Edit tour

Windows Analysis Report
an_api.exe

Overview

General Information

Sample name:	an_api.exe
Analysis ID:	1526423
MD5:	d8b47bd38c34fc553ec5765b5297db5d
SHA1:	514bef950e36a998fac74c506d1d8123a778dac3
SHA256:	59fe7e6e026da28b275c1fa65ac6f2bb0712793903fe1b77cbe148c15df0c927
Tags:	exeuser-aachum
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Drops large PE files

Injects a PE file into a foreign processes

Sigma detected: Explorer NOUACCHECK Flag

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

an_api.exe (PID: 3644 cmdline: "C:\Users\user\Desktop\an_api.exe" MD5: D8B47BD38C34FC553EC5765B5297DB5D)

csc.exe (PID: 7148 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

explorer.exe (PID: 4676 cmdline: "C:\Windows\explorer.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)

cvtres.exe (PID: 6696 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" P61I1O 193.142.146.64 8000 O4U27X MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

conhost.exe (PID: 7136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 4932 cmdline: C:\Windows\explorer.exe /NoUACCheck MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Sigma Signatures

System Summary

Sigma detected: Explorer NOUACCHECK Flag

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\explorer.exe /NoUACCheck, CommandLine: C:\Windows\explorer.exe /NoUACCheck, CommandLine|base64offset|contains: y, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Windows\explorer.exe /NoUACCheck, ProcessId: 4932, ProcessName: explorer.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\an_api.exe, ProcessId: 3644, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OcuulusUpdater

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: an_api.exe	ReversingLabs: Detection: 44%
Source: an_api.exe	Virustotal: Detection: 57%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source: an_api.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source:

Binary string: C:\Users\LapTop\Desktop\DLL\obj\Debug\DLL.pdb source: csc.exe, 00000002.00000002.1623463170.00000000068D1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.3318711703.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	2_2_04D87478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then jmp 04D83700h	2_2_04D833BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then push dword ptr [ebp-24h]	2_2_04D87EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	2_2_04D87EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	2_2_04D876EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then push dword ptr [ebp-24h]	2_2_04D87EE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	2_2_04D87EE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then xor edx, edx	2_2_04D87E1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then xor edx, edx	2_2_04D87E28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then push dword ptr [ebp-20h]	2_2_04D87BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	2_2_04D87BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then push dword ptr [ebp-20h]	2_2_04D87BC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	2_2_04D87BC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-4Ch]	7_2_02739AFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4x nop then mov ecx, dword ptr [ebp+0Ch]	7_2_02732390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4x nop then mov ecx, dword ptr [ebp+0Ch]	7_2_02732398
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4x nop then mov ecx, dword ptr [ebp+0Ch]	7_2_027324B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-4Ch]	7_2_0273AA33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-4Ch]	7_2_0273A9F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-4Ch]	7_2_0273A9BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-4Ch]	7_2_02739AEF

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.142.146.64:8000

Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64

Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://ascstats.iobit.com/usage.phpU
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: EyesUpdater.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://piriform.com/go/app_cc_license_agreement
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://piriform.com/go/app_cc_privacy_policy
Source: cvtres.exe, 00000007.00000002.3320106410.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: an_api.exe, EyesUpdater.exe.0.dr	String found in binary or memory: http://www.piriform.com/ccleaner

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 2_2_04D83728 CreateDesktopW,

2_2_04D83728

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\an_api.exe

File dump: EyesUpdater.exe.0.dr 976635604

Jump to dropped file

Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042FF22 NtQueryDefaultLocale,	0_2_0042FF22
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00430170 NtQueryDefaultLocale,	0_2_00430170
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0043017F NtQueryDefaultLocale,	0_2_0043017F
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042F919 NtQueryDefaultLocale,	0_2_0042F919
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042FA0F NtQueryDefaultLocale,	0_2_0042FA0F
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042FADD NtQueryDefaultLocale,	0_2_0042FADD
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042F6BC NtQueryDefaultLocale,	0_2_0042F6BC

Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00426056	0_2_00426056
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00436C58	0_2_00436C58
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424C73	0_2_00424C73
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424C00	0_2_00424C00
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00435030	0_2_00435030
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0043243A	0_2_0043243A
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004304C6	0_2_004304C6
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004324E7	0_2_004324E7
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00433080	0_2_00433080
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004354BD	0_2_004354BD
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00433146	0_2_00433146
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042FD6C	0_2_0042FD6C
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00425512	0_2_00425512
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004255CD	0_2_004255CD
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00433192	0_2_00433192
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00425990	0_2_00425990
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00426194	0_2_00426194
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004331A5	0_2_004331A5
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004369A4	0_2_004369A4
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042F1AD	0_2_0042F1AD
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042824E	0_2_0042824E
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424E53	0_2_00424E53
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00425A24	0_2_00425A24
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00428229	0_2_00428229
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042523A	0_2_0042523A
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00425EC5	0_2_00425EC5
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424ED0	0_2_00424ED0
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424AD4	0_2_00424AD4
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424ADA	0_2_00424ADA
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004252EA	0_2_004252EA
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424EF5	0_2_00424EF5
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00425289	0_2_00425289
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004252AE	0_2_004252AE
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00433AAC	0_2_00433AAC
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424EB3	0_2_00424EB3
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042F6BC	0_2_0042F6BC
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424B49	0_2_00424B49
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424B4E	0_2_00424B4E
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00425F67	0_2_00425F67
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00432B7C	0_2_00432B7C
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00427F12	0_2_00427F12
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424F15	0_2_00424F15
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00425320	0_2_00425320
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424733	0_2_00424733
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00433332	0_2_00433332
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424731	0_2_00424731
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424F3B	0_2_00424F3B
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004253CE	0_2_004253CE
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424FDE	0_2_00424FDE
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424BEF	0_2_00424BEF
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004253F8	0_2_004253F8
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424F87	0_2_00424F87
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042538D	0_2_0042538D
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424B90	0_2_00424B90
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424BA9	0_2_00424BA9
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424FB9	0_2_00424FB9
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073BD86	0_2_0073BD86
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073FAEF	0_2_0073FAEF
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073F83A	0_2_0073F83A
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00740438	0_2_00740438
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00740819	0_2_00740819
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073B809	0_2_0073B809
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0074000A	0_2_0074000A
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073F0F1	0_2_0073F0F1
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073C0DB	0_2_0073C0DB
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073C4C6	0_2_0073C4C6
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007404CB	0_2_007404CB
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007404B8	0_2_007404B8
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073B09C	0_2_0073B09C
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00740887	0_2_00740887
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00740977	0_2_00740977
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073C16A	0_2_0073C16A
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073F56C	0_2_0073F56C
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073B94E	0_2_0073B94E
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073ED39	0_2_0073ED39
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073D126	0_2_0073D126
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00740D0A	0_2_00740D0A
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073F9F2	0_2_0073F9F2
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073EDFE	0_2_0073EDFE
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007401EA	0_2_007401EA
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073EDDB	0_2_0073EDDB
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007401C9	0_2_007401C9
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007401A7	0_2_007401A7
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007401A0	0_2_007401A0
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007405AC	0_2_007405AC
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073ED86	0_2_0073ED86
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0074098E	0_2_0074098E
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073EE71	0_2_0073EE71
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073FA75	0_2_0073FA75
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00740652	0_2_00740652
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073FA5E	0_2_0073FA5E
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073EE5C	0_2_0073EE5C
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073B644	0_2_0073B644
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073FE4C	0_2_0073FE4C
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073FE33	0_2_0073FE33
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073B604	0_2_0073B604
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073C6FC	0_2_0073C6FC
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007406E8	0_2_007406E8
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073C2C6	0_2_0073C2C6
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007406A5	0_2_007406A5
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00740292	0_2_00740292
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073EA98	0_2_0073EA98
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073FA8D	0_2_0073FA8D
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073B68C	0_2_0073B68C
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073B766	0_2_0073B766
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073FF54	0_2_0073FF54
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073EB32	0_2_0073EB32
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073B72E	0_2_0073B72E
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073EB1B	0_2_0073EB1B
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073B707	0_2_0073B707
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073FF06	0_2_0073FF06
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00740702	0_2_00740702
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073EBFF	0_2_0073EBFF
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073C3E8	0_2_0073C3E8
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073B7D1	0_2_0073B7D1
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073FFC2	0_2_0073FFC2
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073EFC6	0_2_0073EFC6
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073C3A1	0_2_0073C3A1
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073F3A1	0_2_0073F3A1
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073BBAA	0_2_0073BBAA
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073C39B	0_2_0073C39B
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0073FF9C	0_2_0073FF9C
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00747867	0_2_00747867
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0074A03B	0_2_0074A03B
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0074717D	0_2_0074717D
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00749DBE	0_2_00749DBE
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0074858B	0_2_0074858B
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00749E60	0_2_00749E60
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00749E59	0_2_00749E59
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0074764F	0_2_0074764F
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00749F55	0_2_00749F55
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0074833E	0_2_0074833E
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00750056	0_2_00750056
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0075006E	0_2_0075006E
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007500CD	0_2_007500CD
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007735D1	0_2_007735D1
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0077EE47	0_2_0077EE47
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00784BD7	0_2_00784BD7
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0077E079	0_2_0077E079
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0077D868	0_2_0077D868
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0078545B	0_2_0078545B
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0077EC4C	0_2_0077EC4C
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00786021	0_2_00786021
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00777414	0_2_00777414
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00787806	0_2_00787806
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007894CF	0_2_007894CF
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007884A6	0_2_007884A6
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00785887	0_2_00785887
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00787912	0_2_00787912
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007759F7	0_2_007759F7
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0077D9F2	0_2_0077D9F2
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007755CA	0_2_007755CA
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00774DBE	0_2_00774DBE
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00785188	0_2_00785188
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00786E5F	0_2_00786E5F
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0076423C	0_2_0076423C
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0075F623	0_2_0075F623
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0078861D	0_2_0078861D
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007632E2	0_2_007632E2
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0077DAE1	0_2_0077DAE1
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00764ADC	0_2_00764ADC
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00773EDB	0_2_00773EDB
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0077E2B2	0_2_0077E2B2
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007872AC	0_2_007872AC
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007856A0	0_2_007856A0
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00772A9F	0_2_00772A9F
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0075F29A	0_2_0075F29A
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00787E81	0_2_00787E81
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00784377	0_2_00784377
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00785313	0_2_00785313
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00776F06	0_2_00776F06
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00789B04	0_2_00789B04
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00787B04	0_2_00787B04
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00787FF9	0_2_00787FF9
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00774BF2	0_2_00774BF2
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007727EA	0_2_007727EA
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00786BDE	0_2_00786BDE
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00787F91	0_2_00787F91
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00785383	0_2_00785383
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00790020	0_2_00790020
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007ACCF5	0_2_007ACCF5
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007AB894	0_2_007AB894
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007A5C82	0_2_007A5C82
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007AB874	0_2_007AB874
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0079006D	0_2_0079006D
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00790060	0_2_00790060
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007A3836	0_2_007A3836
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007A44D5	0_2_007A44D5
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007AACA1	0_2_007AACA1
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007A5559	0_2_007A5559
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007A3128	0_2_007A3128
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007AD12C	0_2_007AD12C
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007ABD24	0_2_007ABD24
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007901DE	0_2_007901DE
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00790D9A	0_2_00790D9A
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007B8662	0_2_007B8662
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007A5247	0_2_007A5247
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007AB616	0_2_007AB616
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007A4EE1	0_2_007A4EE1
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007A5AB6	0_2_007A5AB6
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00790291	0_2_00790291
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007A3291	0_2_007A3291
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00790285	0_2_00790285
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007A5376	0_2_007A5376
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007B7FE8	0_2_007B7FE8
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007A2FE7	0_2_007A2FE7
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_007A3BD0	0_2_007A3BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_04D8A160	2_2_04D8A160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_04D80C50	2_2_04D80C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_04D8ABA0	2_2_04D8ABA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_04D8D5E8	2_2_04D8D5E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_04D8B0F8	2_2_04D8B0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_04D83F98	2_2_04D83F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_04D88AB0	2_2_04D88AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_04D88AA1	2_2_04D88AA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_04D83F88	2_2_04D83F88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_0273A0B8	7_2_0273A0B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_0273A0A7	7_2_0273A0A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_0273F878	7_2_0273F878

Source: an_api.exe, 00000000.00000000.1448812423.00000000006C0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameScreenShot.exe, vs an_api.exe
Source: an_api.exe, 00000000.00000002.1656328707.0000000002432000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePHVNC.exe, vs an_api.exe
Source: an_api.exe, 00000000.00000002.1655444562.0000000000724000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameScreenShot.exe, vs an_api.exe
Source: an_api.exe, 00000000.00000002.1655444562.0000000000724000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePHVNC.exe, vs an_api.exe
Source: an_api.exe	Binary or memory string: OriginalFilenameScreenShot.exe, vs an_api.exe

Source: an_api.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 2.2.csc.exe.68f5888.2.raw.unpack, HVNC.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.2.csc.exe.68f5888.2.raw.unpack, HVNC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.2.csc.exe.68e57ec.1.raw.unpack, HVNC.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.2.csc.exe.68e57ec.1.raw.unpack, HVNC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal80.evad.winEXE@9/3@0/1

Source: C:\Users\user\Desktop\an_api.exe

File created: C:\Users\user\Music\OcoulsUpdater

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Mutant created: \Sessions\1\BaseNamedObjects\O4U27X
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7136:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: C:\Windows\explorer.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\an_api.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: an_api.exe	ReversingLabs: Detection: 44%
Source: an_api.exe	Virustotal: Detection: 57%

Source: C:\Users\user\Desktop\an_api.exe

File read: C:\Users\user\Desktop\an_api.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\an_api.exe "C:\Users\user\Desktop\an_api.exe"
Source: C:\Users\user\Desktop\an_api.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /NoUACCheck
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" P61I1O 193.142.146.64 8000 O4U27X
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\an_api.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" P61I1O 193.142.146.64 8000 O4U27X	Jump to behavior

Source: C:\Users\user\Desktop\an_api.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\an_api.exe	Section loaded: k7rn7l32.dll	Jump to behavior
Source: C:\Users\user\Desktop\an_api.exe	Section loaded: ntd3ll.dll	Jump to behavior
Source: C:\Users\user\Desktop\an_api.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\an_api.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswb7.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.search.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: userenv.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: an_api.exe

Static file information: File size 3604856 > 1048576

Source: an_api.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x2a9200

Source:

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.an_api.exe.724afa.0.raw.unpack, RunPE.cs

.Net Code: Run4 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\an_api.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\an_api.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"			Jump to behavior

Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00435E2B push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00428053 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00426056 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042AC5B push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424C73 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00425802 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00424C00 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00425809 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042A81B push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00426032 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004304C6 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004258C7 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004308D5 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004280D9 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042A8FB push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042A891 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042849C push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042A8A7 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00434CAC push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004308B4 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042A942 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042615E push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042A90A push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00425512 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00428120 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042A12C push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_00428139 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004255CD push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042A9DA push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_004361F1 push esp; retf 0000h	0_2_00436825
Source: C:\Users\user\Desktop\an_api.exe	Code function: 0_2_0042A5F5 push esp; retf 0000h	0_2_00436825

Source: C:\Users\user\Desktop\an_api.exe

File created: C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe

Jump to dropped file

Source: C:\Users\user\Desktop\an_api.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OcuulusUpdater			Jump to behavior
Source: C:\Users\user\Desktop\an_api.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OcuulusUpdater			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 4D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 68D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 88D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: 28F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: 48F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\an_api.exe

Dropped PE file which has not been started: C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe

Jump to dropped file

Source: C:\Users\user\Desktop\an_api.exe

API coverage: 5.8 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 5700	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 3160	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 3160	Thread sleep time: -50000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: cvtres.exe, 00000007.00000002.3319029869.0000000000B48000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\an_api.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.an_api.exe.724afa.0.raw.unpack, RunPE.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 0.2.an_api.exe.724afa.0.raw.unpack, RunPE.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 0.2.an_api.exe.724afa.0.raw.unpack, RunPE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: 0.2.an_api.exe.724afa.0.raw.unpack, RunPE.cs	Reference to suspicious API methods: VirtualAllocEx(processInformation.ProcessHandle, num2, length, 12288, 64)
Source: 0.2.an_api.exe.724afa.0.raw.unpack, RunPE.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num4, data, bufferSize, ref bytesRead)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\an_api.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 2D0000 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\an_api.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 2D0000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\an_api.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 2D0000	Jump to behavior
Source: C:\Users\user\Desktop\an_api.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 47BF008	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 402000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 412000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 414000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 601008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" P61I1O 193.142.146.64 8000 O4U27X

Jump to behavior

Source: csc.exe, 00000002.00000002.1623463170.00000000068D1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.3318711703.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: Shell_TrayWnd

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: cvtres.exe, 00000007.00000002.3319029869.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Create Account	312 Process Injection	1 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
an_api.exe	45%	ReversingLabs	Win32.Trojan.Midie
an_api.exe	58%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://piriform.com/go/app_cc_privacy_policy	0%	Virustotal		Browse
http://piriform.com/go/app_cc_license_agreement	0%	Virustotal		Browse
http://www.piriform.com/ccleaner	0%	Virustotal		Browse
http://ascstats.iobit.com/usage.phpU	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://piriform.com/go/app_cc_privacy_policy	an_api.exe, EyesUpdater.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://ascstats.iobit.com/usage.phpU	an_api.exe, EyesUpdater.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://www.piriform.com/ccleaner	an_api.exe, EyesUpdater.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://piriform.com/go/app_cc_license_agreement	an_api.exe, EyesUpdater.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	cvtres.exe, 00000007.00000002.3320106410.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.142.146.64	unknown	Netherlands		208046	HOSTSLICK-GERMANYNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526423
Start date and time:	2024-10-05 16:48:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	an_api.exe
Detection:	MAL
Classification:	mal80.evad.winEXE@9/3@0/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 88% Number of executed functions: 216 Number of non-executed functions: 54
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target cvtres.exe, PID 6696 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:51:09	API Interceptor	34x Sleep call for process: cvtres.exe modified
16:49:35	Task Scheduler	Run new task: CreateExplorerShellUnelevatedTask path: C:\Windows\explorer.exe s>/NoUACCheck
16:49:44	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run OcuulusUpdater C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe
16:49:53	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run OcuulusUpdater C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.142.146.64	licarisan_api.exe	Get hash	malicious	Icarus	Browse
	build.exe	Get hash	malicious	Unknown	Browse
	Form-8879_PDF.jar	Get hash	malicious	Unknown	Browse
	Form-8879_PDF.jar	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTSLICK-GERMANYNL	licarisan_api.exe	Get hash	malicious	Icarus	Browse	193.142.146.64
	build.exe	Get hash	malicious	Unknown	Browse	193.142.146.64
	ub16vsLP6y.zip	Get hash	malicious	Remcos	Browse	193.142.146.203
	ISehgzqm2V.zip	Get hash	malicious	Remcos	Browse	193.142.146.203
	Form-8879_PDF.jar	Get hash	malicious	Unknown	Browse	193.142.146.64
	Form-8879_PDF.jar	Get hash	malicious	Unknown	Browse	193.142.146.64
	bot_library.exe	Get hash	malicious	Unknown	Browse	193.142.146.43
	SecuriteInfo.com.ELF.Mirai-CQT.17542.12898.elf	Get hash	malicious	Mirai	Browse	193.142.146.10
	arm7.elf	Get hash	malicious	Unknown	Browse	193.142.146.10

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	706
Entropy (8bit):	5.349842958726647
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTArkvoDLI4MWuCq1KDLI4M9XKbbDLI4MWuPJKAVKhk:MLU84qpE4KiE4Kx1qE4qXKDE4KhKiKhk
MD5:	86CF233CE16FF4D7540CDC53D0B313FF
SHA1:	6968C0B0D1C109D59A72C821AF75A012BB4EDC9E
SHA-256:	F2F3CD07D8D9BED11E44314A9A8E4A835A98B7E627AE7C4666A9B6E37D8D8521
SHA-512:	FA6BF1A4841AFC9C97323F90E9A96CA5DD3ACBB5D7224A77853B8E8FFCB260BA374969CC94A58D30CEA7A0D43D0EEC8AEBD616CA8D6B5E5F6B584BBB9BB93F3F
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Roaming\temp0923

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	10
Entropy (8bit):	2.446439344671015
Encrypted:	false
SSDEEP:	3:MKV/z:MKBz
MD5:	E27D47991851642F9EDCBA5827441DD5
SHA1:	D2D3C1B59CDE8CA587E7AF6AA565D0B3A6AD69AB
SHA-256:	0736DC7C3FEFD085EC17D24EF7BE290E4447B87A1196397DD3203D7C19EEACED
SHA-512:	BEA4525CFC84C6C666628810723D2A28A2184AEC4F16F8F189425A2D669F62B5F89B00B5035D3B38A94629CF5B0EA5F3A4FD2B224A69C19B4450636AE9989205
Malicious:	false
Reputation:	low
Preview:	10/05/2024

C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe

Download File

Process:	C:\Users\user\Desktop\an_api.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	976635604
Entropy (8bit):	0.05263770084266713
Encrypted:	false
SSDEEP:
MD5:	BEC213FE01EBDFBB381B2F51BAF82A52
SHA1:	6D2CC91D29645FCCBB075C2F19D6CAB71FAB269F
SHA-256:	03AA9197CEC1ABDC26538D9E3141FD48B75FA2A32F1AB49FE8E6F894F7E7571E
SHA-512:	BE5BC63FCF8C04392F1396F4198E8CE517B75EEB9EDB45A970DF7BFAD5F364199EFF7CF2FF041525DEB84AE5D1586DE95EA977677A3CAD7CC4878E7A62162E07
Malicious:	false
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...m.$a......................,...................@...........................;.......7..........@...............................=......F............6.xO...`...............................P......................d................................text............................... ..`.itext.............................. ..`.data....@.......@..................@....bss.....................................idata...@.......>..................@....tls.........@...........................rdata.......P......................@..@.rsrc...F........*.. ..............@..@.....................................................@......................@..@................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.8033875458884285
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	an_api.exe
File size:	3'604'856 bytes
MD5:	d8b47bd38c34fc553ec5765b5297db5d
SHA1:	514bef950e36a998fac74c506d1d8123a778dac3
SHA256:	59fe7e6e026da28b275c1fa65ac6f2bb0712793903fe1b77cbe148c15df0c927
SHA512:	b8f630c43031b1dff4ae68afadebd6691cacf05148c6d21247fc06cbfd569eda100e371cf4f32dbb8a1a1e0fc7fdc16890a121e08e75e1519c115e66ba9940b5
SSDEEP:	49152:gVMxgUgoJUcaqCDxdITcP2MNoSPhaC+1R7JDO95n5c:gV7UgoJUBZgoP2MNBajv8955c
TLSH:	BDF57C51E211D80ED02A2678C077CDF17622AD38D4748713BEAE7C777B75BA01A1CAE6
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	3b71d48cc8c86907

Static PE Info

General

Entrypoint:	0x4aac88
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x6124A66D [Tue Aug 24 07:57:33 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	33e003ddaff3bc71480e8cb946f52917

