Hash: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
Instruction Fuzzy Hash: FE416030218B898FDBB5EF2498457EAB3E4FBD8311F40462E989EC7241EF34D5458782

Function 0F38D4B2 Relevance: 6.4, Strings: 5, Instructions: 149COMMON

Download Yara Rule

Strings

dll, xrefs: 0F38D51C
cli., xrefs: 0F38D515
sspi, xrefs: 0F38D50E
user, xrefs: 0F38D4D3
32.d, xrefs: 0F38D4DA

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: 32.d$cli.$dll$sspi$user
API String ID: 0-327345718
Opcode ID: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
Instruction ID: b9ed73770f761e5d4940b07472d3a1079b9879c1bad2841b8f3ced65d155e839
Opcode Fuzzy Hash: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
Instruction Fuzzy Hash: F7416C70A18F0D8FCF58FF6880957AE73E5FB68314F40016AAC0ADB242DB39D5418B86

Function 0F38B432 Relevance: 5.1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

kern, xrefs: 0F38B52A
.dll, xrefs: 0F38B53F
el32, xrefs: 0F38B537
h, xrefs: 0F38B51F

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: .dll$el32$h$kern
API String ID: 0-4264704552
Opcode ID: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
Instruction ID: f53b45ad9c47c24e78987253deb60089b07ec7e6536e218cad3c912f8811250f
Opcode Fuzzy Hash: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
Instruction Fuzzy Hash: AE417F70608B498FDBA9EF28C4843AAF7E1FBD8310F544A2E949EC3256DB74D545CB81

Function 0F3920B9 Relevance: 5.1, Strings: 4, Instructions: 110COMMON

Download Yara Rule

Strings

Snif, xrefs: 0F392154
om:, xrefs: 0F392146
f fr, xrefs: 0F39213D
, xrefs: 0F392184

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: $Snif$f fr$om:
API String ID: 0-3434893486
Opcode ID: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
Instruction ID: b1aaac9e98a329305b02bb264c5028370931d9572c99064ff74ef1d9e6c758e2
Opcode Fuzzy Hash: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
Instruction Fuzzy Hash: 7431E57151DB886FDB1AEB28C4846DAB7D4FB84310F50491EE49BC7292EE34E549CB43

Function 0F3920C2 Relevance: 5.1, Strings: 4, Instructions: 109COMMON

Download Yara Rule

Strings

Snif, xrefs: 0F392154
om:, xrefs: 0F392146
f fr, xrefs: 0F39213D
, xrefs: 0F392184

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: $Snif$f fr$om:
API String ID: 0-3434893486
Opcode ID: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
Instruction ID: 2571415e2061aa0a2b7759ab0921c0f14186ddeba53000e9f174b83c9e56717c
Opcode Fuzzy Hash: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
Instruction Fuzzy Hash: 1831F67151CB486FDB1AEB24C4846DAB7D4FB94310F40491EE49BC3396EE34E505CA43

Function 0F38DFC2 Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

.dll, xrefs: 0F38DFFE
hild, xrefs: 0F38DFF6
chro, xrefs: 0F38E023
me_c, xrefs: 0F38DFEE

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: .dll$chro$hild$me_c
API String ID: 0-3136806129
Opcode ID: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
Instruction ID: 244ebe2bc4c86b88c8f37cf01a3b0cdf7ab3cec77a8415b30c3f795d04d83edc
Opcode Fuzzy Hash: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
Instruction Fuzzy Hash: FB317C70118B088FCB84FF688494BAAB7E1FBD8210F84066D944ACB256DF38D946CB52

Function 0F38DFBF Relevance: 5.1, Strings: 4, Instructions: 105COMMON

Download Yara Rule

Strings

.dll, xrefs: 0F38DFFE
hild, xrefs: 0F38DFF6
chro, xrefs: 0F38E023
me_c, xrefs: 0F38DFEE

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: .dll$chro$hild$me_c
API String ID: 0-3136806129
Opcode ID: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
Instruction ID: 163ed50c44abdddd9a071c09e77aed505f5447691c4dc5b0913954c12c420ee5
Opcode Fuzzy Hash: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
Instruction Fuzzy Hash: 35317E70118B088FCB84EF689494BAAB7E1FFD8310F84466D944ACB256DF38D946CB52

Function 0F3908C2 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

on.d, xrefs: 0F390902
urlmon.dll, xrefs: 0F390959
User-Agent: , xrefs: 0F390935, 0F390948
nt: , xrefs: 0F39091E

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: User-Agent: $nt: $on.d$urlmon.dll
API String ID: 0-319646191
Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
Instruction ID: d79f2ad573c2b478d02aa6556a86c294f3efb9a3d3693e76610857b5194787c4
Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
Instruction Fuzzy Hash: 4B31DD71618B0C8BCF45EFA8C8847EEBBE1FB58224F40022AD45ED7241DF788645C799

Function 0F3908BE Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

on.d, xrefs: 0F390902
urlmon.dll, xrefs: 0F390959
User-Agent: , xrefs: 0F390935, 0F390948
nt: , xrefs: 0F39091E

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: User-Agent: $nt: $on.d$urlmon.dll
API String ID: 0-319646191
Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
Instruction ID: cb33866186515f31afa5e73d96dc0253b46b7a15565edbc6eb47db3154aea5aa
Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
Instruction Fuzzy Hash: 7621D270618B0C8BCF45EFA8C8847EDBBE1FF58224F40422AD45AD7251DF788645C799

Function 0F391E92 Relevance: 5.1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

Strings

., xrefs: 0F391F1F
t, xrefs: 0F391EF4
l, xrefs: 0F391F26
l, xrefs: 0F391F03

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: .$l$l$t
API String ID: 0-168566397
Opcode ID: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
Instruction ID: b2114c97b751c5c67e01edf7f720f7508fbc8ba840d6e0c5f853faab5b78f38d
Opcode Fuzzy Hash: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
Instruction Fuzzy Hash: 3A217C70A28B0E9BDB48EFA8C0447AEBAF0FF58320F50562ED009D3641DB7895918B84

Function 0F391E94 Relevance: 5.1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

Strings

., xrefs: 0F391F1F
t, xrefs: 0F391EF4
l, xrefs: 0F391F26
l, xrefs: 0F391F03

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: .$l$l$t
API String ID: 0-168566397
Opcode ID: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
Instruction ID: ab63d009d3e7b8d9c081dc3c09cc5c66a9b2d0208726820cf612a571e7adbeb5
Opcode Fuzzy Hash: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
Instruction Fuzzy Hash: 5A216D74A28B0D9BDB48EFA8D0447EDBBF1FF58324F50562DD009D3641DB7895918B84

Function 0F391FF2 Relevance: 5.1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

Strings

pass, xrefs: 0F392022
logi, xrefs: 0F39203C
user, xrefs: 0F392015
auth, xrefs: 0F39202F

Memory Dump Source

Source File: 00000004.00000002.4156759152.000000000F2A0000.00000040.00000001.00040000.00000000.sdmp, Offset: 0F2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f2a0000_explorer.jbxd

Similarity

API ID:
String ID: auth$logi$pass$user
API String ID: 0-2393853802
Opcode ID: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
Instruction ID: 59643d719cff6d688666b3869df21be29fc48f3056a7fba5361f5a07cb66d676
Opcode Fuzzy Hash: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
Instruction Fuzzy Hash: 9F21C070628B0D8BCF05DF9998806EEB7E1EF88354F004619E44AEB345D7B4E9158BC2

Analysis Process: netsh.exePID: 396, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	618
Total number of Limit Nodes:	77

Executed Functions

Function 00BBA036 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 481
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL ref: 00BBA19F

Strings

0, xrefs: 00BBA227

Memory Dump Source

Source File: 00000006.00000002.4141563978.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bb0000_netsh.jbxd

Similarity

API ID: InformationProcessQuery
String ID: 0
API String ID: 1778838933-4108050209
Opcode ID: 7bc916a415ef614ffafa7f75d0ec115445e44d1b24a8fe03bb76e065ae57333e
Instruction ID: 5a17ac47d4446cff0b0bf7587f414be0313039bc8971e61d5db43fc4cf346f7c
Opcode Fuzzy Hash: 7bc916a415ef614ffafa7f75d0ec115445e44d1b24a8fe03bb76e065ae57333e
Instruction Fuzzy Hash: 01F15270918A4C8FDBA9EF68C894AEEB7E0FF98304F40466AE44ED7251DF749641CB41

Function 00BB9BAF Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 227
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL ref: 00BB9C93
NtMapViewOfSection.NTDLL ref: 00BB9CFF
NtClose.NTDLL ref: 00BB9DC5

Strings

@, xrefs: 00BB9D0C
@, xrefs: 00BB9C8B

Memory Dump Source

Source File: 00000006.00000002.4141563978.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bb0000_netsh.jbxd

Similarity

API ID: Section$CloseCreateView
String ID: @$@
API String ID: 1133238012-149943524
Opcode ID: db7dcd85dc853400a789dde9de35cb8114d6383d98fd4a16120e7ccab82aa783
Instruction ID: 14666e09cb98f059f4ff8b3f78dd0c55145f00eab6fb0bc12c2dad947bdd40dc
Opcode Fuzzy Hash: db7dcd85dc853400a789dde9de35cb8114d6383d98fd4a16120e7ccab82aa783
Instruction Fuzzy Hash: 06619170218B088FCB58EF68D8856AABBE0FF98314F50062EE58AC3251DF75D441CB86

Function 00BB9BB2 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL ref: 00BB9C93
NtMapViewOfSection.NTDLL ref: 00BB9CFF

Strings

@, xrefs: 00BB9D0C
@, xrefs: 00BB9C8B

Memory Dump Source

Source File: 00000006.00000002.4141563978.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bb0000_netsh.jbxd

Similarity

API ID: Section$CreateView
String ID: @$@
API String ID: 1585966358-149943524
Opcode ID: d19581801156352ea8c1368f03ac477e7143ca4b49b2be0ea58d8e64d299f740
Instruction ID: b11fb2c1858eb2ef02c575bbf3ee3d0d61f9491565a7070e94a1793e8506bde2
Opcode Fuzzy Hash: d19581801156352ea8c1368f03ac477e7143ca4b49b2be0ea58d8e64d299f740
Instruction Fuzzy Hash: 0B518E70618B088FDB58DF18D885AAABBE0FB98314F50062EF98AC3651DF75D441CB86

Function 00BBA042 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL ref: 00BBA19F

Strings

0, xrefs: 00BBA0CD

Memory Dump Source

Source File: 00000006.00000002.4141563978.0000000000BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bb0000_netsh.jbxd

Similarity

API ID: InformationProcessQuery
String ID: 0
API String ID: 1778838933-4108050209
Opcode ID: 4a13b2017a61ababd9bba988d9a9b5b8b8f576b3da72e298de5122239bed11ad
Instruction ID: fff8ee8f2a6ea9535e6d41e91ce26b309383cf80f88952f39e9a3138b581d12b
Opcode Fuzzy Hash: 4a13b2017a61ababd9bba988d9a9b5b8b8f576b3da72e298de5122239bed11ad
Instruction Fuzzy Hash: 60515D70918A8C8FDBA9EF68C8846EEBBF4FB98305F40422ED44AD7211DF709645CB41

Function 0041A35F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00414BB7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00414BB7,007A002E,00000000,00000060,00000000,00000000), ref: 0041A3AD

Strings

.z`, xrefs: 0041A39D, 0041A3A8

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: fed1d1309162db8d0a747d187bc6f9ad4c96d1cc1fdd8183c8b47b824c70450f
Instruction ID: b0ea305ca0179594be26f88849999d72c403b9e7c25092e2012cfb502ab0554f
Opcode Fuzzy Hash: fed1d1309162db8d0a747d187bc6f9ad4c96d1cc1fdd8183c8b47b824c70450f
Instruction Fuzzy Hash: FEF0BDB2205208AFCB48CF88DC85EEB37EDAF8C754F158248BA0DD7241D630E8518BA4

Function 0041A360 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00414BB7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00414BB7,007A002E,00000000,00000060,00000000,00000000), ref: 0041A3AD

Strings

.z`, xrefs: 0041A39D, 0041A3A8

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 1571a74e51eef41835f20cf1113afde9e84efeac6e640e2865a3d9423fa4fe5b
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: FEF0BDB2201208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Function 0041A40A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,?,?,?,?,?,1JA,FFFFFFFF,?,rMA,?,00000000), ref: 0041A455

Strings

1JA, xrefs: 0041A42C, 0041A438

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: 1JA
API String ID: 2738559852-3517284412
Opcode ID: a7d9e67bc0a7f934f25e98d71784c61da8d6ac106cdc2fb5df1c2e41c41e999a
Instruction ID: d9f3efcc6fba735fe827f6fd57d323a72c1d16cfd7affead5f3e42ca52de0d7b
Opcode Fuzzy Hash: a7d9e67bc0a7f934f25e98d71784c61da8d6ac106cdc2fb5df1c2e41c41e999a
Instruction Fuzzy Hash: 81F0A9B2200208AFCB14DF99DC81DEB77A9EF8C754F158249BA1DA7241D634E951CBE4

Function 0041A410 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,FFFFFFFF,?,?,?,?,?,1JA,FFFFFFFF,?,rMA,?,00000000), ref: 0041A455

Strings

1JA, xrefs: 0041A42C, 0041A438

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: 1JA
API String ID: 2738559852-3517284412
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: c6e97d42c3e85b78cd3a41c20c82dd28da71633a8e67c8174f08c115ef6e08ba
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 87F0B7B2200208AFCB14DF89DC81EEB77ADEF8C754F158249BE1D97241D630E851CBA4

Function 0041A48A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(PMA,?,?,00414D50,00000000,FFFFFFFF), ref: 0041A4B5

Strings

PMA, xrefs: 0041A4AC, 0041A4B4

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: Close
String ID: PMA
API String ID: 3535843008-3622942700
Opcode ID: 6866c63e7f77f1cf9f4179088a192caf9762c1937d793d073a03901159387ab9
Instruction ID: eea82b31076ec0d138028a2a42476fb395de81841b37d259ef3cf74a12bfe863
Opcode Fuzzy Hash: 6866c63e7f77f1cf9f4179088a192caf9762c1937d793d073a03901159387ab9
Instruction Fuzzy Hash: 93E086712001147FD711DFA8DC45EE73B6CEF88730F244559B91D97291D130E6118790

Function 0041A490 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(PMA,?,?,00414D50,00000000,FFFFFFFF), ref: 0041A4B5

Strings

PMA, xrefs: 0041A4AC, 0041A4B4

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: Close
String ID: PMA
API String ID: 3535843008-3622942700
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: a008c5d5ec14fa9f5013d94ab86a46559dd82bf248144eb087863a0ac6a31d62
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: F7D01776200218ABD710EB99CC85EE77BACEF48B64F158499BA1C9B242C530FA1086E0

Function 00D92AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D92ADA

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4be22ec3e1fc31eca0e1a459f615abd0ab95e78ebfb9a13994c7ebccd56749bf
Instruction ID: 7af77ddad12162e02e4ba321ec78eeb8ea7ff21d4ccaa1923c63211a8aa14c91
Opcode Fuzzy Hash: 4be22ec3e1fc31eca0e1a459f615abd0ab95e78ebfb9a13994c7ebccd56749bf
Instruction Fuzzy Hash: 76900265711400030305B5980704507004687D6351355C032F5015660CDA2189616131

Function 00D92B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D92B6A

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4efdfa5da2537f61c8238ba322e23a2636802e8eb6ff5d22da937d8b8d624e7f
Instruction ID: 176f7b0660fff39f2cc03aff0d58a4c211ff44cc1d8f485bf0dce2796f979a52
Opcode Fuzzy Hash: 4efdfa5da2537f61c8238ba322e23a2636802e8eb6ff5d22da937d8b8d624e7f
Instruction Fuzzy Hash: C39002A170240003430571984414616400A87E1301B55C032E50146A0DC92589917135