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 004A98E4h
call 00007FB8F0B2D089h
call 00007FB8F0BD52ACh
mov eax, dword ptr [004F2830h]
mov eax, dword ptr [eax]
call 00007FB8F0B322BCh
mov eax, dword ptr [004F2830h]
mov eax, dword ptr [eax]
mov dl, 01h
call 00007FB8F0B322FEh
mov ecx, dword ptr [004AED4Ch]
mov eax, dword ptr [004F2830h]
mov eax, dword ptr [eax]
mov edx, dword ptr [004A9528h]
call 00007FB8F0B3229Eh
mov eax, dword ptr [004F2830h]
mov eax, dword ptr [eax]
call 00007FB8F0B3229Ah
call 00007FB8F0B2CCEDh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf0000	0x13dee	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x110000	0x2a9046	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x36b600	0x4f78	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x106000	0x95f8	.rdata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x105000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf1f64	0x1a00	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa9000	0xa8e00	b6345467ee85dd7097ee84ae3eaaf44d	False	0.4634761287934863	data	6.6366006981501595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xaa000	0x1000	0xe00	47f13ebf2c1d7f5f845d183af3921c70	False	0.533203125	data	5.726454537490657	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xab000	0x4000	0x4000	50b772b21b84466c3b21a7e6d5fd0748	False	0.48486328125	DOS executable (block device driver)	5.33588059365472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xaf000	0x41000	0x41000	513135b4c6487bca867d615455634c4d	False	0.6882662259615384	data	7.410467622829767	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xf0000	0x14000	0x13e00	a6fdfc22de58e230668e6140af18f713	False	0.20748575078616352	data	5.442044496747251	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x104000	0x1000	0x1000	23a516eee44fe9d482d78f4329d3baa2	False	0.392822265625	data	4.09924522772341	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x105000	0xb000	0x200	7630f45a6a5af0e127c28e46ae9ee2bb	False	0.05078125	data	0.18415065608732903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x110000	0x2a9046	0x2a9200	aa0435b87b899984986e67aae0721676	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MAD	0x11529c	0x14	data			1.25
MAD	0x1152b0	0x10ea4	data			1.0004474337509381
PNG	0x126154	0x269b	PNG image data, 340 x 205, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9596276434281089
PNG	0x1287f0	0x2248	PNG image data, 340 x 205, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9644484958979034
PNG	0x12aa38	0x1915	PNG image data, 340 x 205, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9484503971344027
PNG	0x12c350	0x2114	PNG image data, 340 x 205, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9636277751535192
PNG	0x12e464	0x18f	PNG image data, 19 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0275689223057645
PNG	0x12e5f4	0x238	PNG image data, 19 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0193661971830985
PNG	0x12e82c	0x5059	PNG image data, 205 x 45, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.996159268802567
PNG	0x133888	0x219	PNG image data, 19 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0204841713221602
PNG	0x133aa4	0x258	PNG image data, 19 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0183333333333333
PNG	0x133cfc	0x203	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0155339805825243
PNG	0x133f00	0x358	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0128504672897196
PNG	0x134258	0x153	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9911504424778761
PNG	0x1343ac	0x34a	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.013064133016627
PNG	0x1346f8	0x2c6	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0154929577464789
PNG	0x1349c0	0x114e	PNG image data, 49 x 46, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0024830699774265
PNG	0x135b10	0x18a8	PNG image data, 61 x 57, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.001742712294043
PNG	0x1373b8	0x1e62	PNG image data, 73 x 69, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.001414245307277
PNG	0x13921c	0x30a5	PNG image data, 98 x 92, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.000883321288043
PNG	0x13c2c4	0x475d	PNG image data, 122 x 115, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0008758005364278
PNG	0x140a24	0x6328	PNG image data, 206 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.44425622439331863
PNG	0x146d4c	0x608	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0071243523316062
PNG	0x147354	0x801	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0053684724255734
PNG	0x147b58	0x782	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.005723204994797
PNG	0x1482dc	0x7c3	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0055359838953195
PNG	0x148aa0	0x3f16	PNG image data, 490 x 270, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9763467492260062
PNG	0x14c9b8	0x7b96	PNG image data, 205 x 257, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9983564068525191
PNG	0x154550	0x27fe	PNG image data, 768 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9854463762453605
PNG	0x156d50	0x13d	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.003154574132492
PNG	0x156e90	0x167	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0139275766016713
PNG	0x156ff8	0x182	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0129533678756477
PNG	0x15717c	0x197	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0171990171990173
PNG	0x157314	0x213	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0207156308851224
PNG	0x157528	0x1ff	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0215264187866928
PNG	0x157728	0x268	PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0178571428571428
PNG	0x157990	0x2ba	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.015759312320917
PNG	0x157c4c	0x41d	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0104463437796771
PNG	0x15806c	0x4fb	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.008627450980392
PNG	0x158568	0x6b0	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0064252336448598
PNG	0x158c18	0x896	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0050045495905369
PNG	0x1594b0	0x21e	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0018450184501846
PNG	0x1596d0	0x253	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0033613445378151
PNG	0x159924	0x275	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8712241653418124
PNG	0x159b9c	0x39e	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8704103671706264
PNG	0x159f3c	0x286	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0170278637770898
PNG	0x15a1c4	0x2ef	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.014647137150466
PNG	0x15a4b4	0x3ee	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9701789264413518
PNG	0x15a8a4	0x4d2	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9619124797406807
PNG	0x15ad78	0x410	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.010576923076923
PNG	0x15b188	0x51c	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0084097859327217
PNG	0x15b6a4	0x6d1	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0063037249283668
PNG	0x15bd78	0x832	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0052430886558628
PNG	0x15c5ac	0x3a9	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0117395944503735
PNG	0x15c958	0x43d	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0101382488479262
PNG	0x15cd98	0x5bb	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0074982958418541
PNG	0x15d354	0x71c	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.006043956043956
PNG	0x15da70	0x1f4	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.022
PNG	0x15dc64	0x266	PNG image data, 23 x 23, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.017915309446254
PNG	0x15decc	0x2c9	PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0154277699859748
PNG	0x15e198	0x386	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0121951219512195
PNG	0x15e520	0x470	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0096830985915493
PNG	0x15e990	0x10d	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x15eaa0	0x1ef	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0121212121212122
PNG	0x15ec90	0x1ba	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9932126696832579
PNG	0x15ee4c	0x165	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7675070028011205
PNG	0x15efb4	0x20b	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8107074569789675
PNG	0x15f1c0	0x10d	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x15f2d0	0x1e0	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0041666666666667
PNG	0x15f4b0	0x17d	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.979002624671916
PNG	0x15f630	0x165	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7703081232492998
PNG	0x15f798	0x20e	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8098859315589354
PNG	0x15f9a8	0xf3	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9794238683127572
PNG	0x15fa9c	0xfa	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.948
PNG	0x15fb98	0x119	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9466192170818505
PNG	0x15fcb4	0x14b	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7190332326283988
PNG	0x15fe00	0x17e	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6544502617801047
PNG	0x15ff80	0xef	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9832635983263598
PNG	0x160070	0xfe	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9803149606299213
PNG	0x160170	0x11a	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9680851063829787
PNG	0x16028c	0x14f	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7194029850746269
PNG	0x1603dc	0x181	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6311688311688312
PNG	0x160560	0x105	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9693486590038314
PNG	0x160668	0x115	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x160780	0x122	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9896551724137931
PNG	0x1608a4	0x16c	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8159340659340659
PNG	0x160a10	0x1a1	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7553956834532374
PNG	0x160bb4	0x103	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.972972972972973
PNG	0x160cb8	0x118	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.975
PNG	0x160dd0	0x126	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9285714285714286
PNG	0x160ef8	0x16f	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8092643051771117
PNG	0x161068	0x1a5	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7505938242280285
PNG	0x161210	0xde	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9234234234234234
PNG	0x1612f0	0xe9	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9313304721030042
PNG	0x1613dc	0xf0	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.875
PNG	0x1614cc	0x138	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6538461538461539
PNG	0x161604	0x16a	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.5994475138121547
PNG	0x161770	0xdc	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9090909090909091
PNG	0x16184c	0xe8	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9353448275862069
PNG	0x161934	0xf2	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9132231404958677
PNG	0x161a28	0x13d	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6624605678233438
PNG	0x161b68	0x16f	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6103542234332425
PNG	0x161cd8	0x1b7	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0250569476082005
PNG	0x161e90	0x21c	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0203703703703704
PNG	0x1620ac	0x279	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0173775671406002
PNG	0x162328	0x310	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0140306122448979
PNG	0x162638	0x3bc	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0115062761506277
PNG	0x1629f4	0x386	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0121951219512195
PNG	0x162d7c	0x4c2	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0090311986863711
PNG	0x163240	0x665	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0067196090409285
PNG	0x1638a8	0x998	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0044788273615635
PNG	0x164240	0xd0f	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.003290457672749
PNG	0x164f50	0x2b0	PNG image data, 32 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0159883720930232
PNG	0x165200	0x3c5	PNG image data, 42 x 21, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.01139896373057
PNG	0x1655c8	0x4a3	PNG image data, 52 x 26, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0092670598146587
PNG	0x165a6c	0x5d7	PNG image data, 63 x 31, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0073578595317725
PNG	0x166044	0x715	PNG image data, 84 x 42, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0060672917815774
PNG	0x16675c	0x5e2	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0073041168658698
PNG	0x166d40	0x6f5	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0061763054463784
PNG	0x167438	0x7cb	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0055137844611528
PNG	0x167c04	0xa5f	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0041431261770244
PNG	0x168664	0xcfa	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9993979530403372
PNG	0x169360	0x7c6	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0055276381909548
PNG	0x169b28	0x7a2	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0056294779938588
PNG	0x16a2cc	0xa9e	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.004047093451067
PNG	0x16ad6c	0x11ec	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0023975588491718
PNG	0x16bf58	0x176e	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.001833944648216
PNG	0x16d6c8	0x823	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0052808449351895
PNG	0x16deec	0xa2c	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0042242703533026
PNG	0x16e918	0xc07	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0035725885027607
PNG	0x16f520	0x102f	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0026550808592807
PNG	0x170550	0x125f	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.002338932596215
PNG	0x1717b0	0x6b6	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0064027939464493
PNG	0x171e68	0x8b7	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0049305244285074
PNG	0x172720	0xafc	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0039118065433854
PNG	0x17321c	0x110e	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0025194686211636
PNG	0x17432c	0x146a	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9980864906238041
PNG	0x175798	0x109	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0075471698113208
PNG	0x1758a4	0x464	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7135231316725978
PNG	0x175d08	0x462	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7112299465240641
PNG	0x17616c	0x479	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7170305676855895
PNG	0x1765e8	0x4b9	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7377998345740281
PNG	0x176aa4	0x6dc	PNG image data, 24 x 23, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.00626423690205
PNG	0x177180	0x939	PNG image data, 30 x 29, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0046590427784836
PNG	0x177abc	0xb1f	PNG image data, 36 x 34, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0038637161924833
PNG	0x1785dc	0x1151	PNG image data, 48 x 46, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0024813895781637
PNG	0x179730	0x17be	PNG image data, 60 x 57, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0018098058571898
PNG	0x17aef0	0x7a9	PNG image data, 68 x 22, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0056093829678736
PNG	0x17b69c	0x122	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.006896551724138
PNG	0x17b7c0	0x103	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0038610038610039
PNG	0x17b8c4	0x146	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0153374233128833
PNG	0x17ba0c	0x134	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0064935064935066
PNG	0x17bb40	0x164	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0196629213483146
PNG	0x17bca4	0x1c6	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.024229074889868
PNG	0x17be6c	0x21d	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0203327171903882
PNG	0x17c08c	0x26f	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0176565008025682
PNG	0x17c2fc	0x2f4	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0145502645502646
PNG	0x17c5f0	0x3ad	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0116896918172158
PNG	0x17c9a0	0x1524	PNG image data, 64 x 60, 8-bit/color RGB, non-interlaced	English	Great Britain	1.0020325203252032
PNG	0x17dec4	0x1d78	PNG image data, 80 x 75, 8-bit/color RGB, non-interlaced	English	Great Britain	1.001458112407211
PNG	0x17fc3c	0x27c8	PNG image data, 96 x 90, 8-bit/color RGB, non-interlaced	English	Great Britain	1.0010801256873527
PNG	0x182404	0x3a7a	PNG image data, 128 x 120, 8-bit/color RGB, non-interlaced	English	Great Britain	1.0007348029392118
PNG	0x185e80	0x51f4	PNG image data, 160 x 150, 8-bit/color RGB, non-interlaced	English	Great Britain	1.0007626310772164
PNG	0x18b074	0x3946	PNG image data, 120 x 113, 8-bit/color RGB, non-interlaced	English	Great Britain	1.0007502387123175
PNG	0x18e9bc	0x4aad	PNG image data, 150 x 141, 8-bit/color RGB, non-interlaced	English	Great Britain	1.000836951404509
PNG	0x19346c	0x6301	PNG image data, 180 x 169, 8-bit/color RGB, non-interlaced	English	Great Britain	1.000631288222529
PNG	0x199770	0xaa7b	PNG image data, 240 x 226, 8-bit/color RGB, non-interlaced	English	Great Britain	1.000481176821025
PNG	0x1a41ec	0xcc64	PNG image data, 300 x 282, 8-bit/color RGB, non-interlaced	English	Great Britain	1.000496903906429
PNG	0x1b0e50	0x107f	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0026047833293867
PNG	0x1b1ed0	0x157d	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.00199963642974
PNG	0x1b3450	0x1dc2	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0014439485429247
PNG	0x1b5214	0x2fac	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0009013438216978
PNG	0x1b81c0	0x432c	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0009304489416144
PNG	0x1bc4ec	0x102	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9922480620155039
PNG	0x1bc5f0	0x1b6	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9908675799086758
PNG	0x1bc7a8	0x16c	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9752747252747253
PNG	0x1bc914	0x170	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.779891304347826
PNG	0x1bca84	0x201	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8031189083820662
PNG	0x1bcc88	0xf6	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9959349593495935
PNG	0x1bcd80	0xff	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.984313725490196
PNG	0x1bce80	0x118	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9714285714285714
PNG	0x1bcf98	0x14f	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7253731343283583
PNG	0x1bd0e8	0x182	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6373056994818653
PNG	0x1bd26c	0xdd	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9140271493212669
PNG	0x1bd34c	0xe9	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9356223175965666
PNG	0x1bd438	0xf3	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9135802469135802
PNG	0x1bd52c	0x13e	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6666666666666666
PNG	0x1bd66c	0x16f	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.6076294277929155
PNG	0x1bd7dc	0x112	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9817518248175182
PNG	0x1bd8f0	0x119	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9786476868327402
PNG	0x1bda0c	0x127	PNG image data, 60 x 48, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9322033898305084
PNG	0x1bdb34	0x170	PNG image data, 80 x 64, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8097826086956522
PNG	0x1bdca4	0x1a6	PNG image data, 100 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7535545023696683
PNG	0x1bde4c	0xc6	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9949494949494949
PNG	0x1bdf14	0xfd	PNG image data, 11 x 10, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1be014	0x121	PNG image data, 13 x 12, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0069204152249136
PNG	0x1be138	0xed	PNG image data, 18 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1be228	0x115	PNG image data, 22 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1be340	0xc5	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9898477157360406
PNG	0x1be408	0xfa	PNG image data, 11 x 10, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.004
PNG	0x1be504	0xdd	PNG image data, 13 x 12, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9547511312217195
PNG	0x1be5e4	0x14a	PNG image data, 18 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.009090909090909
PNG	0x1be730	0x128	PNG image data, 22 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.010135135135135
PNG	0x1be858	0xc0	PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.984375
PNG	0x1be918	0xcb	PNG image data, 10 x 11, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9852216748768473
PNG	0x1be9e4	0x116	PNG image data, 12 x 13, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0071942446043165
PNG	0x1beafc	0xeb	PNG image data, 16 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9957446808510638
PNG	0x1bebe8	0x11b	PNG image data, 20 x 22, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1bed04	0xbe	PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9894736842105263
PNG	0x1bedc4	0xd0	PNG image data, 10 x 11, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9711538461538461
PNG	0x1bee94	0xdc	PNG image data, 12 x 13, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.990909090909091
PNG	0x1bef70	0xe8	PNG image data, 16 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1bf058	0xff	PNG image data, 20 x 22, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1bf158	0xbc	PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9893617021276596
PNG	0x1bf214	0xcb	PNG image data, 10 x 11, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9802955665024631
PNG	0x1bf2e0	0x112	PNG image data, 12 x 13, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9598540145985401
PNG	0x1bf3f4	0xef	PNG image data, 16 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1bf4e4	0x119	PNG image data, 20 x 22, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1bf600	0xbf	PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9842931937172775
PNG	0x1bf6c0	0xcf	PNG image data, 10 x 11, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9855072463768116
PNG	0x1bf790	0xde	PNG image data, 12 x 13, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9954954954954955
PNG	0x1bf870	0xec	PNG image data, 16 x 18, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9957627118644068
PNG	0x1bf95c	0xfa	PNG image data, 20 x 22, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1bfa58	0xbe	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9947368421052631
PNG	0x1bfb18	0xc8	PNG image data, 11 x 10, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.99
PNG	0x1bfbe0	0xbda3	PNG image data, 13 x 12, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7202916761076894
PNG	0x1cb984	0xe8	PNG image data, 18 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9956896551724138
PNG	0x1cba6c	0x109	PNG image data, 22 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1cbb78	0xce	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1cbc48	0xca	PNG image data, 11 x 10, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9851485148514851
PNG	0x1cbd14	0xf6	PNG image data, 13 x 12, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9959349593495935
PNG	0x1cbe0c	0xee	PNG image data, 18 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9957983193277311
PNG	0x1cbefc	0xbf71	PNG image data, 22 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.7202146544512232
PNG	0x1d7e70	0x12d	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0066445182724253
PNG	0x1d7fa0	0x13a	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0095541401273886
PNG	0x1d80dc	0x161	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0113314447592068
PNG	0x1d8240	0x18a	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0203045685279188
PNG	0x1d83cc	0x1ca	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0240174672489082
PNG	0x1d8598	0xff	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1d8698	0x11b	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0035335689045937
PNG	0x1d87b4	0x135	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0161812297734627
PNG	0x1d88ec	0x160	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0113636363636365
PNG	0x1d8a4c	0x18c	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0176767676767677
PNG	0x1d8bd8	0x4f5	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0086682427107958
PNG	0x1d90d0	0x2b8	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0158045977011494
PNG	0x1d9388	0x42b	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0103092783505154
PNG	0x1d97b4	0x3d7	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0111902339776195
PNG	0x1d9b8c	0xf6	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0040650406504066
PNG	0x1d9c84	0xcd	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0
PNG	0x1d9d54	0x10c	PNG image data, 40 x 32, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0223880597014925
PNG	0x1d9e60	0x240	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0190972222222223
PNG	0x1da0a0	0x27d	PNG image data, 26 x 21, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0172684458398744
PNG	0x1da320	0x39c	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0119047619047619
PNG	0x1da6bc	0x717	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8429752066115702
PNG	0x1dadd4	0x7e5	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8629391390400791
PNG	0x1db5bc	0x937	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8817295464179737
PNG	0x1dbef4	0xa5e	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8862094951017332
PNG	0x1dc954	0x4a5	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0092514718250631
PNG	0x1dcdfc	0x7f5	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8689248895434463
PNG	0x1dd5f4	0x8f0	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8837412587412588
PNG	0x1ddee4	0xabf	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9051254089422028
PNG	0x1de9a4	0xcb7	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9182795698924732
PNG	0x1df65c	0x438	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.010185185185185
PNG	0x1dfa94	0x7af	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8566344687341129
PNG	0x1e0244	0x87f	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8726436781609196
PNG	0x1e0ac4	0xa53	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8974650018917897
PNG	0x1e1518	0xc5f	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9153773287022419
PNG	0x1e2178	0x796	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.005664263645726
PNG	0x1e2910	0xbee	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9119187950229207
PNG	0x1e3500	0xda8	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9236270022883295
PNG	0x1e42a8	0x114b	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9405918229049017
PNG	0x1e53f4	0x14d6	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9514435695538058
PNG	0x1e68cc	0x7fa	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8653281096963761
PNG	0x1e70c8	0x8e2	PNG image data, 62 x 62, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8768689533861038
PNG	0x1e79ac	0xa08	PNG image data, 75 x 75, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8921339563862928
PNG	0x1e83b4	0xc4f	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9139955569660425
PNG	0x1e9004	0xf37	PNG image data, 125 x 125, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9324775353016688
PNG	0x1e9f3c	0x325	PNG image data, 32 x 16, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.013664596273292
PNG	0x1ea264	0x472	PNG image data, 42 x 21, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0096660808435853
PNG	0x1ea6d8	0x55f	PNG image data, 52 x 26, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.008
PNG	0x1eac38	0x6ae	PNG image data, 63 x 31, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0064327485380118
PNG	0x1eb2e8	0x8f3	PNG image data, 84 x 42, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0048013967699694
PNG	0x1ebbdc	0x9ba	PNG image data, 37 x 47, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.004417670682731
PNG	0x1ec598	0x34d	PNG image data, 126 x 14, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.01301775147929
PNG	0x1ec8e8	0xa99	PNG image data, 157 x 17, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0040545521562845
PNG	0x1ed384	0xc30	PNG image data, 189 x 21, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.003525641025641
PNG	0x1edfb4	0xe60	PNG image data, 252 x 28, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0029891304347827
PNG	0x1eee14	0x1506	PNG image data, 315 x 35, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0020438498699369
PNG	0x1f031c	0xbbe	PNG image data, 37 x 47, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.0036593479707252
RT_BITMAP	0x1f0edc	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096			0.41392649903288203
RT_BITMAP	0x1f1f04	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.2161654135338346
RT_BITMAP	0x1f232c	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5018796992481203
RT_BITMAP	0x1f2754	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.3167293233082707
RT_BITMAP	0x1f2b7c	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096			0.5548839458413927
RT_BITMAP	0x1f3ba4	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5582706766917294
RT_BITMAP	0x1f3fcc	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.48402255639097747
RT_BITMAP	0x1f43f4	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.5469924812030075
RT_BITMAP	0x1f481c	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.4906015037593985
RT_BITMAP	0x1f4c44	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096			0.3034332688588008
RT_BITMAP	0x1f5c6c	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024			0.48872180451127817
RT_BITMAP	0x1f6094	0x6804	Device independent bitmap graphic, 391 x 17 x 32, image size 26588, resolution 3582 x 3582 px/m	English	Great Britain	0.2400105152471083
RT_BITMAP	0x1fc898	0x5c28	Device independent bitmap graphic, 368 x 16 x 32, image size 23552, resolution 3700 x 3700 px/m	English	Great Britain	0.2527975584944049
RT_BITMAP	0x2024c0	0x8fe8	Device independent bitmap graphic, 460 x 20 x 32, image size 36800, resolution 3503 x 3503 px/m	English	Great Britain	0.2719326818675353
RT_BITMAP	0x20b4a8	0xcf28	Device independent bitmap graphic, 552 x 24 x 32, image size 52992, resolution 3543 x 3543 px/m	English	Great Britain	0.23167144365666012
RT_BITMAP	0x2183d0	0x17028	Device independent bitmap graphic, 736 x 32 x 32, image size 94208, resolution 3543 x 3543 px/m	English	Great Britain	0.1775528393175452
RT_BITMAP	0x22f3f8	0x23f28	Device independent bitmap graphic, 920 x 40 x 32, image size 147200, resolution 3503 x 3503 px/m	English	Great Britain	0.14206058136375985
RT_BITMAP	0x253320	0x9ea4	Device independent bitmap graphic, 483 x 21 x 32, image size 40572, resolution 3582 x 3582 px/m	English	Great Britain	0.2606618733379297
RT_BITMAP	0x25d1c4	0xe0c4	Device independent bitmap graphic, 575 x 25 x 32, image size 57500, resolution 3503 x 3503 px/m	English	Great Britain	0.21746611053180395
RT_BITMAP	0x26b288	0x19f98	Device independent bitmap graphic, 782 x 34 x 32, image size 106352, resolution 3543 x 3543 px/m	English	Great Britain	0.16091435446274155
RT_BITMAP	0x285220	0x27a18	Device independent bitmap graphic, 966 x 42 x 32, image size 162288, resolution 3582 x 3582 px/m	English	Great Britain	0.13048272633187127
RT_BITMAP	0x2acc38	0x2028	Device independent bitmap graphic, 128 x 16 x 32, image size 8192, resolution 3700 x 3700 px/m	English	Great Britain	0.04652575315840622
RT_BITMAP	0x2aec60	0x3228	Device independent bitmap graphic, 160 x 20 x 32, image size 12800, resolution 3700 x 3700 px/m	English	Great Britain	0.07842679127725857
RT_BITMAP	0x2b1e88	0x4828	Device independent bitmap graphic, 192 x 24 x 32, image size 18432, resolution 3661 x 3661 px/m	English	Great Britain	0.056463837158943264
RT_BITMAP	0x2b66b0	0x8028	Device independent bitmap graphic, 256 x 32 x 32, image size 32768, resolution 3661 x 3661 px/m	English	Great Britain	0.0326749573274811
RT_BITMAP	0x2be6d8	0xc828	Device independent bitmap graphic, 320 x 40 x 32, image size 51200, resolution 3661 x 3661 px/m	English	Great Britain	0.03266978922716628
RT_BITMAP	0x2caf00	0xab8	Device independent bitmap graphic, 52 x 13 x 32, image size 2704, resolution 2795 x 2795 px/m	English	Great Britain	0.1271865889212828
RT_BITMAP	0x2cb9b8	0x1028	Device independent bitmap graphic, 64 x 16 x 32, image size 4096, resolution 3622 x 3622 px/m	English	Great Britain	0.1071083172147002
RT_BITMAP	0x2cc9e0	0x16b8	Device independent bitmap graphic, 76 x 19 x 32, image size 5776, resolution 3622 x 3622 px/m	English	Great Britain	0.10333562585969738
RT_BITMAP	0x2ce098	0x2a68	Device independent bitmap graphic, 104 x 26 x 32, image size 10816, resolution 3661 x 3661 px/m	English	Great Britain	0.05407148120854827
RT_BITMAP	0x2d0b00	0x4028	Device independent bitmap graphic, 128 x 32 x 32, image size 16384, resolution 3661 x 3661 px/m	English	Great Britain	0.0479176814417925
RT_BITMAP	0x2d4b28	0x2028	Device independent bitmap graphic, 16 x 128 x 32, image size 8192, resolution 2834 x 2834 px/m	English	Great Britain	0.22983479105928087
RT_BITMAP	0x2d6b50	0x1028	Device independent bitmap graphic, 32 x 32 x 32, image size 4096, resolution 3780 x 3780 px/m	English	Canada	0.30947775628626695
RT_ICON	0x2d7b78	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	Chinese	China	0.32692535194605465
RT_MENU	0x2e83a0	0x5e	data	English	Great Britain	0.8617021276595744
RT_MENU	0x2e8400	0x13c	data	English	Great Britain	0.49683544303797467
RT_MENU	0x2e853c	0x8e	data	English	Great Britain	0.6971830985915493
RT_MENU	0x2e85cc	0x1aa	data	English	Great Britain	0.42018779342723006
RT_MENU	0x2e8778	0xda	data	English	Great Britain	0.6238532110091743
RT_MENU	0x2e8854	0x164	data	English	Great Britain	0.547752808988764
RT_MENU	0x2e89b8	0xbe	data	English	Great Britain	0.6368421052631579
RT_MENU	0x2e8a78	0xae	data	English	Great Britain	0.632183908045977
RT_MENU	0x2e8b28	0xb8	data	English	Great Britain	0.657608695652174
RT_DIALOG	0x2e8be0	0x530	data	English	Great Britain	0.42846385542168675
RT_DIALOG	0x2e9110	0x238	data	English	Great Britain	0.4982394366197183
RT_DIALOG	0x2e9348	0xe8	data	English	Great Britain	0.6508620689655172
RT_DIALOG	0x2e9430	0x1c8	data	English	Great Britain	0.5657894736842105
RT_DIALOG	0x2e95f8	0x1e0	data	English	Great Britain	0.49166666666666664
RT_DIALOG	0x2e97d8	0x1ac	data	English	Great Britain	0.5607476635514018
RT_DIALOG	0x2e9984	0x1cc	data	English	Great Britain	0.5
RT_DIALOG	0x2e9b50	0x1e4	data	English	Great Britain	0.5206611570247934
RT_DIALOG	0x2e9d34	0x33c	data	English	Great Britain	0.358695652173913
RT_DIALOG	0x2ea070	0x6b6	data	English	Great Britain	0.3911525029103609
RT_DIALOG	0x2ea728	0x1a4	data	English	Great Britain	0.5166666666666667
RT_DIALOG	0x2ea8cc	0x1ce	data	English	Great Britain	0.48268398268398266
RT_DIALOG	0x2eaa9c	0x4e4	data	English	Great Britain	0.40814696485623003
RT_DIALOG	0x2eaf80	0x57e	data	English	Great Britain	0.4139402560455192
RT_DIALOG	0x2eb500	0x54	data	English	Great Britain	0.8095238095238095
RT_DIALOG	0x2eb554	0xe0	data	English	Great Britain	0.6517857142857143
RT_DIALOG	0x2eb634	0x29a	data	English	Great Britain	0.47297297297297297
RT_DIALOG	0x2eb8d0	0xdc	data	English	Great Britain	0.6363636363636364
RT_DIALOG	0x2eb9ac	0x70	data	English	Great Britain	0.7857142857142857
RT_DIALOG	0x2eba1c	0x1ce	data	English	Great Britain	0.48484848484848486
RT_DIALOG	0x2ebbec	0x180	data	English	Great Britain	0.5755208333333334
RT_DIALOG	0x2ebd6c	0x230	data	English	Great Britain	0.4446428571428571
RT_DIALOG	0x2ebf9c	0xc4	data	English	Great Britain	0.7244897959183674
RT_DIALOG	0x2ec060	0x14c	data	English	Great Britain	0.5993975903614458
RT_DIALOG	0x2ec1ac	0x462	data	English	Great Britain	0.43137254901960786
RT_DIALOG	0x2ec610	0x468	data	English	Great Britain	0.43351063829787234
RT_DIALOG	0x2eca78	0x224	data	English	Great Britain	0.5091240875912408
RT_DIALOG	0x2ecc9c	0x286	data	English	Great Britain	0.5046439628482973
RT_DIALOG	0x2ecf24	0x1e8	data	English	Great Britain	0.5758196721311475
RT_DIALOG	0x2ed10c	0xc8	dBase III DBT, next free block index 4294901761	English	Great Britain	0.665
RT_DIALOG	0x2ed1d4	0x938	data	English	Great Britain	0.3771186440677966
RT_DIALOG	0x2edb0c	0x462	data	English	Great Britain	0.446524064171123
RT_DIALOG	0x2edf70	0x48a	data	English	Great Britain	0.3717728055077453
RT_DIALOG	0x2ee3fc	0x34	data	English	Great Britain	0.9038461538461539
RT_DIALOG	0x2ee430	0x336	data	English	Great Britain	0.38929440389294406
RT_DIALOG	0x2ee768	0x462	data	English	Great Britain	0.44563279857397503
RT_DIALOG	0x2eebcc	0xd6	dBase III DBT, next free block index 4294901761	English	Great Britain	0.7009345794392523
RT_DIALOG	0x2eeca4	0x37c	data	English	Great Britain	0.4461883408071749
RT_DIALOG	0x2ef020	0xd4	data	English	Great Britain	0.6037735849056604
RT_DIALOG	0x2ef0f4	0x2c8	data	English	Great Britain	0.44662921348314605
RT_DIALOG	0x2ef3bc	0x1a2	data	English	Great Britain	0.5239234449760766
RT_DIALOG	0x2ef560	0x186	data	English	Great Britain	0.5948717948717949
RT_DIALOG	0x2ef6e8	0x3b4	data	English	Great Britain	0.4588607594936709
RT_DIALOG	0x2efa9c	0x38a	data	English	Great Britain	0.45916114790286977
RT_DIALOG	0x2efe28	0x3c8	data	English	Great Britain	0.3894628099173554
RT_DIALOG	0x2f01f0	0x428	data	English	Great Britain	0.36654135338345867
RT_DIALOG	0x2f0618	0x92	data	English	Great Britain	0.6027397260273972
RT_DIALOG	0x2f06ac	0x39c	data	English	Great Britain	0.4090909090909091
RT_DIALOG	0x2f0a48	0x248	data	English	Great Britain	0.488013698630137
RT_DIALOG	0x2f0c90	0x51c	data	English	Great Britain	0.4258409785932722
RT_DIALOG	0x2f11ac	0x558	data	English	Great Britain	0.4159356725146199
RT_DIALOG	0x2f1704	0x4fe	data	English	Great Britain	0.4460093896713615
RT_DIALOG	0x2f1c04	0x544	data	English	Great Britain	0.41839762611275966
RT_DIALOG	0x2f2148	0x454	data	English	Great Britain	0.4575812274368231
RT_DIALOG	0x2f259c	0x144	data	English	Great Britain	0.6172839506172839
RT_DIALOG	0x2f26e0	0x514	data	English	Great Britain	0.4276923076923077
RT_DIALOG	0x2f2bf4	0x248	data	English	Great Britain	0.4674657534246575
RT_DIALOG	0x2f2e3c	0x1dc	data	English	Great Britain	0.5189075630252101
RT_DIALOG	0x2f3018	0xfc	data	English	Great Britain	0.6746031746031746
RT_DIALOG	0x2f3114	0x40	data	English	Great Britain	0.875
RT_DIALOG	0x2f3154	0x334	data	English	Great Britain	0.44390243902439025
RT_STRING	0x2f3488	0x2b4	data			0.47398843930635837
RT_STRING	0x2f373c	0xbe0	data			0.24243421052631578
RT_RCDATA	0x2f431c	0x10	data			1.5
RT_RCDATA	0x2f432c	0x3ac	data			0.7042553191489361
RT_RCDATA	0x2f46d8	0x140	Delphi compiled form 'TFormMain'			0.740625
RT_RCDATA	0x2f4818	0xb90	Delphi compiled form 'TMadExcept'			0.47297297297297297
RT_RCDATA	0x2f53a8	0x34e	Delphi compiled form 'TMEContactForm'			0.43498817966903075
RT_RCDATA	0x2f56f8	0x228	Delphi compiled form 'TMEDetailsForm'			0.5416666666666666
RT_RCDATA	0x2f5920	0x2a3	Delphi compiled form 'TMEScrShotForm'			0.5333333333333333
RT_RCDATA	0x2f5bc4	0x507	Delphi compiled form 'TNoticForm'			0.5003885003885004
RT_RCDATA	0x2f60cc	0x2c634	Delphi compiled form 'TScreenShotMainForm'			0.26612654830264226
RT_RCDATA	0x322700	0x20a2	Delphi compiled form 'TTipForm'			0.3003351687814221
RT_GROUP_ICON	0x3247a4	0x14	data	Chinese	China	1.15
RT_VERSION	0x3247b8	0x30c	data	English	United States	0.4564102564102564
RT_DLGINCLUDE	0x324ac4	0xf436	PC bitmap, Windows 3.x format, 8436 x 2 x 51, image size 63287, cbSize 62518, bits offset 54			0.9213346556191817
RT_ANIICON	0x333efc	0xdb5b	PC bitmap, Windows 3.x format, 7600 x 2 x 39, image size 56797, cbSize 56155, bits offset 54			0.3993411094292583
RT_ANIICON	0x341a58	0x916c	PC bitmap, Windows 3.x format, 4737 x 2 x 47, image size 37231, cbSize 37228, bits offset 54			0.3930643601590201
RT_ANIICON	0x34abc4	0x9f2d	PC bitmap, Windows 3.x format, 5290 x 2 x 47, image size 41201, cbSize 40749, bits offset 54			0.41745809713121795
RT_ANIICON	0x354af4	0x35514	PC bitmap, Windows 3.x format, 27750 x 2 x 41, image size 219036, cbSize 218388, bits offset 54			0.4682720662307453
RT_ANIICON	0x38a008	0x2eceb	PC bitmap, Windows 3.x format, 24404 x 2 x 49, image size 192574, cbSize 191723, bits offset 54			0.4801041085315794
RT_MANIFEST	0x3b8cf4	0x352	XML 1.0 document, ASCII text, with CRLF line terminators	Chinese	China	0.48

Imports

DLL	Import
gdi32.dll	TextOutW, StretchDIBits, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixelV, SetPixel, SetDIBitsToDevice, SetDIBits, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RoundRect, RestoreDC, ResizePalette, Rectangle, RectVisible, RealizePalette, Polyline, OffsetViewportOrgEx, MoveToEx, LineTo, IntersectClipRect, GetViewportOrgEx, GetTextMetricsW, GetTextExtentPoint32W, GetTextExtentExPointW, GetTextColor, GetTextAlign, GetStockObject, GetROP2, GetPixel, GetPaletteEntries, GetObjectType, GetObjectW, GetNearestPaletteIndex, GetDeviceCaps, GetDIBits, GetCurrentPositionEx, GetCurrentObject, GetClipBox, GetBkMode, GetBkColor, ExtTextOutW, ExcludeClipRect, Ellipse, DeleteObject, DeleteDC, CreateRoundRectRgn, CreateRectRgn, CreatePolygonRgn, CreatePenIndirect, CreatePen, CreatePalette, CreateHalftonePalette, CreateFontIndirectW, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CombineRgn, BitBlt
kernel32.dll	lstrcmpW, WriteProcessMemory, WritePrivateProfileStringW, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, UnmapViewOfFile, TerminateProcess, SystemTimeToFileTime, Sleep, ReadProcessMemory, QueryDosDeviceW, OutputDebugStringW, OpenProcess, MulDiv, MapViewOfFile, LocalFree, LocalAlloc, LoadLibraryW, LeaveCriticalSection, IsBadCodePtr, InitializeCriticalSection, HeapFree, HeapDestroy, HeapAlloc, GlobalUnlock, GlobalMemoryStatus, GlobalHandle, GlobalLock, GlobalGetAtomNameW, GlobalFree, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomW, GetWindowsDirectoryW, GetVersionExW, GetVersion, GetTickCount, GetTempPathW, GetSystemTime, GetSystemInfo, GetSystemDirectoryW, GetProcessTimes, GetProcAddress, GetPrivateProfileStringW, GetPriorityClass, GetModuleHandleW, GetModuleFileNameW, GetLogicalDriveStringsW, GetLastError, GetDriveTypeW, GetDiskFreeSpaceExW, GetCurrentThreadId, GetCurrentProcess, InterlockedIncrement, InterlockedExchangeAdd, InterlockedExchange, InterlockedDecrement, InterlockedCompareExchange, FreeLibrary, FlushInstructionCache, FileTimeToSystemTime, EnterCriticalSection, CreateMutexW, CreateFileMappingW, CreateFileW, CopyFileW, CloseHandle
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegFlushKey, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW, GetUserNameW, AdjustTokenPrivileges
shell32.dll	SHGetFileInfoW, ExtractIconW
shell32.dll	SHGetSpecialFolderPathW, SHGetPathFromIDListW, SHBrowseForFolderW
ole32.dll	CoCreateInstance
comctl32.dll	_TrackMouseEvent, ImageList_GetIconSize, ImageList_Draw
Kernel32.dll	GetLongPathNameW
kernel32.dll	Sleep
ole32.dll	IsEqualGUID
comctl32.dll	ImageList_GetIconSize
user32.dll	PrivateExtractIconsW
kernel32.dll	VerSetConditionMask, VerifyVersionInfoW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	Canada
Chinese	China
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 5, 2024 16:49:38.955152988 CEST	49706	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:38.960084915 CEST	8000	49706	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:38.960215092 CEST	49706	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:38.972548008 CEST	49706	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:38.977435112 CEST	8000	49706	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:38.977562904 CEST	49706	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:38.982367992 CEST	8000	49706	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:40.579416990 CEST	8000	49706	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:40.579595089 CEST	49706	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:40.606723070 CEST	49706	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:40.611670017 CEST	8000	49706	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:41.610183001 CEST	49708	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:41.615134954 CEST	8000	49708	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:41.615232944 CEST	49708	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:41.617486000 CEST	49708	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:41.622524977 CEST	8000	49708	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:41.624625921 CEST	49708	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:41.629492044 CEST	8000	49708	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:43.272295952 CEST	8000	49708	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:43.272432089 CEST	49708	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:43.272856951 CEST	49708	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:43.279561043 CEST	8000	49708	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:44.286132097 CEST	49709	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:44.291137934 CEST	8000	49709	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:44.291342020 CEST	49709	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:44.293349981 CEST	49709	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:44.298300028 CEST	8000	49709	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:44.298361063 CEST	49709	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:44.303302050 CEST	8000	49709	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:45.939038038 CEST	8000	49709	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:45.939131021 CEST	49709	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:45.939344883 CEST	49709	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:45.946734905 CEST	8000	49709	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:46.957187891 CEST	49710	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:46.963884115 CEST	8000	49710	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:46.963979959 CEST	49710	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:46.964586020 CEST	49710	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:46.969419003 CEST	8000	49710	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:46.969470978 CEST	49710	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:46.974318027 CEST	8000	49710	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:48.616780996 CEST	8000	49710	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:48.616856098 CEST	49710	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:48.617065907 CEST	49710	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:48.621840000 CEST	8000	49710	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:49.627278090 CEST	49711	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:49.947645903 CEST	8000	49711	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:49.947727919 CEST	49711	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:49.948281050 CEST	49711	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:49.953094006 CEST	8000	49711	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:49.953144073 CEST	49711	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:49.958143950 CEST	8000	49711	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:51.583631992 CEST	8000	49711	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:51.583703995 CEST	49711	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:51.583901882 CEST	49711	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:51.588701963 CEST	8000	49711	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:52.595319033 CEST	49712	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:52.600740910 CEST	8000	49712	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:52.600817919 CEST	49712	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:52.601444006 CEST	49712	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:52.606267929 CEST	8000	49712	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:52.606319904 CEST	49712	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:52.611099958 CEST	8000	49712	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:54.253746986 CEST	8000	49712	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:54.253810883 CEST	49712	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:54.254070997 CEST	49712	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:54.260149956 CEST	8000	49712	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:55.266892910 CEST	49713	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:55.271790028 CEST	8000	49713	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:55.271859884 CEST	49713	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:55.272402048 CEST	49713	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:55.277210951 CEST	8000	49713	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:55.277266026 CEST	49713	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:55.282048941 CEST	8000	49713	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:56.912939072 CEST	8000	49713	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:56.913018942 CEST	49713	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:56.913988113 CEST	49713	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:56.918833971 CEST	8000	49713	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:57.926048040 CEST	49714	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:57.933181047 CEST	8000	49714	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:57.933274984 CEST	49714	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:57.933809042 CEST	49714	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:57.940902948 CEST	8000	49714	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:57.940989971 CEST	49714	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:57.948086023 CEST	8000	49714	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:59.563374996 CEST	8000	49714	193.142.146.64	192.168.2.8
Oct 5, 2024 16:49:59.563462973 CEST	49714	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:59.563653946 CEST	49714	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:49:59.569344044 CEST	8000	49714	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:00.579205990 CEST	49715	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:00.586667061 CEST	8000	49715	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:00.586745977 CEST	49715	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:00.587295055 CEST	49715	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:00.594750881 CEST	8000	49715	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:00.594805956 CEST	49715	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:00.601967096 CEST	8000	49715	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:02.203279018 CEST	8000	49715	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:02.205796003 CEST	49715	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:02.206068993 CEST	49715	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:02.210978031 CEST	8000	49715	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:03.220763922 CEST	49716	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:03.226075888 CEST	8000	49716	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:03.227061987 CEST	49716	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:03.227802038 CEST	49716	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:03.232556105 CEST	8000	49716	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:03.233581066 CEST	49716	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:03.238424063 CEST	8000	49716	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:04.863604069 CEST	8000	49716	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:04.864820957 CEST	49716	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:04.864936113 CEST	49716	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:04.869820118 CEST	8000	49716	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:05.875858068 CEST	49717	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:05.881005049 CEST	8000	49717	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:05.881091118 CEST	49717	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:05.881679058 CEST	49717	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:05.886795044 CEST	8000	49717	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:05.886857033 CEST	49717	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:05.891794920 CEST	8000	49717	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:07.521719933 CEST	8000	49717	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:07.521804094 CEST	49717	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:07.522002935 CEST	49717	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:07.526851892 CEST	8000	49717	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:08.540092945 CEST	49718	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:08.545130968 CEST	8000	49718	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:08.545361042 CEST	49718	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:08.545794010 CEST	49718	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:08.550587893 CEST	8000	49718	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:08.550664902 CEST	49718	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:08.555535078 CEST	8000	49718	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:10.156519890 CEST	8000	49718	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:10.157047987 CEST	49718	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:10.159132004 CEST	49718	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:10.165539026 CEST	8000	49718	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:11.172665119 CEST	49719	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:11.177803993 CEST	8000	49719	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:11.177930117 CEST	49719	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:11.178507090 CEST	49719	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:11.183425903 CEST	8000	49719	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:11.183654070 CEST	49719	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:11.188601971 CEST	8000	49719	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:12.850222111 CEST	8000	49719	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:12.850291014 CEST	49719	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:12.850840092 CEST	49719	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:12.855654001 CEST	8000	49719	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:13.860234022 CEST	49720	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:13.865222931 CEST	8000	49720	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:13.865341902 CEST	49720	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:13.866245985 CEST	49720	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:13.871005058 CEST	8000	49720	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:13.871110916 CEST	49720	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:13.875869989 CEST	8000	49720	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:18.297457933 CEST	8000	49720	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:18.297538996 CEST	49720	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:18.297950029 CEST	49720	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:18.302855968 CEST	8000	49720	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:19.313364029 CEST	49722	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:19.318550110 CEST	8000	49722	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:19.322088003 CEST	49722	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:19.322719097 CEST	49722	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:19.327544928 CEST	8000	49722	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:19.328888893 CEST	49722	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:19.333714008 CEST	8000	49722	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:21.047852039 CEST	8000	49722	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:21.048008919 CEST	49722	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:21.048217058 CEST	49722	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:21.053045988 CEST	8000	49722	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:22.065087080 CEST	49723	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:22.535907984 CEST	8000	49723	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:22.536103010 CEST	49723	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:22.536900997 CEST	49723	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:22.541950941 CEST	8000	49723	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:22.542047024 CEST	49723	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:22.547156096 CEST	8000	49723	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:24.173099995 CEST	8000	49723	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:24.173196077 CEST	49723	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:24.174180984 CEST	49723	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:24.180783033 CEST	8000	49723	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:25.189424992 CEST	49724	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:25.194562912 CEST	8000	49724	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:25.194639921 CEST	49724	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:25.195291042 CEST	49724	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:25.200066090 CEST	8000	49724	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:25.200222969 CEST	49724	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:25.205053091 CEST	8000	49724	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:27.222498894 CEST	8000	49724	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:27.222608089 CEST	49724	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:27.222923040 CEST	49724	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:27.227996111 CEST	8000	49724	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:28.235768080 CEST	49725	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:28.240823984 CEST	8000	49725	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:28.240932941 CEST	49725	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:28.241544962 CEST	49725	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:28.246462107 CEST	8000	49725	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:28.246598005 CEST	49725	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:28.251548052 CEST	8000	49725	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:29.881323099 CEST	8000	49725	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:29.881417990 CEST	49725	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:29.881628990 CEST	49725	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:29.886465073 CEST	8000	49725	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:30.891773939 CEST	49726	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:30.896794081 CEST	8000	49726	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:30.896878958 CEST	49726	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:30.897480965 CEST	49726	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:30.902335882 CEST	8000	49726	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:30.902393103 CEST	49726	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:30.907278061 CEST	8000	49726	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:32.516336918 CEST	8000	49726	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:32.516680956 CEST	49726	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:32.516680956 CEST	49726	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:32.523123026 CEST	8000	49726	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:33.532182932 CEST	49727	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:33.537224054 CEST	8000	49727	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:33.537298918 CEST	49727	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:33.538136005 CEST	49727	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:33.542947054 CEST	8000	49727	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:33.543000937 CEST	49727	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:33.547919989 CEST	8000	49727	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:35.176464081 CEST	8000	49727	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:35.176533937 CEST	49727	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:35.176743031 CEST	49727	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:35.181833029 CEST	8000	49727	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:36.188465118 CEST	49734	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:36.193475962 CEST	8000	49734	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:36.193547010 CEST	49734	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:36.194072008 CEST	49734	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:36.198805094 CEST	8000	49734	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:36.198849916 CEST	49734	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:36.203639984 CEST	8000	49734	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:37.815021038 CEST	8000	49734	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:37.815125942 CEST	49734	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:37.815345049 CEST	49734	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:37.820310116 CEST	8000	49734	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:38.828929901 CEST	49752	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:38.833745003 CEST	8000	49752	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:38.833827019 CEST	49752	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:38.834353924 CEST	49752	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:38.839245081 CEST	8000	49752	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:38.839314938 CEST	49752	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:38.844172955 CEST	8000	49752	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:40.468521118 CEST	8000	49752	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:40.468601942 CEST	49752	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:40.468791962 CEST	49752	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:40.473624945 CEST	8000	49752	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:41.469644070 CEST	49767	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:41.474606037 CEST	8000	49767	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:41.478086948 CEST	49767	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:41.478569031 CEST	49767	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:41.483350992 CEST	8000	49767	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:41.483422995 CEST	49767	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:41.488215923 CEST	8000	49767	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:43.097070932 CEST	8000	49767	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:43.097140074 CEST	49767	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:43.098411083 CEST	49767	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:43.103348970 CEST	8000	49767	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:44.110337019 CEST	49787	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:44.115330935 CEST	8000	49787	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:44.116085052 CEST	49787	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:44.116614103 CEST	49787	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:44.121767044 CEST	8000	49787	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:44.122160912 CEST	49787	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:44.127408028 CEST	8000	49787	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:45.814029932 CEST	8000	49787	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:45.814212084 CEST	49787	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:45.814431906 CEST	49787	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:45.819140911 CEST	8000	49787	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:46.828923941 CEST	49805	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:46.833806038 CEST	8000	49805	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:46.833880901 CEST	49805	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:46.834330082 CEST	49805	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:46.839118004 CEST	8000	49805	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:46.839179039 CEST	49805	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:46.844166994 CEST	8000	49805	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:48.455553055 CEST	8000	49805	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:48.455624104 CEST	49805	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:48.455811977 CEST	49805	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:48.460525990 CEST	8000	49805	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:49.469645977 CEST	49821	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:49.475509882 CEST	8000	49821	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:49.475581884 CEST	49821	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:49.476171017 CEST	49821	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:49.480959892 CEST	8000	49821	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:49.481019020 CEST	49821	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:49.485972881 CEST	8000	49821	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:51.094677925 CEST	8000	49821	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:51.094830990 CEST	49821	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:51.096606016 CEST	49821	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:51.101511955 CEST	8000	49821	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:52.110162020 CEST	49841	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:52.123354912 CEST	8000	49841	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:52.123415947 CEST	49841	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:52.124125957 CEST	49841	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:52.130985975 CEST	8000	49841	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:52.131047964 CEST	49841	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:52.137043953 CEST	8000	49841	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:53.758024931 CEST	8000	49841	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:53.758219957 CEST	49841	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:53.758394957 CEST	49841	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:53.765168905 CEST	8000	49841	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:54.766515970 CEST	49856	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:54.772161007 CEST	8000	49856	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:54.772254944 CEST	49856	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:54.772923946 CEST	49856	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:54.779537916 CEST	8000	49856	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:54.779659033 CEST	49856	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:54.786358118 CEST	8000	49856	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:56.398797989 CEST	8000	49856	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:56.398874044 CEST	49856	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:56.399080038 CEST	49856	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:56.403918982 CEST	8000	49856	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:57.407252073 CEST	49874	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:57.412414074 CEST	8000	49874	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:57.412503004 CEST	49874	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:57.412983894 CEST	49874	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:57.417824984 CEST	8000	49874	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:57.417886019 CEST	49874	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:57.422935963 CEST	8000	49874	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:59.032792091 CEST	8000	49874	193.142.146.64	192.168.2.8
Oct 5, 2024 16:50:59.032907009 CEST	49874	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:59.033788919 CEST	49874	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:50:59.038650990 CEST	8000	49874	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:00.047833920 CEST	49886	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:00.053020954 CEST	8000	49886	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:00.053137064 CEST	49886	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:00.053710938 CEST	49886	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:00.058425903 CEST	8000	49886	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:00.058495045 CEST	49886	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:00.063288927 CEST	8000	49886	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:01.692553997 CEST	8000	49886	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:01.692640066 CEST	49886	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:01.692948103 CEST	49886	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:01.697876930 CEST	8000	49886	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:02.704036951 CEST	49902	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:02.709060907 CEST	8000	49902	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:02.709141970 CEST	49902	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:02.709908962 CEST	49902	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:02.714869022 CEST	8000	49902	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:02.714925051 CEST	49902	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:02.719790936 CEST	8000	49902	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:04.329298973 CEST	8000	49902	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:04.330106020 CEST	49902	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:04.330622911 CEST	49902	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:04.335432053 CEST	8000	49902	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:05.344727039 CEST	49915	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:05.349741936 CEST	8000	49915	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:05.350111008 CEST	49915	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:05.350604057 CEST	49915	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:05.355443001 CEST	8000	49915	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:05.358128071 CEST	49915	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:05.363734007 CEST	8000	49915	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:06.987337112 CEST	8000	49915	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:06.987608910 CEST	49915	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:06.987868071 CEST	49915	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:06.992748022 CEST	8000	49915	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:08.000955105 CEST	49932	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:08.006844044 CEST	8000	49932	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:08.006933928 CEST	49932	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:08.007630110 CEST	49932	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:08.013972998 CEST	8000	49932	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:08.014040947 CEST	49932	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:08.019350052 CEST	8000	49932	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:09.626362085 CEST	8000	49932	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:09.626537085 CEST	49932	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:09.626749992 CEST	49932	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:09.631618977 CEST	8000	49932	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:10.594635963 CEST	49950	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:10.599678040 CEST	8000	49950	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:10.599757910 CEST	49950	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:10.600478888 CEST	49950	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:10.605304003 CEST	8000	49950	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:10.605361938 CEST	49950	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:10.611247063 CEST	8000	49950	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:12.225079060 CEST	8000	49950	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:12.225186110 CEST	49950	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:12.225516081 CEST	49950	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:12.230384111 CEST	8000	49950	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:13.172827959 CEST	49966	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:13.179727077 CEST	8000	49966	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:13.179814100 CEST	49966	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:13.180485010 CEST	49966	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:13.185519934 CEST	8000	49966	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:13.185600996 CEST	49966	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:13.191468000 CEST	8000	49966	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:14.797776937 CEST	8000	49966	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:14.797907114 CEST	49966	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:14.798703909 CEST	49966	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:14.803807020 CEST	8000	49966	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:15.704669952 CEST	49984	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:15.709585905 CEST	8000	49984	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:15.710990906 CEST	49984	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:15.711657047 CEST	49984	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:15.716522932 CEST	8000	49984	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:15.718139887 CEST	49984	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:15.723129034 CEST	8000	49984	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:17.329545975 CEST	8000	49984	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:17.329607964 CEST	49984	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:17.329853058 CEST	49984	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:17.334640026 CEST	8000	49984	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:18.204155922 CEST	50000	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:18.255714893 CEST	8000	50000	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:18.255805016 CEST	50000	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:18.256930113 CEST	50000	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:18.264081955 CEST	8000	50000	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:18.264306068 CEST	50000	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:18.270850897 CEST	8000	50000	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:19.878101110 CEST	8000	50000	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:19.878329992 CEST	50000	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:19.878526926 CEST	50000	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:19.883281946 CEST	8000	50000	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:20.735354900 CEST	50013	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:20.740642071 CEST	8000	50013	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:20.742141008 CEST	50013	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:20.742693901 CEST	50013	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:20.747476101 CEST	8000	50013	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:20.748127937 CEST	50013	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:20.753505945 CEST	8000	50013	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:22.362782001 CEST	8000	50013	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:22.366244078 CEST	50013	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:22.366744995 CEST	50013	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:22.371582031 CEST	8000	50013	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:23.188540936 CEST	50014	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:23.194978952 CEST	8000	50014	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:23.195091009 CEST	50014	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:23.195713043 CEST	50014	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:23.203762054 CEST	8000	50014	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:23.203840971 CEST	50014	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:23.217051029 CEST	8000	50014	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:24.824289083 CEST	8000	50014	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:24.824527025 CEST	50014	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:24.824606895 CEST	50014	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:24.829761028 CEST	8000	50014	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:25.626055956 CEST	50015	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:25.631206989 CEST	8000	50015	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:25.631318092 CEST	50015	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:25.631874084 CEST	50015	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:25.636889935 CEST	8000	50015	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:25.636969090 CEST	50015	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:25.642726898 CEST	8000	50015	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:27.251806974 CEST	8000	50015	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:27.251879930 CEST	50015	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:27.252051115 CEST	50015	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:27.256989002 CEST	8000	50015	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:28.018901110 CEST	50016	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:28.024463892 CEST	8000	50016	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:28.024559021 CEST	50016	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:28.028490067 CEST	50016	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:28.033461094 CEST	8000	50016	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:28.033587933 CEST	50016	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:28.038472891 CEST	8000	50016	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:29.658217907 CEST	8000	50016	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:29.658337116 CEST	50016	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:29.658545971 CEST	50016	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:29.663301945 CEST	8000	50016	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:30.407366991 CEST	50017	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:30.412658930 CEST	8000	50017	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:30.412767887 CEST	50017	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:30.413436890 CEST	50017	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:30.418199062 CEST	8000	50017	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:30.418267012 CEST	50017	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:30.423516989 CEST	8000	50017	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:32.049341917 CEST	8000	50017	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:32.049454927 CEST	50017	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:32.049648046 CEST	50017	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:32.054404020 CEST	8000	50017	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:32.766592026 CEST	50018	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:32.771532059 CEST	8000	50018	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:32.771640062 CEST	50018	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:32.772205114 CEST	50018	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:32.777018070 CEST	8000	50018	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:32.777070045 CEST	50018	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:32.781888962 CEST	8000	50018	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:35.068434954 CEST	8000	50018	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:35.068484068 CEST	50018	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:35.068682909 CEST	50018	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:35.068855047 CEST	8000	50018	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:35.068892956 CEST	50018	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:35.069224119 CEST	8000	50018	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:35.069261074 CEST	50018	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:35.074466944 CEST	8000	50018	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:35.767921925 CEST	50019	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:35.772844076 CEST	8000	50019	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:35.773000002 CEST	50019	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:35.778075933 CEST	50019	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:35.782840967 CEST	8000	50019	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:35.782900095 CEST	50019	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:35.787655115 CEST	8000	50019	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:37.409033060 CEST	8000	50019	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:37.409174919 CEST	50019	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:37.409603119 CEST	50019	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:37.416142941 CEST	8000	50019	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:38.079046965 CEST	50020	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:38.084199905 CEST	8000	50020	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:38.084286928 CEST	50020	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:38.084837914 CEST	50020	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:38.089560032 CEST	8000	50020	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:38.089638948 CEST	50020	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:38.094439030 CEST	8000	50020	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:39.726061106 CEST	8000	50020	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:39.726165056 CEST	50020	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:39.726396084 CEST	50020	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:39.731198072 CEST	8000	50020	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:40.376477003 CEST	50021	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:40.385281086 CEST	8000	50021	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:40.385395050 CEST	50021	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:40.386008024 CEST	50021	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:40.390995979 CEST	8000	50021	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:40.391051054 CEST	50021	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:40.395889044 CEST	8000	50021	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:42.018161058 CEST	8000	50021	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:42.018251896 CEST	50021	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:42.018517017 CEST	50021	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:42.024456024 CEST	8000	50021	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:42.644773960 CEST	50022	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:42.650248051 CEST	8000	50022	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:42.650330067 CEST	50022	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:42.650973082 CEST	50022	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:42.655869961 CEST	8000	50022	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:42.655991077 CEST	50022	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:42.660940886 CEST	8000	50022	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:44.267342091 CEST	8000	50022	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:44.267453909 CEST	50022	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:44.267694950 CEST	50022	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:44.272948027 CEST	8000	50022	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:44.876058102 CEST	50023	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:44.881067991 CEST	8000	50023	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:44.881179094 CEST	50023	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:44.881792068 CEST	50023	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:44.886605978 CEST	8000	50023	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:44.886662006 CEST	50023	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:44.891454935 CEST	8000	50023	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:46.517688990 CEST	8000	50023	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:46.517759085 CEST	50023	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:46.517976046 CEST	50023	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:46.522797108 CEST	8000	50023	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:47.110594034 CEST	50024	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:47.115678072 CEST	8000	50024	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:47.115797997 CEST	50024	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:47.119544983 CEST	50024	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:47.124373913 CEST	8000	50024	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:47.124533892 CEST	50024	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:47.129395962 CEST	8000	50024	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:48.738410950 CEST	8000	50024	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:48.738514900 CEST	50024	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:48.738763094 CEST	50024	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:48.743479967 CEST	8000	50024	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:49.315336943 CEST	50025	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:49.320388079 CEST	8000	50025	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:49.320466995 CEST	50025	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:49.323215961 CEST	50025	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:49.327991009 CEST	8000	50025	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:49.328058958 CEST	50025	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:49.332851887 CEST	8000	50025	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:51.008935928 CEST	8000	50025	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:51.009011030 CEST	50025	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:51.009198904 CEST	50025	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:51.013986111 CEST	8000	50025	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:51.563604116 CEST	50026	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:51.568552971 CEST	8000	50026	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:51.568669081 CEST	50026	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:51.570044994 CEST	50026	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:51.575069904 CEST	8000	50026	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:51.575136900 CEST	50026	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:51.580045938 CEST	8000	50026	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:53.304438114 CEST	8000	50026	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:53.304589033 CEST	50026	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:53.304894924 CEST	50026	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:53.309967041 CEST	8000	50026	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:53.845664024 CEST	50027	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:53.850689888 CEST	8000	50027	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:53.850778103 CEST	50027	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:53.851398945 CEST	50027	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:53.856177092 CEST	8000	50027	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:53.856245995 CEST	50027	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:53.861001015 CEST	8000	50027	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:55.501914978 CEST	8000	50027	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:55.501991987 CEST	50027	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:55.502207041 CEST	50027	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:55.507045984 CEST	8000	50027	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:56.016580105 CEST	50028	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:56.021811962 CEST	8000	50028	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:56.021909952 CEST	50028	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:56.022495985 CEST	50028	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:56.027539015 CEST	8000	50028	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:56.027618885 CEST	50028	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:56.032464981 CEST	8000	50028	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:57.649760962 CEST	8000	50028	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:57.649931908 CEST	50028	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:57.650636911 CEST	50028	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:57.657422066 CEST	8000	50028	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:58.141946077 CEST	50029	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:58.280355930 CEST	8000	50029	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:58.280488968 CEST	50029	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:58.282103062 CEST	50029	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:58.287396908 CEST	8000	50029	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:58.287488937 CEST	50029	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:58.292500019 CEST	8000	50029	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:59.928915024 CEST	8000	50029	193.142.146.64	192.168.2.8
Oct 5, 2024 16:51:59.929056883 CEST	50029	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:59.932308912 CEST	50029	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:51:59.937686920 CEST	8000	50029	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:00.408523083 CEST	50030	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:00.413614988 CEST	8000	50030	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:00.413758039 CEST	50030	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:00.415883064 CEST	50030	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:00.420737982 CEST	8000	50030	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:00.420850992 CEST	50030	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:00.425690889 CEST	8000	50030	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:02.033526897 CEST	8000	50030	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:02.033591032 CEST	50030	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:02.033772945 CEST	50030	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:02.038562059 CEST	8000	50030	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:02.502424002 CEST	50031	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:02.507515907 CEST	8000	50031	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:02.507642031 CEST	50031	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:02.508207083 CEST	50031	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:02.512995958 CEST	8000	50031	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:02.513077021 CEST	50031	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:02.517880917 CEST	8000	50031	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:04.127531052 CEST	8000	50031	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:04.127661943 CEST	50031	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:04.127872944 CEST	50031	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:04.132791042 CEST	8000	50031	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:04.579305887 CEST	50032	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:04.591336966 CEST	8000	50032	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:04.591553926 CEST	50032	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:04.592231035 CEST	50032	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:04.602823973 CEST	8000	50032	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:04.602920055 CEST	50032	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:04.612242937 CEST	8000	50032	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:06.206295967 CEST	8000	50032	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:06.206428051 CEST	50032	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:06.207098007 CEST	50032	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:06.211858034 CEST	8000	50032	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:06.641856909 CEST	50033	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:06.646792889 CEST	8000	50033	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:06.650197983 CEST	50033	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:06.651016951 CEST	50033	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:06.655810118 CEST	8000	50033	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:06.658154011 CEST	50033	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:06.662967920 CEST	8000	50033	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:08.417900085 CEST	8000	50033	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:08.418035030 CEST	50033	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:08.418232918 CEST	50033	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:08.431102991 CEST	8000	50033	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:08.847027063 CEST	50034	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:08.852020025 CEST	8000	50034	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:08.852113008 CEST	50034	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:08.852634907 CEST	50034	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:08.857553959 CEST	8000	50034	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:08.857620001 CEST	50034	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:08.862487078 CEST	8000	50034	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:10.471615076 CEST	8000	50034	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:10.471690893 CEST	50034	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:10.471932888 CEST	50034	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:10.477669954 CEST	8000	50034	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:10.875993013 CEST	50035	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:10.880846977 CEST	8000	50035	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:10.881062031 CEST	50035	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:10.881701946 CEST	50035	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:10.886471987 CEST	8000	50035	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:10.886538982 CEST	50035	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:10.891472101 CEST	8000	50035	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:12.509501934 CEST	8000	50035	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:12.509615898 CEST	50035	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:12.509947062 CEST	50035	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:12.514919996 CEST	8000	50035	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:12.907293081 CEST	50036	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:12.914041042 CEST	8000	50036	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:12.914119959 CEST	50036	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:12.914664984 CEST	50036	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:12.919945955 CEST	8000	50036	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:12.920011997 CEST	50036	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:12.924871922 CEST	8000	50036	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:14.554791927 CEST	8000	50036	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:14.554892063 CEST	50036	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:14.555200100 CEST	50036	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:14.560184956 CEST	8000	50036	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:14.944427967 CEST	50037	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:14.949338913 CEST	8000	50037	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:14.949446917 CEST	50037	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:14.954679012 CEST	50037	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:14.959789991 CEST	8000	50037	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:14.959846020 CEST	50037	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:14.965027094 CEST	8000	50037	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:16.586199999 CEST	8000	50037	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:16.586313009 CEST	50037	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:16.587740898 CEST	50037	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:16.592484951 CEST	8000	50037	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:16.954145908 CEST	50038	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:16.959028006 CEST	8000	50038	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:16.959119081 CEST	50038	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:16.959901094 CEST	50038	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:16.964966059 CEST	8000	50038	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:16.965061903 CEST	50038	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:16.969854116 CEST	8000	50038	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:18.580744982 CEST	8000	50038	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:18.580828905 CEST	50038	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:18.581024885 CEST	50038	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:18.585923910 CEST	8000	50038	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:18.938420057 CEST	50039	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:18.943320036 CEST	8000	50039	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:18.943391085 CEST	50039	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:18.943875074 CEST	50039	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:18.948862076 CEST	8000	50039	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:18.948909044 CEST	50039	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:18.953974962 CEST	8000	50039	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:20.565016985 CEST	8000	50039	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:20.565099001 CEST	50039	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:20.565335989 CEST	50039	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:20.570627928 CEST	8000	50039	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:20.910859108 CEST	50040	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:20.915699005 CEST	8000	50040	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:20.915783882 CEST	50040	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:20.920243979 CEST	50040	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:20.925015926 CEST	8000	50040	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:20.925079107 CEST	50040	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:20.929913044 CEST	8000	50040	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:22.568406105 CEST	8000	50040	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:22.568495035 CEST	50040	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:22.568742990 CEST	50040	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:22.576447964 CEST	8000	50040	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:22.907322884 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:22.912489891 CEST	8000	50041	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:22.912602901 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:22.913151026 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:22.918179035 CEST	8000	50041	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:22.918257952 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:22.923182964 CEST	8000	50041	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:24.689549923 CEST	8000	50041	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:24.689702034 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:24.719727993 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:25.032140970 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:25.048242092 CEST	50042	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:25.641480923 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:25.731786966 CEST	8000	50041	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:25.731817007 CEST	8000	50041	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:25.731894016 CEST	8000	50041	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:25.731972933 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:25.732050896 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:25.732050896 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:25.733227968 CEST	8000	50041	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:25.733257055 CEST	8000	50041	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:25.733290911 CEST	8000	50042	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:25.733318090 CEST	8000	50041	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:25.733421087 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:25.733499050 CEST	50041	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:25.733527899 CEST	50042	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:25.735050917 CEST	50042	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:25.739875078 CEST	8000	50042	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:25.739980936 CEST	50042	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:25.744844913 CEST	8000	50042	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:27.367897034 CEST	8000	50042	193.142.146.64	192.168.2.8
Oct 5, 2024 16:52:27.367995024 CEST	50042	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:27.462801933 CEST	50042	8000	192.168.2.8	193.142.146.64
Oct 5, 2024 16:52:27.467894077 CEST	8000	50042	193.142.146.64	192.168.2.8