Function 00D92CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D92CAA

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fb0ec110ce3797c1a4c922a0002a52fefeeee01efe517bca13f7ee07c89eead5
Instruction ID: e42871014d93576d6c2ce4f0b95aca71a5ccaf7568ab3cc15d4e7fd181286b88
Opcode Fuzzy Hash: fb0ec110ce3797c1a4c922a0002a52fefeeee01efe517bca13f7ee07c89eead5
Instruction Fuzzy Hash: FC90027170140402D30075D85408646000587E1301F55D022A9024665ECA6589917131

Function 00D92C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D92C7A

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4b4ea7ddacc6f00b774e3f8ece7590fe93c097cba817312a6e2fb110543dc0f0
Instruction ID: 31fa624e013c9f692e59b63f237f74249370a5cd01f3908e7ae8c2410f2fe37f
Opcode Fuzzy Hash: 4b4ea7ddacc6f00b774e3f8ece7590fe93c097cba817312a6e2fb110543dc0f0
Instruction Fuzzy Hash: EE90027170148802D3107198840474A000587D1301F59C422A8424768D8A9589917131

Function 00D92C60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D92C6A

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cba2b906c13d3f62dc91a2306c252adbc58f32c6b38c10c5952bd08dd560cd32
Instruction ID: e752fa3d85784412e01bb0f8b9bc52cc0da7f4bf89a1ef2e5c94efdb2e438a1f
Opcode Fuzzy Hash: cba2b906c13d3f62dc91a2306c252adbc58f32c6b38c10c5952bd08dd560cd32
Instruction Fuzzy Hash: 0990027170140842D30071984404B46000587E1301F55C027A4124764D8A15C9517531

Function 00D92DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D92DDA

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc78dc8d327685947d4d04467d9f9a239eac012a421f315c7ddaf67464b4ba22
Instruction ID: 08e08f821b6f2b1864c3e873fc5f5999e69fe0be0e14cdd45ecdcb335525713d
Opcode Fuzzy Hash: bc78dc8d327685947d4d04467d9f9a239eac012a421f315c7ddaf67464b4ba22
Instruction Fuzzy Hash: 5F900261742441525745B1984404507400697E1341795C023A5414A60C89269956E631

Function 00D92DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D92DFA

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 177b11e0f5006f27c855d3f6b1558fce49e463eadc91e790ba18d62ca4f92dc7
Instruction ID: 825959cccd5274cfb6af818e61d8358855080d8fce91166e9752c04243dcad26
Opcode Fuzzy Hash: 177b11e0f5006f27c855d3f6b1558fce49e463eadc91e790ba18d62ca4f92dc7
Instruction Fuzzy Hash: FA90027170140413D31171984504707000987D1341F95C423A4424668D9A568A52B131

Function 00D92D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D92D1A

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 60998fbc5393dbd916cdf87092e21f1d5cdebfee08534655691a15f6087a148b
Instruction ID: c4b19e0eaa566d3e61e15d1cd33d54cb78eb7bc83326dd5328ea409250adbaec
Opcode Fuzzy Hash: 60998fbc5393dbd916cdf87092e21f1d5cdebfee08534655691a15f6087a148b
Instruction Fuzzy Hash: 1790026971340002D3807198540860A000587D2302F95D426A4015668CCD1589696331

Function 00D92EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D92EAA

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6b9a33a34bb259a4352ceb16e86499076936345f7705d187593647345bfec722
Instruction ID: 276aba18b2c666303e40c595e0d4e2f76152d00e52844d75603203aa0e0d4774
Opcode Fuzzy Hash: 6b9a33a34bb259a4352ceb16e86499076936345f7705d187593647345bfec722
Instruction Fuzzy Hash: C79002B170140402D34071984404746000587D1301F55C022A9064664E8A598ED57675

Function 00D92FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D92FEA

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2af0223d28b3e081c32cf8addde6267cbbdf41a65dde2d3c16f87db237b9873c
Instruction ID: 0f93a5ddad8f26645f337c3a5815dbba8e039ef0f949ef7a8bc3504b80b46ba0
Opcode Fuzzy Hash: 2af0223d28b3e081c32cf8addde6267cbbdf41a65dde2d3c16f87db237b9873c
Instruction Fuzzy Hash: AA900261711C0042D30075A84C14B07000587D1303F55C126A4154664CCD1589616531

Function 00D92F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D92F3A

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c49aee22b93945c38e7094ede9edf338f5f4dc23113b87e506f6ab70b93b3daa
Instruction ID: ffa8fe6011805b7ebe9f84b2995d18e1abb48601f8f276f47d9b1a7b0c49aaaa
Opcode Fuzzy Hash: c49aee22b93945c38e7094ede9edf338f5f4dc23113b87e506f6ab70b93b3daa
Instruction Fuzzy Hash: E19002A174140442D30071984414B060005C7E2301F55C026E5064664D8A19CD527136

Function 00D935C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D935CA

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e18e332b627b15ac1e506c48e5e790c3a3b0c2b8d27a2ba294e9738887b3fbf3
Instruction ID: 5afa92d809626c0f0b74d020495e1f002006a7ef3c898c9131f1bdd2b42b7a95
Opcode Fuzzy Hash: e18e332b627b15ac1e506c48e5e790c3a3b0c2b8d27a2ba294e9738887b3fbf3
Instruction Fuzzy Hash: 09900271B0550402D30071984514706100587D1301F65C422A4424678D8B958A5175B2

Function 00419080 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 00419128

Strings

net.dll, xrefs: 004190F1, 00419177, 0041914F, 0041915B, 00419183
wininet.dll, xrefs: 004190DE, 004190E7

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 2fc5539ce258b5b6beccd941e799445f8f165c982dea3b187c6cdf1ac72fd1ad
Instruction ID: 2511d3cdde594a459876a10949f18b9dbd63c8e6bbb0d03ebfda35d58ccafa52
Opcode Fuzzy Hash: 2fc5539ce258b5b6beccd941e799445f8f165c982dea3b187c6cdf1ac72fd1ad
Instruction Fuzzy Hash: 243192B2500345BBD724DF65C885FA7B7B9FB48B04F10811EF62E5B245D634B990CBA8

Function 004191A4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0040F050,?,?,00000000), ref: 004191EC

Strings

net.dll, xrefs: 00419177, 00419183

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: net.dll
API String ID: 2422867632-2431746569
Opcode ID: ad5e7f28f32926ce923828140b5cfa8639c3460879cf9296b84e7864fb638656
Instruction ID: 7300f322227102f16bcd6e2f7069b684d6053782363c66e42f5ed88aedb1cee5
Opcode Fuzzy Hash: ad5e7f28f32926ce923828140b5cfa8639c3460879cf9296b84e7864fb638656
Instruction Fuzzy Hash: 4901FC776002047AD7349A79DC46FE7B3A8DB80B15F14011EF91EA7280DA79B98487E9

Function 0041A663 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00403AF8), ref: 0041A69D

Strings

.z`, xrefs: 0041A68C, 0041A698

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: bcc30635236e8fa720a28b406ee799dbec335dff77b832bd978397278855787d
Instruction ID: 24307b1b16fdc674b1b2a46e27d06997c9a9b4145e39e254628283c940cb61d2
Opcode Fuzzy Hash: bcc30635236e8fa720a28b406ee799dbec335dff77b832bd978397278855787d
Instruction Fuzzy Hash: 37E065B51142146FD724DF68CC48E9B776CDF48A54F118659B95857291C530E91087A0

Function 0041A670 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00403AF8), ref: 0041A69D

Strings

.z`, xrefs: 0041A68C, 0041A698

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 086aab0bc8c344d6c60c9bbd5a0512cabfd8005857d16272e4a7e29987098a06
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: C1E012B1200208ABDB18EF99CC49EA777ACEF88764F118559BA085B242C630E9108AB0

Function 0041A630 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(6EA,?,00414CAF,00414CAF,?,00414536,?,?,?,?,?,00000000,00000000,?), ref: 0041A65D

Strings

6EA, xrefs: 0041A652, 0041A65C

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: 6EA
API String ID: 1279760036-1400015478
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: b63900df46c74d48569035b2bcc9be016157083d4ef88d1b541c797289a4eec1
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 46E012B1200208ABDB14EF99CC41EA777ACEF88664F158559BA085B242C630F9118AB0

Function 00408308 Relevance: 3.1, APIs: 2, Instructions: 58threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0040836A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0040838B

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 7e75bf849664dcd21a59adfd75ead6ad56d5676ebc833959a6e845d45839b9aa
Instruction ID: 5992b9be4baf2c7b566ef3647458cd36ce21ba925a148f2579bd006564dde71f
Opcode Fuzzy Hash: 7e75bf849664dcd21a59adfd75ead6ad56d5676ebc833959a6e845d45839b9aa
Instruction Fuzzy Hash: 9601D871A9032877E721A6959C43FFE7B6C9B44F94F04011DFF04BA1C2EAE8690543EA

Function 00408310 Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0040836A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0040838B

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: a493eabf7697513180435b5f665ed638a4e8f6b3857f93d23393bef0d0da5e70
Instruction ID: fe648ddaccc693dff6b318d6e20673cc1517f8ca6da234ac2c2ad493b9bfa733
Opcode Fuzzy Hash: a493eabf7697513180435b5f665ed638a4e8f6b3857f93d23393bef0d0da5e70
Instruction Fuzzy Hash: FF018431A8032C76E721A6959C43FFE776C5B40F54F05011AFF04BA1C2EAA8690546EA

Function 0040ACF0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD62

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
Instruction ID: bd03027937dafe21d6f438616a486266aae6a772261e1344982784e00def1180
Opcode Fuzzy Hash: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
Instruction Fuzzy Hash: 80015EB5E0020DBBDF10DBA1DC42FDEB3789F54308F0045AAA908A7281F634EB548B95

Function 0041A6E0 Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 0041A734

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: c0409bc591760e5b86b1b32807d612366400da8e17bcb8cc8f9e0bcd0fd11a44
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: C601B2B2210108BFCB54DF89DC80EEB77ADAF8C754F158258FA0D97241C630E851CBA4

Function 004191B0 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0040F050,?,?,00000000), ref: 004191EC

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 89ef2758859c2e10bc0e5734033b475c64cd629f5ad8a823021e51abe1df765a
Instruction ID: 08ee09190344bf92f8f3f610aae4f3648aa43aed276248cc1f80d003229f7369
Opcode Fuzzy Hash: 89ef2758859c2e10bc0e5734033b475c64cd629f5ad8a823021e51abe1df765a
Instruction Fuzzy Hash: 32E092773803143AE3306599AC03FE7B39CDB81B24F14002AFA0DEB2C1D999F84542A8

Function 0041A7C9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0040F1D2,0040F1D2,?,00000000,?,?), ref: 0041A800

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 12bca789234c5c8e009ebb5de871be4c352e22ecce6a122e4c61cd4aa664f28b
Instruction ID: af75529915aef102090087d8ecb2994e73b38dbc4dd88fb73fd8a3c03c61f894
Opcode Fuzzy Hash: 12bca789234c5c8e009ebb5de871be4c352e22ecce6a122e4c61cd4aa664f28b
Instruction Fuzzy Hash: 28E06DB12002086FCB24DF65CC85EDB3769EF49350F118158F90D97241CA35E8118BB0

Function 0041A7D0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0040F1D2,0040F1D2,?,00000000,?,?), ref: 0041A800

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 3f9aab8e47c10174471559fee5d267dc63a882ce56825bdd12c8e63267ac542a
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 23E01AB12002086BDB10DF49CC85EE737ADEF88654F118155BA0C57241C934E8118BF5

Function 0041A6A4 Relevance: 1.5, APIs: 1, Instructions: 20processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 0041A734

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 882eee7629ece8699dc18cc87715d42552190a95e794bad672922a76abbf6966
Instruction ID: 9926e89926c1833471749db3aad87792544e539113a25e0d4aa8347d48243819
Opcode Fuzzy Hash: 882eee7629ece8699dc18cc87715d42552190a95e794bad672922a76abbf6966
Instruction Fuzzy Hash: D6D0C9B66545046B9714DA9DAC81CE773ACEBD8A20710C71BF96C8B140893495528BB1

Function 0040F6CA Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,00408D14,?), ref: 0040F6FB

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 2708cc23a197495d08e4d6a41a27bf5a19914847986057d4c8381ebeb1bbe9fb
Instruction ID: 39ff73362f3c324b3fb3a669c3a213d1a7861d9c5117aa6ee258ed075576ecec
Opcode Fuzzy Hash: 2708cc23a197495d08e4d6a41a27bf5a19914847986057d4c8381ebeb1bbe9fb
Instruction Fuzzy Hash: 4AD05E756903042BEA20BAE59C03F6A32896B84B14F094475F948EB3C3E9A5E50586A5

Function 0040F6D0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,00408D14,?), ref: 0040F6FB

Memory Dump Source

Source File: 00000006.00000002.4140775395.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_netsh.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 2932bcf02bc07d7163de81b169680dc5c005ffd35bbbe1c0c8f45c66faab01c4
Instruction ID: 16dd6e19701eb8137eea147804aeefc1d225e4ea9fc13a12949d67fdd6a7e390
Opcode Fuzzy Hash: 2932bcf02bc07d7163de81b169680dc5c005ffd35bbbe1c0c8f45c66faab01c4
Instruction Fuzzy Hash: 71D05E756503082AE610AAA59C03F6632886B44B04F490074F948AA3C3D964E4014169

Function 00D92C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D92C24

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a40027de4ef781911760e8ae3da504be8b82ab5d89f01a2e4708737ae6bf0dd4
Instruction ID: 501a512253bcc6fbf76193987e8ac099f8401599ba2222a771c05aeb091d3106
Opcode Fuzzy Hash: a40027de4ef781911760e8ae3da504be8b82ab5d89f01a2e4708737ae6bf0dd4
Instruction Fuzzy Hash: 5BB09B71D015C5D5DF11E760460971B790067D1701F19C072D2030751F4738D5D1F175

Non-executed Functions

Function 01568D48 Relevance: 65.2, APIs: 28, Strings: 9, Instructions: 447memorycomCOMMON

Download Yara Rule

APIs

CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0(00000000,00000006,?,?,?), ref: 01568D7D
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0(01561C9C,00000000,00000001,01561CAC,?), ref: 01568DAA
SysAllocString.OLEAUT32(?), ref: 01568DED
SysAllocString.OLEAUT32(?), ref: 01568E37
SysAllocString.OLEAUT32(?), ref: 01568E4B
SysAllocString.OLEAUT32(00000000), ref: 01568E54
SysAllocString.OLEAUT32(?), ref: 01568E77
SysFreeString.OLEAUT32(00000000), ref: 01568E92
SysFreeString.OLEAUT32(00000000), ref: 01568E99
SysFreeString.OLEAUT32(?), ref: 01568EA3
SysFreeString.OLEAUT32(?), ref: 01568EAD
SysFreeString.OLEAUT32(?), ref: 01568EB7
SysAllocString.OLEAUT32(WQL), ref: 01568F18
SysAllocString.OLEAUT32(select * from Win32_OperatingSystem), ref: 01568F29
VariantChangeType.OLEAUT32(?,?,00000000,00000017), ref: 01568FF1
VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 01569044
VariantChangeType.OLEAUT32(?,?,00000000,00000017), ref: 015690A8
VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 015690FB
VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 0156915B
VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 015691B6
SysFreeString.OLEAUT32(?), ref: 01569211
SysFreeString.OLEAUT32(?), ref: 0156921B
SysFreeString.OLEAUT32(?), ref: 01569239
SysFreeString.OLEAUT32(00000000), ref: 01569240
SysFreeString.OLEAUT32(?), ref: 0156924A
SysFreeString.OLEAUT32(?), ref: 01569254
SysFreeString.OLEAUT32(?), ref: 0156925E
CoUninitialize.API-MS-WIN-CORE-COM-L1-1-0 ref: 01569264