Target ID:	0
Start time:	10:49:19
Start date:	05/10/2024
Path:	C:\Users\user\Desktop\an_api.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\an_api.exe"
Imagebase:	0x400000
File size:	3'604'856 bytes
MD5 hash:	D8B47BD38C34FC553EC5765B5297DB5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:49:34
Start date:	05/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x320000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:49:34
Start date:	05/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe"
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:49:34
Start date:	05/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /NoUACCheck
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:49:36
Start date:	05/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" P61I1O 193.142.146.64 8000 O4U27X
Imagebase:	0xa00000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:49:36
Start date:	05/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	53.4%
Signature Coverage:	33.1%
Total number of Nodes:	133
Total number of Limit Nodes:	12

Executed Functions

Function 00784BD7 Relevance: 103.9, APIs: 1, Strings: 58, Instructions: 601injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 00784F4B

Strings

P, xrefs: 00784D97, 00784E1C
L, xrefs: 007890BD
t, xrefs: 00788BE2
x, xrefs: 00788BD4
g, xrefs: 00784F76
e, xrefs: 00788C05
S, xrefs: 00784FD8
d, xrefs: 007890D2
t, xrefs: 00784FDF
W, xrefs: 007854B2
b, xrefs: 007890E7
o, xrefs: 0078546C
o, xrefs: 00784FB5
c, xrefs: 00784FBC
t, xrefs: 00784F8B
y, xrefs: 00789103
b, xrefs: 0078548F
v, xrefs: 00784F99
L, xrefs: 007890D9
o, xrefs: 007890C4
e, xrefs: 00784FC3
i, xrefs: 00788BDB
y, xrefs: 007854AB
a, xrefs: 0078549D
r, xrefs: 007890EE
u, xrefs: 00784F6F
r, xrefs: 00784FAE
r, xrefs: 007890FC
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB
s, xrefs: 00788C0C
s, xrefs: 00784FD1
b, xrefs: 00784F68
p, xrefs: 00784FED
o, xrefs: 00788BF7
i, xrefs: 007890E0
e, xrefs: 00784FA0
s, xrefs: 00784FCA
s, xrefs: 00788C13
o, xrefs: 00784FE6
d, xrefs: 0078547A
L, xrefs: 00785481
L, xrefs: 00785465
e, xrefs: 00784F61
D, xrefs: 00784F5A
i, xrefs: 00785488
i, xrefs: 00784F92
c, xrefs: 00788BFE
P, xrefs: 00784FA7
E, xrefs: 00788BCD
r, xrefs: 00785496
r, xrefs: 00788BF0
r, xrefs: 007854A4
a, xrefs: 007890F5
a, xrefs: 00785473
A, xrefs: 00784F7D
c, xrefs: 00784F84

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: A$D$E$L$L$L$L$P$P$P$S$W$W$a$a$a$a$b$b$b$c$c$c$d$d$e$e$e$e$g$i$i$i$i$o$o$o$o$o$p$r$r$r$r$r$r$s$s$s$s$t$t$t$u$v$x$y$y
API String ID: 3559483778-1767516126
Opcode ID: 212cce9c8623a1b776a63750937d0ff178700bda268de22295b4aac2d64a7175
Instruction ID: e57743384bf2be94cf143c3fe414f71f46bd031cc480286f5cfff7b5c4884dda
Opcode Fuzzy Hash: 212cce9c8623a1b776a63750937d0ff178700bda268de22295b4aac2d64a7175
Instruction Fuzzy Hash: BE42CFB1D086A98EEB24DB24CC487EABBB5AF51304F0440E9D44D67681D2BD5FC5CF62

Function 0073BD86 Relevance: 68.8, APIs: 2, Strings: 37, Instructions: 592
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

E, xrefs: 0073DC54
58;;, xrefs: 0073C91F
x, xrefs: 0073DC5B
l, xrefs: 0073DD8A
e, xrefs: 0073DD20
u, xrefs: 0073DCF6, 0073DCC0, 0073DCC9
F2<>, xrefs: 0073DDC6
r, xrefs: 0073DD6E
l, xrefs: 0073DD9F
F, xrefs: 0073DD0B
r, xrefs: 0073DC77
t, xrefs: 0073DD75
i, xrefs: 0073DCE1
a, xrefs: 0073DD83
s, xrefs: 0073DC93
s, xrefs: 0073DC9A
c, xrefs: 0073DDAD
o, xrefs: 0073DC7E
A, xrefs: 0073DD91
R, xrefs: 0073DDBB
P, xrefs: 0073DC70
r, xrefs: 0073DCE8
e, xrefs: 0073DC8C
e, xrefs: 0073DD19
t, xrefs: 0073DC69
V, xrefs: 0073DCDA
a, xrefs: 0073DCFD, 0073DEB8
c, xrefs: 0073DC85
i, xrefs: 0073DC62
l, xrefs: 0073DD98
V, xrefs: 0073DD60
l, xrefs: 0073DD04
r, xrefs: 0073DD12
t, xrefs: 0073DCEF
i, xrefs: 0073DD67
u, xrefs: 0073DD7C
o, xrefs: 0073DDA6

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: 58;;$A$E$F$F2<>$P$R$V$V$a$a$c$c$e$e$e$i$i$i$l$l$l$l$o$o$r$r$r$r$s$s$t$t$t$u$u$x
API String ID: 0-3242596576
Opcode ID: 22d4afd0425f057eb71b9609288411be4d7df077d64ee263f9918b7fc1dd899d
Instruction ID: ed1ce2c161c53e3fd8376926f28cc6b2327e2fe3134638cfb7d050ea562ca732
Opcode Fuzzy Hash: 22d4afd0425f057eb71b9609288411be4d7df077d64ee263f9918b7fc1dd899d
Instruction Fuzzy Hash: 7A42BEB1D042A88BFB25CB24CC547EABBB5EF95300F1481EAD44DA7282D6795FC18F52

Function 0077E2B2 Relevance: 67.1, APIs: 1, Strings: 37, Instructions: 586
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 0077F9FA

Strings

L, xrefs: 007890BD
o, xrefs: 0077EA97
t, xrefs: 00788BE2
s, xrefs: 00788C0C
y, xrefs: 0077EAD6
d, xrefs: 0077EAA5
L, xrefs: 0077EAAC
x, xrefs: 00788BD4
<8I@, xrefs: 0077EE2B
W, xrefs: 0077EADD
e, xrefs: 00788C05
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
b, xrefs: 0077EABA
s, xrefs: 00788C13
b, xrefs: 007890E7
y, xrefs: 00789103
i, xrefs: 0077EAB3
r, xrefs: 0077EAC1
L, xrefs: 007890D9
r, xrefs: 0077EACF
o, xrefs: 007890C4
L, xrefs: 0077EA90
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
j@h, xrefs: 0077F9DE
r, xrefs: 007890EE
r, xrefs: 00788BF0
a, xrefs: 0077EAC8
a, xrefs: 007890F5
a, xrefs: 0077EA9E
r, xrefs: 007890FC
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: <8I@$E$L$L$L$L$P$W$W$a$a$a$a$b$b$c$d$d$e$i$i$i$j@h$o$o$o$r$r$r$r$r$s$s$t$x$y$y
API String ID: 4275171209-3097042741
Opcode ID: 0bcd373811692b9c53ba05288a44e3e24032068d770e0722ea261a86ddbc33bd
Instruction ID: 3dfa709f472e930b03fa9681e4fe60c152b1d0734059f38c2d8dc45fe5b65245
Opcode Fuzzy Hash: 0bcd373811692b9c53ba05288a44e3e24032068d770e0722ea261a86ddbc33bd
Instruction Fuzzy Hash: 1742E3B1E042A89AEB24CB24CC58BEABBB5EF55304F0480F9D54DA7281D67D5FC58F12

Function 0073B09C Relevance: 67.0, APIs: 2, Strings: 36, Instructions: 547
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F
d, xrefs: 0073B189
o, xrefs: 0073B22B
i, xrefs: 0073B197
r, xrefs: 0073B1B3
t, xrefs: 0073B216
b, xrefs: 0073B992
i, xrefs: 0073B98B
a, xrefs: 0073B1AC
y, xrefs: 0073B1BA
E, xrefs: 0073B201
W, xrefs: 0073B1C1
y, xrefs: 0073B9AE
s, xrefs: 0073B240
L, xrefs: 0073B190
r, xrefs: 0073B1A5
d, xrefs: 0073B97D
L, xrefs: 0073B174
s, xrefs: 0073B247
o, xrefs: 0073B96F
P, xrefs: 0073B21D
L, xrefs: 0073B984
r, xrefs: 0073B224
b, xrefs: 0073B19E
a, xrefs: 0073B9A0
e, xrefs: 0073B239
a, xrefs: 0073B182
L, xrefs: 0073B968
x, xrefs: 0073B208
c, xrefs: 0073B232
a, xrefs: 0073B976
r, xrefs: 0073B9A7
o, xrefs: 0073B17B
r, xrefs: 0073B999
i, xrefs: 0073B20F
W, xrefs: 0073B9B5

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;$E$L$L$L$L$P$W$W$a$a$a$a$b$b$c$d$d$e$i$i$i$o$o$o$r$r$r$r$r$s$s$t$x$y$y
API String ID: 1029625771-4009114861
Opcode ID: 1a43e311990051fb2355f972c6f017fb52e0ceac2311ba783246b59fad3e87df
Instruction ID: 4483da4b0211b37748290d9c30e41fe79eedeb64eab2e1529f0b212326655bd6
Opcode Fuzzy Hash: 1a43e311990051fb2355f972c6f017fb52e0ceac2311ba783246b59fad3e87df
Instruction Fuzzy Hash: 4E32B151D186A8CAFB218B24DC447EAB675EF61300F0490F9C18CAB291E67E5FC5CF66

Function 007727EA Relevance: 47.6, APIs: 1, Strings: 26, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

y, xrefs: 00772DC8
d, xrefs: 00772D97
i, xrefs: 007728A0
t, xrefs: 007728F4
o, xrefs: 00772D89
V, xrefs: 00772899
a, xrefs: 007728BC
o, xrefs: 007728D8
L, xrefs: 00772D9E
t, xrefs: 007728AE
c, xrefs: 007728ED
r, xrefs: 00772DC1
u, xrefs: 007728B5
P, xrefs: 007728CA
i, xrefs: 00772DA5
r, xrefs: 007728D1
b, xrefs: 00772DAC
r, xrefs: 007728A7
W, xrefs: 00772DCF
a, xrefs: 00772D90
L, xrefs: 00772D82
a, xrefs: 00772DBA
r, xrefs: 00772DB3
t, xrefs: 007728DF
e, xrefs: 007728E6
l, xrefs: 007728C3

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-2457314740
Opcode ID: e7dcbd269d77a3b2a7558c782f689d32117e03524c26433dd1440a336c4a3442
Instruction ID: bfcea859e7a94283d89223d536081dbcf4893b2c1c753b5e552cd23918380708
Opcode Fuzzy Hash: e7dcbd269d77a3b2a7558c782f689d32117e03524c26433dd1440a336c4a3442
Instruction Fuzzy Hash: D3F1F5B1D042A98AFB248B24DC587EAB775EF51300F1481F9D54DA7281D6BE4FC58F22

Function 0077EC4C Relevance: 45.9, APIs: 1, Strings: 25, Instructions: 391
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 0077F9FA

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
x, xrefs: 00788BD4
<8I@, xrefs: 0077EE2B
e, xrefs: 00788C05
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
s, xrefs: 00788C13
b, xrefs: 007890E7
y, xrefs: 00789103
L, xrefs: 007890D9
o, xrefs: 007890C4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
j@h, xrefs: 0077F9DE
r, xrefs: 007890EE
r, xrefs: 00788BF0
a, xrefs: 007890F5
r, xrefs: 007890FC
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: <8I@$E$L$L$P$W$a$a$b$c$d$e$i$i$j@h$o$o$r$r$r$s$s$t$x$y
API String ID: 4275171209-266970051
Opcode ID: 190273423703327b4d04cf023b15ae8de329cff38361cbdc07aaec45b8d95fb4
Instruction ID: b6832b04fa110ba3c9819a68e62167eea748330e9af84fd46f071e4cd7b7a3af
Opcode Fuzzy Hash: 190273423703327b4d04cf023b15ae8de329cff38361cbdc07aaec45b8d95fb4
Instruction Fuzzy Hash: 8CF104B1D082A88AEB208B24DC587EA7B75EF55300F1480FAD54D67281D6BD4FC5CF62

Function 0077EE47 Relevance: 44.3, APIs: 1, Strings: 24, Instructions: 543
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 0077F9FA

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
j@h, xrefs: 0077F9DE
e, xrefs: 00788C05
r, xrefs: 007890EE
r, xrefs: 00788BF0
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$j@h$o$o$r$r$r$s$s$t$x$y
API String ID: 4275171209-410011414
Opcode ID: afa986527c84f1645bc79b0d6fa37fff6f867f8d9a061dbac9b7a2de743f2dc8
Instruction ID: a119884afc635dbb444a80f051f7eeaabbcfbc0c5312f6b41c4b3b43c63fd802
Opcode Fuzzy Hash: afa986527c84f1645bc79b0d6fa37fff6f867f8d9a061dbac9b7a2de743f2dc8
Instruction Fuzzy Hash: C422CEB1E052688BEB24CB24CC58BEABBB5EB85304F1481FAD40D67281D6795FC5CF52

Function 00784377 Relevance: 44.2, APIs: 1, Strings: 24, Instructions: 498injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 00784F4B

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
_W, xrefs: 007847F5
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 007890EE
r, xrefs: 00788BF0
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: E$L$L$P$W$_W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 3559483778-1762996778
Opcode ID: 2eb74568783af71e0c5f44e95373f637b824b178062607dbc5bd6ee8ad160a42
Instruction ID: 6693b1801fdcca74b44b4842d096f5449417cf0fb89c3686ef42d799305e6dc6
Opcode Fuzzy Hash: 2eb74568783af71e0c5f44e95373f637b824b178062607dbc5bd6ee8ad160a42
Instruction Fuzzy Hash: DF22F171E081A98BEB24DB24CC98BEABBB5AF55304F1440FAC44D67282D6B95FC5CF11

Function 00786BDE Relevance: 42.5, APIs: 1, Strings: 23, Instructions: 481
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00787795

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 983334009-215400123
Opcode ID: d4af79fcc55e2d06a94efce8fc39b630b092735f345ba270443234d268e862b1
Instruction ID: 59b580bf49cd4f83bc44e40b90f8224a6104d234d457fb694d721c003fb31da7
Opcode Fuzzy Hash: d4af79fcc55e2d06a94efce8fc39b630b092735f345ba270443234d268e862b1
Instruction Fuzzy Hash: 7C12FEB1D041A89AEB248B24DC98BEABBB5EB80304F1441F9D94D67281D77D9FC1CF52

Function 007872AC Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 404
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00787795

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 983334009-215400123
Opcode ID: e1172734129b6dc0e1b99b42b0bd49df3696b6a03c0ef73e2da620bd3084eb4d
Instruction ID: b96ea5ddb8692e7fb64a2b59314a3c62fbc953b555b4b62939732a3511687307
Opcode Fuzzy Hash: e1172734129b6dc0e1b99b42b0bd49df3696b6a03c0ef73e2da620bd3084eb4d
Instruction Fuzzy Hash: 8AF1E0B1D082A89AEB248B24DC58BEABBB5EF90304F1440F9D54D66281D67D5EC5CF12

Function 00777414 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 399
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-215400123
Opcode ID: 57d5dce7b450a18ec50dd41d8ca64e5baf1b35d0a54b99e31d433e7f024414b5
Instruction ID: 7257b1ebe6ba37db89f8290bc2677012cdbf0fd316b3f820d026e20143d41b33
Opcode Fuzzy Hash: 57d5dce7b450a18ec50dd41d8ca64e5baf1b35d0a54b99e31d433e7f024414b5
Instruction Fuzzy Hash: E8F116B1D086A88AEB249B24CC587EABB75EF51304F1480F9D54D67282D67D4FC5CF22

Function 00786E5F Relevance: 42.3, APIs: 1, Strings: 23, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-215400123
Opcode ID: d4a39bfe16b11c7f6b0feef259fa541ef98292d2378902ded36a5f9c5bfc0f2d
Instruction ID: 4e80c658da95f874ba6eaf48909303bef3eba885105b63241bacdf0b86363b3f
Opcode Fuzzy Hash: d4a39bfe16b11c7f6b0feef259fa541ef98292d2378902ded36a5f9c5bfc0f2d
Instruction Fuzzy Hash: 09D124B2D081A89AEB249B28DC58BEA7BB5EF51304F0440F9D54D67282D6BD4FC4CF52

Function 007AACA1 Relevance: 39.4, APIs: 1, Strings: 25, Instructions: 427
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

r, xrefs: 007AC97E
L, xrefs: 007AC94D
a, xrefs: 007AB59E
i, xrefs: 007AC970
b, xrefs: 007AC977
y, xrefs: 007AB5AC
d, xrefs: 007AB57B
W, xrefs: 007AB5B3
L, xrefs: 007AB566
L, xrefs: 007AB582
L, xrefs: 007AC969
i, xrefs: 007AB589
b, xrefs: 007AB590
d, xrefs: 007AC962
r, xrefs: 007AC98C
o, xrefs: 007AB56D
R, xrefs: 007AC843
a, xrefs: 007AC95B
a, xrefs: 007AC985
W, xrefs: 007AC99A
y, xrefs: 007AC993
r, xrefs: 007AB597
o, xrefs: 007AC954
a, xrefs: 007AB574
r, xrefs: 007AB5A5

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$L$L$R$W$W$a$a$a$a$b$b$d$d$i$i$o$o$r$r$r$r$y$y
API String ID: 4275171209-3125122428
Opcode ID: 3097514b869e3eff5e9ada57ae7500aa9f5b33fc991b9547c625da666e7054bb
Instruction ID: 5505c352f440650809d181dc37479d3b32929a34c444ff13c14f6ceb5d9fc9ea
Opcode Fuzzy Hash: 3097514b869e3eff5e9ada57ae7500aa9f5b33fc991b9547c625da666e7054bb
Instruction Fuzzy Hash: 6102F1A1D042A89BE7208B24DC487DABB75EF95300F0441FAD44CA7282D7BE5FC58F26

Function 0073B809 Relevance: 26.7, APIs: 2, Strings: 13, Instructions: 404
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

58;;, xrefs: 0073C91F
o, xrefs: 0073B96F
L, xrefs: 0073B984
a, xrefs: 0073B9A0
b, xrefs: 0073B992
i, xrefs: 0073B98B
L, xrefs: 0073B968
y, xrefs: 0073B9AE
a, xrefs: 0073B976
r, xrefs: 0073B9A7
d, xrefs: 0073B97D
r, xrefs: 0073B999
W, xrefs: 0073B9B5

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: 58;;$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-3996198472
Opcode ID: 842df7f15a63082bf1acedd84bf3ab58ce6f177d051e17ba2e403f3d717db766
Instruction ID: 053422dbe94e80324b0b4a0d88e4dfa4b5ca1b29323aeaeb57454d67709043c4
Opcode Fuzzy Hash: 842df7f15a63082bf1acedd84bf3ab58ce6f177d051e17ba2e403f3d717db766
Instruction Fuzzy Hash: 56F1A1A1D042688BFB218B24CC847EA7775EF95300F1481FAD54DA7242EA395FC5CB66

Function 0073B644 Relevance: 26.6, APIs: 2, Strings: 13, Instructions: 374COMMON

Download Yara Rule

Strings

58;;, xrefs: 0073C91F
o, xrefs: 0073B96F
L, xrefs: 0073B984
a, xrefs: 0073B9A0
b, xrefs: 0073B992
i, xrefs: 0073B98B
L, xrefs: 0073B968
y, xrefs: 0073B9AE
a, xrefs: 0073B976
r, xrefs: 0073B9A7
d, xrefs: 0073B97D
r, xrefs: 0073B999
W, xrefs: 0073B9B5

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: 58;;$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-3996198472
Opcode ID: d0654651439897cd51ee6b937fa434b8e9814b29b6c8a441179a4deced1e8a1f
Instruction ID: 4c4fd799cee3f173a4e0a824b66f88589c7c49f554aee6f9de50231d1c36dcaf
Opcode Fuzzy Hash: d0654651439897cd51ee6b937fa434b8e9814b29b6c8a441179a4deced1e8a1f
Instruction Fuzzy Hash: 3FE1A2A1D052688AFB218B24CC847EA77B5FF95300F1080EAD58DA7242EA395FC5CF56

Function 0073B766 Relevance: 26.6, APIs: 2, Strings: 13, Instructions: 374COMMON

Download Yara Rule

Strings

58;;, xrefs: 0073C91F
o, xrefs: 0073B96F
L, xrefs: 0073B984
a, xrefs: 0073B9A0
b, xrefs: 0073B992
i, xrefs: 0073B98B
L, xrefs: 0073B968
y, xrefs: 0073B9AE
a, xrefs: 0073B976
r, xrefs: 0073B9A7
d, xrefs: 0073B97D
r, xrefs: 0073B999
W, xrefs: 0073B9B5

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: 58;;$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-3996198472
Opcode ID: 56d8989a38e245f0d533e5b2010a686bd9ffcb2b0e139dc22d146a70d395a9f6
Instruction ID: 425575b44015cad0617775defd6329f144726f7a03262ce8c595655c5c8bff08
Opcode Fuzzy Hash: 56d8989a38e245f0d533e5b2010a686bd9ffcb2b0e139dc22d146a70d395a9f6
Instruction Fuzzy Hash: 8EE1A561D05268CAFB218B24CC447EA7775FF95300F1481EAD58DA7242EB395FC5CB62

Function 0073B68C Relevance: 26.6, APIs: 2, Strings: 13, Instructions: 359COMMON

Download Yara Rule

Strings

58;;, xrefs: 0073C91F
o, xrefs: 0073B96F
L, xrefs: 0073B984
a, xrefs: 0073B9A0
b, xrefs: 0073B992
i, xrefs: 0073B98B
L, xrefs: 0073B968
y, xrefs: 0073B9AE
a, xrefs: 0073B976
r, xrefs: 0073B9A7
d, xrefs: 0073B97D
r, xrefs: 0073B999
W, xrefs: 0073B9B5

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: 58;;$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-3996198472
Opcode ID: 77e41d47abbb3b28f9a248eb3f31f7bd1662ab9a9810ad188d565535c9a0d30e
Instruction ID: 4c6c480d51e9e168e51a16d1dbcb6e2341e542f218bd0dc4a6683fbe2d84bb6b
Opcode Fuzzy Hash: 77e41d47abbb3b28f9a248eb3f31f7bd1662ab9a9810ad188d565535c9a0d30e
Instruction Fuzzy Hash: 20E1A3A1D052688AFB218B24CC847EA7775FF95300F1480EAD58DA7242EB395FC5CF66

Function 0073B707 Relevance: 26.6, APIs: 2, Strings: 13, Instructions: 330libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F
o, xrefs: 0073B96F
L, xrefs: 0073B984
a, xrefs: 0073B9A0
b, xrefs: 0073B992
i, xrefs: 0073B98B
L, xrefs: 0073B968
y, xrefs: 0073B9AE
a, xrefs: 0073B976
r, xrefs: 0073B9A7
d, xrefs: 0073B97D
r, xrefs: 0073B999
W, xrefs: 0073B9B5