Strings

OSProductSuite, xrefs: 01569078
\\%s\root\cimv2, xrefs: 01568DCA
WQL, xrefs: 01568F13
ServicePackMajorVersion, xrefs: 01569132
select * from Win32_OperatingSystem, xrefs: 01568F20
ServicePackMinorVersion, xrefs: 01569191
Version, xrefs: 0156901C
OSType, xrefs: 01568FCB
BuildNumber, xrefs: 015690D5

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: String$Free$Alloc$ChangeTypeVariant$CreateInitializeInstanceUninitialize
String ID: BuildNumber$OSProductSuite$OSType$ServicePackMajorVersion$ServicePackMinorVersion$Version$WQL$\\%s\root\cimv2$select * from Win32_OperatingSystem
API String ID: 3160123450-4179124359
Opcode ID: b4825d7b8a65ffa3d403a7fd9109aad673e32866d5c9d693966f8c0315df74fa
Instruction ID: eed71102687b058dded10d9b18a548389ad72a621ba98f1e97045d835cf41c9f
Opcode Fuzzy Hash: b4825d7b8a65ffa3d403a7fd9109aad673e32866d5c9d693966f8c0315df74fa
Instruction Fuzzy Hash: 03F19F76114701AFD7219F64D849B6FBBB9FBC8724F11091CFA659B250EB30E808DBA1

Function 01567DFA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000500,?,00000000,00000000,000000B6,00000000,?,00000000,?,?,01567F23,?,0156471D,000000B6,?), ref: 01567E14
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,01567F23,?,0156471D,000000B6,?), ref: 01567E20
wprintf.MSVCRT ref: 01567E2C
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,01567F23,?,0156471D,000000B6,?), ref: 01567E38
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000,?,01567F23,?,0156471D), ref: 01567E51

Strings

Error %d in FormatMessageW(), xrefs: 01567E27

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: ErrorFormatFreeHandleLastLocalMessagewprintf
String ID: Error %d in FormatMessageW()
API String ID: 10433382-1232673963
Opcode ID: 1416dfd445c978fe3dbdf4d7cd585314c0240752aba4eff048487216b02e75bd
Instruction ID: d4163ed304435a9ad420cd52fd37090b51d555daaa3cfc8283636b7bcdcd2f78
Opcode Fuzzy Hash: 1416dfd445c978fe3dbdf4d7cd585314c0240752aba4eff048487216b02e75bd
Instruction Fuzzy Hash: 71F04F76511124FFDB2197A5AC0E99F7A6CEB84675F110114F9119B284D6304E04D7E0

Function 01569B55 Relevance: 7.6, APIs: 5, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(00000000), ref: 01569B82
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 01569B91
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 01569B9A
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 01569BA3
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?), ref: 01569BB8

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 25db3a8d4b22288bf998b6bee93068d5730a23e3d51a9c306a6c66aa60ea8d95
Instruction ID: 676ed3d58b587e07e3c1ff4b728263c3c7d0ba62c138c5b05a9738c9307d46d9
Opcode Fuzzy Hash: 25db3a8d4b22288bf998b6bee93068d5730a23e3d51a9c306a6c66aa60ea8d95
Instruction Fuzzy Hash: 13111F71E05108DFCF20DFB8E64969EB7F8FF58314F624459D812EB218E6349A04DB50

Function 015696E0 Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,01569816,01561000), ref: 015696E7
UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(01569816,?,01569816,01561000), ref: 015696F0
GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(C0000409,?,01569816,01561000), ref: 015696FB
TerminateProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000000,?,01569816,01561000), ref: 01569702

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: eb3246e0889522affad0a65a2d047040cb8812d370dd9e6c74f14e63c00e87a3
Instruction ID: 59865d5e451faff138069c1139dcb6f9d01a60ba8bbe7087e1f58ca9982b658d
Opcode Fuzzy Hash: eb3246e0889522affad0a65a2d047040cb8812d370dd9e6c74f14e63c00e87a3
Instruction Fuzzy Hash: 04D0C932014144ABCB222BE1FC0EA593E38FB4427AF068004F72A8A004CB314409EB71

Function 015692E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0156930D
GetVersionExW.API-MS-WIN-CORE-SYSINFO-L1-1-0(0000011C,?,?,?), ref: 01569326

Part of subcall function 01564F00: _vsnwprintf.MSVCRT ref: 01564F32

Strings

%d.%d.%d, xrefs: 0156935E

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Version_vsnwprintfmemset
String ID: %d.%d.%d
API String ID: 413895009-3144769927
Opcode ID: 5b9993c77d801cee0ebd537a8d52ea3b2c417e0cc3b12f3f87c89535f16cde86
Instruction ID: 4e1e1e30adc7ff8f0741d1c0eed70e14602eb4519d4c1e1503bf005695fd50ee
Opcode Fuzzy Hash: 5b9993c77d801cee0ebd537a8d52ea3b2c417e0cc3b12f3f87c89535f16cde86
Instruction Fuzzy Hash: 651187B0A002197AD7609F62EC0AFFFBABCFBD5B14F004059F9146F244DA745954E7A1

Function 01564068 Relevance: 2.5, APIs: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,015671E2), ref: 015640AE
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015640B5

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 4602f5275e7bedb2b9e1dcbb8da4525097b23e6156707eb2f7da1fb8ea962c4a
Instruction ID: eacf288ec3b74369a4164529bb208b1e4d540f63d41d2ad7bda06acf442f417a
Opcode Fuzzy Hash: 4602f5275e7bedb2b9e1dcbb8da4525097b23e6156707eb2f7da1fb8ea962c4a
Instruction Fuzzy Hash: DCF080757113219FEB349E65F89AB7AB769FB40736F02401DD5198F184CB705808FB90

Function 01569930 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(Function_000098E0), ref: 01569935

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 370ffb5c0d39128dc9f9fd64e922d031e92eddb678ca0daa85ae697a222d20a1
Instruction ID: d6c8979a733dcdc1f8021a2f915c025c572d5c7e6e329d0ce0a09094af7ac104
Opcode Fuzzy Hash: 370ffb5c0d39128dc9f9fd64e922d031e92eddb678ca0daa85ae697a222d20a1
Instruction Fuzzy Hash: AA900260265150CA8A111F736C1A80565986A4855A7424858A111CD008DF704004F671

Function 01566BF1 Relevance: 77.5, APIs: 36, Strings: 8, Instructions: 453memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01566C2D
memset.MSVCRT ref: 01566C3D
HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000001,00000000,00000000), ref: 01566C74
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 01566C7B
wprintf.MSVCRT ref: 01566C94

Strings

GetModuleHandle failed, xrefs: 01566C8A
MprmsgGetErrorString, xrefs: 01566D0C
%s, xrefs: 01566C8F
api-ms-win-appmodel-runtime-l1-1-0.dll, xrefs: 01566CE2
mprmsg.dll, xrefs: 01566CF8
%s>, xrefs: 01566CA9
netsh, xrefs: 01566CA4
netsh.exe, xrefs: 01566CD0

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: memset$HandleHeapInformationModulewprintf
String ID: %s$%s>$GetModuleHandle failed$MprmsgGetErrorString$api-ms-win-appmodel-runtime-l1-1-0.dll$mprmsg.dll$netsh$netsh.exe
API String ID: 2957350143-4264442765
Opcode ID: 7b61d59160e850ead5ebe8af8498987c3942ce51087cad80c21c0471e1449823
Instruction ID: f51f7d629c6cbcb19a8d8a9368e76ea5820c515b39bca7c770df4a995f29eee4
Opcode Fuzzy Hash: 7b61d59160e850ead5ebe8af8498987c3942ce51087cad80c21c0471e1449823
Instruction Fuzzy Hash: B5F1F775A00627DBDB319F25EC89AADB7BDFB44224F4040AAE4069F144DB319E84CFE5

Function 01562810 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

MatchToken.NETSH(?,help), ref: 01562879

Part of subcall function 01567690: _wcsnicmp.MSVCRT ref: 015676BC

MatchToken.NETSH(?,015612B0,?,help), ref: 01562891
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,015612B0,?,help), ref: 015628A6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015628AD
MatchTagsInCmdLine.NETSH(?,?,?,mode,00000002,00000000), ref: 015628D8
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 015628E6
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015628ED

Strings

append, xrefs: 01562967
name, xrefs: 0156284C
open, xrefs: 0156295A
mode, xrefs: 0156283B, 015628CA
close, xrefs: 01562978
help, xrefs: 01562871

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Match$ProcessToken$AllocFreeLineTags_wcsnicmp
String ID: append$close$help$mode$name$open
API String ID: 60316392-503993532
Opcode ID: d485c39989d9969d515b13a962ec76ea861542ab80e97cbb009f970ad1d21312
Instruction ID: edab77d8e227ddb44bca1847d6404b73c36903d95264a2e7b283291e29f2233f
Opcode Fuzzy Hash: d485c39989d9969d515b13a962ec76ea861542ab80e97cbb009f970ad1d21312
Instruction Fuzzy Hash: C091D871A002199FDF228FA8E889EAE7BBDFB48364F050119E515FF290D7709D04DBA1

Function 01562590 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 200memorywindowCOMMON

Download Yara Rule

APIs

MatchToken.NETSH(?,help), ref: 0156261F
MatchToken.NETSH(?,015612B0,?,help), ref: 01562638
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,015612B0,?,help), ref: 0156264D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01562654
MatchTagsInCmdLine.NETSH(01561284,?,?,?,00000003,00000000), ref: 0156267C
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 0156268D
_wcsicmp.MSVCRT ref: 0156272F
PrintMessageFromModule.NETSH(000000A9,?), ref: 0156274D
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000208), ref: 0156275B
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01562762
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?), ref: 0156278C
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01562793
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01562694

Part of subcall function 01566A15: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,?), ref: 01566A4C
Part of subcall function 01566A15: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01566A53
Part of subcall function 01566A15: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,?), ref: 01566A85
Part of subcall function 01566A15: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01566A8C

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000), ref: 015627B6
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015627BD
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000), ref: 015627C9
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015627D0
PrintMessageFromModule.NETSH(00003AA0), ref: 015627F1

Strings

pwd, xrefs: 015625E0
user, xrefs: 015625D0
name, xrefs: 015625C0
help, xrefs: 01562617

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$Free$AllocMatch$FromMessageModulePrintToken$LineTags_wcsicmp
String ID: help$name$pwd$user
API String ID: 1986014345-3860914806
Opcode ID: be0983bc5a858d81d8e266b8ab998093e9c3bee4652394af5e6bca109e02eef5
Instruction ID: 1e7c72b983da6b3efdc30a65fb5caca854657bd8aea21d4c6b443d3e74fb83b9
Opcode Fuzzy Hash: be0983bc5a858d81d8e266b8ab998093e9c3bee4652394af5e6bca109e02eef5
Instruction Fuzzy Hash: 7C6190B16183029FD7219F69D889A6E7BEDBB88714F05091DF949DF244DB34C9048BA2

Function 01568A48 Relevance: 38.6, APIs: 13, Strings: 9, Instructions: 127stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(?,01561A54,?,?,?), ref: 01568A94
memcmp.MSVCRT ref: 01568AA4
lstrcmpiW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(?,ras,?,?), ref: 01568AD8
MatchToken.NETSH(?,diagnostics,?,?), ref: 01568B1C
MatchToken.NETSH(?,set,?,diagnostics,?,?), ref: 01568B31
MatchToken.NETSH(?,show,?,set,?,diagnostics,?,?), ref: 01568B42
MatchToken.NETSH(?,tracing,?,set,?,diagnostics,?,?), ref: 01568B54
MatchToken.NETSH(?,user,?,tracing,?,set,?,diagnostics,?,?), ref: 01568B66
MatchToken.NETSH(?,add,?,user,?,tracing,?,set,?,diagnostics,?,?), ref: 01568B77
MatchToken.NETSH(?,delete,?,add,?,user,?,tracing,?,set,?,diagnostics,?,?), ref: 01568B88
MatchToken.NETSH(?,dump,?,delete,?,add,?,user,?,tracing,?,set,?,diagnostics,?,?), ref: 01568B99
MatchToken.NETSH(?,set,?,dump,?,delete,?,add,?,user,?,tracing,?,set,?,diagnostics), ref: 01568BAA
MatchToken.NETSH(?,show,?,set,?,dump,?,delete,?,add,?,user,?,tracing,?,set), ref: 01568BBB

Strings

user, xrefs: 01568B5D
tracing, xrefs: 01568B4B
add, xrefs: 01568B6F
show, xrefs: 01568B3A, 01568BB3
dump, xrefs: 01568B91
diagnostics, xrefs: 01568B14
delete, xrefs: 01568B80
set, xrefs: 01568B29, 01568BA2
ras, xrefs: 01568AD0

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: MatchToken$lstrcmpi$memcmp
String ID: add$delete$diagnostics$dump$ras$set$show$tracing$user
API String ID: 4174612407-597535005
Opcode ID: e0f9a0498fda055fcdea31d75530a768b82fdc4c61160a12379d936e919056f5
Instruction ID: 4f330c6428a463be8de8b0f210f97b03ddbacd494628e3647081801d9bdd602a
Opcode Fuzzy Hash: e0f9a0498fda055fcdea31d75530a768b82fdc4c61160a12379d936e919056f5
Instruction Fuzzy Hash: 824180706007079EDB52AF2EC886ABEBAADBF94648F44442DD542EF125E7719911CBC0

Function 01566790 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 152memorywindowstringCOMMON

Download Yara Rule

APIs

PrintMessage.NETSH([%1!s!] ,?), ref: 015667C7
PrintMessage.NETSH(01574AE0), ref: 015667DD
lstrcmpiW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(netsh,0156B2F0), ref: 015667F0
PrintMessageFromModule.NETSH(000003EF,015617F4,015617E0), ref: 0156682B

Part of subcall function 01567EA0: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,?,?,00004000,?,00000000,?,?,0156471D,000000B6,?), ref: 01567ED0
Part of subcall function 01567EA0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,GetResourceString,?,0156471D,000000B6,?), ref: 01567EE2

PrintMessage.NETSH(%1!s!>,netsh), ref: 01566847
iswctype.MSVCRT(?,00000008,00000000,?,?), ref: 0156686D
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,?), ref: 015668AD
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015668B4
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,?,00000000,?,?), ref: 015668EB
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015668F2
ProcessCommand.NETSH(?,?), ref: 015668FF
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 0156691C
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01566923
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 01566935
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156693C

Strings

[%1!s!] , xrefs: 015667C2
%1!s!>, xrefs: 01566842
netsh, xrefs: 015667CE, 015667EB, 0156683D

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$FreeMessagePrint$AddressCommandFromLoadModuleProcStringiswctypelstrcmpi
String ID: %1!s!>$[%1!s!] $netsh
API String ID: 1372608480-1238292096
Opcode ID: 013dec69786dd268eed701a5e3499189bca3bbc0f9c708f50832faf4dada4a46
Instruction ID: ab8aa4687e479a2fbaea19f4750b60ea005f5c9034d4d2ddbf5d0362af7a097e
Opcode Fuzzy Hash: 013dec69786dd268eed701a5e3499189bca3bbc0f9c708f50832faf4dada4a46
Instruction Fuzzy Hash: F8510871E10216EFDB219FB9D8498AEB7FDFF44614B11041AE915EF240EB708944DBE0

Function 01562B20 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

MatchToken.NETSH(?,help), ref: 01562B5B

Part of subcall function 01567690: _wcsnicmp.MSVCRT ref: 015676BC

MatchToken.NETSH(?,015612B0,?,help), ref: 01562B70
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000004,?,015612B0,?,help), ref: 01562B80
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01562B87
MatchTagsInCmdLine.NETSH(?,?,015612B8,mode,00000001,00000000), ref: 01562BAD
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01562BBB
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01562BC2

Strings

mode, xrefs: 01562B35, 01562BA1
online, xrefs: 01562BFB
help, xrefs: 01562B53
offline, xrefs: 01562C12