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-3996198472
Opcode ID: 322be1a34f4d81431aa03b1047b515092f4120325e75a70f322153ae512ad36f
Instruction ID: cc56b5b46be8da1257bb98a3f9a7d4e79ea67f0cee09e0595ee0db1e0ddf8c0a
Opcode Fuzzy Hash: 322be1a34f4d81431aa03b1047b515092f4120325e75a70f322153ae512ad36f
Instruction Fuzzy Hash: BAD1B561D052688BF7218B24CC847EA77B5FF91310F1580FAD58DA7242DA395FC5CB92

Function 0073B72E Relevance: 26.6, APIs: 2, Strings: 13, Instructions: 318libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F
o, xrefs: 0073B96F
L, xrefs: 0073B984
a, xrefs: 0073B9A0
b, xrefs: 0073B992
i, xrefs: 0073B98B
L, xrefs: 0073B968
y, xrefs: 0073B9AE
a, xrefs: 0073B976
r, xrefs: 0073B9A7
d, xrefs: 0073B97D
r, xrefs: 0073B999
W, xrefs: 0073B9B5

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-3996198472
Opcode ID: fb95ae2f67c642d2c630daf0b9350bb78da5051131dba3b8aa3d02c782c8acb9
Instruction ID: 9dcb040cf5a6b89e753583f2b2ca3c6907778319a202767d6e1eea99fb034137
Opcode Fuzzy Hash: fb95ae2f67c642d2c630daf0b9350bb78da5051131dba3b8aa3d02c782c8acb9
Instruction Fuzzy Hash: 19C19261D052688BFB218B24CC847EA77B5FF91310F1481EAD58DA7242DA3A5FC5CB92

Function 0073B94E Relevance: 26.6, APIs: 2, Strings: 13, Instructions: 308libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F
o, xrefs: 0073B96F
L, xrefs: 0073B984
a, xrefs: 0073B9A0
b, xrefs: 0073B992
i, xrefs: 0073B98B
L, xrefs: 0073B968
y, xrefs: 0073B9AE
a, xrefs: 0073B976
r, xrefs: 0073B9A7
d, xrefs: 0073B97D
r, xrefs: 0073B999
W, xrefs: 0073B9B5

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-3996198472
Opcode ID: b60ce4421ad9eb535f2829ac4cd7594511d94f45f84ee696c053257134959745
Instruction ID: 1663d05f68eda37a854f23a134d3974bc3f0619d482abc9c644ce9cc6f03f881
Opcode Fuzzy Hash: b60ce4421ad9eb535f2829ac4cd7594511d94f45f84ee696c053257134959745
Instruction Fuzzy Hash: 12C1BFA2D052688BF7218B24CC84BEAB7B5EF91310F1480EAD58DA7242D7395F85CF56

Function 0073B7D1 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 296libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F
o, xrefs: 0073B96F
L, xrefs: 0073B984
a, xrefs: 0073B9A0
b, xrefs: 0073B992
i, xrefs: 0073B98B
L, xrefs: 0073B968
y, xrefs: 0073B9AE
a, xrefs: 0073B976
r, xrefs: 0073B9A7
d, xrefs: 0073B97D
r, xrefs: 0073B999
W, xrefs: 0073B9B5

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-3996198472
Opcode ID: 4bae9e28324d64047e6b0ad8c330f3fe3cc61ad4e59d2dbc25d5287e7b91ba18
Instruction ID: c188c6679401bbd54f9536556c94c05a544be3712d4b5fb48e1fb787ee028e94
Opcode Fuzzy Hash: 4bae9e28324d64047e6b0ad8c330f3fe3cc61ad4e59d2dbc25d5287e7b91ba18
Instruction Fuzzy Hash: A4C1B362D052688BF7218B24CC847EA77B5FF91310F1480EAD58DA7242DA3A5FC5CF92

Function 0073B604 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 285libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F
o, xrefs: 0073B96F
L, xrefs: 0073B984
a, xrefs: 0073B9A0
b, xrefs: 0073B992
i, xrefs: 0073B98B
L, xrefs: 0073B968
y, xrefs: 0073B9AE
a, xrefs: 0073B976
r, xrefs: 0073B9A7
d, xrefs: 0073B97D
r, xrefs: 0073B999
W, xrefs: 0073B9B5

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 1029625771-3996198472
Opcode ID: b3cc4a0784e3c32cfa14634f2a7adc362d6519384c53d5bf94efe743124d46b3
Instruction ID: 7cfb4c1f024de21070f5dc2570f8e4c4c150fe9061903f87102a70e6b3a31795
Opcode Fuzzy Hash: b3cc4a0784e3c32cfa14634f2a7adc362d6519384c53d5bf94efe743124d46b3
Instruction Fuzzy Hash: 2CB1A362D052688BF7218B24CC847EA77B5FF91300F1480EAD58DA7242DA7A5FC5CF92

Function 007A4EE1 Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 391COMMON

Download Yara Rule

Strings

o, xrefs: 007A5141
i, xrefs: 007A515D
d, xrefs: 007A514F
L, xrefs: 007A5156
r, xrefs: 007A516B
a, xrefs: 007A5172
r, xrefs: 007A5179
b, xrefs: 007A5164
y, xrefs: 007A5180
W, xrefs: 007A5187
a, xrefs: 007A5148
L, xrefs: 007A513A

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 58ddfe5abf8c4c3572a2c679f54013033417a53b165b61fc4359651a8f62c3f1
Instruction ID: 8cb7a953034a1068f6ec57bd2d6e50ed2cab1a1acb9e326495e80aef3d5947d2
Opcode Fuzzy Hash: 58ddfe5abf8c4c3572a2c679f54013033417a53b165b61fc4359651a8f62c3f1
Instruction Fuzzy Hash: 7CE100B1D045689AEB248B24CC44BEAB775FF91300F1482FAD80D6B281E77D5EC58F62

Function 007ACCF5 Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 349COMMON

Download Yara Rule

Strings

P, xrefs: 007B7998
i, xrefs: 007B78C6
e, xrefs: 007B78F0
P, xrefs: 007B78D4
s, xrefs: 007B78FE
E, xrefs: 007B78B8
x, xrefs: 007B78BF
c, xrefs: 007B78E9
o, xrefs: 007B78E2
s, xrefs: 007B78F7
t, xrefs: 007B78CD
r, xrefs: 007B78DB

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID:
String ID: E$P$P$c$e$i$o$r$s$s$t$x
API String ID: 0-1626331376
Opcode ID: 38923482a2c856a4b248278af1c69e7fbdd98e8c59b93b29966d66e5c2eb1665
Instruction ID: 74f75f26f35cabe01101ca4b33a532f107f68c72e358220e927b16a6a71ef71f
Opcode Fuzzy Hash: 38923482a2c856a4b248278af1c69e7fbdd98e8c59b93b29966d66e5c2eb1665
Instruction Fuzzy Hash: 04E171B1D052689FEB24CB14CD94BEABBB5FB85300F1442EAD44967341DA785EC1CF91

Function 00772A9F Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 304COMMON

Download Yara Rule

Strings

y, xrefs: 00772DC8
i, xrefs: 00772DA5
d, xrefs: 00772D97
b, xrefs: 00772DAC
L, xrefs: 00772D9E
o, xrefs: 00772D89
W, xrefs: 00772DCF
a, xrefs: 00772D90
L, xrefs: 00772D82
a, xrefs: 00772DBA
r, xrefs: 00772DC1
r, xrefs: 00772DB3

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: df3203f4556b521416e035291e508ac6a69f9e6c0079bcac238b0c1ad96f7397
Instruction ID: d7b6a8a9f638f7e268d138fb55a2ca4d5bd4dbfb712961a6c873d4d21ca670d5
Opcode Fuzzy Hash: df3203f4556b521416e035291e508ac6a69f9e6c0079bcac238b0c1ad96f7397
Instruction Fuzzy Hash: C8C102A1D082698EFB248B24DC49BFAB774EF50310F1481FAD54DA7281E67D5FC58B22

Function 0076423C Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 266COMMON

Download Yara Rule

Strings

y, xrefs: 00772DC8
i, xrefs: 00772DA5
d, xrefs: 00772D97
b, xrefs: 00772DAC
L, xrefs: 00772D9E
o, xrefs: 00772D89
W, xrefs: 00772DCF
a, xrefs: 00772D90
L, xrefs: 00772D82
a, xrefs: 00772DBA
r, xrefs: 00772DC1
r, xrefs: 00772DB3

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: cbc952824749a2c7c19d00f5a6b4a4cdb7fb3ca91f3fa89a1fcb75c59dfd2723
Instruction ID: f86a6d49e3430d3b8287b02f9840dc6a2ee4c5a11f83ce717414c70dcb146ff6
Opcode Fuzzy Hash: cbc952824749a2c7c19d00f5a6b4a4cdb7fb3ca91f3fa89a1fcb75c59dfd2723
Instruction Fuzzy Hash: 6EB125A1D082698EFB308B24CC897FAB775EF50314F1481F9D44DA6681E67D4FC59B22

Function 007AD12C Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 175fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 007AD8AB

Strings

P, xrefs: 007B7998
i, xrefs: 007B78C6
e, xrefs: 007B78F0
P, xrefs: 007B78D4
s, xrefs: 007B78FE
E, xrefs: 007B78B8
x, xrefs: 007B78BF
c, xrefs: 007B78E9
o, xrefs: 007B78E2
s, xrefs: 007B78F7
t, xrefs: 007B78CD
r, xrefs: 007B78DB

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: FileRead
String ID: E$P$P$c$e$i$o$r$s$s$t$x
API String ID: 2738559852-1626331376
Opcode ID: cbae7d4ac969f35bbd9b881effaa80ac46ee9489e14c847f6b39496ff107396e
Instruction ID: dc8a479bc0088f52ec6a401a00ea1bee2bead982650bf81805002e83c3e9fdb0
Opcode Fuzzy Hash: cbae7d4ac969f35bbd9b881effaa80ac46ee9489e14c847f6b39496ff107396e
Instruction Fuzzy Hash: 2C61D3B1C042549EFB388B24DD48FEABBB5AB95310F0442FAD40E56681DA7D6EC4CF61

Function 0073FF06 Relevance: 22.8, APIs: 2, Strings: 13, Instructions: 336memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
FE?^, xrefs: 0073FF06
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
y, xrefs: 00740B1E
i, xrefs: 00740AFB
a, xrefs: 00740AE6
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: FE?^$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-1587576117
Opcode ID: ca1e9b969d9eb84d235cdb7c530f011c6786524cdc09d3b8ddaa4ea44986d27a
Instruction ID: 1ef87cb2d53fb56464a19797147b8b207a51e315bef7dcecc5751a707742e038
Opcode Fuzzy Hash: ca1e9b969d9eb84d235cdb7c530f011c6786524cdc09d3b8ddaa4ea44986d27a
Instruction Fuzzy Hash: F8D1C1B2E052689BF724CA24DC45BAABB79EB85310F1040FAD50DA7680D77D5FC18F52

Function 007ABD24 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 292COMMON

Download Yara Rule

Strings

d, xrefs: 007AC962
r, xrefs: 007AC98C
R, xrefs: 007AC843
r, xrefs: 007AC97E
a, xrefs: 007AC95B
a, xrefs: 007AC985
L, xrefs: 007AC94D
i, xrefs: 007AC970
W, xrefs: 007AC99A
843A, xrefs: 007ABD7B
b, xrefs: 007AC977
y, xrefs: 007AC993
o, xrefs: 007AC954
L, xrefs: 007AC969

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: 843A$L$L$R$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-3932493382
Opcode ID: 1d6c25055469e45a61440516a60af798f69cf407dd0718fee1cb7b95e162e015
Instruction ID: a7978934b7f26b921f3754a1440eafd2407c19cda24d8e147896ada08fe3ae9d
Opcode Fuzzy Hash: 1d6c25055469e45a61440516a60af798f69cf407dd0718fee1cb7b95e162e015
Instruction Fuzzy Hash: C0B100B0D042A89FE7248B24CC48BEA7B75EF81310F1441FAD54DA7282D6BD5EC58F62

Function 007404B8 Relevance: 22.8, APIs: 2, Strings: 13, Instructions: 291memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
9B5A, xrefs: 007404B8
y, xrefs: 00740B1E
i, xrefs: 00740AFB
a, xrefs: 00740AE6
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: 9B5A$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-1063467930
Opcode ID: 191be81c19ffc2051f6efd660d8d6cafe5b66d617245423f574154a499352287
Instruction ID: 62be306be1aff5f21bd305b26a1945f3c002284690a02585cbc4e3163955851b
Opcode Fuzzy Hash: 191be81c19ffc2051f6efd660d8d6cafe5b66d617245423f574154a499352287
Instruction Fuzzy Hash: F2C1E3A1E052689BEB25CB24DC45BAABB75EF85310F1081FAD10DA7680D7BD5FC08F52

Function 0073FAEF Relevance: 21.7, APIs: 2, Strings: 12, Instructions: 660COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 2e3e585cef6aeb9599288c0271d1b243796cd9d3adbdffe4a946dcb84dbec19c
Instruction ID: d5feead25dc1952e2abbd9a349c1f0dde323b5d8c028d2867dd11a9aa1c92b84
Opcode Fuzzy Hash: 2e3e585cef6aeb9599288c0271d1b243796cd9d3adbdffe4a946dcb84dbec19c
Instruction Fuzzy Hash: 4052ABB1E052688BEB24CB14CC84BEABB75FB85304F2081EAD80DA7281D7795EC1CF51

Function 007AB894 Relevance: 21.6, APIs: 1, Strings: 13, Instructions: 607memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,3A3646D4,00003000,00000004), ref: 007AC4B4

Strings

d, xrefs: 007AC962
r, xrefs: 007AC98C
R, xrefs: 007AC843
r, xrefs: 007AC97E
a, xrefs: 007AC95B
a, xrefs: 007AC985
L, xrefs: 007AC94D
i, xrefs: 007AC970
W, xrefs: 007AC99A
b, xrefs: 007AC977
y, xrefs: 007AC993
o, xrefs: 007AC954
L, xrefs: 007AC969

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$R$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-2756691126
Opcode ID: 2a674859cd59c49979f144918c303a8e0df89dba96b6b5a5b37bee3632418993
Instruction ID: 4259d096eb9a0cdcc675594ae83aaec48426b5d6cae01c18f2ca87d8fc8f8155
Opcode Fuzzy Hash: 2a674859cd59c49979f144918c303a8e0df89dba96b6b5a5b37bee3632418993
Instruction Fuzzy Hash: CD32BFB1D042689FEB248B24CC84BEAB7B5EF85310F1481EAD44D67282DB795EC5CF52

Function 0073F83A Relevance: 21.4, APIs: 2, Strings: 12, Instructions: 436COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 7cae29aab83ca7edc0f1f3035cdfb21b69b066c6281e4ff667e85936b395aab9
Instruction ID: 3c5836aa4fa15b29d14f1568df4018d14f2f4d7a3c77cafa4ead867cc0269ca5
Opcode Fuzzy Hash: 7cae29aab83ca7edc0f1f3035cdfb21b69b066c6281e4ff667e85936b395aab9
Instruction Fuzzy Hash: 3902D0A2E052689BFB24CB24DC44BEABB75EF85310F1481FAD40DA6680D77D5EC18F52

Function 0074000A Relevance: 21.4, APIs: 2, Strings: 12, Instructions: 421COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 973501270aa56ae09ae4039e66a32f4e90c47beeb6a310f96686219012d44591
Instruction ID: 065a0cb9b40003bb8a4876cb8ecdd1be0383b141e4e56ffb6289b76dd4d486ff
Opcode Fuzzy Hash: 973501270aa56ae09ae4039e66a32f4e90c47beeb6a310f96686219012d44591
Instruction Fuzzy Hash: C4F1A0A2E052689BEB24CB24DC45BEABB75EF85310F1080FAD50DA7680D7795FC18F52

Function 007401EA Relevance: 21.4, APIs: 2, Strings: 12, Instructions: 414memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: c582d787e7e418989103487e7d59c6094514cae46e9312cde05629bb193e2fb5
Instruction ID: 26e6fec73e4b0124cf5920a6bc520e9b945c1003381d0e038349ac1f18ddc90f
Opcode Fuzzy Hash: c582d787e7e418989103487e7d59c6094514cae46e9312cde05629bb193e2fb5
Instruction Fuzzy Hash: CEF1A0A2E042689BE7248A24DC45BEABB75EF85310F1081FAD50DA7680D77D5FC18F52

Function 0073FE33 Relevance: 21.4, APIs: 2, Strings: 12, Instructions: 400COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: d70cdd623c6ff5e5c5f3c2617df1ffd67bce2bd6a30c3c08aa36ead5a732ae6a
Instruction ID: 886896064b09aa9868e5244b0042c8c3dc4361480adbe7f9f1ff2b3c7a5368a0
Opcode Fuzzy Hash: d70cdd623c6ff5e5c5f3c2617df1ffd67bce2bd6a30c3c08aa36ead5a732ae6a
Instruction Fuzzy Hash: 8CE1F2A2E042689BF724CA24DC45BEBBB79EB85310F1041FAD50DA6680D77D5FC18F62

Function 00740438 Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 341COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 4e4d1ee5c33cc016d71e406a0160c54334961762eee94a0bf079849d6fc80f5e
Instruction ID: 01c0c44d6b0703c459fce57a171e751d280e2042653f6d8b5347e7a9130d96c7
Opcode Fuzzy Hash: 4e4d1ee5c33cc016d71e406a0160c54334961762eee94a0bf079849d6fc80f5e
Instruction Fuzzy Hash: A2D105A1E052A88BEB20CB24DC44BAABB75EF85310F1481FAD50DA7681D77D5FC18F52

Function 007401C9 Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 338COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: 1042fea36150735a5688563958fe4ad885375868a46bd49ba5a67a205c0985af
Instruction ID: a0bcfdf831e3f4f8abaf99108a0daec7e823588e27000e10bafcbd26ea812a88
Opcode Fuzzy Hash: 1042fea36150735a5688563958fe4ad885375868a46bd49ba5a67a205c0985af
Instruction Fuzzy Hash: DFD1C2B2E042689BE724CA24DC45BEABB75EB85310F1081FAD50DA7680D77D5FC18F62

Function 0073FF9C Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 327memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: e2b6fd0e1abf24e3d9e3ebf01d249daa5363595202a6f5185868d2facf3b5262
Instruction ID: df28b533fe4b9a231a0df01d588dbf8388530c8a530601da840780956def337a
Opcode Fuzzy Hash: e2b6fd0e1abf24e3d9e3ebf01d249daa5363595202a6f5185868d2facf3b5262
Instruction Fuzzy Hash: 63D1D2A2E042689BF724CA24DC45BEABB75EB85310F1081FAD50DA7680D7BD5FC18F52

Function 0073FF54 Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 322memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: 9dd34207d8338eac8f9fb93acb16d361cffbfec9adbeb446276a27f31b009c98
Instruction ID: 143ab8b82ee3ba96859f4c815a36f8d1522cfaca2655a01f85787facbfe7b55e
Opcode Fuzzy Hash: 9dd34207d8338eac8f9fb93acb16d361cffbfec9adbeb446276a27f31b009c98
Instruction Fuzzy Hash: 6EC1E2A2E042689BF724CA24DC45BEABB75EF85310F1041FAD50DA6680D7BD5FC08F62

Function 007401A0 Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 319memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: 37494907c12288564357288a9b0a2a49502afdaf2ecb55d2816ef6cd98043490
Instruction ID: 16e0217a6f34eaec416a22a879a53093b3ab5e1ea2fd5c076085b03b1cf2f4be
Opcode Fuzzy Hash: 37494907c12288564357288a9b0a2a49502afdaf2ecb55d2816ef6cd98043490
Instruction Fuzzy Hash: ADC1D2A2E042689BE724CA24DC45BEABB75EB85310F1041FAD50DA7680D7BD5FC08F52

Function 007401A7 Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 317memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: 5f68f5fc2a20ac95c794faa6edf58880e5bd9c6e18ca42f21a44040ed45339dc
Instruction ID: 175a212b62397ca0c33a812f994856c676c0af654e0ceedc6b549c2cc20eff92
Opcode Fuzzy Hash: 5f68f5fc2a20ac95c794faa6edf58880e5bd9c6e18ca42f21a44040ed45339dc
Instruction Fuzzy Hash: 16C1D3A2E042689BE724CA24DC45BEABB75EF85310F1041FAD50DA7680D77D5FC18F52

Function 0073FFC2 Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 315memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: c2f327989373934171bfdec5517d1a18ba96226f64c644abddf5354155f70278
Instruction ID: df195f9482eedc8443c546ee9d703cc45470cc034b90ba357330e90e5382a27e
Opcode Fuzzy Hash: c2f327989373934171bfdec5517d1a18ba96226f64c644abddf5354155f70278
Instruction Fuzzy Hash: 98C1D2A2E052689BE724CB24DC45BEABB75EF85310F1041FAD50DA6680D7BD5FC08F52

Function 0073FA5E Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 310memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: 058d6447977b868ab0dc489698eb5c9e4e4a0f744056732a771e9df646101d64
Instruction ID: 3e0ba6ae27131c71296d1ffcb997ff4160cb11e08a17fef837848529519ca563
Opcode Fuzzy Hash: 058d6447977b868ab0dc489698eb5c9e4e4a0f744056732a771e9df646101d64
Instruction Fuzzy Hash: 32C117A2E042589BF724CB24DC45BEA7B79EB85310F1481FAD50DA6680D7BD5FC08F62

Function 0073FE4C Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 309COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: ccc21b4abfacf610edcd0b307c051cf76c308747f4bee5885a11fb257302fd0d
Instruction ID: 912295d988c8d7dea8febdb720497b3602e32489257b686e5ba85f35487397dd
Opcode Fuzzy Hash: ccc21b4abfacf610edcd0b307c051cf76c308747f4bee5885a11fb257302fd0d
Instruction Fuzzy Hash: C0C1F3A2E052689BE721CB24DC45BEABB79EF85310F1440FAD10DA6680D7BD5FC08F52

Function 0073FA75 Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 289memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: 7fd75649bd94031705b386f364834656433c3651bb8e6fb4efe4a46d20b4e2ab
Instruction ID: 5a7a624f9db314bf5b3f50d56593991f15c8c0d88ab29c5398a639b0c5eb160d
Opcode Fuzzy Hash: 7fd75649bd94031705b386f364834656433c3651bb8e6fb4efe4a46d20b4e2ab
Instruction Fuzzy Hash: 5DB1F4A2E052689BF724CB24DC45BAA7B79EF85310F1481FAD10DA6680D7BD5FC08F52

Function 007404CB Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 287memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: 7c41e0ce4fd8e3bc84b018321328c9ad3adc79975dc7ea8fae0c964eaf59cf11
Instruction ID: 111349374371b2f3a2bd749e634b3ea124b9b6fc4457bb176af46941c8235178
Opcode Fuzzy Hash: 7c41e0ce4fd8e3bc84b018321328c9ad3adc79975dc7ea8fae0c964eaf59cf11
Instruction Fuzzy Hash: 4CC1F3A1E052688BEB21CB24DC45BAABB75EF85310F1081FAD10DA7680D7BD5FC08F52

Function 0073FA8D Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 282memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: 3be8b5769921a0cc48d0f4db4314990560c0bfe6d66a159d7c5bf376edf4e6d6
Instruction ID: 10f3b688e0f20c1c76682856d6a2c9f60a4b04b0a71f7dc90945826c8c6ccaea
Opcode Fuzzy Hash: 3be8b5769921a0cc48d0f4db4314990560c0bfe6d66a159d7c5bf376edf4e6d6
Instruction Fuzzy Hash: EBB104A2E052689BF724CB24DC45BAA7B79EF85310F1081FAD10DA6680D7BD5FC08F52

Function 00740292 Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 281memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: 0df2ed6db5846c7791f78cf44373eda3ba58a6ab84ec8c8689043ee228c389ce
Instruction ID: 44f5b9a7b71c002a0ec70021a7f8e3e5f016bfce8f4b1d2dd572a967a6b11414
Opcode Fuzzy Hash: 0df2ed6db5846c7791f78cf44373eda3ba58a6ab84ec8c8689043ee228c389ce
Instruction Fuzzy Hash: 11B1E3A1E052689BEB25CB24DC45BAABB75EF85310F1041FAD10DA7680D7BD5FC08F52

Function 007405AC Relevance: 21.3, APIs: 2, Strings: 12, Instructions: 266memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,?,?,?,?,0073FAE5,?,?,?,?,?,0073FA55), ref: 00740629

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-4069139063
Opcode ID: 108f6cad63c1af9b5bdb1ea0f0e5207ce858bb0c7a7d26f8d7f4734a060fe4b7
Instruction ID: e8788e8a4d5d21c9ca403aeacbb4bae245b1457db898395fb07bad8eb5761752
Opcode Fuzzy Hash: 108f6cad63c1af9b5bdb1ea0f0e5207ce858bb0c7a7d26f8d7f4734a060fe4b7
Instruction Fuzzy Hash: 9CA1E2A2E052689BE725CB24DC05BAABB75EF95310F1081FAD10DA6680D7BD5FC08F52

Function 007AB616 Relevance: 21.3, APIs: 1, Strings: 13, Instructions: 251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,3A3646D4,00003000,00000004), ref: 007AC4B4

Strings

d, xrefs: 007AC962
r, xrefs: 007AC98C
R, xrefs: 007AC843
r, xrefs: 007AC97E
a, xrefs: 007AC95B
a, xrefs: 007AC985
L, xrefs: 007AC94D
i, xrefs: 007AC970
W, xrefs: 007AC99A
b, xrefs: 007AC977
y, xrefs: 007AC993
o, xrefs: 007AC954
L, xrefs: 007AC969

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$R$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-2756691126
Opcode ID: 0d5f8edfd1e033f6d9d081d1bd345ceb3d76d614d8c06da33463d9ec5a6ffa5d
Instruction ID: 7333ca75afcf5120e03cd0c0e2a3d1d453da9215cffabbed621afc641574e330
Opcode Fuzzy Hash: 0d5f8edfd1e033f6d9d081d1bd345ceb3d76d614d8c06da33463d9ec5a6ffa5d
Instruction Fuzzy Hash: 68A1E2A1C042A8DBEB318B64CC487DA7B75EF91310F1441FAD44DA7282D77D5AC6CB62

Function 007AB874 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 220COMMON

Download Yara Rule

Strings

d, xrefs: 007AC962
r, xrefs: 007AC98C
R, xrefs: 007AC843
r, xrefs: 007AC97E
a, xrefs: 007AC95B
a, xrefs: 007AC985
L, xrefs: 007AC94D
i, xrefs: 007AC970
W, xrefs: 007AC99A
b, xrefs: 007AC977
y, xrefs: 007AC993
o, xrefs: 007AC954
L, xrefs: 007AC969

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$R$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-2756691126
Opcode ID: b45bca3c18b8e26a939dcd03d75f24c1a54a8a9fc1d17548d88bbecef47c6c62
Instruction ID: 213573c96664e74ced76b6d6bee85e10e71faf2fed0dd29bbce066a38cc0c4e5
Opcode Fuzzy Hash: b45bca3c18b8e26a939dcd03d75f24c1a54a8a9fc1d17548d88bbecef47c6c62
Instruction Fuzzy Hash: B8911360C082E8DBEB318B64CC487DA7B74EF52310F1401FAD54DA7292D6BE5AC5CB62

Function 00740977 Relevance: 19.9, APIs: 1, Strings: 12, Instructions: 445COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: a3833399d696baba5925ae65bb34a2ac1f86f8e0c8dd2363374f28492a0a4c00
Instruction ID: 91c03bf4449fcee68e37a6fab38efa5ee55035bc8de98192bf48c0e7242de6b0
Opcode Fuzzy Hash: a3833399d696baba5925ae65bb34a2ac1f86f8e0c8dd2363374f28492a0a4c00
Instruction Fuzzy Hash: 00F1C2B1E042689FE7208A24DC44BEABB75EF95310F1481FAD50DAA680D77D5EC1CF62

Function 00740819 Relevance: 19.8, APIs: 1, Strings: 12, Instructions: 277COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 626286dc3145a9ceb373ec54416ee02e9362e85d65e9bd09d9c3b5e6838d890c
Instruction ID: 3e95d2feeb67176d6891962c2642164ed711a586097a5058acfc4353a387060d
Opcode Fuzzy Hash: 626286dc3145a9ceb373ec54416ee02e9362e85d65e9bd09d9c3b5e6838d890c
Instruction Fuzzy Hash: C0B1E4A1D092688AEB208B20DC44BFAB775EF95310F1440FAD54DAA681D7BD5FC1CF62

Function 00740652 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 332b3e6430d19420b1ee0080fd6fc520b97be395d3ae14560607965414a2d83c
Instruction ID: 1b0a70c3558b94bba71acbc3aebf28e1e6776e57268d0af5a61c9b0945094ea8
Opcode Fuzzy Hash: 332b3e6430d19420b1ee0080fd6fc520b97be395d3ae14560607965414a2d83c
Instruction Fuzzy Hash: D981C3A2E092689BF7218B24DC05BAA7B75EF95310F1480F9D14DA7680D7BD5FC08F62

Function 00740887 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 206COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 12c25f12408f7817a32ae4db1752b6294e1cd68d6914459cb0563eff8df6a94d
Instruction ID: 938d5cd6c0785070137a1bb85ac6eee8042acb15e855e67a7211da13fcf1564f
Opcode Fuzzy Hash: 12c25f12408f7817a32ae4db1752b6294e1cd68d6914459cb0563eff8df6a94d
Instruction Fuzzy Hash: C481F5A1E19268DAFB218B24DC05BAA7B75EF94310F1040F9D50DAB680D7BD5FC18F62

Function 007406A5 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 201COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: b1f61200e529b8c7f4376567ac66b02105bde492e96273f1b940a1884bbd18fb
Instruction ID: d67c4e7773017f27fc068196d63f2775f2993fe5483f3efcb7a5b8b083ecee16
Opcode Fuzzy Hash: b1f61200e529b8c7f4376567ac66b02105bde492e96273f1b940a1884bbd18fb
Instruction Fuzzy Hash: C181C461E05268DAEB21CB24DC04BAA7B75EF95310F1040F9D10DA7680D7BD5FC18F66

Function 007406E8 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 187COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: cc4925b0cf0388dc3c652625eea76bab694f73e0d50806dce0be33916bdec234
Instruction ID: ae5fac36a3d8756d0595e89914bcbe1abdf3a7d60fab5592ebd2c89f72cd2efd
Opcode Fuzzy Hash: cc4925b0cf0388dc3c652625eea76bab694f73e0d50806dce0be33916bdec234
Instruction Fuzzy Hash: CA71E561E09268DAFB21CA20DC45BAA7B75EF55310F1080F9D10DAB681D7BE5FC08F66

Function 0074098E Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 183COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: b48c769832a94e32108240dc1840d14c81d1ea0f691112e3d8d0c1baef4c5d8a
Instruction ID: 8c901ed2447b4971717ed865aaf92fc6d8846e4490bd08138d13c1deabf96139
Opcode Fuzzy Hash: b48c769832a94e32108240dc1840d14c81d1ea0f691112e3d8d0c1baef4c5d8a
Instruction Fuzzy Hash: 8971B161E092688BEB21CA20DC45BAABB75EF55310F1080F9D10DAB680D7BD5FC18F66

Function 00740702 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 177COMMON

Download Yara Rule

Strings

L, xrefs: 00740AD8
d, xrefs: 00740AED
a, xrefs: 00740B10
a, xrefs: 00740AE6
r, xrefs: 00740B17
r, xrefs: 00740B09
W, xrefs: 00740B25
o, xrefs: 00740ADF
L, xrefs: 00740AF4
b, xrefs: 00740B02
y, xrefs: 00740B1E
i, xrefs: 00740AFB

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: c46c570d5446a2d5467e1f42c2a2ce5184b1b281cab986c7b8fd1b9a6c231fcd
Instruction ID: e5a1adc3b0aa78e973c0d867801080ee3ebd39684ccda421f37ab1743ea3fc7a
Opcode Fuzzy Hash: c46c570d5446a2d5467e1f42c2a2ce5184b1b281cab986c7b8fd1b9a6c231fcd
Instruction Fuzzy Hash: 7E71D261E092A8CAFB21CA20DC45BAA7B75EF55310F1440F9D10DAB681D7BE5FC08F66

Function 00747867 Relevance: 15.1, APIs: 2, Strings: 6, Instructions: 1054memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

YQ, xrefs: 00747DFD
8, xrefs: 00747F5F
n, xrefs: 00747F73
n, xrefs: 00747F7D
9O2H, xrefs: 00747D15
x, xrefs: 00747F87

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 8$9O2H$YQ$n$n$x
API String ID: 544645111-3304744247
Opcode ID: 69386a36971a658fc630513184ed7c099aa3821ad6824479479b6fcbaebe94e8
Instruction ID: cb88efaade75dabd8b740292696c45642fcd359fbe7cfcb11178af818f32e39b
Opcode Fuzzy Hash: 69386a36971a658fc630513184ed7c099aa3821ad6824479479b6fcbaebe94e8
Instruction Fuzzy Hash: 3492E3B2D052299FE768CB24DD95BEABB79EB80304F1481FAD80D67280D7385EC5CE51

Function 0073C0DB Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 261libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F
>I=8, xrefs: 0073C164

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;$>I=8
API String ID: 1029625771-155885316
Opcode ID: 35e1ac0cfd89fe0ec794b65637f3b9deb7f65578e6540b6b36b4b01e1dad12aa
Instruction ID: b320641c0bd27183c3a75f6ce39be74e726d2c5e446dafe692a99fe533720aab
Opcode Fuzzy Hash: 35e1ac0cfd89fe0ec794b65637f3b9deb7f65578e6540b6b36b4b01e1dad12aa
Instruction Fuzzy Hash: B5A1A1B2D052288BF7258B24DC54BEA7775FF95310F1081FAD44DA7282EA395F818F92

Function 00790285 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007906CB

Strings

6P5J, xrefs: 007901A1
V, xrefs: 0079017C
:6G4, xrefs: 00790185

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 6P5J$:6G4$V
API String ID: 544645111-4136328420
Opcode ID: 41ab6318d1e11c53fb6b31b663cc187aabf6f52d288538c19d9329ccb153bc5e
Instruction ID: febd65453732466fbf5ca646489f53238adb67ca22337f6a11c9ea493e5c7f10
Opcode Fuzzy Hash: 41ab6318d1e11c53fb6b31b663cc187aabf6f52d288538c19d9329ccb153bc5e
Instruction Fuzzy Hash: 3691A0B1D146689FEB64CB24EC94AEAB7B5EF84310F1041FAD40DA7280D7785AC18F51

Function 007901DE Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210COMMON

Download Yara Rule

Strings

6P5J, xrefs: 007901A1
V, xrefs: 0079017C
:6G4, xrefs: 00790185

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID:
String ID: 6P5J$:6G4$V
API String ID: 0-4136328420
Opcode ID: aefc00fab04364c5526d428b14c983b1f0945961f141436e2c9f42166c4c0ad6
Instruction ID: 6ee9c9a22a86a8d8e347f1806e2f7aa75200fbc60cb5693f5cd8324ae2fa9533
Opcode Fuzzy Hash: aefc00fab04364c5526d428b14c983b1f0945961f141436e2c9f42166c4c0ad6
Instruction Fuzzy Hash: 9981E1B1D141299EEB248B65EC54AFAB7B5FF84310F1081FAE44DA6280D7785EC2CF51

Function 0073BBAA Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 359libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: cc2e511995be5be34fab9666ca07c63b00c2c3c7d2036cbbed0b7bd9617dc367
Instruction ID: 18070a0604987fb18975157e194508ab14a65b23ab7d0a6502eae1af4869d82a
Opcode Fuzzy Hash: cc2e511995be5be34fab9666ca07c63b00c2c3c7d2036cbbed0b7bd9617dc367
Instruction Fuzzy Hash: 32E1C2B2D046688BE724CB24CC547EAB7B1FF95310F1481EAD549A7282E7395EC1CB52

Function 0073C4C6 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: 58;;
API String ID: 0-1097885115
Opcode ID: e313e241e25a06ed6e75e972cb07b4dd85bdb7d140b035caedc03ab4db9f7bc6
Instruction ID: f4b8b14da449403928a062ac6ce8f6783e7785ccbe94bf7a728c56328dbc77d0
Opcode Fuzzy Hash: e313e241e25a06ed6e75e972cb07b4dd85bdb7d140b035caedc03ab4db9f7bc6
Instruction Fuzzy Hash: 3AB1CEB2D052688BFB218B24DC44BEAB775EF95310F1480FAD44DA7282E6395EC1CF56

Function 0073C2C6 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: 58;;
API String ID: 0-1097885115
Opcode ID: 22ca3381ebd58f7cb10a37d7fd096ac8d21137ad97239cc4f3eca2fc889d32ba
Instruction ID: d02923b8f9ae7b42144835983af51eba7d92ed260cfda2af45ca078d2e7330df
Opcode Fuzzy Hash: 22ca3381ebd58f7cb10a37d7fd096ac8d21137ad97239cc4f3eca2fc889d32ba
Instruction Fuzzy Hash: AEB1B0B2D052688BFB218B24DC44BEAB7B5FF95300F1480EAD54DA7242E6395EC1CF56

Function 0073C3E8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID: 58;;
API String ID: 0-1097885115
Opcode ID: b58c26a595d89cbe3261a6ae415f4e93fe19bb261545e45a9169b1c0276ddc4e
Instruction ID: 39c51a42e9e760cf594c0e2a09296b85a2f73111fa6fe0564da26817b26be279
Opcode Fuzzy Hash: b58c26a595d89cbe3261a6ae415f4e93fe19bb261545e45a9169b1c0276ddc4e
Instruction Fuzzy Hash: 26B1AEB1D052688BFB218B24DC44BEAB7B5EF95310F1481EAD44DA7282E6395EC1CF52

Function 0073C39B Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: 48c925df8cf96d39180aa67d21354ed0d431ea75e16f728e69d16fbd790784c4
Instruction ID: c2a7d60a5c0c25486132e72d5554ee3e2472c3f822110bf07deb58917a2c8a0a
Opcode Fuzzy Hash: 48c925df8cf96d39180aa67d21354ed0d431ea75e16f728e69d16fbd790784c4
Instruction Fuzzy Hash: FA81C2B2D052688BFB218B24CC547EA77B5FF95310F1481EAD44DA7242EA395EC1CF52

Function 0073C3A1 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: 02116d4912179def992d5bf33905613bc785c13a830d5d32e930fbe84121da88
Instruction ID: edb2fbe157f6ea86a03df50fc6aa9ee59e50eb3fc52754648f6d8c54efc65555
Opcode Fuzzy Hash: 02116d4912179def992d5bf33905613bc785c13a830d5d32e930fbe84121da88
Instruction Fuzzy Hash: 7181B2B2D052688BFB218B24DC447EA77B5FF95310F1481FAD44DA7242EA395E81CF52

Function 0073C16A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: 46284f666c03a09767970508c6776837150aa35730913134bccddb1521d6f27d
Instruction ID: 88a09555114d0416dc4d9dcf47828b235de19887a1d43686a4e5f916c4883113
Opcode Fuzzy Hash: 46284f666c03a09767970508c6776837150aa35730913134bccddb1521d6f27d
Instruction Fuzzy Hash: 8C81AEB2D052688BFB218B24DC547EA7775FF95300F1081FAD44DA7282EA399E85CF52

Function 0074717D Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 374COMMON

Download Yara Rule

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID:
String ID: 9O2H
API String ID: 0-1121337113
Opcode ID: 0c07162519cacff6acc55bec96d5c2d631f534974b0ae796fa17a3ab91ce2f0f
Instruction ID: c35ba289bfe4ffc3897377801fd3e9cb326d7e83a01990c87a365b8f0143b7d9
Opcode Fuzzy Hash: 0c07162519cacff6acc55bec96d5c2d631f534974b0ae796fa17a3ab91ce2f0f
Instruction Fuzzy Hash: AEE16CB1D092689FEB28CB24DD94BEABBB6EB84310F1481E9D80D67241D7395EC1CE51

Function 0074764F Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 236memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: 655e6a42d58379f49f5ea78439d7a84d37b54a89369f73c65b207491431b7d99
Instruction ID: 1d360dd1b2e8f4d02345483563c3ed339bebf4e083711e8bed504d86e3dd888f
Opcode Fuzzy Hash: 655e6a42d58379f49f5ea78439d7a84d37b54a89369f73c65b207491431b7d99
Instruction Fuzzy Hash: 5B91C2B2D051299BE7248B64DD85BFA7B79EF84310F1580B9E80D67280E73C5EC5CB61

Function 0042FF22 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 0043025C

Strings

;AEG, xrefs: 004304C0

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID: ;AEG
API String ID: 2949231068-310388792
Opcode ID: e283daf0454460f5befa1cdcb6e6f51ea6255e925627109cc1915e2f62c0574b
Instruction ID: 5887eae4052711c59592a9dd49dea0a6b65758c7c71c3e36ac2cc2c32c1e17ed
Opcode Fuzzy Hash: e283daf0454460f5befa1cdcb6e6f51ea6255e925627109cc1915e2f62c0574b
Instruction Fuzzy Hash: 92818B70D086688FDB24CB14DCA0BAAB7B5FF89301F1482EAD80967742D7396E85CF05

Function 007735D1 Relevance: 1.9, APIs: 1, Instructions: 444memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00773CD9

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5c7c7533aa67f86da7fb4516ab1ececff61193c8d85efa719629fb0566206397
Instruction ID: 3b63e4ba873f4637a53727b973c6e1a6d5a3331fc8f31467f7eabef3a2659cb8
Opcode Fuzzy Hash: 5c7c7533aa67f86da7fb4516ab1ececff61193c8d85efa719629fb0566206397
Instruction Fuzzy Hash: 5B0267B1E042288BEB24CB24DC84BEAB7B5EB85344F1481EAD94D66280D6786FC1DF51

Function 0042F6BC Relevance: 1.9, APIs: 1, Instructions: 356nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 0043025C

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: f94a0ba367229d31413a577a058c824ef2d1d0ea4ae30b261ca976f27c157ad5
Instruction ID: 5e4d2b6425af27c640fa6e31b4d31ca192e23736c938c5ceb0006c0e2512c2fe
Opcode Fuzzy Hash: f94a0ba367229d31413a577a058c824ef2d1d0ea4ae30b261ca976f27c157ad5
Instruction Fuzzy Hash: 47E1E0B1E042648BEB24CA14DC90AEBBBB5EB85314F9481FAD84D67641D3395EC6CF41

Function 007A5559 Relevance: 1.8, APIs: 1, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5288a0ab1f91f2708ca991f54d850724edcf9b27b6adea1d629f01fa0a91c480
Instruction ID: 0e9a293c695e4e5f57e59800716da3ca0fc1567abbf6fe8e343fe4de015f1378
Opcode Fuzzy Hash: 5288a0ab1f91f2708ca991f54d850724edcf9b27b6adea1d629f01fa0a91c480
Instruction Fuzzy Hash: 12D19FB1D005698FEB24CF14CC94BEABB75EB86310F1482EAD94E67641D6385EC5CF41

Function 007A5376 Relevance: 1.7, APIs: 1, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453253ba8c23715a24c4985ade3d381c976caa0aa89c4be394ddd4ffd2e6fb24
Instruction ID: 4a67290f9ed1b184878f4b0c4b8ade873aa1fe7ce3345835d39bed0c45c19792
Opcode Fuzzy Hash: 453253ba8c23715a24c4985ade3d381c976caa0aa89c4be394ddd4ffd2e6fb24
Instruction Fuzzy Hash: 238103F2C04964DAE7248B20DC55BFA7776FBD5301F1482FAE90AA6681E73C5EC18E11

Function 004354BD Relevance: 1.7, APIs: 1, Instructions: 208memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 377c7df89d80da11ef3d092481d2acc270e8805a47df935d931cb81bec5ee1bc
Instruction ID: 132e9914ea113e4d8b5022472a6d7401beea8cf73d49ef6df81c4ba0e97e9409
Opcode Fuzzy Hash: 377c7df89d80da11ef3d092481d2acc270e8805a47df935d931cb81bec5ee1bc
Instruction Fuzzy Hash: 4E7136B1C045269AE7248B21DC50BFAB775EF59310F1091FBE94EA6280E63C5EC2CF56

Function 007A5C82 Relevance: 1.7, APIs: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007A6093

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0abf808ab98f5123bd96dde9f6d3a1ef5512c6c6c3905857d5311dcd95ed2cd4
Instruction ID: 21ef686bcfc5122675b2b0fc923d629dee9d324572514eb40ba44f2ad95b7b6d
Opcode Fuzzy Hash: 0abf808ab98f5123bd96dde9f6d3a1ef5512c6c6c3905857d5311dcd95ed2cd4
Instruction Fuzzy Hash: A27112B2D00A298FE7248B24CC84AEAB771EF85311F1482FDD90D67240E6389EC5CF52

Function 007A5247 Relevance: 1.7, APIs: 1, Instructions: 187memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007A6093

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 78f0b983962653205e1cbcb56935746c48326087a18a860e347ff1286413efe6
Instruction ID: 556411ea49806bbdc1e8866b0e3f0db7b72a811e16907259a2658e6189752600
Opcode Fuzzy Hash: 78f0b983962653205e1cbcb56935746c48326087a18a860e347ff1286413efe6
Instruction Fuzzy Hash: 3361FFB2D04954DEEB248A20DC55BFA7775EBD5301F1482FAE50EAA681E73C5AC08E12

Function 007A5AB6 Relevance: 1.7, APIs: 1, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007A6093

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 52a954b9bdf0ddbb811c70d31640052fbf532a653c5ebe18fe769b0858905ff1
Instruction ID: 117547384976ce7bd6d77f4e0a7deb75a96e20341bc361802c9e6f6e7c19d0a9
Opcode Fuzzy Hash: 52a954b9bdf0ddbb811c70d31640052fbf532a653c5ebe18fe769b0858905ff1
Instruction Fuzzy Hash: A071F6B1D009298ADB248F24CC84AFAB775EF95311F1482FDE94E67644E6384EC5CF51

Function 0042F919 Relevance: 1.7, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68dc788df5f1fccde9be20d50e46d84b31ddcb8dc2f3f2c3b06feae6ebb5e13f
Instruction ID: 4daaebef2b5fb0ad50d04981375063e23a21d00829eff6e35d2e14305338b352
Opcode Fuzzy Hash: 68dc788df5f1fccde9be20d50e46d84b31ddcb8dc2f3f2c3b06feae6ebb5e13f
Instruction Fuzzy Hash: BB513AB1E041745AE720CA24EC90BEBBBB8AF82314F9881FBC88D56141D2395FC9CF51

Function 00790291 Relevance: 1.6, APIs: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007906CB

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fea2c02335a52256f84b58949ca89b17a4f4db96b40d5418258d7a742afcf12a
Instruction ID: 20c33d57d93e9cb41971b9ca3ddbb228179f7a4c3bcc4c3c1952b43d6a8410e5
Opcode Fuzzy Hash: fea2c02335a52256f84b58949ca89b17a4f4db96b40d5418258d7a742afcf12a
Instruction Fuzzy Hash: 85518FB1E181689FEB64CA24DD54BEBB7B5FBC5314F1081FAD40DA6280C7786EC18E51

Function 00790060 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ccc6a2e0f4554f6a7b5c9d051f6f8a7a4235b4900a9c32c1935092db39baacd6
Instruction ID: 64a3db4b89848d1a65bba6de4cdb3000778e15d514005d0fed740433e0662e8f
Opcode Fuzzy Hash: ccc6a2e0f4554f6a7b5c9d051f6f8a7a4235b4900a9c32c1935092db39baacd6
Instruction Fuzzy Hash: FD4182B1E181289FEB24CA24ED54BBB7775FBC5314F1081FAE50D96280C7785EC28E61

Function 0079006D Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6ceec2c104d6f5eec4ea6a1cd2d7c810db73bf5cbb5903ac98f7262051a28be4
Instruction ID: 0526c7e4ac0d0a4dbf31b0c1b14f489e2664552e88457ce6240d38aa7e4c6b17
Opcode Fuzzy Hash: 6ceec2c104d6f5eec4ea6a1cd2d7c810db73bf5cbb5903ac98f7262051a28be4
Instruction Fuzzy Hash: 944181B1E181289FEB24CA24DD54BBB7775FBC5314F1081FAE50D96280C7785EC28E61

Function 00750056 Relevance: 1.6, APIs: 1, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000), ref: 0075056A

Memory Dump Source

Source File: 00000000.00000002.1655851065.0000000000750000.00000040.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e6dbbbd7735032f95aeee03a1d506fbb5f674d50d8fb0a533bbcff43bbe4cd61
Instruction ID: 88b3bad35b67e07099f44c40bf991a56ab9bd8cf1b9148cc01271472f2d4d77e
Opcode Fuzzy Hash: e6dbbbd7735032f95aeee03a1d506fbb5f674d50d8fb0a533bbcff43bbe4cd61
Instruction Fuzzy Hash: C7410671D042289FE7208B65DC94BEBB779EB85311F1040FAD84D56181E67C1EC5CE51

Function 00790020 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e04ebaee61accc9e54c64cd157f1275efcae64d39b36e5f2e98e3628de4a937c
Instruction ID: ddd69a03a29d2f5070ef9fc189dbdae3163a784b6d3017cd12a79556344dc716
Opcode Fuzzy Hash: e04ebaee61accc9e54c64cd157f1275efcae64d39b36e5f2e98e3628de4a937c
Instruction Fuzzy Hash: AC41A1B1E182289FEB24CA24DD54AFB7779FBC5314F1081FAE50D96280C7785EC28E61

Function 0042FADD Relevance: 1.6, APIs: 1, Instructions: 119nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 0043025C

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: fc2c7cf506ee0b7218e6718aa60b809288b12ec73738e03229235574524ce91d
Instruction ID: a73b48649596a081ff00b43c8662d84fff5c9f01465cc5fb8c965ebb436d6dc1
Opcode Fuzzy Hash: fc2c7cf506ee0b7218e6718aa60b809288b12ec73738e03229235574524ce91d
Instruction Fuzzy Hash: 3E4139B2E042645FF3208625ED94AD77F78EF81310F5581FBD80D56641E33D5ACACA62

Function 0075006E Relevance: 1.6, APIs: 1, Instructions: 119memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000), ref: 0075056A

Memory Dump Source

Source File: 00000000.00000002.1655851065.0000000000750000.00000040.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0d38eb02bf5988aadbaa3aff9ad3af785d0c4f9826c025fc20400dc4bfc70604
Instruction ID: 21f0e5c78ed097ec5022694784ac529f56c1a63904319ba8dc2fba17b2c4a10b
Opcode Fuzzy Hash: 0d38eb02bf5988aadbaa3aff9ad3af785d0c4f9826c025fc20400dc4bfc70604
Instruction Fuzzy Hash: EB4115B1D042689FE7208B64DC94BFBB7B9EB84301F1040FAE84996281EA7C1EC5CF51

Function 007500CD Relevance: 1.6, APIs: 1, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000), ref: 0075056A

Memory Dump Source

Source File: 00000000.00000002.1655851065.0000000000750000.00000040.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 83acba34f04cc2e89f03197099f351d246db45fdf87ac217c6749198d40e5b94
Instruction ID: cd41aad4cf639320e1cbba948c71665a1015a1d2b7dcb40bb968993dcdd043fe
Opcode Fuzzy Hash: 83acba34f04cc2e89f03197099f351d246db45fdf87ac217c6749198d40e5b94
Instruction Fuzzy Hash: 4341F6B1D042589FE7208B64DC94BEBBB75EB85311F1041EAD90957281DB781EC5CF51

Function 0042FA0F Relevance: 1.6, APIs: 1, Instructions: 98nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 0043025C

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: a51b0ff87929bae328d2f8dfdbd0b84845f71c2d5384a653341606a2255ee195
Instruction ID: bbe5f3d4508f6bb491e922783528a55be6d3a3b751996fe41539b1e95ef27311
Opcode Fuzzy Hash: a51b0ff87929bae328d2f8dfdbd0b84845f71c2d5384a653341606a2255ee195
Instruction Fuzzy Hash: FB316872D041748BE7208A15EC54BEB7BB4AF41324F9481FBC80D62141D77D5ACACF92

Function 0043017F Relevance: 1.6, APIs: 1, Instructions: 61nativeCOMMON

Download Yara Rule

APIs

NtQueryDefaultLocale.NTDLL(00000000,?), ref: 0043025C

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 77eeeeca6e4505cd6c0c4391d730fecbee5df49174bae7b5a293fae14be33c88
Instruction ID: a47955e0fcfd996dd0e357a395fa4fdfc108ce78eaeab6f8da54b42659e62769
Opcode Fuzzy Hash: 77eeeeca6e4505cd6c0c4391d730fecbee5df49174bae7b5a293fae14be33c88
Instruction Fuzzy Hash: 3F21B0B19046688EEB288A50DCA57FF77B5BB48310F1492EAC51A62641D7395FC1CF05

Function 00430170 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: DefaultLocaleQuery
String ID:
API String ID: 2949231068-0
Opcode ID: 8b6194b5d2dc29d37a14f1a9645cca6bcbe631424eeaac79b12cf9236199033b
Instruction ID: 69483c8c6523136a5aeb5f6ba826a63d120030070d2f74067f832d172a7b1f8f
Opcode Fuzzy Hash: 8b6194b5d2dc29d37a14f1a9645cca6bcbe631424eeaac79b12cf9236199033b
Instruction Fuzzy Hash: E501B170D082688FDB25CB10DCA07DF77B4AF49304F0041DAC51922641D7396E82CF46

Function 00740D0A Relevance: 1.5, APIs: 1, Instructions: 207COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 94dfbe9b256fa97ba2459b2ee9c3c4fd51ff0f7198f95132a686f4466021b58e
Instruction ID: d4b6c5abf897764c0482ab14e57cbdd635c4a26fa385276dc1e8b97dc2ff293f
Opcode Fuzzy Hash: 94dfbe9b256fa97ba2459b2ee9c3c4fd51ff0f7198f95132a686f4466021b58e
Instruction Fuzzy Hash: F77117B2E04264DFEB649A61DC84BFB7778EB41310F1081BAEA4D66180D77C9DC1CEA1

Function 00787450 Relevance: 42.3, APIs: 1, Strings: 23, Instructions: 332
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00787795

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 983334009-215400123
Opcode ID: ca5e0b8f7e157f099901af6257e78c32a8a9a12234d9cc70c4ef8c38be5d2f87
Instruction ID: c6b7e0b16ea7cb59a4b1f8fb6ba0f741cd212477f2d7079355c92b9957e756e8
Opcode Fuzzy Hash: ca5e0b8f7e157f099901af6257e78c32a8a9a12234d9cc70c4ef8c38be5d2f87
Instruction Fuzzy Hash: 91F1AF71D086A88BEB28CB28CC98BEABBB5AF44314F1440E9C54D67252D7799FC1CF51

Function 00784E30 Relevance: 42.3, APIs: 1, Strings: 23, Instructions: 265injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 00784F4B

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 3559483778-215400123
Opcode ID: 126753f64f13b8183b2f92366cd8efd58da03e11ea34f0e2f22f8956ad762388
Instruction ID: ca27f6fcbb70321fec2cf439c35bb904fc22061690871138ab9f6310448d00b8
Opcode Fuzzy Hash: 126753f64f13b8183b2f92366cd8efd58da03e11ea34f0e2f22f8956ad762388
Instruction Fuzzy Hash: 5EB1E3B1D096A88AFB248A24DC987EA7B75AF51304F0440F9C54D67282D6BD4FC5CF62

Function 007876A6 Relevance: 42.3, APIs: 1, Strings: 23, Instructions: 263
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00787795

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ContextThreadWow64
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 983334009-215400123
Opcode ID: 9f754cca3fa4fecd03466178994652d2d1e957b76111d15332c3c8577acd41e2
Instruction ID: 47dec3a3a6574aeecb98cf08dd1314104b3605a5dbaec0a88b507baeed1c9073
Opcode Fuzzy Hash: 9f754cca3fa4fecd03466178994652d2d1e957b76111d15332c3c8577acd41e2
Instruction Fuzzy Hash: E7B10571D086A88AEB248B28DC48BEABB75AF51314F1440F9D54D67282D7BE4FC5CF12

Function 00435E2B Relevance: 31.8, APIs: 1, Strings: 17, Instructions: 278
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Strings

s, xrefs: 004367EA
r, xrefs: 00436368
e, xrefs: 0043629B
p, xrefs: 004362B7
P, xrefs: 004367C7
i, xrefs: 004367B9
E, xrefs: 004367AB
2, xrefs: 00436294
e, xrefs: 004362CC
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
r, xrefs: 004367CE
s, xrefs: 004367F1
2, xrefs: 004362DA
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 2$2$E$P$c$e$e$e$i$o$p$r$s$s$t$x$r
API String ID: 544645111-3542425195
Opcode ID: d48b1c4c2420593176b7fe14f744cf7842dccbc861e74eaed4eeeee5f28972e7
Instruction ID: 8c09bbc06d67063911a941368d3e86a3ea25b69c4aba8842cf887f8d291f28e9
Opcode Fuzzy Hash: d48b1c4c2420593176b7fe14f744cf7842dccbc861e74eaed4eeeee5f28972e7
Instruction Fuzzy Hash: 1EC1D0B1D045698FEB24CB18CC84BEABBB5AF85304F0481EAD44D67342D6399EC5CF96

Function 007A4DB4 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 207COMMON