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Match$ProcessToken$AllocFreeLineTags_wcsnicmp
String ID: help$mode$offline$online
API String ID: 60316392-1053974117
Opcode ID: aca0eac9b704f15d272ccfddedc924c99fbac09db48c159f8604493894f8b232
Instruction ID: cb5fedfddcf2c484bd64823d66db63d43acc0df9954a9fb5a4086c2a0c830ab9
Opcode Fuzzy Hash: aca0eac9b704f15d272ccfddedc924c99fbac09db48c159f8604493894f8b232
Instruction Fuzzy Hash: 23510472A00507AFEB229FA8D849BAE7BBDFB84314F014024E915AF258DB309D05CBD1

Function 01563CED Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 160memoryregistrywindowCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 01563D15
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,SOFTWARE\Microsoft\NetSh,00000000,000F003F,01563978), ref: 01563D87
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(01563978,?), ref: 01563DA2
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(01563978), ref: 01563DAD
PrintMessageFromModule.NETSH(000003E9,?), ref: 01563DC3
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 01563DE3
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563DEA
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 01563DFD
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563E04
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 01563E1E
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563E25
memcpy.MSVCRT ref: 01563E43
memcpy.MSVCRT ref: 01563E67
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?), ref: 01563EA8
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 01563EB7
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563EBE

Strings

SOFTWARE\Microsoft\NetSh, xrefs: 01563D7D

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$FreeProcess$memcpy$AllocCloseDeleteFromLibraryMessageModuleOpenPrintValue_wcsicmp
String ID: SOFTWARE\Microsoft\NetSh
API String ID: 915751017-276136757
Opcode ID: fbea5d0f635231b01e88f717cf4a921d0d9f6235b77cbb591f0378f5f5e71252
Instruction ID: 2833951a7f68683a2490d7212dbdf8437e1a5374f9b2f6af62a40594cf61f8b7
Opcode Fuzzy Hash: fbea5d0f635231b01e88f717cf4a921d0d9f6235b77cbb591f0378f5f5e71252
Instruction Fuzzy Hash: 0551D8B1E10111AFCB618FA8F88EA6DBBBCFB44368B164415E919DF245C730DD04DBA0

Function 01563ED3 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 128memoryregistrywindowCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,SOFTWARE\Microsoft\NetSh,00000000,00020019,?), ref: 01563EFB
RegQueryInfoKeyW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000), ref: 01563F20
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?), ref: 01563F44
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563F4B
PrintMessageFromModule.NETSH(00000068), ref: 01563F5F
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?), ref: 01563F6F
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563F76
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01563F84
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563F8B
RegEnumValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 01563FBA
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000), ref: 01563FE7
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01563FF3
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563FFA
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01564006
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156400D

Strings

SOFTWARE\Microsoft\NetSh, xrefs: 01563EEA

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$CloseEnumFromInfoMessageModuleOpenPrintQueryValue
String ID: SOFTWARE\Microsoft\NetSh
API String ID: 1499200800-276136757
Opcode ID: 574aaf270e0eec6c9e3f1ee7c53528c5ac4cf6293e1a5e63837fcc0f1fa78e74
Instruction ID: f3882739ba752b6375e0849dc1b6c31d872b4dd974a3e2030a0f7dc060cba092
Opcode Fuzzy Hash: 574aaf270e0eec6c9e3f1ee7c53528c5ac4cf6293e1a5e63837fcc0f1fa78e74
Instruction Fuzzy Hash: 84419571910119BFDB219BA9EC8DEAFBBBCFB44725F110025B56DEB144DA348904DBB0

Function 0156587A Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 165memorywindowstringCOMMON

Download Yara Rule

APIs

MatchToken.NETSH(?,help,?,00000000,00000000,?,?,?,01564AEF,?,00000002,?,?,?,00000000), ref: 015658A5

Part of subcall function 01567690: _wcsnicmp.MSVCRT ref: 015676BC

MatchToken.NETSH(?,015612B0,?,help,?,00000000,00000000,?,?,?,01564AEF,?,00000002,?,?,?), ref: 015658B6
PrintError.NETSH(00000000,00000000,?,01564AEF,?,00000002,?,?,?,00000000,?,?,00000000), ref: 015658FA
lstrcmpiW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(?,netsh,?,00000000,00000000,?,?,?,01564AEF,?,00000002,?,?,?,00000000), ref: 01565913
PrintError.NETSH(00000000,00003A99,?,01564AEF,?,00000002,?,?,?,00000000,?,?,00000000), ref: 01565961
PrintMessageFromModule.NETSH(00000000,00000002,?,01564AEF,?,00000002,?,?,?,00000000,?,?,00000000), ref: 0156597E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,01564AEF,?,00000002,?,?,?,00000000), ref: 015659CE
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01564AEF,?,00000002,?,?,?,00000000), ref: 015659D5
PrintMessageFromModule.NETSH(?,?,00000000,?,0156131C,00000000,?,01564AEF,?,00000002,?,?,?,00000000), ref: 01565A10
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01565A1C
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01565A23
PrintMessageFromModule.NETSH(?,?,?,?,01564AEF,?,00000002,?,?,?,00000000), ref: 01565A33

Part of subcall function 01567EA0: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,?,?,00004000,?,00000000,?,?,0156471D,000000B6,?), ref: 01567ED0
Part of subcall function 01567EA0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,GetResourceString,?,0156471D,000000B6,?), ref: 01567EE2

PrintMessage.NETSH(01561320,?,01564AEF,?,00000002,?,?,?,00000000,?,?,00000000), ref: 01565A55

Strings

help, xrefs: 0156589D
netsh, xrefs: 0156590C

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Print$HeapMessage$FromModule$ErrorMatchProcessToken$AddressAllocFreeLoadProcString_wcsnicmplstrcmpi
String ID: help$netsh
API String ID: 691894897-4263905064
Opcode ID: 54c400d8bae666632fc7c93a86ea0c124001db5e90a782b3ccbba0f5a256fe82
Instruction ID: 007129a65710c891387262502b9f3428484d7ff68e018e02b83a46dba655390c
Opcode Fuzzy Hash: 54c400d8bae666632fc7c93a86ea0c124001db5e90a782b3ccbba0f5a256fe82
Instruction Fuzzy Hash: 0A513432620207AFDB21AF7CDC8996EBBADFB452A4F044629E9019B150E7708C54DBD0

Function 01563A08 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 01563A59
_wcsicmp.MSVCRT ref: 01563A6F
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 01563A95
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563A9C
memcpy.MSVCRT ref: 01563ABB
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01563AD6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563ADD
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?), ref: 01563B07
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563B0E
_wcsupr.MSVCRT ref: 01563B31
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563B46
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563B4D

Strings

ipxpromn.dll, xrefs: 01563A69
ipxmontr.dll, xrefs: 01563A4D

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$Alloc$_wcsicmp$Free_wcsuprmemcpy
String ID: ipxmontr.dll$ipxpromn.dll
API String ID: 1906506965-3013806906
Opcode ID: cf4bf378662fae3802108ff10add92b43d2d339df01b0845f4c81e9891e98836
Instruction ID: 190e8c0a1f38bdb29c150933723976601d391340bb91a9d98ddc684c113f700a
Opcode Fuzzy Hash: cf4bf378662fae3802108ff10add92b43d2d339df01b0845f4c81e9891e98836
Instruction Fuzzy Hash: 01412E71A002029BDB259F7CF84E9AABBBCFB44325711042EE95ADF145DB30E509DBA0

Function 01567450 Relevance: 24.2, APIs: 16, Instructions: 189memorywindowCOMMON

Download Yara Rule

APIs

wcspbrk.MSVCRT ref: 01567481
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,?), ref: 01567634
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156763B
PrintMessageFromModule.NETSH(00003AA0,?), ref: 01567650
PrintMessageFromModule.NETSH(00000068), ref: 01567673

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: FromHeapMessageModulePrint$FreeProcesswcspbrk
String ID:
API String ID: 3977950575-0
Opcode ID: f7bbba05a0e575d12d984709499f479bec565f199042cc7563c388fd1a5ce501
Instruction ID: 710f7836898c036eda4ed7fdda15d55a0cf4c277f3c1f4ea018eea7c79057ba6
Opcode Fuzzy Hash: f7bbba05a0e575d12d984709499f479bec565f199042cc7563c388fd1a5ce501
Instruction Fuzzy Hash: 5F71B271D00216DFDF21CFA8D8899AEBBB9FB48328F054565E826AB251D7349D44CFD0

Function 015677C6 Relevance: 24.1, APIs: 16, Instructions: 110memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 01569CA9: __iob_func.MSVCRT ref: 01569CAE

fflush.MSVCRT ref: 015677ED
fgets.MSVCRT ref: 01567800
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,000000FF,00000000,00000000,00000000,?,?,?,?,?), ref: 01567820
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(00000000,?,?,?,?,?), ref: 01567827
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,?,-00000002,?,00000000,?,?,?,?,?), ref: 0156786B
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,?,?), ref: 0156787B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?), ref: 01567887
PrintError.NETSH(00000000,00000000,?,?,?,?,?), ref: 0156788F

Part of subcall function 01567BC0: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,?,?,00004000,-00000001,00000000,00000000,?,015679C1,00000000,00000000,?,01567E48,?,01567F23), ref: 01567C05
Part of subcall function 01567BC0: FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000500,?,00000000,00000000,?,00000000,?,?,015679C1,00000000,00000000,?,01567E48,?,01567F23), ref: 01567C2C
Part of subcall function 01567BC0: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567C3A
Part of subcall function 01567BC0: LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567C53

WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,00000002,?,00000000,?,?,?,?,?), ref: 015678AD
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,?,?), ref: 015678BD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?), ref: 015678C9
PrintError.NETSH(00000000,00000000,?,?,?,?,?), ref: 015678D1
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,?,?,?,?), ref: 015678DD
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,?), ref: 015678E4
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,00002000,00000000,00000000,?,?,?,?,?), ref: 01567900
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(00000000,?,?,?,?,?), ref: 01567907

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Error$Handle$ByteCharCloseConsoleFileHeapLastMultiOutputPrintWideWrite$AllocFormatFreeLoadLocalMessageProcessString__iob_funcfflushfgets
String ID:
API String ID: 3788396652-0
Opcode ID: f1246c9645d48bfcacaf5b1e95f22b0603fe1a5b820bde0b220cb040fa6f0022
Instruction ID: 58c090884c6ade678e6fd445c8ec81ea5e088511d33b599ea7b06bcf3ea189a9
Opcode Fuzzy Hash: f1246c9645d48bfcacaf5b1e95f22b0603fe1a5b820bde0b220cb040fa6f0022
Instruction Fuzzy Hash: 31319175610205AFE7319B65FC8DEAA7BBCFB88725F010059FA15CB145EA308908EBB1

Function 01566A15 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 158memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,?), ref: 01566A4C
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01566A53

Part of subcall function 015653D8: _wcslwr.MSVCRT ref: 015653EE

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,?), ref: 01566A85
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01566A8C
GetComputerNameExW.API-MS-WIN-CORE-SYSINFO-L1-1-0(00000001,?,?), ref: 01566AFE
PrintMessageFromModule.NETSH(000000B4,?,?,00000000,?), ref: 01566B14
PrintError.NETSH(00000000,00000000,?,00000000,?), ref: 01566B20
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000208,?,?,00000000,?), ref: 01566B9C
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,?), ref: 01566BA3
PrintMessageFromModule.NETSH(00000000,0000000E,?,?,00000000,?), ref: 01566BB5

Part of subcall function 01568D48: CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0(00000000,00000006,?,?,?), ref: 01568D7D
Part of subcall function 01568D48: CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0(01561C9C,00000000,00000001,01561CAC,?), ref: 01568DAA
Part of subcall function 01568D48: SysAllocString.OLEAUT32(?), ref: 01568DED
Part of subcall function 01568D48: SysAllocString.OLEAUT32(?), ref: 01568E37
Part of subcall function 01568D48: SysAllocString.OLEAUT32(?), ref: 01568E4B
Part of subcall function 01568D48: SysAllocString.OLEAUT32(00000000), ref: 01568E54
Part of subcall function 01568D48: SysFreeString.OLEAUT32(00000000), ref: 01568E92
Part of subcall function 01568D48: SysFreeString.OLEAUT32(00000000), ref: 01568E99
Part of subcall function 01568D48: SysFreeString.OLEAUT32(?), ref: 01568EA3

Strings

netsh, xrefs: 01566AB8
\\%s\ipc$, xrefs: 01566B45

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: String$AllocHeap$Free$PrintProcess$FromMessageModule$ComputerCreateErrorInitializeInstanceName_wcslwr
String ID: \\%s\ipc$$netsh
API String ID: 876722747-2229480662
Opcode ID: d644b8c402a2a3bc8c805b379b41338f44700d001e8fa02404ef923f5fca221f
Instruction ID: 4ac08240784d6190651d67d402aee2b7ad109c219c8e68d75cdea9fd339ed224
Opcode Fuzzy Hash: d644b8c402a2a3bc8c805b379b41338f44700d001e8fa02404ef923f5fca221f
Instruction Fuzzy Hash: 8F51BDB1614312ABD725EF29E88596FB7ECFB84724F00891EB955CF240EB70D9448BE1

Function 01563B75 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 132registrywindowCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 01563BA6
RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,SOFTWARE\Microsoft\NetSh,00000000,STRING,00000000,000F003F,00000000,?,00000000), ref: 01563BE3
_wcsdup.MSVCRT ref: 01563BF4
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 01563C07
wcsrchr.MSVCRT ref: 01563C1A
wcsrchr.MSVCRT ref: 01563C29
wcsrchr.MSVCRT ref: 01563C50
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,?,00000000,00000001,00000000,00000000), ref: 01563C90
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 01563C9E
free.MSVCRT(00000000), ref: 01563CA5
PrintMessageFromModule.NETSH(000003E8), ref: 01563CD4

Strings

SOFTWARE\Microsoft\NetSh, xrefs: 01563BD9
STRING, xrefs: 01563BD3

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: wcsrchr$Close$CreateFromMessageModulePrintValue_wcsdup_wcsicmpfree
String ID: SOFTWARE\Microsoft\NetSh$STRING
API String ID: 3059030296-2051982046
Opcode ID: ff5bbc6fe9c3b25f4dab57dd985e848a7af2aacef83dd31f0c27e6e7897184c7
Instruction ID: b6f72ac2eda50c44902269d0949c0a21c0d4bcace193391ee9b1fc7b5ee5f0b3
Opcode Fuzzy Hash: ff5bbc6fe9c3b25f4dab57dd985e848a7af2aacef83dd31f0c27e6e7897184c7
Instruction Fuzzy Hash: 7E41E436600215AFEB255B29FC4AAAE776DFF85225F11006DF50A9F184EE709D08DBA0

Function 01562095 Relevance: 22.7, APIs: 15, Instructions: 164memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000010), ref: 01562141
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01562148
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 0156215D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01562164
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01562172
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01562179
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 01562185
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156218C
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01562199
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015621A0
PrintMessageFromModule.NETSH(00000068), ref: 015621B5
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 015621D9
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015621E0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 015621F2
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015621F9

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$FromMessageModulePrint
String ID:
API String ID: 794174124-0
Opcode ID: 3f230b178dfbc962b854d9b3a0241789467271882758cda383c38992b1dd685e
Instruction ID: dfc94f2a7b0c8ca8a3e81b854788e72a4cf261709ffb35bd34d4f5d0ec735afe
Opcode Fuzzy Hash: 3f230b178dfbc962b854d9b3a0241789467271882758cda383c38992b1dd685e
Instruction Fuzzy Hash: AF51F7B5A10212EBDB219F78E84986AB7FDFF44324B014819E95ADF244EB31D945CBA0