Download Yara Rule

Strings

o, xrefs: 007A5141
i, xrefs: 007A515D
d, xrefs: 007A514F
L, xrefs: 007A5156
r, xrefs: 007A516B
a, xrefs: 007A5172
r, xrefs: 007A5179
b, xrefs: 007A5164
y, xrefs: 007A5180
W, xrefs: 007A5187
a, xrefs: 007A5148
L, xrefs: 007A513A

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 544645111-4069139063
Opcode ID: fb2ba0efecea7db14b6dd6849b04040b9c6e8b4452ccbf34d24f7eec3b932639
Instruction ID: 082fd786da55e59bb153809c56df76d3838a748f21d23d6a37e8b75aab8c19c9
Opcode Fuzzy Hash: fb2ba0efecea7db14b6dd6849b04040b9c6e8b4452ccbf34d24f7eec3b932639
Instruction Fuzzy Hash: CC8123A1D08698DAF7248A60DC48BEE7775EF91300F1481FAD50D9B281E67E1EC58F22

Function 007A4D38 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 199COMMON

Download Yara Rule

Strings

o, xrefs: 007A5141
i, xrefs: 007A515D
d, xrefs: 007A514F
L, xrefs: 007A5156
r, xrefs: 007A516B
a, xrefs: 007A5172
r, xrefs: 007A5179
b, xrefs: 007A5164
y, xrefs: 007A5180
W, xrefs: 007A5187
a, xrefs: 007A5148
L, xrefs: 007A513A

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: e301f1136dc23ec5ce86bf0f8d293c34fe5df37ee4a0c7d11b99a051b81f3c27
Instruction ID: a341748f1072460607fa389d0fbd38a221604d2dac8176ca28acbbb127d98821
Opcode Fuzzy Hash: e301f1136dc23ec5ce86bf0f8d293c34fe5df37ee4a0c7d11b99a051b81f3c27
Instruction Fuzzy Hash: 3A71F2A1D08598DAF7208A64DC48BEAB775EF91300F1441FAD40D9B681E37E5EC58F62

Function 007A4CF8 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 189COMMON

Download Yara Rule

Strings

o, xrefs: 007A5141
i, xrefs: 007A515D
d, xrefs: 007A514F
L, xrefs: 007A5156
r, xrefs: 007A516B
a, xrefs: 007A5172
r, xrefs: 007A5179
b, xrefs: 007A5164
y, xrefs: 007A5180
W, xrefs: 007A5187
a, xrefs: 007A5148
L, xrefs: 007A513A

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: ba0045aee4632bf9f8288e9925f62b17b9cf83d8b6bbbd32d169f0babc749d3f
Instruction ID: 165551ebf0232232370e60078183ab8368fe265fc85f9238b2e0b02b810decc8
Opcode Fuzzy Hash: ba0045aee4632bf9f8288e9925f62b17b9cf83d8b6bbbd32d169f0babc749d3f
Instruction Fuzzy Hash: 0A7102A1D08598DAF7208A64DC08BEEBB75EF91300F1481FAD40D9B681E77D5EC58F62

Function 00762D04 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 180memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00773CD9

Strings

y, xrefs: 00772DC8
i, xrefs: 00772DA5
d, xrefs: 00772D97
b, xrefs: 00772DAC
L, xrefs: 00772D9E
o, xrefs: 00772D89
W, xrefs: 00772DCF
a, xrefs: 00772D90
L, xrefs: 00772D82
a, xrefs: 00772DBA
r, xrefs: 00772DC1
r, xrefs: 00772DB3

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 544645111-4069139063
Opcode ID: 3e7ea7915b77e74ec114da7d28928eeb795c2bb2c5ef6738da8ef8d118d50073
Instruction ID: d500fc50ea667b36d773fb2e74b0b8421acb3aa50fb96ddf4c01ed7c5d1a52ca
Opcode Fuzzy Hash: 3e7ea7915b77e74ec114da7d28928eeb795c2bb2c5ef6738da8ef8d118d50073
Instruction Fuzzy Hash: D36136A2D08298DEFB258710DC59BF6BB74EF50314F1480FAD90D5A281D2BD1FC59B22

Function 007A4D95 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 173COMMON

Download Yara Rule

Strings

o, xrefs: 007A5141
i, xrefs: 007A515D
d, xrefs: 007A514F
L, xrefs: 007A5156
r, xrefs: 007A516B
a, xrefs: 007A5172
r, xrefs: 007A5179
b, xrefs: 007A5164
y, xrefs: 007A5180
W, xrefs: 007A5187
a, xrefs: 007A5148
L, xrefs: 007A513A

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: e5a4b85ea5a6be067f73c1e94c9d68c04e61ea7dd56f0f0532603cbb6aea7878
Instruction ID: c9fc0d68f32e1ee6581885e2dae5b5c8753e86c8bc5287c9e8953941d04b01f7
Opcode Fuzzy Hash: e5a4b85ea5a6be067f73c1e94c9d68c04e61ea7dd56f0f0532603cbb6aea7878
Instruction Fuzzy Hash: BD61E3A1D08598DAF7208A64DC48BEE7776EF91300F1441FAD00D9B681E77E5EC58B62

Function 007A4FB6 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 163COMMON

Download Yara Rule

Strings

o, xrefs: 007A5141
i, xrefs: 007A515D
d, xrefs: 007A514F
L, xrefs: 007A5156
r, xrefs: 007A516B
a, xrefs: 007A5172
r, xrefs: 007A5179
b, xrefs: 007A5164
y, xrefs: 007A5180
W, xrefs: 007A5187
a, xrefs: 007A5148
L, xrefs: 007A513A

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 544645111-4069139063
Opcode ID: 642a1af1fcf2b58c0a8525e3b11f31f7ef6ffe949ec2bffe79e0e69e5e4e4d29
Instruction ID: 6a8b90d9fbb2e8fd9ae59fbe98e3c332322341df174983c851370ed06bb2e3d5
Opcode Fuzzy Hash: 642a1af1fcf2b58c0a8525e3b11f31f7ef6ffe949ec2bffe79e0e69e5e4e4d29
Instruction Fuzzy Hash: 7C51F491D08598DAF720CA64DC48BEE7776EF91300F1481FAD00D9B681E67E5EC58F62

Function 007AD175 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 73fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 007AD8AB

Strings

P, xrefs: 007B7998
i, xrefs: 007B78C6
e, xrefs: 007B78F0
P, xrefs: 007B78D4
s, xrefs: 007B78FE
E, xrefs: 007B78B8
x, xrefs: 007B78BF
c, xrefs: 007B78E9
o, xrefs: 007B78E2
s, xrefs: 007B78F7
t, xrefs: 007B78CD
r, xrefs: 007B78DB

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: FileRead
String ID: E$P$P$c$e$i$o$r$s$s$t$x
API String ID: 2738559852-1626331376
Opcode ID: 3e72bb9798662fa481e6530410fad883156ba7cca27b4b9449738612a224e42f
Instruction ID: 1cf37f143d3c699016037e77d9daef8429a60ea7085cc8bc658c8c0ffba05bc3
Opcode Fuzzy Hash: 3e72bb9798662fa481e6530410fad883156ba7cca27b4b9449738612a224e42f
Instruction Fuzzy Hash: 403191A1C18294DAFB28CB24DC58FEABBB4AB55340F1442FDD44D56381CABD1FC48B61

Function 007ACD3E Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 72fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 007AD8AB

Strings

P, xrefs: 007B7998
i, xrefs: 007B78C6
e, xrefs: 007B78F0
P, xrefs: 007B78D4
s, xrefs: 007B78FE
E, xrefs: 007B78B8
x, xrefs: 007B78BF
c, xrefs: 007B78E9
o, xrefs: 007B78E2
s, xrefs: 007B78F7
t, xrefs: 007B78CD
r, xrefs: 007B78DB

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: FileRead
String ID: E$P$P$c$e$i$o$r$s$s$t$x
API String ID: 2738559852-1626331376
Opcode ID: 8cd0d9e3ed0116a9a13a4f2452192258fc80ca4e159d23464f1896fa4a06989b
Instruction ID: 9260e8fb1d35a113b4a9daa13f69cea1a3528ce0acef0a658faba072b0231db2
Opcode Fuzzy Hash: 8cd0d9e3ed0116a9a13a4f2452192258fc80ca4e159d23464f1896fa4a06989b
Instruction Fuzzy Hash: 943191A1C18294DAFB28CB28DC58FEABBB4AB51340F1442FDD44D56381CA7D1FC48B61

Function 007ABD82 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 186COMMON

Download Yara Rule

Strings

d, xrefs: 007AC962
r, xrefs: 007AC98C
R, xrefs: 007AC843
r, xrefs: 007AC97E
a, xrefs: 007AC95B
a, xrefs: 007AC985
L, xrefs: 007AC94D
i, xrefs: 007AC970
W, xrefs: 007AC99A
b, xrefs: 007AC977
y, xrefs: 007AC993
o, xrefs: 007AC954
L, xrefs: 007AC969

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$R$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-2756691126
Opcode ID: ad22f7a5fc6880c8a938bf4d1b4f05adfce84bbf4b2aee45719cc094c677c9eb
Instruction ID: ff3e9c616d10fc43799fd3d64133e9a53e5d06b43f1d64c3e93d39e0bc935d44
Opcode Fuzzy Hash: ad22f7a5fc6880c8a938bf4d1b4f05adfce84bbf4b2aee45719cc094c677c9eb
Instruction Fuzzy Hash: 10711560D086E8DBEB318B64CC487DA7B71EF52300F1401EAD54DA7292D6BD5AC5CF62

Function 007AB957 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,3A3646D4,00003000,00000004), ref: 007AC4B4

Strings

d, xrefs: 007AC962
r, xrefs: 007AC98C
R, xrefs: 007AC843
r, xrefs: 007AC97E
a, xrefs: 007AC95B
a, xrefs: 007AC985
L, xrefs: 007AC94D
i, xrefs: 007AC970
W, xrefs: 007AC99A
b, xrefs: 007AC977
y, xrefs: 007AC993
o, xrefs: 007AC954
L, xrefs: 007AC969

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$R$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-2756691126
Opcode ID: 7a0e986797fe8be70a53c8d75e9f2133af24dff39dfd4117e879840c3747c346
Instruction ID: 079b173dcf2649a4d90b12f3862f9874f9d7ae721be5e74754951c154bfdefc5
Opcode Fuzzy Hash: 7a0e986797fe8be70a53c8d75e9f2133af24dff39dfd4117e879840c3747c346
Instruction Fuzzy Hash: B5710260C086E8DBEB318B64CC487DA7B70EF56300F1401EAD54DA7292D6BE4AC1CF22

Function 007ABD94 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,3A3646D4,00003000,00000004), ref: 007AC4B4

Strings

d, xrefs: 007AC962
r, xrefs: 007AC98C
R, xrefs: 007AC843
r, xrefs: 007AC97E
a, xrefs: 007AC95B
a, xrefs: 007AC985
L, xrefs: 007AC94D
i, xrefs: 007AC970
W, xrefs: 007AC99A
b, xrefs: 007AC977
y, xrefs: 007AC993
o, xrefs: 007AC954
L, xrefs: 007AC969

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: AllocVirtual
String ID: L$L$R$W$a$a$b$d$i$o$r$r$y
API String ID: 4275171209-2756691126
Opcode ID: 0d658a1d663a213cc5b873d5e5c3ef55b12fb0cb0b72e8c99989827ef75ab136
Instruction ID: bcb3ea38a79552ef052a3d67517354089d699fc6a97788664583f9249a2fdd89
Opcode Fuzzy Hash: 0d658a1d663a213cc5b873d5e5c3ef55b12fb0cb0b72e8c99989827ef75ab136
Instruction Fuzzy Hash: 5E710260D086E8DBEB318B64CC487DABB70EF51300F0401EAD54DA7292D6BE4AC1CB22

Function 0073B9F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 199libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: b8ed670910e48b1cd923b9b23e3c17c838ec54ab52195adc5b0e51f69df6c554
Instruction ID: a76c52df711db2a865e37f4b3f8f0093df3e873337bd76e26b633f115282f5e7
Opcode Fuzzy Hash: b8ed670910e48b1cd923b9b23e3c17c838ec54ab52195adc5b0e51f69df6c554
Instruction Fuzzy Hash: 4371D3A2D052688BF7218B24CC44BEB7775FF91310F1481FAD48DA7242EB395E85CB92

Function 0073C457 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: 9ff62d0ceb1d617914253a463338e46208648b397788c278fede4c932cf5d433
Instruction ID: 1e64a44be552b36ed41f3ec75d125e28b6be97b316ad4ce4b86440ac0bf30794
Opcode Fuzzy Hash: 9ff62d0ceb1d617914253a463338e46208648b397788c278fede4c932cf5d433
Instruction Fuzzy Hash: A7719271D152688BFB218B24CC547EAB7B5FF95300F1181EAD44DA7242EA395F81CF51

Function 0073C214 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: 44591e135d2e938b324670346e4ef4558aed97279433adc8dbe786ffff309c62
Instruction ID: 4025cec91ea179ba21b2ac314a54794924b606da44dcab435ebd27a19675a9e6
Opcode Fuzzy Hash: 44591e135d2e938b324670346e4ef4558aed97279433adc8dbe786ffff309c62
Instruction Fuzzy Hash: 9E719271D052688BFB218B24CC547EA7775FF95310F1481EAD44DA7282EA395F81CF52

Function 0073C286 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: 3707b5ba113dae2f78811f2a89ec793918a6d13b09fca59d224acd02e083523f
Instruction ID: bcc0cb7d4e6999da8a298200e000ac4e97c97e38966b1b2e94fec69a6fa3d66e
Opcode Fuzzy Hash: 3707b5ba113dae2f78811f2a89ec793918a6d13b09fca59d224acd02e083523f
Instruction Fuzzy Hash: 537192B1D152688BFB218B24CC54BEA7775FF95300F1081EAD44DA7282EA395F81CF52

Function 0073C4EF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 181libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: cb2aafa1792e6a6b0d3747024c696feec48425b0c1bc133ff381c413b26ff3df
Instruction ID: abb385915fd5777371ddc56796e903f2a41caf1bf43e88b40e4261404ef65c9e
Opcode Fuzzy Hash: cb2aafa1792e6a6b0d3747024c696feec48425b0c1bc133ff381c413b26ff3df
Instruction Fuzzy Hash: 097192B1D152688BFB258B24CC547EA7775FF95300F1081EAD44DA7242EA395F81CF51

Function 0073C544 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 159libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: c6d90fafbbec18ad18b76b9a988f244fb8c406e6d656d5cd253e83cd57e05951
Instruction ID: 790f60ad2a242277efc6af9a9756530e8839c6257f60d6767942eedc99b0d525
Opcode Fuzzy Hash: c6d90fafbbec18ad18b76b9a988f244fb8c406e6d656d5cd253e83cd57e05951
Instruction Fuzzy Hash: 92517E71D052688BEB258B24CC547EAB7B5FF95310F1081EAD48DA7242EB399F81CF52

Function 0073C84D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 150libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: 985532e63487c4f0a5e936d07e76499b7e29c3379a434531da89983e781102a8
Instruction ID: 70da0c8fa16938a088e9e401105bd9fec8418eb45c72a82af4396d4cbba22e3d
Opcode Fuzzy Hash: 985532e63487c4f0a5e936d07e76499b7e29c3379a434531da89983e781102a8
Instruction Fuzzy Hash: 78517E71D052688BEB218B24CC547EAB7B5FF95300F1481EAD48DA7242EA399F81CF52

Function 0073C17C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: 69948beb4d4ad9715b3e605e1304bbefa273ac0226e55267eedef0e508671697
Instruction ID: 0bd04e569dae62e6794f91421bf64a324aacfa91b94053ef28916aa1ccc71b6b
Opcode Fuzzy Hash: 69948beb4d4ad9715b3e605e1304bbefa273ac0226e55267eedef0e508671697
Instruction Fuzzy Hash: 26519072D052688BFB218B24CC547EA77B5FF95300F1481EAD48DA7242EA399F85CF52

Function 0073BD3F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: fb87f9978bdec9c467ae54f6df17890c4fc0bce8711336370e7a5e5d53a70201
Instruction ID: 7359458fa39bae26cc520411c07742f14569ea5b2ceab830705930babaeac581
Opcode Fuzzy Hash: fb87f9978bdec9c467ae54f6df17890c4fc0bce8711336370e7a5e5d53a70201
Instruction Fuzzy Hash: FB518171D052688BFB218B24CC547EAB7B5FF95300F1481EAD48DA7242EA399F85CF52

Function 0073C5F1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: c0e2001137d6a89b5375591dacab80e24bb2f066a3f6ef447729503261bb7643
Instruction ID: f48a28556df73f733be866f799a6cd1d3f372aa7f58481201fb4d94a38b78b53
Opcode Fuzzy Hash: c0e2001137d6a89b5375591dacab80e24bb2f066a3f6ef447729503261bb7643
Instruction Fuzzy Hash: 1D518F71D052688BEB218B24CC547EAB7B5FF95300F1481EAD48DA7242EA399F81CF52

Function 0073C5CC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: 878d7a5ffbac7f2dd0610c0c0e4547966783c36ddfb1b182340bb6a8dbbd837a
Instruction ID: a1b1ba125c67810afb20ac69a6406b43ca29fb5efb7d5024eee96bb918235485
Opcode Fuzzy Hash: 878d7a5ffbac7f2dd0610c0c0e4547966783c36ddfb1b182340bb6a8dbbd837a
Instruction Fuzzy Hash: D9518F71D052688BEB218B24CC547EAB7B5FF95300F1481EAD48DA7242EA399F81CF52

Function 0073C59A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?), ref: 0073C893
LoadLibraryW.KERNELBASE(?), ref: 0073C8B0

Strings

58;;, xrefs: 0073C91F

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: LibraryLoad
String ID: 58;;
API String ID: 1029625771-1097885115
Opcode ID: 2a329bda6ca58ad140441f0f457bcf9b0bb4093a2500383b1c4bf27bb91ecddc
Instruction ID: ac4a08e0122a83ad59733db33bbd2cf29426f465f2e62e5231f51c7784e534d9
Opcode Fuzzy Hash: 2a329bda6ca58ad140441f0f457bcf9b0bb4093a2500383b1c4bf27bb91ecddc
Instruction Fuzzy Hash: 9A518F71D052688BEB218B24CC547EAB7B5FF95300F1481EAD48DA7242EA399F81CF52

Function 00741641 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 201COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Strings

, xrefs: 00741A4D
F98?, xrefs: 00741908

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID: $F98?
API String ID: 1263568516-1440876813
Opcode ID: 552561242c1a6ae30a1b4291c2fe744d23cac329fcd8199b480aa094051707c7
Instruction ID: 8bde43e68748d6aea33799c96b4c93b950d0b16a24ba7456b280195cb44351e5
Opcode Fuzzy Hash: 552561242c1a6ae30a1b4291c2fe744d23cac329fcd8199b480aa094051707c7
Instruction Fuzzy Hash: 209145B4E012288BDB24DB14CC94BAAB7B5FF89310F6441EAE84D67641D739AEC1CF41

Function 0074758B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: cf56a9f6e7759ea040a31eb20fed56c766cfa975107237a415020d470c3b35c5
Instruction ID: 7cb256cb3a02b8dd87beb9e829124e7554c0eff7ab526aebed3ee1fb023e208f
Opcode Fuzzy Hash: cf56a9f6e7759ea040a31eb20fed56c766cfa975107237a415020d470c3b35c5
Instruction Fuzzy Hash: 7851DFF2E051249FF7648A14DD84BEAB77AEB84310F1580BAE80DA7640D73D5EC5CEA1

Function 004378B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Strings

, xrefs: 00437BBE

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-399585960
Opcode ID: 2e8118cdc50f5d351fe33459cd3b8273b82f876e9ba5937ff4cb4b849af37bb3
Instruction ID: 9351e294da0ece2dc520d47319c66cfebc14c14efee24f5d9ebff56c84192ef1
Opcode Fuzzy Hash: 2e8118cdc50f5d351fe33459cd3b8273b82f876e9ba5937ff4cb4b849af37bb3
Instruction Fuzzy Hash: 3D612BB4A091298FEB34CF04DC80BA9B7B5FB89318F1481EAD98D67341D735AE918F45

Function 00747002 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID:
String ID: 9O2H
API String ID: 0-1121337113
Opcode ID: e4e648fa9f4888c863b5791d0aa12999f00aa44d567df66d17054dd4268fc8d9
Instruction ID: 1d713c85a9b00874cd21f346f0f0a2f157811740236f7dae536b8d671931e9af
Opcode Fuzzy Hash: e4e648fa9f4888c863b5791d0aa12999f00aa44d567df66d17054dd4268fc8d9
Instruction Fuzzy Hash: 7E5198F2D08119DBE7248A10DD49BFB7779EB84310F2045B9E80A96240D73D5FC5DE61

Function 007470A1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: 8c03c944d69e425cbe220fba62acaaa82f9426fd63005df155c1abc65d0f874c
Instruction ID: 01a81b62be8cd75832667d067d47cd3fd06c2b9c030199666a1041c047852d7c
Opcode Fuzzy Hash: 8c03c944d69e425cbe220fba62acaaa82f9426fd63005df155c1abc65d0f874c
Instruction Fuzzy Hash: B841D5F2D48119AFE7288A10DD45FBB7769EB80310F1041B9E90E96240D33D9EC1DE62

Function 00747831 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: bc50ab9c017d1eafcdef50acd92d5a0463ae73c3f8e55bd500042cad3cdbd4b3
Instruction ID: 53b0eea548b879a7bbf809244022612908310d8b4209cb3daa956fe50921e9bb
Opcode Fuzzy Hash: bc50ab9c017d1eafcdef50acd92d5a0463ae73c3f8e55bd500042cad3cdbd4b3
Instruction Fuzzy Hash: FC41DDB2E04125AFF7248A14DD84FEB7679EB80310F1581BAE80DA7240E73D5EC5CEA1

Function 007470B2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: 90fb8ce6614a2addeb708ab90d971453479231314e71260a11099331319b945a
Instruction ID: 787ea721ca52ab26fee62754b6d1bc13836d6fef60f80d3161a8ad2d46455a3c
Opcode Fuzzy Hash: 90fb8ce6614a2addeb708ab90d971453479231314e71260a11099331319b945a
Instruction Fuzzy Hash: 0E3181F2D48119ABE7248A10DD85FBB7769EB84310F2045B9E90E96640D33D9EC1DEA1

Function 00747055 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: 06dc8b1714d2e5ae77aa7fb5f06350cb683ee2f9da4dbf9714449ddf35623771
Instruction ID: fcfff4d95c255c5b696dcacad29a6ad3f4ab9c6eb87882c22e0340c9c1298ab9
Opcode Fuzzy Hash: 06dc8b1714d2e5ae77aa7fb5f06350cb683ee2f9da4dbf9714449ddf35623771
Instruction Fuzzy Hash: CE31C5E2D48115ABF7288610ED49FBB362DE784310F2485BAE90E96240D73D9FD1DA62

Function 00747B4C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: 944b60e9610741ee08a6ea2ba3d7ee3871c2e5efab3a2efe1820de2230564ad3
Instruction ID: 2caa464b18b8a6825cc2c75e9847b3438dbe87526e382e07a9b6db958ffa46c2
Opcode Fuzzy Hash: 944b60e9610741ee08a6ea2ba3d7ee3871c2e5efab3a2efe1820de2230564ad3
Instruction Fuzzy Hash: C431A1B1D191559BE7288A10DD85FAE773AEBC1310F1481FAE40EA6240D73D5EC1CF61

Function 007470F4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: b2cb5affcb086c98b8070ff832818624cfbc5a6597fe3c3d45ec0310fd0f1343
Instruction ID: 3b75104a44b17625cbcf062b177c013bca36d864a87a7a9d6b26d17fe2019e47
Opcode Fuzzy Hash: b2cb5affcb086c98b8070ff832818624cfbc5a6597fe3c3d45ec0310fd0f1343
Instruction Fuzzy Hash: 9A31D6E2D08155ABF7284620ED49FFB367DEBC4310F1445B9E90E96240D33D9EC1DA61

Function 007470FE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: aa00a5f8f4a056513e97a5a888dfc95de03465119ec3727a95f76969005b2ef6
Instruction ID: cfb65fc432552a0867a4095cbea70a2c6eaca5952e5feb4fee43780d74995f18
Opcode Fuzzy Hash: aa00a5f8f4a056513e97a5a888dfc95de03465119ec3727a95f76969005b2ef6
Instruction Fuzzy Hash: 4931C1E3D48115ABF7284A10ED89FBB766DEBC4310F1085BAE90E96240D33C9EC1DE61

Function 00747BB9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: 627f2ba7e1069881ddc5ed6ac4272a2238c2da8a1adfc6a78abb2301fd666e3d
Instruction ID: 7137fe177295b99b219d35a2f8e08a1c9e3f29c0fbe5612be9a30d195b4e0545
Opcode Fuzzy Hash: 627f2ba7e1069881ddc5ed6ac4272a2238c2da8a1adfc6a78abb2301fd666e3d
Instruction Fuzzy Hash: 0F31A4B1D091589BEB748A50DD85BBF7779EB84310F1085EAE80EA6240D73C5EC1CF61

Function 0074712B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: 27b8aabd37ce37fa5cc78aa9822660137c28a04007d7431e947209e9bbdde4f0
Instruction ID: 6474d3d27b88d924a2eeb991f642ad1f6685f0083f0f9a4fe178d328d87f0e5b
Opcode Fuzzy Hash: 27b8aabd37ce37fa5cc78aa9822660137c28a04007d7431e947209e9bbdde4f0
Instruction Fuzzy Hash: EA21C4E2E48154ABF7288610ED85FBB767DEBC4310F1485BAE90E96240D33C9EC1DE61

Function 00747B5C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: e608ff6675905be3f86befd7375c2a8f84afbcbbca6aa75d83c66ec31456cb6a
Instruction ID: 272cccc4b44db5dd49ace2b24c35be8d0dc775552e941ca80ad614fc15aa798d
Opcode Fuzzy Hash: e608ff6675905be3f86befd7375c2a8f84afbcbbca6aa75d83c66ec31456cb6a
Instruction Fuzzy Hash: 9B3191B1D091689BE7688A10DD85FAF7779EB84310F1085FAE80EA6240D73C5EC1CF61

Function 0074713B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: 1a0bab5b0235c78caf704215ae26be017f33521990cdd3c9bce2cdbaa3fc44f4
Instruction ID: d2aefd701413a036dd2d44af9952bc96dc912e686677e6bf995fdcd09b225ce2
Opcode Fuzzy Hash: 1a0bab5b0235c78caf704215ae26be017f33521990cdd3c9bce2cdbaa3fc44f4
Instruction Fuzzy Hash: E62190F2D08155ABF7288A11DD45FBB766DEBC4310F1085BAE90E96240D33DAEC1CE61

Function 0074754E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: 3e17fd8a11cc2163752be482bd5ff6ea870efba4256083a77bfde9b8f6aaa7d4
Instruction ID: 8a6344f0471d06c328bfcf540e1fcc62ebbfd48cee288d2a319ee799c02044e7
Opcode Fuzzy Hash: 3e17fd8a11cc2163752be482bd5ff6ea870efba4256083a77bfde9b8f6aaa7d4
Instruction Fuzzy Hash: 0B21C5F2D18154ABF7248A10DD85FBB766DEB84310F1085B9E90E96240D73D9E85CE62

Function 0075E14B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

JO:O, xrefs: 0075E14B

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: JO:O
API String ID: 544645111-1843474368
Opcode ID: cc622721f8eb61bb87798297dbf9a65fd1373cd824a5df6eb8d1eeb48ceb78b9
Instruction ID: c9da7f5392e37c3b0ebf75e0b4d210bb3f992094d6fea09a9bb5baa0270a0d47
Opcode Fuzzy Hash: cc622721f8eb61bb87798297dbf9a65fd1373cd824a5df6eb8d1eeb48ceb78b9
Instruction Fuzzy Hash: AB21F372E041789BE7258A95CC44BDBBF78AB44311F0441F7EC0D67240C1796F868FA1

Function 00747568 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: 3eda1ad6ce26faef71310ec3546604ec31c30de9b369b448077f54b05d22b492
Instruction ID: e599629c92aedd83a2bc456b3edec76d4bd98bc2597ef57451fd0fd8df1deb40
Opcode Fuzzy Hash: 3eda1ad6ce26faef71310ec3546604ec31c30de9b369b448077f54b05d22b492
Instruction Fuzzy Hash: 4121C3F2D08115ABF7248A10DD85FBB767DEB84310F1085B6E80EA6240D33D9E81CE62

Function 00747C36 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: 8c792e3d15da30d511550a3b99d280c7c3eabfaa3ca94790b9af3f122209e1ec
Instruction ID: 464d849b89e9f50cb5f35fcc4a914921de3277d821c5b2afa6e654aff54a974e
Opcode Fuzzy Hash: 8c792e3d15da30d511550a3b99d280c7c3eabfaa3ca94790b9af3f122209e1ec
Instruction Fuzzy Hash: D511D0F2E04115ABE7648A10DD89FBB773DEB80310F1085B6E90EA6240D33C9E81CE61

Function 00747C2F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?,?,?,00000001,?,?,00747648,00000000,00000000), ref: 00747C7D

Strings

9O2H, xrefs: 00747D15

Memory Dump Source

Source File: 00000000.00000002.1655703230.0000000000747000.00000040.00000001.01000000.00000003.sdmp, Offset: 00747000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_747000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID: 9O2H
API String ID: 544645111-1121337113
Opcode ID: 62e01d10164888bcb26ac2ce6c3b3304ee9abc7b0054b4e222bb62b347a8ed91
Instruction ID: 3a3fee1cbb77bdf2fdbe021c51b5d9e358e70b083562c2b82e046fe2903e2d66
Opcode Fuzzy Hash: 62e01d10164888bcb26ac2ce6c3b3304ee9abc7b0054b4e222bb62b347a8ed91
Instruction Fuzzy Hash: 191181F2D04155ABE7648A10DD89FBB767DEB84310F1085BAE90EA6240D73D9E81CE61

Function 007413EF Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

F>>Y, xrefs: 007413EF

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID: F>>Y
API String ID: 1263568516-3804029514
Opcode ID: 2cb1a38f518f79bad95764dea54afa966b6b600605c4eb63979dfa95428d231d
Instruction ID: 8d6360cd7d7b2c7731b12bd33b3238aedf6105d80ab4ac5700e3e521bcaf4c5c
Opcode Fuzzy Hash: 2cb1a38f518f79bad95764dea54afa966b6b600605c4eb63979dfa95428d231d
Instruction Fuzzy Hash: 2161B0B1E002689BDB209B14CC54BEAB775EF85300F5481E9E44DA7240E7399EC2CF52

Function 007730BE Relevance: 1.8, APIs: 1, Instructions: 299memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00773CD9

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f0cb9e2adf6cc7d32943055cbd9e43c96e1426ccadce342165f7a0016762b089
Instruction ID: ec9e9038f7ab93d26261df9c69b86886f34eef5c2cc0f9d927c4fe7b2a439789
Opcode Fuzzy Hash: f0cb9e2adf6cc7d32943055cbd9e43c96e1426ccadce342165f7a0016762b089
Instruction Fuzzy Hash: BCC1BEB1D055688FEF28CB14CC98BAAB7B5FB44305F2482EAD80D66241DA396FC5CF51

Function 00435DDD Relevance: 1.7, APIs: 1, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f59b94e9e6dc21921b930ba4c9917ba92cd5ebd5fead7ddbbf6ea4963d8466e4
Instruction ID: 91cbccf9d9e25bacf7879ab5c12bd8268676dbe940acc2f1e24680d6a888bf0c
Opcode Fuzzy Hash: f59b94e9e6dc21921b930ba4c9917ba92cd5ebd5fead7ddbbf6ea4963d8466e4
Instruction Fuzzy Hash: B161ADB1D146299BE7288B14DC80BFBB374FB48310F1451FAE50AA6640E7389EC28F59

Function 00435CDC Relevance: 1.7, APIs: 1, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 703d65518f6f4cd6ace79f861387efd95c8185adf54921794eb342e10e7b6a9e
Instruction ID: 616e8e057f723c4a695999f8346f97917ac1d850d9acc0c30ace4e6039c8491a
Opcode Fuzzy Hash: 703d65518f6f4cd6ace79f861387efd95c8185adf54921794eb342e10e7b6a9e
Instruction Fuzzy Hash: D761D4B1C046299AD7348B10DC80BFB77B4EB48314F1491FAE44AA6681E67C4FC1CF65

Function 0075030D Relevance: 1.7, APIs: 1, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000), ref: 0075056A

Memory Dump Source

Source File: 00000000.00000002.1655851065.0000000000750000.00000040.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e9de6c2abe7fbb2aac2a792d08398fdc3786435641532ef419f2c06c20c47f05
Instruction ID: 46aec5cb5d22e46cbd197e6e969d373f77f2d1c162a9df03e7215e99c6fe1e8b
Opcode Fuzzy Hash: e9de6c2abe7fbb2aac2a792d08398fdc3786435641532ef419f2c06c20c47f05
Instruction Fuzzy Hash: 9C61F1B0D051688BDB28CB14DCE4BEEB7B5EF41301F2481EAD90A66251D6786E85CF80

Function 004376D2 Relevance: 1.7, APIs: 1, Instructions: 170COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 4959961c1b2a01c01821f9607b8b9a9a2471c8d62bcd9766451292aad51a870e
Instruction ID: 4c080fd25a2bd41151171a91d41dccf31b163b1619eb7e8d8b8db0ddb789dadd
Opcode Fuzzy Hash: 4959961c1b2a01c01821f9607b8b9a9a2471c8d62bcd9766451292aad51a870e
Instruction Fuzzy Hash: 2561C0F1D051258BEB248B15CD44BFEB7B9EB84310F1081FAE94D66280EB785EC1DE55

Function 00435B80 Relevance: 1.7, APIs: 1, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ef587606c47cc96a9f471e3146cb557a18d3a9c3d4bf7f88a42c6799cc5ed2e9
Instruction ID: 55703bbbae01038c02166c20b3de40533ed10c19449d20e6f5f95399f203b609
Opcode Fuzzy Hash: ef587606c47cc96a9f471e3146cb557a18d3a9c3d4bf7f88a42c6799cc5ed2e9
Instruction Fuzzy Hash: FE51AEB19146199BE7249B24DC80BFBB778EF54314F0052FAE90AA6640E7385FC28F56

Function 007A58FD Relevance: 1.7, APIs: 1, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007A6093

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 062d8f7a52edb7f1ccb9c5d291f345050266809fe1fa5a0fd1b5d4814f973f77
Instruction ID: 093a07493b33b45c168093b1e20649bc6a40a61944bfccf0b18b39fbdf759aed
Opcode Fuzzy Hash: 062d8f7a52edb7f1ccb9c5d291f345050266809fe1fa5a0fd1b5d4814f973f77
Instruction Fuzzy Hash: 6E5116F2D046599EE7208B24CC99BEB7B34EB81310F0442FAD94967681DB3D9EC58E52

Function 004353C5 Relevance: 1.7, APIs: 1, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 82cf0483e3ce4e7ad954030b9a852cbc99b1a573508b164578d75b763d74f08c
Instruction ID: 9159665fddcd59adc79f99c8ff4973c85f7fb5dbc35fef60490c194b8e9bb998
Opcode Fuzzy Hash: 82cf0483e3ce4e7ad954030b9a852cbc99b1a573508b164578d75b763d74f08c
Instruction Fuzzy Hash: F85163B2C046269BE7248B24DC51BFAB775EF49310F1091FFE50E92241E63C5AC28F56

Function 00435ACB Relevance: 1.6, APIs: 1, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b6763edfb5dd3f07a59377b5909d9c4ec55c984dd4dd1288abac75bb1d9c27d3
Instruction ID: 61fe03940254707d59e5ac818799b38ccd97edc63c5c6680851863f037ad1aca
Opcode Fuzzy Hash: b6763edfb5dd3f07a59377b5909d9c4ec55c984dd4dd1288abac75bb1d9c27d3
Instruction Fuzzy Hash: 0641B4B2D046188FE7249B14DD84BEBB778EB45324F0086FAD90E96640D73C9FC18E55

Function 007A59FE Relevance: 1.6, APIs: 1, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007A6093

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 532d98b5c9bd2ccd0aaccb02dbcd4a2d957f85f35cd67ab4be671fe8e5c367ef
Instruction ID: bd7a7670f3320a834b319b56c95738b3b48140d92cf4ad51283824ea215dce28
Opcode Fuzzy Hash: 532d98b5c9bd2ccd0aaccb02dbcd4a2d957f85f35cd67ab4be671fe8e5c367ef
Instruction Fuzzy Hash: D041D4F2D046699FE7208B10CC84BEABB75EBD2310F1482FAD84956641D7399EC68F52

Function 0075E047 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d9a041a507fd986f6ae144073d9271a5da766805ce2f9390ae1f5a7e30ba5b3c
Instruction ID: 89d80d593e6210b81d2c70f0222c04977e3bf9344c05a079f57406efd42e5bf9
Opcode Fuzzy Hash: d9a041a507fd986f6ae144073d9271a5da766805ce2f9390ae1f5a7e30ba5b3c
Instruction Fuzzy Hash: 0B41C5B1E045789BEB258A55CC44AEBBFB8AB85312F1441F7EC0D67240D1786FC58FA1

Function 00437642 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 1e807a458c3dd8f6fb004da3a07fef09fe53521b798c95b1355f20eb9f923659
Instruction ID: f395d517504bf352fcb6d63cffcab5935d6a8c80beb3075bc498cc4d874de211
Opcode Fuzzy Hash: 1e807a458c3dd8f6fb004da3a07fef09fe53521b798c95b1355f20eb9f923659
Instruction Fuzzy Hash: C5419DB1D151298AEB288B24CD15BFEB774EF88310F1081FAD94E66381EA785EC1CE55

Function 0075E0B3 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d721933132e9c7ef6471857d9aac76fcf910c3b6f543e4b9017f488f3fc52114
Instruction ID: 8b146d7c654ea3fbb740fcb538b4ee7d7eebee9c3ef24f8efedbb33d67ceca9e
Opcode Fuzzy Hash: d721933132e9c7ef6471857d9aac76fcf910c3b6f543e4b9017f488f3fc52114
Instruction Fuzzy Hash: 9A41D771E045789BE7298A55CC44AEABBB5AB45311F1442FBDC0DA7240C1786FC5CF91

Function 0075E054 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ce0e16ba3f0795cdf1c8bc26b54f552288570dab2df6c98ad5ea9cb03042f256
Instruction ID: 5f33d2b7e755043fb26a3f0d0542f4314552e21de2198dffa540b123174bb60c
Opcode Fuzzy Hash: ce0e16ba3f0795cdf1c8bc26b54f552288570dab2df6c98ad5ea9cb03042f256
Instruction Fuzzy Hash: 2441D4B1E045789BEB258A55CC44BEABFB8AB85312F1441F7EC0D67240D2786FC58FA1

Function 0042007A Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?), ref: 004201B8

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5f2835000de9c3daab481ce8ed2c5e026aac589888598740c5d67dbcc5fd40cc
Instruction ID: e400065f6857abaa178c0966eea005ecabff4a4ba90655605491290b5f59ed6d
Opcode Fuzzy Hash: 5f2835000de9c3daab481ce8ed2c5e026aac589888598740c5d67dbcc5fd40cc
Instruction Fuzzy Hash: 8641C2B1E051389BEB248A14DC94AFAB7B4EF81301F1081EBD40D63641D63D6FC5DE56

Function 004200DB Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?), ref: 004201B8

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 597c1c35a0c4d769df8eb8758e78d365707a90189048371236036dfa69c5d33a
Instruction ID: bf84e2b94d511eb6579173506e8b5dd4eb5c12a8ac80803ca02686515e484eba
Opcode Fuzzy Hash: 597c1c35a0c4d769df8eb8758e78d365707a90189048371236036dfa69c5d33a
Instruction Fuzzy Hash: 2641D171E091789BEB248A24DC94AFAB7B5EB81300F1081EAD44D63282D6396FC5DF52

Function 004374D1 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ca1be9d631d2602c4dc8d89f7b21a27934f0e6dd74a26dd47c3f3f49b10f3698
Instruction ID: f8200e12950d757160bee6e163f143d7160e377103b1dba0b0748f43467179e6
Opcode Fuzzy Hash: ca1be9d631d2602c4dc8d89f7b21a27934f0e6dd74a26dd47c3f3f49b10f3698
Instruction Fuzzy Hash: CF31C0F1D19114AFF7288B25DC45BEBBBB4EB48310F1041FBD84E56680C63D9E868E52

Function 0077388D Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00773CD9

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c55daf31d7d9a0d895b4a0d002668c42aab4560cc82c313457db0d86564410fb
Instruction ID: a2e3f5e94a0b1f2de2dc98f0c24c36e529571cb1996e6999aad7f0cf392e53a9
Opcode Fuzzy Hash: c55daf31d7d9a0d895b4a0d002668c42aab4560cc82c313457db0d86564410fb
Instruction Fuzzy Hash: 0E3107F2E051589FFB248A14CC98BEB7768EF44304F2481FAE90D56240D27D6FC19E62

Function 00435326 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 26a54706db0fccdab48d747b9fc8bd881d9f8d45b4d79c8745d6cc9d1c23cdd9
Instruction ID: 87834bccbc5b05aed12bed6806fc4236cec88d9931b439765765285f76fd376d
Opcode Fuzzy Hash: 26a54706db0fccdab48d747b9fc8bd881d9f8d45b4d79c8745d6cc9d1c23cdd9
Instruction Fuzzy Hash: 0F319BB2818256AFE720CA20DC95BEB7728EF05314F10A6BAE84986141C63C8DC28B52

Function 00437599 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 60bfd2e2d39d6bbdf27a08aae07ea945d0ac587fe441608abd3b54598ecda18d
Instruction ID: e1d7ac14d3dffd2269d94b55983f595c9d34729798fb5cb106ec7ebad50024a1
Opcode Fuzzy Hash: 60bfd2e2d39d6bbdf27a08aae07ea945d0ac587fe441608abd3b54598ecda18d
Instruction Fuzzy Hash: 4F31C0F2D052249BF7288B24DC49BEB7778EB84310F1042FED94E66780DA799EC18E55

Function 00750186 Relevance: 1.6, APIs: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000), ref: 0075056A

Memory Dump Source

Source File: 00000000.00000002.1655851065.0000000000750000.00000040.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f0fd98ac37145f98bea26308a918bee84d2cd7a7fff634225bbcb225d36ad991
Instruction ID: 0c27f95ad5fec0c5c8f53958719a2941e653b162bf760de622145fe3c70f35e0
Opcode Fuzzy Hash: f0fd98ac37145f98bea26308a918bee84d2cd7a7fff634225bbcb225d36ad991
Instruction Fuzzy Hash: 3631E371D042689FE7208B60DC98BEBB7B5FF85301F1041EAD9495A181D7785EC6CF51

Function 0042008F Relevance: 1.6, APIs: 1, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?), ref: 004201B8

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bf228d8aa83f4e8b32544523133e5518885e0e63ca17b1508f5db441f6132744
Instruction ID: bf68594441c63b1c533a5d8a3490404c08d265d56b5f4f0cafceff8ec4d8c438
Opcode Fuzzy Hash: bf228d8aa83f4e8b32544523133e5518885e0e63ca17b1508f5db441f6132744
Instruction Fuzzy Hash: 8131DFB1E091389BEB248A14DC94AFAB7B5EF80300F1081EAD80D63641D63D6FC5DF62

Function 007730FA Relevance: 1.6, APIs: 1, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00773CD9

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d72052a1e748016a1cbcb9ffdd9d7c0f6437225ba617ca355c55f55eef19cb4b
Instruction ID: 75e75d54defc8f96f29013b08105033901dad84c58849f3807d3ed03f589505e
Opcode Fuzzy Hash: d72052a1e748016a1cbcb9ffdd9d7c0f6437225ba617ca355c55f55eef19cb4b
Instruction Fuzzy Hash: 412168F2D05014AEFF248A60DCA9FF63728EF40354F24C1AEE60E58181D67D1FC65622

Function 00435364 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 049a38f2c41877552dab4f06af937065a8eb189a31cb42e5c580da08e9c72d0f
Instruction ID: 90248d00d4e5c5dfb73f5e2d3ad6cb69d4a2b53d67901a375c7731379bf62a66
Opcode Fuzzy Hash: 049a38f2c41877552dab4f06af937065a8eb189a31cb42e5c580da08e9c72d0f
Instruction Fuzzy Hash: FB2178F2C186556FF3209A24DC95BF73B28DF16314F10A5BBE88E81181D63C89C18B52

Function 0077307E Relevance: 1.6, APIs: 1, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00773CD9

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 09b9064e96741eb4a0e9d6449bbf139cb24913e0995dea9da59b8b79fba71c9e
Instruction ID: 73a051b13941b43758f70f8e117ebe8316c1ede497d3136c2aceac1e88909372
Opcode Fuzzy Hash: 09b9064e96741eb4a0e9d6449bbf139cb24913e0995dea9da59b8b79fba71c9e
Instruction Fuzzy Hash: 052127F2E05014AEFB244650DCA9FF66768EB80314F2881BAE50E94180D67D5FC55522

Function 007A51D7 Relevance: 1.6, APIs: 1, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007A6093

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5c23362cb8469639f5d5bd61aebfc892ea548f9a92186d90c44e0e8066b3aa9b
Instruction ID: 5f624f5acea9ae170fee3a13fe51118281f452659dac730433ee42acddfcf6dc
Opcode Fuzzy Hash: 5c23362cb8469639f5d5bd61aebfc892ea548f9a92186d90c44e0e8066b3aa9b
Instruction Fuzzy Hash: 6C210EF2D00544AFF7244610EC59FFB7329EBD1311F0981BEE9095A681D63C5AC58E52

Function 0076390E Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feecfd2df1c7ac606b2235d02184f71da5a7a8fa0882f8d9d932bd46452c240d
Instruction ID: 2f0c331eeb904785fccf5adfd9af8a912cba7c8be4c4ecd4d795a272fe138e45
Opcode Fuzzy Hash: feecfd2df1c7ac606b2235d02184f71da5a7a8fa0882f8d9d932bd46452c240d
Instruction Fuzzy Hash: 7931D1F2E051589FEB348A14CD98BEA7768EF40304F2481EAEA0D56240D67D6FC59E62

Function 00773BE8 Relevance: 1.6, APIs: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00773CD9

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d477d49dd728a228c4c6f57eb723cc1920f8865288ad5b6d7daceb052f8e7474
Instruction ID: 4664fc711cbdfb4ec489dcb58f9e3dfd7df2ef4cc1493acbb02faba5274715ac
Opcode Fuzzy Hash: d477d49dd728a228c4c6f57eb723cc1920f8865288ad5b6d7daceb052f8e7474
Instruction Fuzzy Hash: 3531E4B1D081688AEF208A64CC98BEA7BB4FF01344F2482EAD54D661C0D7788FC19F52

Function 007974A9 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3614ee1d9f30a89307c03fa6a440f521eec006d734804339a3e8f0b4f7117b85
Instruction ID: 579df47b45c9004fc2652c92d5ef38fb51abd9872b71a81358e62d769867bd25
Opcode Fuzzy Hash: 3614ee1d9f30a89307c03fa6a440f521eec006d734804339a3e8f0b4f7117b85
Instruction Fuzzy Hash: 753104F1D0426A9BE7219F10CC95BEAB734EF92310F0482FEDC4916646D7399A85CF92

Function 0075E124 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: feecd30f8c9319be8d215601a563091ec49ec056e870c57d9e2d0486de4fc5c8
Instruction ID: 424cc5b9e6cad0e10f730e573be125930dae4134b9fc97f156dc922930d87ad3
Opcode Fuzzy Hash: feecd30f8c9319be8d215601a563091ec49ec056e870c57d9e2d0486de4fc5c8
Instruction Fuzzy Hash: 713191B2E045789BE7258B55CC44ADABF79AB84311F0442FBEC0DA7240D2796F85CFA1

Function 00790643 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007906CB

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 39e275ec1c35cfc0fc8c2dfb902d0e47c153de596d32667f82fa5f950f90a53d
Instruction ID: 94b295f344223a285ced5dd52dbcc5cc4716c864928060ce38db524017d572cb
Opcode Fuzzy Hash: 39e275ec1c35cfc0fc8c2dfb902d0e47c153de596d32667f82fa5f950f90a53d
Instruction Fuzzy Hash: 84318075E182689FEB24CA24DD54AEBBB75FBC5310F1081FAE90D67280D7781E818E50

Function 0077355B Relevance: 1.6, APIs: 1, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00773CD9

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 672a6e9c398127390f159aa9a0a8a6dfc5638d474e8ee1d35211bc8b70eb8a28
Instruction ID: c8835926f6d796029f77ad5c753e3ea6f81012312edc9733c033b79208f10157
Opcode Fuzzy Hash: 672a6e9c398127390f159aa9a0a8a6dfc5638d474e8ee1d35211bc8b70eb8a28
Instruction Fuzzy Hash: BC2146B3F041989AEF344624CC1CBEB7A69EF81304F1881EAE54E56180D6BD5F958A23

Function 00437A4E Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243c03d28fefc7bfc76e5f9d67ecd0aee0ae9c6300cbf9d61b4aec04f09c4b68
Instruction ID: e685fcaec7639e152abd2c0db4721adcde6ad1eccf28977c9dd053634b64aa60
Opcode Fuzzy Hash: 243c03d28fefc7bfc76e5f9d67ecd0aee0ae9c6300cbf9d61b4aec04f09c4b68
Instruction Fuzzy Hash: ED31B2B09095688EEB34DA10CC54BFEBB75BF86306F18C0EBD88956241C6385EC18F85

Function 007903E7 Relevance: 1.6, APIs: 1, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007906CB

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a1da692fd9409898eedd0dff31bffa48d17f43ddad8d6db234594d823d53869f
Instruction ID: 45bb296a48f302e4603e322565e2c1125d3d68e2dc59f32590fab2fc83ae72c0
Opcode Fuzzy Hash: a1da692fd9409898eedd0dff31bffa48d17f43ddad8d6db234594d823d53869f
Instruction Fuzzy Hash: 8E216F75E182689EEB24CA64DD54AEBBB75FBC5315F1081FAE40D67280C7381E818E50

Function 007903C2 Relevance: 1.6, APIs: 1, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007906CB

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a0fbac005d1cd0a976140bc5e8a70ac1720e3fa486696c24fe5a4858d817a595
Instruction ID: 13d144791b41c64ff85181670863189da0003a33227410f599357e05549cce11
Opcode Fuzzy Hash: a0fbac005d1cd0a976140bc5e8a70ac1720e3fa486696c24fe5a4858d817a595
Instruction Fuzzy Hash: DF217175E182689FEF24CA64DD54AEBBB75FBC5314F1081FAE40D67280C7381E818E50

Function 00790390 Relevance: 1.6, APIs: 1, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007906CB

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f4dd04b85583fab945b4c70269a50a500312e9b4f735aaf1b2f4673d1c0b9df2
Instruction ID: 002258847cac7cc5c0396e5cde8aa0ba8063bf28b2bd4b75348f9bba97cd477a
Opcode Fuzzy Hash: f4dd04b85583fab945b4c70269a50a500312e9b4f735aaf1b2f4673d1c0b9df2
Instruction Fuzzy Hash: 51217175E182689FEF24CA64DD54AEBBB75FBC5314F1081FAE40DA7280C7381E818E60

Function 004360C3 Relevance: 1.6, APIs: 1, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2b9ee5b93113c9ecd1c533ca0ff79ca34461b2feea62dc68b74a3e5aba595e76
Instruction ID: 48f3cc865a0984af165a92f16e2fd60287389934402a623581960ad95f799c97
Opcode Fuzzy Hash: 2b9ee5b93113c9ecd1c533ca0ff79ca34461b2feea62dc68b74a3e5aba595e76
Instruction Fuzzy Hash: BF2120B1D04929ABEB30CA15CC84BEB7BB5AB85305F1481FAD94D66241C63C5EC2CF84

Function 0042014B Relevance: 1.6, APIs: 1, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?), ref: 004201B8

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cc13985adc761a46429428e5bd474307ea7958b409a345780647d696ba53012f
Instruction ID: 9671d37d4a75ce5aa1982cfdab36205b5de45d335f6f2501c1c3db36624401c9
Opcode Fuzzy Hash: cc13985adc761a46429428e5bd474307ea7958b409a345780647d696ba53012f
Instruction Fuzzy Hash: F831C2B1E0A2259BE724CA14DC94AFAB7B9EF84300F1041EAD40D63681D63D6FC1DE62

Function 0042016C Relevance: 1.6, APIs: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?), ref: 004201B8

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 37948ab762802ce7f557aa99ed7308f9b85f52108a0519ab78828b44e4f3cb4a
Instruction ID: 45216ff5e39a4ce5787e80d90b860c832f48a82df623d6b95750821e27953b44
Opcode Fuzzy Hash: 37948ab762802ce7f557aa99ed7308f9b85f52108a0519ab78828b44e4f3cb4a
Instruction Fuzzy Hash: 6921E7B1E0A1349BE7248A14DD54AFAB7B9EF80300F1481F6D40D63685D63D6FC6DE62

Function 0043557E Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6d643d96f4e8432022d1308e396aced8aabc9cc9f7284635b128964820ef658d
Instruction ID: 3cc8ede69fe2f45060b56daf5c69da5546aaa454d50bc43abd812abceaf9202b
Opcode Fuzzy Hash: 6d643d96f4e8432022d1308e396aced8aabc9cc9f7284635b128964820ef658d
Instruction Fuzzy Hash: 7611BDF3D082566FE3209A24DC91BE77B28DF56310F1095BBE58EC2041D53C99C18B53

Function 00790695 Relevance: 1.6, APIs: 1, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007906CB

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bc16e440c8a43cd813293962f44e32bb2fb2b21321650d273e94f524e1eafcce
Instruction ID: 088ad30a03d76802c3dd1bb101c31d20a925d9e036b40da3ef66bc8181f001ca
Opcode Fuzzy Hash: bc16e440c8a43cd813293962f44e32bb2fb2b21321650d273e94f524e1eafcce
Instruction Fuzzy Hash: 2B219275A18228DFEF24CA24DD94ABBB775FFC5314F1041FAE54D56280C7381E818E50

Function 007A5449 Relevance: 1.6, APIs: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 007A6093

Memory Dump Source

Source File: 00000000.00000002.1655969725.0000000000790000.00000040.00000001.01000000.00000003.sdmp, Offset: 00790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9ee1d9d3e21e9ebdd4bc5b49d3b426aee428698af9715a4c11122f147b3e7827
Instruction ID: 5fbe71f9b562c14f4b651b296a2d851ffabf6aeb7db5d3f58efc23f51546c1ba
Opcode Fuzzy Hash: 9ee1d9d3e21e9ebdd4bc5b49d3b426aee428698af9715a4c11122f147b3e7827
Instruction Fuzzy Hash: E3112CE3C00545AFF7244510EC59FFB732ADBD5311F08C1BAE90A9AA84D63C5AC58E62

Function 00435625 Relevance: 1.6, APIs: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 95dd215d890fe885fa150a14f9c9722c30204adc5fcefd90c24751f7340a85c7
Instruction ID: 5536b51baad34215fd5c76938a89e049e4e95c9d0a4340a867dee740062a741e
Opcode Fuzzy Hash: 95dd215d890fe885fa150a14f9c9722c30204adc5fcefd90c24751f7340a85c7
Instruction Fuzzy Hash: 27116BF3E096557EE7204624EC5AFE77F2CDB96310F25A6BAE14E82001C63D49C1CB46

Function 0075020E Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000), ref: 0075056A

Memory Dump Source

Source File: 00000000.00000002.1655851065.0000000000750000.00000040.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 25e74c388fa7a7e88b2ecd8b6fcaabb371e689bd8cbe02c10dae0738072a69a2
Instruction ID: a87fb8c256cbfaf492003045d29e730c9a3264ecf22d51df8e91cf6fa4c01a75
Opcode Fuzzy Hash: 25e74c388fa7a7e88b2ecd8b6fcaabb371e689bd8cbe02c10dae0738072a69a2
Instruction Fuzzy Hash: 2B117270C082699FDB209B60DC94BEAB7B4FF45301F1005DED9499A141EB745ED5CF51

Function 0075025A Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000), ref: 0075056A

Memory Dump Source

Source File: 00000000.00000002.1655851065.0000000000750000.00000040.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bc82d6c4e5de0e4fda556e01048f724bd24922641a901bbfa2146e59aaa4c273
Instruction ID: 9ec71293e648626ecb06b5f6d8358b843d766d68b70a88a5e0b6db413746d7a3
Opcode Fuzzy Hash: bc82d6c4e5de0e4fda556e01048f724bd24922641a901bbfa2146e59aaa4c273
Instruction Fuzzy Hash: E61102B08082689FDB208B20CC94BEA7BB4FF45300F1004EEE9898A141EA785ED5CF52

Function 007502B1 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000), ref: 0075056A

Memory Dump Source

Source File: 00000000.00000002.1655851065.0000000000750000.00000040.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9cdb46649e74b6b53f6801e46e80e1337b946775cee847cca3996799c167538f
Instruction ID: 57266d96aa99ce48471ab05f0c0f63b8d84fe28dac3fed63003291f55c0d2162
Opcode Fuzzy Hash: 9cdb46649e74b6b53f6801e46e80e1337b946775cee847cca3996799c167538f
Instruction Fuzzy Hash: 31112970C082585FD7348B20CC94BEA7BB4FF45301F1000DEE9898A141EA745ED5CF51

Function 0075028C Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,00000000), ref: 0075056A

Memory Dump Source

Source File: 00000000.00000002.1655851065.0000000000750000.00000040.00000001.01000000.00000003.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b1be6c4d46a960bcc2112b684d7c987132ba4a067c3d7d0b86ffbb358d3843f7
Instruction ID: fe97c7363b7