Function 015645E0 Relevance: 19.7, APIs: 13, Instructions: 231windowCOMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 01564620
wcschr.MSVCRT ref: 01564635
wcschr.MSVCRT ref: 01564675
wcschr.MSVCRT ref: 01564685
PrintMessageFromModule.NETSH(000000B5,?), ref: 0156469E
wcschr.MSVCRT ref: 015646EF
wcschr.MSVCRT ref: 015646FF
PrintMessageFromModule.NETSH(000000B6,?), ref: 01564718
wcschr.MSVCRT ref: 01564761
wcschr.MSVCRT ref: 01564774
PrintMessageFromModule.NETSH(000000B7,?), ref: 01564790
_wcsicmp.MSVCRT ref: 0156480A
memcpy.MSVCRT ref: 01564836

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: wcschr$FromMessageModulePrint$_wcsicmpmemcpy
String ID:
API String ID: 1297359847-0
Opcode ID: f24a7f3edc59bc96bf9b3cf954f61f7537c4c4faf9a274c90dfe00e06372fea5
Instruction ID: bc5d0294b37ffe89d7fe8d8661a1301a19f2f16dccee9c039ca3ed4823f68705
Opcode Fuzzy Hash: f24a7f3edc59bc96bf9b3cf954f61f7537c4c4faf9a274c90dfe00e06372fea5
Instruction Fuzzy Hash: 33810335A00202DFDF29DF68E8C1AAEBBB9FF44710B14406DD9119F684EB30A951CBD0

Function 0156562B Relevance: 19.7, APIs: 13, Instructions: 196memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0156401D: MatchToken.NETSH(?,?,00000000,00000000,?,?,?,0156566F,?,?,00000000,?), ref: 01564041

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,?,00000000,?), ref: 01565705
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156570C
GenericMonitor.NETSH(?,00000004,?,?,00000000,0156F3D8,?,?,?,00000000,?), ref: 01565741
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,00000000,?), ref: 01565792
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01565799
memcpy.MSVCRT ref: 015657B3
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000004), ref: 015657C1
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015657C8
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,015612B0), ref: 01565808
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156580F
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01565818
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156581F

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$GenericMatchMonitorTokenmemcpy
String ID:
API String ID: 3287015945-0
Opcode ID: a00c3f8b6dffdde6d361609284f205994d73c9c6b805688acd6ac80e5ac1f840
Instruction ID: c803b7f3f3764fc7c42827308a639c9ab5a353a438b509e0b9d4f5995c24c43a
Opcode Fuzzy Hash: a00c3f8b6dffdde6d361609284f205994d73c9c6b805688acd6ac80e5ac1f840
Instruction Fuzzy Hash: A961C471664303ABD7219F68D849B6E77EDFB943A4F104828F9198F251EB30D848CBE1

Function 015653F7 Relevance: 19.7, APIs: 13, Instructions: 188memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,?,?,?,?), ref: 015654B6
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015654BD
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?), ref: 01565547
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156554E

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 905f2939b3accd0e99323641275b6efce868b822783e5d62341340b3f5a9caa0
Instruction ID: 71591221ff06a256583bca63cc644c04dfecf0c2da9b1c5de76daa55f4e32f60
Opcode Fuzzy Hash: 905f2939b3accd0e99323641275b6efce868b822783e5d62341340b3f5a9caa0
Instruction Fuzzy Hash: 5751C5717A0302ABDB219F68EC49B6A7BADFB947A5F004425F959CF244E730C944CBE1

Function 0156846A Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 377windowmemoryCOMMON

Download Yara Rule

APIs

PrintMessageFromModule.NETSH(00000087,00000000,?,?,?,01564CB5,?,00000002,?,?,?,?), ref: 0156850E
_wcsicmp.MSVCRT ref: 015685E2
PrintMessageFromModule.NETSH(?,00000070,?,00000000,?,?,?,01564CB5,?,00000002,?,?,?), ref: 0156881E
PrintMessageFromModule.NETSH(?,0000006F,00000000,?,?,?,01564CB5,?,00000002,?,?,?), ref: 0156882B
PrintMessageFromModule.NETSH(?,00000069,00000000,?,?,?,01564CB5,?,00000002,?,?,?), ref: 0156885D
PrintMessage.NETSH( %1!s!,?,00000000,?,?,?,01564CB5,?,00000002,?,?,?), ref: 01568888
PrintMessage.NETSH(01561320,00000000,?,?,?,01564CB5,?,00000002,?,?,?), ref: 0156889E
PrintMessageFromModule.NETSH(?,0000006B,015612B0,00000000,?,?,?,01564CB5,?,00000002,?,?,?), ref: 015688B2
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,?,?,01564CB5,?,00000002,?,?,?), ref: 015688C7
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01564CB5,?,00000002,?,?,?), ref: 015688CE

Strings

%1!s!, xrefs: 01568883

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: MessagePrint$FromModule$Heap$FreeProcess_wcsicmp
String ID: %1!s!
API String ID: 1398923986-2251066777
Opcode ID: ae6699099e2a031a3b6a6a811dadf81f27d039fa255d897fb5552c3709050f62
Instruction ID: 02248122413525ead15503843cdbcc4d737e5046d58c880146f07ddf3e4810da
Opcode Fuzzy Hash: ae6699099e2a031a3b6a6a811dadf81f27d039fa255d897fb5552c3709050f62
Instruction Fuzzy Hash: 2AE19E70A003029FDB28CF68D881A6EB7BAFF98314B148568D9159F296DB71ED50CBD0

Function 01567920 Relevance: 19.6, APIs: 13, Instructions: 80memoryfileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,000000B6,000000FF,00000000,00000000,00000000,00000000,0156471D,00000000,00004000,00000000,00000000,?,01567E48,?,01567F23), ref: 01567939
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567940
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 0156794A
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567951
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,000000B6,000000FF,00000000,00000000,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567969
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567970
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(000000B6,00000000,-00000001,0156471D,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567981
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,-00000001,0156471D,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567998
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679A8
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679B4
PrintError.NETSH(00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679BC

Part of subcall function 01567BC0: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,?,?,00004000,-00000001,00000000,00000000,?,015679C1,00000000,00000000,?,01567E48,?,01567F23), ref: 01567C05
Part of subcall function 01567BC0: FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000500,?,00000000,00000000,?,00000000,?,?,015679C1,00000000,00000000,?,01567E48,?,01567F23), ref: 01567C2C
Part of subcall function 01567BC0: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567C3A
Part of subcall function 01567BC0: LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567C53

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679C5
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679CC

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$ByteCharConsoleErrorFileFreeHandleMultiOutputProcessWideWrite$AllocCloseFormatLastLoadLocalMessagePrintString
String ID:
API String ID: 3846968651-0
Opcode ID: c8c48798eb728b5b6b474af3cfa30dced5fe7a6b1c56db2391dda443de8ad497
Instruction ID: 849094b999039d7ae4a64b0f51f13919f77c119c1bc7fcbb8326690e91122ce4
Opcode Fuzzy Hash: c8c48798eb728b5b6b474af3cfa30dced5fe7a6b1c56db2391dda443de8ad497
Instruction Fuzzy Hash: A21193B1511220BFDB316BB6FC4ED9B7F6CEB853797110118B626DA144EA309908EBB0

Function 0156831B Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 114memorywindowCOMMON

Download Yara Rule

APIs

qsort.MSVCRT ref: 01568336
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000001,?,?,?,?,?,01564CB5,?,00000002,?,?,?), ref: 015683A2
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,?,01564CB5,?,00000002,?,?,?), ref: 015683A9
PrintMessage.NETSH(%1!-14s! - ,01573FEC,?,?,?,?,?,01564CB5,?,00000002,?,?,?), ref: 015683BC
PrintMessage.NETSH(%1!-14s! - ,00000000,01573FEC,0156131C,?,?,?,?,?,?,01564CB5,?,00000002,?,?,?), ref: 015683F1
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,01573FEC,0156131C,?,?,?,?,?,?,01564CB5,?,00000002,?,?,?), ref: 015683FC
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,?,01564CB5,?,00000002,?,?,?), ref: 01568403
PrintMessage.NETSH(%1!-14s! - ,01573FEC,00000001,?,?,?,?,?,01564CB5,?,00000002,?,?,?), ref: 01568412
PrintMessageFromModule.NETSH(?,?,?,?,0156131C,00000001,?,?,?,?,?,01564CB5,?,00000002,?,?), ref: 01568436
PrintMessage.NETSH(01561320,?,?,?,?,00000001,?,?,?,?,?,01564CB5,?,00000002,?,?), ref: 01568447

Strings

%1!-14s! - , xrefs: 015683B7, 015683EC, 0156840D

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: MessagePrint$Heap$Process$AllocFreeFromModuleqsort
String ID: %1!-14s! -
API String ID: 3292501186-4170063814
Opcode ID: 6b6de4a4faa89b83bc0b2e6e291649565d8ce45c1c4dd6c24b2b9108105bf486
Instruction ID: 635442ad4abc6d3ce3b8efca7bc71284499a6fd9f828659925981a67c335ddc7
Opcode Fuzzy Hash: 6b6de4a4faa89b83bc0b2e6e291649565d8ce45c1c4dd6c24b2b9108105bf486
Instruction Fuzzy Hash: 7B312C75700302EFDB21AFA9DC96C7EB7ADFB84228310842DE9464F204D6719C49DBE0

Function 01567BC0 Relevance: 18.2, APIs: 12, Instructions: 171windowCOMMON

Download Yara Rule

APIs

LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,?,?,00004000,-00000001,00000000,00000000,?,015679C1,00000000,00000000,?,01567E48,?,01567F23), ref: 01567C05
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000500,?,00000000,00000000,?,00000000,?,?,015679C1,00000000,00000000,?,01567E48,?,01567F23), ref: 01567C2C
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567C53
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567C3A

Part of subcall function 01567920: GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,000000B6,000000FF,00000000,00000000,00000000,00000000,0156471D,00000000,00004000,00000000,00000000,?,01567E48,?,01567F23), ref: 01567939
Part of subcall function 01567920: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567940
Part of subcall function 01567920: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 0156794A
Part of subcall function 01567920: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567951
Part of subcall function 01567920: GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,000000B6,000000FF,00000000,00000000,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567969
Part of subcall function 01567920: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567970
Part of subcall function 01567920: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(000000B6,00000000,-00000001,0156471D,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567981
Part of subcall function 01567920: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,-00000001,0156471D,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567998
Part of subcall function 01567920: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679A8
Part of subcall function 01567920: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679B4
Part of subcall function 01567920: PrintError.NETSH(00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679BC
Part of subcall function 01567920: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679C5
Part of subcall function 01567920: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679CC

LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(000003EE,?,00004000,-00000001,00000000,00000000,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D), ref: 01567C8C
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567C98
LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00004000,-00000001,00000000,00000000,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D), ref: 01567CE5
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000500,?,00000000,00000000,?,00000000,?,?,015679C1,00000000,00000000,?,01567E48,?,01567F23), ref: 01567D0C
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567D5F
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,01561714,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567D79
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001000,00000000,?,00000400,?,00004000,?,-00000001,00000000,00000000,?,015679C1,00000000,00000000,?,01567E48), ref: 01567DC3
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567DD1

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Handle$Heap$FormatFreeLoadMessageString$ByteCharConsoleErrorFileLocalMultiOutputProcessWideWrite$AllocCloseLastPrint
String ID:
API String ID: 1170536616-0
Opcode ID: bc8bf3f37e878e743a6f7a4d076fbfb0135440f3c3e5130d020d2207c851298d
Instruction ID: 1147d0e4e61488f76ec1e1964bc5d6e3d120b91e4c43f352463ced3436aa9339
Opcode Fuzzy Hash: bc8bf3f37e878e743a6f7a4d076fbfb0135440f3c3e5130d020d2207c851298d
Instruction Fuzzy Hash: 0151A33560011A9BEB319B54DC44EEE77BCFB48714F0085A4E95ADB284DB309E8CCFA0

Function 015648A0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 015689D7: lstrcmpiW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(?,?,?,015648DC), ref: 015689EE

Part of subcall function 01568A48: lstrcmpiW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(?,01561A54,?,?,?), ref: 01568A94
Part of subcall function 01568A48: memcmp.MSVCRT ref: 01568AA4
Part of subcall function 01568A48: lstrcmpiW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(?,ras,?,?), ref: 01568AD8
Part of subcall function 01568A48: MatchToken.NETSH(?,diagnostics,?,?), ref: 01568B1C
Part of subcall function 01568A48: MatchToken.NETSH(?,set,?,diagnostics,?,?), ref: 01568B31
Part of subcall function 01568A48: MatchToken.NETSH(?,show,?,set,?,diagnostics,?,?), ref: 01568B42
Part of subcall function 01568A48: MatchToken.NETSH(?,tracing,?,set,?,diagnostics,?,?), ref: 01568B54
Part of subcall function 01568A48: MatchToken.NETSH(?,user,?,tracing,?,set,?,diagnostics,?,?), ref: 01568B66
Part of subcall function 01568A48: MatchToken.NETSH(?,add,?,user,?,tracing,?,set,?,diagnostics,?,?), ref: 01568B77
Part of subcall function 01568A48: MatchToken.NETSH(?,delete,?,add,?,user,?,tracing,?,set,?,diagnostics,?,?), ref: 01568B88
Part of subcall function 01568A48: MatchToken.NETSH(?,dump,?,delete,?,add,?,user,?,tracing,?,set,?,diagnostics,?,?), ref: 01568B99

PrintError.NETSH(00000000,00000000), ref: 0156492B

Part of subcall function 01568BE5: RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,System\CurrentControlSet\Services\RemoteAccess\Parameters,MultiTenancyEnabled,00000018,00000000,00000000,00000004), ref: 01568C30
Part of subcall function 01568BE5: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000), ref: 01568C52

MatchToken.NETSH(?,01561490,?), ref: 0156497C
MatchToken.NETSH(?,00000000,?), ref: 015649D3
MatchToken.NETSH(?,?,?), ref: 01564A32
MatchToken.NETSH(?,?,?), ref: 01564A72

Part of subcall function 015651C6: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,00000000,?,?,?,?,01564B22,?,?,?,?,?), ref: 0156525B
Part of subcall function 015651C6: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01564B22,?,?,?,?,?), ref: 01565262
Part of subcall function 015651C6: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,?,?,?,?,01564B22,?,?,?,?,?), ref: 01565286
Part of subcall function 015651C6: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01564B22,?,?,?,?,?), ref: 0156528D

GenericMonitor.NETSH(?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 01564BB9

Part of subcall function 015648A0: MatchToken.NETSH(?,help,?,?,?), ref: 01564BDC
Part of subcall function 015648A0: MatchToken.NETSH(?,015612B0,?,help,?,?,?), ref: 01564BF1
Part of subcall function 015648A0: MatchCmdLine.NETSH(?,-000000FB,?,?,?,015612B0,?,help,?,?,?), ref: 01564C3E

Part of subcall function 0156846A: PrintMessageFromModule.NETSH(00000087,00000000,?,?,?,01564CB5,?,00000002,?,?,?,?), ref: 0156850E

Strings

help, xrefs: 01564BD4

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Match$Token$Heap$lstrcmpi$PrintProcess$AllocCloseErrorFreeFromGenericLineMessageModuleMonitorValuememcmp
String ID: help
API String ID: 1271217041-143088812
Opcode ID: 31e8722618eb1ea799304b1d178e30703b9602a33fe8195e811bdb1b67f8fc67
Instruction ID: f393dc22db1234b664ad5f37d853cd251fbfe56e742f9a068d4609c3fcc0dd38
Opcode Fuzzy Hash: 31e8722618eb1ea799304b1d178e30703b9602a33fe8195e811bdb1b67f8fc67
Instruction Fuzzy Hash: 55D14870A0020AEFDF15DF69C9809AEBBBAFF88314B048159E9159F256D731ED61CBD0

Function 00D92890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00D9293C
___swprintf_l.LIBCMT ref: 00D9295E
___swprintf_l.LIBCMT ref: 00D929A3
___swprintf_l.LIBCMT ref: 00DCA52E

Strings

ffff:, xrefs: 00DCA504
::ffff:0:%u.%u.%u.%u, xrefs: 00DCA54E
::%hs%u.%u.%u.%u, xrefs: 00DCA527
:%u.%u.%u.%u, xrefs: 00DCA5B8

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 9a0717efed1b2de52c322555a2aa8719446ea5ef4b6ce8f924ce7c3448cf1925
Instruction ID: 3058465020d5c9f6d7050c20bfc9809e3eb6f683efe2b045b828bba985638d57
Opcode Fuzzy Hash: 9a0717efed1b2de52c322555a2aa8719446ea5ef4b6ce8f924ce7c3448cf1925
Instruction Fuzzy Hash: F251D7B6A0011ABFCF10DB9C8890A7EFBB8FB18304B14C269E4A5D7641D274DE548BF0

Function 00E02410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00E024A6
___swprintf_l.LIBCMT ref: 00E024E2
___swprintf_l.LIBCMT ref: 00E0257D
___swprintf_l.LIBCMT ref: 00E025A3
___swprintf_l.LIBCMT ref: 00E025C8
___swprintf_l.LIBCMT ref: 00E02608

Strings

::%hs%u.%u.%u.%u, xrefs: 00E0249E
ffff:, xrefs: 00E0247D, 00E0249D
:%u.%u.%u.%u, xrefs: 00E025FF
::ffff:0:%u.%u.%u.%u, xrefs: 00E024DA

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: b24d21488773fec695c46f4fcaebe9abed848bb1c5fb2ec14fadf60563edd906
Instruction ID: e89c8d79301e1b5ff45effad4413cb0249cd34fb73a5a0ed80e3f5c23a183180
Opcode Fuzzy Hash: b24d21488773fec695c46f4fcaebe9abed848bb1c5fb2ec14fadf60563edd906
Instruction Fuzzy Hash: EF51E571A00645AFCB30DE5CCC9497EBBF9EB44304B14945EE6A6E76C1E674DE808B60

Function 01562FD0 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 01565EB0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,0000000C,?,00000000,?,?,?,?,015651DC,?,?,?,01564B22,?,?,?), ref: 01565D5D
Part of subcall function 01565EB0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,015651DC,?,?,?,01564B22,?,?,?,?,?), ref: 01565D64
Part of subcall function 01565EB0: PrintMessageFromModule.NETSH(00000068,?,?,015651DC,?,?,?,01564B22,?,?,?,?,?), ref: 01565E91

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 0156300B
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563012
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 01563032
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563039
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01563058
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156305F
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156307B
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563082
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 01563091
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563098

Strings

netsh, xrefs: 01562FD7

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$Free$AllocFromMessageModulePrint
String ID: netsh
API String ID: 695201130-4166728403
Opcode ID: 80d6d34339476df12b7e0a5e562097435b01e3b671a317ba98a11710beec5aa4
Instruction ID: 93fa9b1ba3eefd678991a8a6d83b8bce2f4749f1c23a9d698f8de0fc332ba677
Opcode Fuzzy Hash: 80d6d34339476df12b7e0a5e562097435b01e3b671a317ba98a11710beec5aa4
Instruction Fuzzy Hash: D1217F71620202EFDB229FA9E44DB59BBADFF44735F118419E51D8F246DB709848CBA0

Function 01568130 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5), ref: 01568153

Strings

NetshStopRefreshEvent, xrefs: 01568179

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Handle
String ID: NetshStopRefreshEvent
API String ID: 2519475695-639338441
Opcode ID: 9f8b9daf2ccf6649f3b3b088b6f914939a072ef117aac5444523111c53a045c3
Instruction ID: bed65acae4150aac3c536ac3c0bfb1856ea31bf6a423867b0ba1034906d670b1
Opcode Fuzzy Hash: 9f8b9daf2ccf6649f3b3b088b6f914939a072ef117aac5444523111c53a045c3
Instruction Fuzzy Hash: 7B311A71910215EFDB129FA4DC45BAEBBB8FF09726F110515F922EF280D77498448BA4

Function 00D87630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00DC46FC
CLIENT(ntdll): Processing section info %ws..., xrefs: 00DC4787
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00DC4725
ExecuteOptions, xrefs: 00DC46A0
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 00DC4742
Execute=1, xrefs: 00DC4713
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00DC4655

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: be35b27694306c83800a43eed78a6b3246d74321b546f3c3328b5a9dab57f7c6
Instruction ID: 90dae9b0aa987692ce78572b03781318574b96e00a9fa8f9a3a83b9796bcb6c5
Opcode Fuzzy Hash: be35b27694306c83800a43eed78a6b3246d74321b546f3c3328b5a9dab57f7c6
Instruction Fuzzy Hash: 305117356442197ADF10BBA5DC96FAE77A8EF45300F2800A9E505A72D1EB70DE45CF70

Function 01564210 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109windowCOMMON

Download Yara Rule

APIs

PrintMessageFromModule.NETSH(000000CB), ref: 01564257

Part of subcall function 01567EA0: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,?,?,00004000,?,00000000,?,?,0156471D,000000B6,?), ref: 01567ED0
Part of subcall function 01567EA0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,GetResourceString,?,0156471D,000000B6,?), ref: 01567EE2

Part of subcall function 0156412C: ConvertGuidToString.NETSH(?,?), ref: 0156417C
Part of subcall function 0156412C: PrintMessageFromModule.NETSH(000000C8,?,?), ref: 0156419F
Part of subcall function 0156412C: PrintMessageFromModule.NETSH(000000C9), ref: 015641B6
Part of subcall function 0156412C: PrintMessageFromModule.NETSH(000000CA,?), ref: 015641D3

PrintMessageFromModule.NETSH(000000CC), ref: 01564296
PrintMessage.NETSH(%1!s!,00000000), ref: 015642AB
ConvertGuidToString.NETSH(?,?), ref: 015642ED
ConvertGuidToString.NETSH(?,?), ref: 01564301
PrintMessageFromModule.NETSH(000000CD), ref: 01564315
PrintMessageFromModule.NETSH(000000CE,?,?,?), ref: 01564345

Strings

%1!s!, xrefs: 015642A6

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: MessagePrint$FromModule$String$ConvertGuid$AddressLoadProc
String ID: %1!s!
API String ID: 953968408-1485915839
Opcode ID: 3b758d465ce51508492d98335d5e63c755bbaac096796d36201f3c35063ae256
Instruction ID: 07841f98cd2b9a809094c0b27b2f8772e0b224b2cf89d4cd21912028d6f10917
Opcode Fuzzy Hash: 3b758d465ce51508492d98335d5e63c755bbaac096796d36201f3c35063ae256
Instruction Fuzzy Hash: 7531E9717002069FEB34DB68EC85F6A77EDFB94218F520129D5198F184DB30AD49DB90

Function 01563861 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90windowlibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,00000000,00000000), ref: 01563896
PrintMessageFromModule.NETSH(0000006A,?,?,00000000,00000000), ref: 015638B2
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,InitHelperDll,?,00000000,00000000), ref: 015638CA
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,00000000), ref: 015638FB
PrintMessageFromModule.NETSH(?,000003ED,InitHelperDll,?,?,00000000,00000000), ref: 015638F2

Part of subcall function 01567EA0: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,?,?,00004000,?,00000000,?,?,0156471D,000000B6,?), ref: 01567ED0
Part of subcall function 01567EA0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,GetResourceString,?,0156471D,000000B6,?), ref: 01567EE2

PrintMessageFromModule.NETSH(00000088,InitHelperDll,?,00000000,?,00000000,00000000), ref: 01563960

Part of subcall function 01563CED: _wcsicmp.MSVCRT ref: 01563D15

Strings

InitHelperDll, xrefs: 015638C4
InitHelperDll, xrefs: 015638E7, 01563950

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: FromMessageModulePrint$AddressLibraryLoadProc$FreeString_wcsicmp
String ID: InitHelperDll$InitHelperDll
API String ID: 4046571770-3952794692
Opcode ID: 85be18c9941ade2e0ac2335e714ce940d61426badd23f1c41294d40080d13c3b
Instruction ID: 61c4da552f77021e89d8dcdffb800c0765bf9cc81b80756b25f1e4d4ccc571db
Opcode Fuzzy Hash: 85be18c9941ade2e0ac2335e714ce940d61426badd23f1c41294d40080d13c3b
Instruction Fuzzy Hash: 5131F871B10701AFD7729F58EC86E3677A9FB84314B420828E81A9F295DB70AC09DB91

Function 01564F67 Relevance: 13.7, APIs: 9, Instructions: 240memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,0000000C,00000000,?,?,?,?,?,?,0156603A,00000000,?,?,?,?,?), ref: 01565057
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,0156603A,00000000,?,?,?,?,?,?,?), ref: 0156505E

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: b2028bb97b98e802968641b356625fa3035e90cea625a3a142f8492e768dc1b7
Instruction ID: 93424b3dfcd1e972896f04db904cdd8cc053631dfc12177d0f3d6e0883f45932
Opcode Fuzzy Hash: b2028bb97b98e802968641b356625fa3035e90cea625a3a142f8492e768dc1b7
Instruction Fuzzy Hash: 34712575A60212DBDB249F6CD8546BEB7E9FF446A4B444429EA85DF380FA31C842C7E0

Function 015676D4 Relevance: 13.6, APIs: 9, Instructions: 91COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,00000000,00000000,?), ref: 015676EF
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 015676F6
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?), ref: 01567711
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 01567718
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,00000001,?,00000000), ref: 0156772C
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 01567733
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?), ref: 0156778E
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 01567795
fputwc.MSVCRT ref: 015677AA

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: ConsoleHandle$Mode$Readfputwc
String ID:
API String ID: 2610215220-0
Opcode ID: cdcb9e9e08b727d5ee85f4fb0b149455e7d709a587ef9f63dda13b7880066d2c
Instruction ID: 788ccb07acd156962dbaeff5354bcaeae15933dc2a8d6d8d9dca514bef65547b
Opcode Fuzzy Hash: cdcb9e9e08b727d5ee85f4fb0b149455e7d709a587ef9f63dda13b7880066d2c
Instruction Fuzzy Hash: D121D736910106ABDB209BA8E805AAD77BCFF08338F200625E925DF1C4D67499848BA1

Function 01567FB0 Relevance: 12.1, APIs: 8, Instructions: 65memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00008000), ref: 01567FCD
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01567FD4
LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00004000), ref: 01567FEC
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000500,00000000,00000000,00000000,?,00000000,?), ref: 01568007

Part of subcall function 01567920: GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,000000B6,000000FF,00000000,00000000,00000000,00000000,0156471D,00000000,00004000,00000000,00000000,?,01567E48,?,01567F23), ref: 01567939
Part of subcall function 01567920: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567940
Part of subcall function 01567920: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 0156794A
Part of subcall function 01567920: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567951
Part of subcall function 01567920: GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,000000B6,000000FF,00000000,00000000,00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567969
Part of subcall function 01567920: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567970
Part of subcall function 01567920: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(000000B6,00000000,-00000001,0156471D,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567981
Part of subcall function 01567920: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,-00000001,0156471D,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 01567998
Part of subcall function 01567920: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679A8
Part of subcall function 01567920: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679B4
Part of subcall function 01567920: PrintError.NETSH(00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679BC
Part of subcall function 01567920: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679C5
Part of subcall function 01567920: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01567E48,?,01567F23,?,0156471D,000000B6,?), ref: 015679CC

Part of subcall function 01569CA9: __iob_func.MSVCRT ref: 01569CAE

fflush.MSVCRT ref: 01568026
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01568030
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01568037
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?), ref: 01568045

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$Free$AllocByteCharConsoleErrorFileMultiOutputWideWrite$CloseFormatHandleLastLoadLocalMessagePrintString__iob_funcfflush
String ID:
API String ID: 2883199061-0
Opcode ID: 999d4f41326284768efb5dc5347f0b962840dc179be05410e53a906d245059db
Instruction ID: 6b03313ce688af397fc6dd2bf70da863f8fea8f37bcc1f3af5cf249dcf5929dd
Opcode Fuzzy Hash: 999d4f41326284768efb5dc5347f0b962840dc179be05410e53a906d245059db
Instruction Fuzzy Hash: 01119AB2510209BFEB219FA5EC4EE9F7BACFB44275B110425BA099B240DA719D049BB0

Function 015694A3 Relevance: 10.6, APIs: 7, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0(000003E8,01569D60,0000000C), ref: 015694E0
_amsg_exit.MSVCRT ref: 015694F5
_initterm.MSVCRT ref: 01569549
__IsNonwritableInCurrentImage.LIBCMT ref: 01569575
exit.MSVCRT ref: 015695BC
_XcptFilter.MSVCRT ref: 015695CE

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: CurrentFilterImageNonwritableSleepXcpt_amsg_exit_inittermexit
String ID:
API String ID: 796493780-0
Opcode ID: 19eebf60461f576fc333860d6b40ec0277d9d9551d88347bbb6283b2fd4e008e
Instruction ID: 899225d4c01e5d78e0e4a3c786080844c1816d0dbf92014c35a09dede62a002c
Opcode Fuzzy Hash: 19eebf60461f576fc333860d6b40ec0277d9d9551d88347bbb6283b2fd4e008e
Instruction Fuzzy Hash: E0310171680312DFDB72AF28F486A2D37A8FB44778F11002DE5218F294DB358848EBD0

Function 015630D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00004008), ref: 015630E5
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015630EC
ProcessCommand.NETSH(?,?,?,netsh), ref: 01563152
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,netsh), ref: 01563165
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156316C

Strings

netsh, xrefs: 015630F8

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$AllocCommandFree
String ID: netsh
API String ID: 2704014861-4166728403
Opcode ID: a8a454b95723ac2fb3ec1e4411dabde64b2083837fbce3bc4ef2ba87ed27d1c8
Instruction ID: 95a478a73b4cf52dc0e238673d3452b5f2f60e51e1d48cb7e2343544e55a7bad
Opcode Fuzzy Hash: a8a454b95723ac2fb3ec1e4411dabde64b2083837fbce3bc4ef2ba87ed27d1c8
Instruction Fuzzy Hash: 47119372A10206EBD7219F69E809E5E7BBDBB84720F1A8019E91D9F344DB70E905C7E1

Function 015644DB Relevance: 10.1, APIs: 8, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 01564512
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,00000000,?,?,?,01564828), ref: 01564548
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01564828), ref: 0156454F
memcpy.MSVCRT ref: 0156456A
memcpy.MSVCRT ref: 0156457F
memcpy.MSVCRT ref: 015645A9
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,01564828), ref: 015645BD
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,01564828), ref: 015645C4

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$memcpy$Process$AllocFree_wcsicmp
String ID:
API String ID: 1032568189-0
Opcode ID: 07e89795480e4615d6d6480ebaf79ed301d2d349da490c329ba689c7c797b7a1
Instruction ID: 73c96ca5b6ea97f2b1414a9d730a4750e6b138e5366d74b0eb8565f363060db0
Opcode Fuzzy Hash: 07e89795480e4615d6d6480ebaf79ed301d2d349da490c329ba689c7c797b7a1
Instruction Fuzzy Hash: 5E31B172600A019FD7259F78DD8A92BBBFEFF90228705192DE257CBD90DA31F8108B50

Function 00E26940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
Instruction ID: f646360eaba9e5a5eaff200f9fef54733caa4d5c7cf9252d3d02c8bd10cc6c4d
Opcode Fuzzy Hash: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
Instruction Fuzzy Hash: B3024670608351AFC704DF28D490A6FBBE5EFC8704F149A2DF989AB265DB31E904CB52

Function 00D7F5B0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 382COMMON

Download Yara Rule

Strings

known by the service. It may be a more recent revision than the service is aware of., xrefs: 00D7F82C
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 00DC02E7
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 00DC02BD
RTL: Re-Waiting, xrefs: 00DC031E

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting$known by the service. It may be a more recent revision than the service is aware of.
API String ID: 0-797994856
Opcode ID: 8be28ca327fab01d6411c35ac8e63b18ca7a99bdbbc9f9349cc10a6c32b29e30
Instruction ID: d9b173ab1b360790daeae07c7fc90a847c15c01ae01f84d08e8bbb5ee0f54d64
Opcode Fuzzy Hash: 8be28ca327fab01d6411c35ac8e63b18ca7a99bdbbc9f9349cc10a6c32b29e30
Instruction Fuzzy Hash: EAE19F70604742DFD725CF28C885B2ABBE0FB85314F284A2DF5A9872D1E774D945CB62

Function 015632CF Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,015632C6,?,?,?,00000000,?,?), ref: 015632EC
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,015632C6,?,?,?,00000000,?,?,?,01562F69,?,?), ref: 015632F3
memcpy.MSVCRT ref: 01563309
qsort.MSVCRT ref: 0156331A
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01563350
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563357

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$AllocFreememcpyqsort
String ID:
API String ID: 3964738767-0
Opcode ID: efbd717c15f7d66bbd1f3d19781c647ac67231c2ed11da79dbf32214a9d760d8
Instruction ID: ac103606638e21c032c5bcf901d39ec47ae2de9519ce4bbd92bf8c6379b39896
Opcode Fuzzy Hash: efbd717c15f7d66bbd1f3d19781c647ac67231c2ed11da79dbf32214a9d760d8
Instruction Fuzzy Hash: 0F11C432600605FFCB619BA4D889E6EBBBCFF84324F10441DF60A9B610CA30A904DB70

Function 015633AA Relevance: 9.1, APIs: 6, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000002,?,?,?,?,?,015633A3,?,?,?,?,?,0156348F), ref: 015633C7
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,015633A3,?,?,?,?,?,0156348F,?,00000002,00000002,?,015624DD), ref: 015633CE
memcpy.MSVCRT ref: 015633E4
qsort.MSVCRT ref: 015633F5
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01563425
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156342C

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$AllocFreememcpyqsort
String ID:
API String ID: 3964738767-0
Opcode ID: cf841ad7414711a41826891ad3588bc78f26395693246d51f9295f579f55a0e9
Instruction ID: ca62a635930c6d08d52ce5335ceba623455e6ed2e2e27a81d331309dd27eb08b
Opcode Fuzzy Hash: cf841ad7414711a41826891ad3588bc78f26395693246d51f9295f579f55a0e9
Instruction Fuzzy Hash: D811A372610601ABD7615BA9EC8DA5EBBBDFB84329F111419E24B9B900DA70E840CB60

Function 01567B4B Relevance: 9.0, APIs: 6, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000044,00000000,00000000,?,?,?,01567C75,-00000001,00000000,00000000,?,015679C1,00000000,00000000), ref: 01567B61
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01567C75,-00000001,00000000,00000000,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D), ref: 01567B68
CreateWellKnownSid.API-MS-WIN-SECURITY-BASE-L1-1-0(0000001A,00000000,00000000,0156471D,?,01567C75,-00000001,00000000,00000000,?,015679C1,00000000,00000000,?,01567E48), ref: 01567B7C
CheckTokenMembership.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000000,000000B6,?,01567C75,-00000001,00000000,00000000,?,015679C1,00000000,00000000,?,01567E48,?,01567F23), ref: 01567B8C
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,01567C75,-00000001,00000000,00000000,?,015679C1,00000000,00000000,?,01567E48,?,01567F23), ref: 01567B9F
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01567C75,-00000001,00000000,00000000,?,015679C1,00000000,00000000,?,01567E48,?,01567F23,?,0156471D), ref: 01567BA6

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$AllocCheckCreateFreeKnownMembershipTokenWell
String ID:
API String ID: 2370236486-0
Opcode ID: f76ebcc7d375041c0460729199a315bdcb72a38fd413a83294ffffa87a556d9f
Instruction ID: 0bda843dd889ec9d6121fdfd5b66ba1c7f1f7a83f1f3d4f942af51e76d93db21
Opcode Fuzzy Hash: f76ebcc7d375041c0460729199a315bdcb72a38fd413a83294ffffa87a556d9f
Instruction Fuzzy Hash: E00162B2911115BBAB219FA6EC4DDEF7E7CEF86A68B010155BA14DB104E7308904E7B0

Function 01567A20 Relevance: 9.0, APIs: 6, Instructions: 46memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00008000), ref: 01567A3A
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01567A41
LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00004000), ref: 01567A59
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000500,00000000,00000000,00000000,?,00000000,?), ref: 01567A74
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01567A7C
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01567A83

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$AllocFormatFreeLoadMessageString
String ID:
API String ID: 3754540327-0
Opcode ID: 00c0002602591c5abbf101d2839367a4bf7801dbb3fff6e50d1646a28390b463
Instruction ID: ed1a78f3b71add8646705b47f5d309f3e02abc7a181df8a45577cf9092d1c052
Opcode Fuzzy Hash: 00c0002602591c5abbf101d2839367a4bf7801dbb3fff6e50d1646a28390b463
Instruction Fuzzy Hash: 85018BB6910114BBDB218BA6EC0DEDF7EBCEB85725B010015BA19DA144D6709A04DBB0

Function 01568230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationCOMMON

Download Yara Rule

APIs

SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,00000000), ref: 01568244
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?), ref: 01568250
ResetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0(?), ref: 0156825D
SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(01568060,00000000), ref: 0156826A
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 01568273
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 0156827C

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: CloseConsoleHandle$CtrlCursorEventHandlerObjectPositionResetSingleWait
String ID:
API String ID: 2461670359-0
Opcode ID: d77d50131f437d1b85b7fd1e304526699190e130edfe67405c852cfe956869c5
Instruction ID: cea98ac27b5603fc8058b553246c03499a7a83216e73d9520b1d815f945063a8
Opcode Fuzzy Hash: d77d50131f437d1b85b7fd1e304526699190e130edfe67405c852cfe956869c5
Instruction Fuzzy Hash: D6F0F971510209FFCF526F61EC09E9E3B79FB48265F158524F926CE024DB718954EBA0

Function 00D9B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00D9B6BF

Strings

0, xrefs: 00D9B66F
-, xrefs: 00D9B650
+, xrefs: 00D9B65A
0, xrefs: 00D9B695

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction ID: 5e41580318014abc4bd1117c30c8cbd937b9eda234108fa770ea6ed13e98a1bf
Opcode Fuzzy Hash: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction Fuzzy Hash: 8F81A370E052499EDF24CEA8EA917FEBBB5AF85330F1E425BD851AB291C7349840C771

Function 00E020E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00E0214F
___swprintf_l.LIBCMT ref: 00E02172

Strings

]:%u, xrefs: 00E02169
%%%u, xrefs: 00E02146
[, xrefs: 00E0212B

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$[$]:%u
API String ID: 48624451-2819853543
Opcode ID: 02bef10e69b1e300b5188e6ceb71481926fbf7ab91e8876932365f389b800387
Instruction ID: 06b2ed22e752b3dcabf21b55a0bdc0be7b99c65619ea38c790557797879e5044
Opcode Fuzzy Hash: 02bef10e69b1e300b5188e6ceb71481926fbf7ab91e8876932365f389b800387
Instruction Fuzzy Hash: 89216076A01119ABCB10DF79CC45AFEBBF8EF54744F04012AEA05E3241EB30DA458BB1

Function 01563612 Relevance: 7.6, APIs: 6, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 01563695
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156369C
memcpy.MSVCRT ref: 015636B2
memcpy.MSVCRT ref: 015636D5
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 015636E7
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015636EE

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Processmemcpy$AllocFree
String ID:
API String ID: 1904491526-0
Opcode ID: 629dcf54d7bb96cdd3185aab6d494a87dc0991d1efa55c252c083999a071ee94
Instruction ID: 740b876f13632074f9e41c73c81efcafa5df133c87d40d22e59be16e1b350ee3
Opcode Fuzzy Hash: 629dcf54d7bb96cdd3185aab6d494a87dc0991d1efa55c252c083999a071ee94
Instruction Fuzzy Hash: 8221F8F1A00112AFDB50DF68FC4AA5DBBACFB44674B064065E819EF244D730EE04EBA0

Function 01562249 Relevance: 7.6, APIs: 6, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 015622CF
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015622D6
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 015622E1
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015622E8
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 015622F1
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015622F8

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: a0634e16c93fa095d5063b7a53e4e5efaf05681f1961983d7843ec8fab4bede3
Instruction ID: f68a93e6215ac0d263b465c88214cd36affb788d319363d16c2a0fbe1dea6ab6
Opcode Fuzzy Hash: a0634e16c93fa095d5063b7a53e4e5efaf05681f1961983d7843ec8fab4bede3
Instruction Fuzzy Hash: 80212E71710102EFDB115FA8D849B79B7B9FF89735F148454E6098F245D7309845CBA0

Function 0156443D Relevance: 7.6, APIs: 6, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,00000000,01563604), ref: 01564470
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,01563604), ref: 01564477
memcpy.MSVCRT ref: 0156448E
memcpy.MSVCRT ref: 015644B0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,01563604), ref: 015644C0
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,01563604), ref: 015644C7

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Processmemcpy$AllocFree
String ID:
API String ID: 1904491526-0
Opcode ID: 67573d1544b8393692fdbc5e9c131c249c4cd694a69251b604f4b7a8c2f9e0ff
Instruction ID: 1abe232cdc0c969f1715b050b41854cdabd98f3534fbf6d1074dc56c4a6e9615
Opcode Fuzzy Hash: 67573d1544b8393692fdbc5e9c131c249c4cd694a69251b604f4b7a8c2f9e0ff
Instruction Fuzzy Hash: 30110432210602AFD3289B74DD9AA2BF7ADFB84221B45591DE257CF990DA70F4008B60

Function 0156809E Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?), ref: 015680BE
FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,00000020,?,?,?), ref: 015680DA
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?), ref: 015680E5
FillConsoleOutputAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?), ref: 01568104
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?), ref: 0156810E

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Console$BufferFillInfoOutputScreen$AttributeCharacterCursorPosition
String ID:
API String ID: 2018928815-0
Opcode ID: 07ec5ba2ec3482d7423706e41bef60850a6dddebeaf31b0ae2ce449541593ad0
Instruction ID: 95cf83122665e6cbe951570f78b75da665283298a8468b344f7e26ed865b35bc
Opcode Fuzzy Hash: 07ec5ba2ec3482d7423706e41bef60850a6dddebeaf31b0ae2ce449541593ad0
Instruction Fuzzy Hash: A0110972910129AF8F12DFA5D949DFFBBBCFB49614B01001AF911F6100D7389909EB71

Function 00D8BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00DC7B7F
RTL: Resource at %p, xrefs: 00DC7B8E
RTL: Re-Waiting, xrefs: 00DC7BAC

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: 8257d740a266ef8b6851536985c8a7cef2b84cee41e3a8cba30d7df620a3679f
Instruction ID: 1eb8360af4e4c8807a20b8e51dcfaf8c111e1ce9020effaa694cf6e6f3cb73b4
Opcode Fuzzy Hash: 8257d740a266ef8b6851536985c8a7cef2b84cee41e3a8cba30d7df620a3679f
Instruction Fuzzy Hash: FB41E2357047029FC721EE25CC41B6AB7E5EF88720F140A2EF996DB281DB31E8058BB1

Function 01562DE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123windowCOMMON

Download Yara Rule

APIs

PrintMessage.NETSH(%1!s!,?), ref: 01562F05

Part of subcall function 01567241: _wcsicmp.MSVCRT ref: 01567267
Part of subcall function 01567241: _wcsicmp.MSVCRT ref: 01567287
Part of subcall function 01567241: _wcsicmp.MSVCRT ref: 015672B0

PrintMessageFromModule.NETSH(00000065), ref: 01562E37

Part of subcall function 01567EA0: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,?,?,00004000,?,00000000,?,?,0156471D,000000B6,?), ref: 01567ED0
Part of subcall function 01567EA0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,GetResourceString,?,0156471D,000000B6,?), ref: 01567EE2

PrintMessageFromModule.NETSH(00000064,?), ref: 01562F1A

Strings

%1!s!, xrefs: 01562F00

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: MessagePrint_wcsicmp$FromModule$AddressLoadProcString
String ID: %1!s!
API String ID: 3716039470-1485915839
Opcode ID: 2f6ea197613e495ba6a8bc9a29b109ae02ad53ffcb9d9c39d6f15f56851f067b
Instruction ID: ccf25841f68005d3d5cacf1bfe1a2c7c3932a3f93b689271ad142f81b25c96d5
Opcode Fuzzy Hash: 2f6ea197613e495ba6a8bc9a29b109ae02ad53ffcb9d9c39d6f15f56851f067b
Instruction Fuzzy Hash: 8C41243560011A8FCB21EF64DC91AAEB37AFF94310F1181A9DB0A6F254CB31AD54CBD9

Function 00D8B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DC728C

Strings

RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 00DC7294
RTL: Resource at %p, xrefs: 00DC72A3
RTL: Re-Waiting, xrefs: 00DC72C1

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: b511b6fd750fc25fc145e0993ddb6b45413d23af22368944110f941c9a1fdfc4
Instruction ID: 8394f9681d5e97a2ff9fdafd07df3399c0a6a84b8961069a5842a3c6c50c8266
Opcode Fuzzy Hash: b511b6fd750fc25fc145e0993ddb6b45413d23af22368944110f941c9a1fdfc4
Instruction Fuzzy Hash: 6B41F231704613ABC720DE25CC42F66B7A5FB54724F18061AF895EB281DB20E8069BF5

Function 00E02300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00E0238D
___swprintf_l.LIBCMT ref: 00E023B3

Strings

]:%u, xrefs: 00E023AA
%%%u, xrefs: 00E02384

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: ef6ff55984bc854589c8ea3269a5e5234823ac86234fe4b8c3ba555b7640d256
Instruction ID: ce7620057b5d0db99bb326cbb06a6b07957a3a53f488efa8bb9e2ef1f82ce5e9
Opcode Fuzzy Hash: ef6ff55984bc854589c8ea3269a5e5234823ac86234fe4b8c3ba555b7640d256
Instruction Fuzzy Hash: F2318672A002199FCB20DF29CC45BEEB7F8EB54714F445559E949E3281EB349E858FA0

Function 01568BE5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,System\CurrentControlSet\Services\RemoteAccess\Parameters,MultiTenancyEnabled,00000018,00000000,00000000,00000004), ref: 01568C30
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000), ref: 01568C52

Strings

MultiTenancyEnabled, xrefs: 01568C23
System\CurrentControlSet\Services\RemoteAccess\Parameters, xrefs: 01568C28

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: CloseValue
String ID: MultiTenancyEnabled$System\CurrentControlSet\Services\RemoteAccess\Parameters
API String ID: 3132538880-1071825540
Opcode ID: d6cad0ca300f7735eced3e3d7afcec5430b9dbf2c3716ec8158c78b1f8a7a259
Instruction ID: 76d75dae8e24ab14d84ca4d072041aaa99beb2cf538f2d3c2075d4809576e9f8
Opcode Fuzzy Hash: d6cad0ca300f7735eced3e3d7afcec5430b9dbf2c3716ec8158c78b1f8a7a259
Instruction Fuzzy Hash: CE014B71901218FBDB228B95E90ABDEBBB8FB04366F114164E911AA244D7708B5CEBD0

Function 01564380 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40windowCOMMON

Download Yara Rule

APIs

MatchToken.NETSH(?,help), ref: 0156439F

Part of subcall function 01567690: _wcsnicmp.MSVCRT ref: 015676BC

MatchToken.NETSH(?,015612B0,?,help), ref: 015643B0

Part of subcall function 01563B75: _wcsicmp.MSVCRT ref: 01563BA6
Part of subcall function 01563B75: RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,SOFTWARE\Microsoft\NetSh,00000000,STRING,00000000,000F003F,00000000,?,00000000), ref: 01563BE3
Part of subcall function 01563B75: _wcsdup.MSVCRT ref: 01563BF4
Part of subcall function 01563B75: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 01563C07

PrintMessageFromModule.NETSH(00000068,?,015612B0,?,help), ref: 015643CE

Part of subcall function 01567EA0: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,?,?,00004000,?,00000000,?,?,0156471D,000000B6,?), ref: 01567ED0
Part of subcall function 01567EA0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,GetResourceString,?,0156471D,000000B6,?), ref: 01567EE2

Strings

help, xrefs: 01564397

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: MatchToken$AddressCloseCreateFromLoadMessageModulePrintProcString_wcsdup_wcsicmp_wcsnicmp
String ID: help
API String ID: 611077269-143088812
Opcode ID: 502917dd1d7752505ca799359846dcf651abf31111e5b3aef123cfb4f7c7cd19
Instruction ID: 37bf6deac9e7671cb9f4e2ae1ef311f1e6b417fb6fd5ce6856b214060ace49e7
Opcode Fuzzy Hash: 502917dd1d7752505ca799359846dcf651abf31111e5b3aef123cfb4f7c7cd19
Instruction Fuzzy Hash: 91F04936300617AA9A126E9DA945D3E376DFB94224F004026F900DF150EB21EC61C7D2

Function 01568060 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

OpenEventW.API-MS-WIN-CORE-SYNCH-L1-1-0(001F0003,00000000,NetshStopRefreshEvent), ref: 01568078
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000), ref: 01568085
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 0156808C

Strings

NetshStopRefreshEvent, xrefs: 0156806C

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Event$CloseHandleOpen
String ID: NetshStopRefreshEvent
API String ID: 1560313832-639338441
Opcode ID: 5ee12e9c8e396d4ab8f3abd5489015d6c4a959fa22840ed28ea578cf43868297
Instruction ID: 47f1a55f9adab72547e2d6cb72d83e5e0a9aae82faa6c9d900574359d389066c
Opcode Fuzzy Hash: 5ee12e9c8e396d4ab8f3abd5489015d6c4a959fa22840ed28ea578cf43868297
Instruction Fuzzy Hash: 43E0C232591B24ABDB3266767C0EFAF7A9CAB48736F024424F729EF140CA70841582F4

Function 015634FC Relevance: 6.3, APIs: 5, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?), ref: 01563522
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563529
memcpy.MSVCRT ref: 01563548
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0156358E
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01563595

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$AllocFreememcpy
String ID:
API String ID: 3405790324-0
Opcode ID: d06dbd015da1cd08c42469fcc78f50be9e07c25b46d3852ff21140b42b18e8e6
Instruction ID: fac22a34efd301d10a5c00bd4335214b7f1db7035b19f025422c1f4c361d8c98
Opcode Fuzzy Hash: d06dbd015da1cd08c42469fcc78f50be9e07c25b46d3852ff21140b42b18e8e6
Instruction Fuzzy Hash: B8110BF1800105EFCB51CF64E80A959BBF9FB44324B024055EC18DF244D770E908EF90

Function 0156412C Relevance: 6.1, APIs: 4, Instructions: 72windowCOMMON

Download Yara Rule

APIs

ConvertGuidToString.NETSH(?,?), ref: 0156417C
PrintMessageFromModule.NETSH(000000C8,?,?), ref: 0156419F

Part of subcall function 01567EA0: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,?,?,00004000,?,00000000,?,?,0156471D,000000B6,?), ref: 01567ED0
Part of subcall function 01567EA0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,GetResourceString,?,0156471D,000000B6,?), ref: 01567EE2

PrintMessageFromModule.NETSH(000000C9), ref: 015641B6
PrintMessageFromModule.NETSH(000000CA,?), ref: 015641D3

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: FromMessageModulePrint$String$AddressConvertGuidLoadProc
String ID:
API String ID: 2510173387-0
Opcode ID: 37030f197afaac29ebc6c757f92958de38e556a3aecdcfcec85d5e6912839458
Instruction ID: 805009ec8aa8189d7986e65845223f15227ecc414637fed137aa934392e8acea
Opcode Fuzzy Hash: 37030f197afaac29ebc6c757f92958de38e556a3aecdcfcec85d5e6912839458
Instruction Fuzzy Hash: 64218072A0020ADFDB18DF64DC81CAEB7BDFBA4314B114129D919AF255EB31AD46CBC0

Function 0156694A Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

_wfopen.MSVCRT ref: 01566969
PrintMessageFromModule.NETSH(0000006C,?,?,?,?,01562514), ref: 01566980

Part of subcall function 01567EA0: LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,?,?,00004000,?,00000000,?,?,0156471D,000000B6,?), ref: 01567ED0
Part of subcall function 01567EA0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,GetResourceString,?,0156471D,000000B6,?), ref: 01567EE2

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 01566988
fclose.MSVCRT ref: 015669B7

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: AddressErrorFromLastLoadMessageModulePrintProcString_wfopenfclose
String ID:
API String ID: 2254135562-0
Opcode ID: 495b0b6a2950c0df7290e18b91f444530493aaa97bd774678804256e1b4b2727
Instruction ID: a427673b0d1ef76eecccac01587aee1e118e3a7cccd36549e6c817b16b5fed43
Opcode Fuzzy Hash: 495b0b6a2950c0df7290e18b91f444530493aaa97bd774678804256e1b4b2727
Instruction Fuzzy Hash: E501A7B2E00211ABD720DB6EF80585ABBEDF785674706402FF515DF208EB709D04ABD0

Function 01567F40 Relevance: 6.0, APIs: 4, Instructions: 38windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000900,?,?,00000000,?,00000000,?), ref: 01567F68
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 01567F74
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5), ref: 01567F7E
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000), ref: 01567F97

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: ErrorFormatFreeHandleLastLocalMessage
String ID:
API String ID: 1910557688-0
Opcode ID: 433ac53dd7f6b499c3ddf3b729994e0ac45ddcab5ce3fef7124a8219f25a06ce
Instruction ID: 7a70ee37c317981335324a4c84e8e1fd6c08fe4f5f28256d91c9cc92a60cb671
Opcode Fuzzy Hash: 433ac53dd7f6b499c3ddf3b729994e0ac45ddcab5ce3fef7124a8219f25a06ce
Instruction Fuzzy Hash: FEF03175910118FFDF169B94E809DEE7BBDFB48224F114255F92297240E7709F44DBA0

Function 01569400 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 015699B8: GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 015699BF

__set_app_type.MSVCRT ref: 01569412
__p__fmode.MSVCRT ref: 01569428
__p__commode.MSVCRT ref: 01569436
__setusermatherr.MSVCRT ref: 01569457

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: c00765f416064b1474cfa8d4d23b08f3321ccf9e893ff38eec4e61602cb0fd07
Instruction ID: cf70e429b3c6e2bb85968b2787085c5e5955868644fb52ba22803a4a1fc3c472
Opcode Fuzzy Hash: c00765f416064b1474cfa8d4d23b08f3321ccf9e893ff38eec4e61602cb0fd07
Instruction Fuzzy Hash: 4DF0D4B05083439FC7786F70B44E5483BA8F79433AB12061DD4728F2D8CB7A8059EB60

Function 00D97D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00D97E8B

Strings

-, xrefs: 00D97DDD
+, xrefs: 00D97DE8

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction ID: 81de4468c5a3e97719ca50edf6af0132c44021d3603fd50f94d9db8b8bd236ab
Opcode Fuzzy Hash: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction Fuzzy Hash: 20919070E1821A9BDF24DF69C881ABEB7A5EF44720F68465AF855E72C0EB30DD409770

Function 00D59126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

@, xrefs: 00D59175
$, xrefs: 00D59191

Memory Dump Source

Source File: 00000006.00000002.4141713015.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000006.00000002.4141713015.0000000000E49000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000E4D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.4141713015.0000000000EBE000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_netsh.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: 37f37fdd7124950a745e4215b847fd39ee0cbf7ac737b0f48f61bfee29ac03a7
Instruction ID: 2a53435ed3d7c2bac5e800c7b2d00d7a03d05e894b8dcf4202e690d7d70c6735
Opcode Fuzzy Hash: 37f37fdd7124950a745e4215b847fd39ee0cbf7ac737b0f48f61bfee29ac03a7
Instruction Fuzzy Hash: E1811C76D00269DBDB31CB54CC55BEEB7B4AB09750F0441DAA91AB7280D7709E85CFB0

Function 01567EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,?,?,00004000,?,00000000,?,?,0156471D,000000B6,?), ref: 01567ED0
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(0156471D,GetResourceString,?,0156471D,000000B6,?), ref: 01567EE2

Strings

GetResourceString, xrefs: 01567EDC

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: AddressLoadProcString
String ID: GetResourceString
API String ID: 2390443819-1598891890
Opcode ID: 0244da047c18d1797c12ea91a8fdc83080894952c15a7687ae0edee93119d8c8
Instruction ID: f0e5388707e86eee2144c3b6b3f05d7044c210776e51439c0ebf1243bcbbabdf
Opcode Fuzzy Hash: 0244da047c18d1797c12ea91a8fdc83080894952c15a7687ae0edee93119d8c8
Instruction Fuzzy Hash: 1701C83560011D9BDB219F18DC40DAEB7BDFB94664F0181A5E915EB204EE30DD088FD0

Function 01564CC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01564CDC
RegisterContext.NETSH(?), ref: 01564D22

Part of subcall function 015645E0: wcschr.MSVCRT ref: 01564620
Part of subcall function 015645E0: wcschr.MSVCRT ref: 01564635
Part of subcall function 015645E0: wcschr.MSVCRT ref: 01564675
Part of subcall function 015645E0: wcschr.MSVCRT ref: 01564685
Part of subcall function 015645E0: PrintMessageFromModule.NETSH(000000B5,?), ref: 0156469E

Strings

netsh, xrefs: 01564CE1

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: wcschr$ContextFromMessageModulePrintRegistermemset
String ID: netsh
API String ID: 1453721150-4166728403
Opcode ID: 44cf3ccde5ffc4cb8e9abd59e952806de65391085250b2c0cd615a2c625fa125
Instruction ID: 920cfc9e8828ded8730f8de8375a926506d13aee8c257b163b70aee410b45c09
Opcode Fuzzy Hash: 44cf3ccde5ffc4cb8e9abd59e952806de65391085250b2c0cd615a2c625fa125
Instruction Fuzzy Hash: BF0119B1E002199BCB10DF95C848BDEBBF8BB95318F104419D814AF240D7B55A0ACBA9

Function 015651C6 Relevance: 5.1, APIs: 4, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 01565EB0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,0000000C,?,00000000,?,?,?,?,015651DC,?,?,?,01564B22,?,?,?), ref: 01565D5D
Part of subcall function 01565EB0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,015651DC,?,?,?,01564B22,?,?,?,?,?), ref: 01565D64
Part of subcall function 01565EB0: PrintMessageFromModule.NETSH(00000068,?,?,015651DC,?,?,?,01564B22,?,?,?,?,?), ref: 01565E91

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,00000000,?,?,?,?,01564B22,?,?,?,?,?), ref: 0156525B
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01564B22,?,?,?,?,?), ref: 01565262
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,?,?,?,?,01564B22,?,?,?,?,?), ref: 01565286
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01564B22,?,?,?,?,?), ref: 0156528D

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$Process$Alloc$FreeFromMessageModulePrint
String ID:
API String ID: 206731548-0
Opcode ID: bf09bf30c3fecbe1a841659cacbacc67038bb166555aca7d8457eeff52ee932c
Instruction ID: a2b91806fd3b148b0ad253c215020c651318c041913f18b347c4ee7338bf35e3
Opcode Fuzzy Hash: bf09bf30c3fecbe1a841659cacbacc67038bb166555aca7d8457eeff52ee932c
Instruction Fuzzy Hash: DC31D8316602029BCB259FA8C4846AEB7E9FF44394B588518F90ADF201F731E945C7D0

Function 015652BD Relevance: 5.1, APIs: 4, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,?,?,01564EFC,?,00000001,?,?,015684AB,00000000,?,?), ref: 015652ED
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01564EFC,?,00000001,?,?,015684AB,00000000,?,?,?,01564CB5,?,00000002,?), ref: 015652F4
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,01564EFC,?,00000001,?,?,015684AB,00000000,?), ref: 0156533C
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,01564EFC,?,00000001,?,?,015684AB,00000000,?,?,?,01564CB5,?,00000002,?), ref: 01565343

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: b281bf8372cd506c0d9155db83cb3f63765e8e4bc11365ef5cdaddda0f1255a6
Instruction ID: 23832820c302f777321bfb30f09595748b0b640a41d451e8bc3e888e179cf104
Opcode Fuzzy Hash: b281bf8372cd506c0d9155db83cb3f63765e8e4bc11365ef5cdaddda0f1255a6
Instruction Fuzzy Hash: 40210236750101DBCB269F6DDC498ABB7ACFF846503594929ED0ACB204F671AD06CBA0

Function 01566706 Relevance: 5.1, APIs: 4, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000001,00000000,?,?,00000003), ref: 0156673C
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01566743
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000001,00000000,?,?,00000003), ref: 0156674F
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01566756

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 631cff4eda95c2459fb754251c44db7641b9b8c66f01203d7e5b70c3fa332863
Instruction ID: da4270bead903f881f7c13dc9ccee59e8a7b6b890002de6a32cfc13e19d673c9
Opcode Fuzzy Hash: 631cff4eda95c2459fb754251c44db7641b9b8c66f01203d7e5b70c3fa332863
Instruction Fuzzy Hash: 8611A336600215AFCB219F68D44DB8E7BADFB85365F114529F515CF294EA74AC0487A0

Function 015623BB Relevance: 5.0, APIs: 4, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015623E4
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 015623EB
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 015623FA
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 01562401

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: a184ae0f57a6df1372452554e995cd8a509d656b3a9c35ffdee4aa0f69c0a172
Instruction ID: 0e92385aeb28a91595724fd956908a9ae94167363f91be526afb59fc857ff859
Opcode Fuzzy Hash: a184ae0f57a6df1372452554e995cd8a509d656b3a9c35ffdee4aa0f69c0a172
Instruction Fuzzy Hash: 9EF0C272A211109BD7324F6AE80DA6A7A2DBF41735F168019F45D8F281C3309842DBE0

Function 01565A64 Relevance: 5.0, APIs: 4, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,01565B32,?,?,00000000,?,01565D0B,?), ref: 01565A78
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,01565B32,?,?,00000000,?,01565D0B,?), ref: 01565A7F
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,01565B32,?,?,00000000,?,01565D0B,?), ref: 01565A8D
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,01565B32,?,?,00000000,?,01565D0B,?), ref: 01565A94

Memory Dump Source

Source File: 00000006.00000002.4142384381.0000000001560000.00000040.80000000.00040000.00000000.sdmp, Offset: 01560000, based on PE: true

Associated: 00000006.00000002.4142384381.0000000001579000.00000040.80000000.00040000.00000000.sdmpDownload File
Associated: 00000006.00000002.4142450745.000000000157C000.00000040.80000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1560000_netsh.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 9ab7804b407131e4aa6af31156c48982408ecc334eaa29226ea040a2c0b7473a
Instruction ID: e2071918d1a62a1c726fab2ae7fcf62933fc553888e1854b4b618f98981ac662
Opcode Fuzzy Hash: 9ab7804b407131e4aa6af31156c48982408ecc334eaa29226ea040a2c0b7473a
Instruction Fuzzy Hash: C6E08673630222ABD7211AF9788DF8BAE5DEBC4677F020025F71DDA044CAB144099BB0

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8tvMmyxveyzFcnJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8tvMmyxveyzFcnJ.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
8tvMmyxveyzFcnJ.exe

Function 0749D410 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0749D40A Relevance: 1.7, APIs: 1, Instructions: 242
processCOMMON

Function 0297B130 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Function 050C0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 029744B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0297590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0749D180 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON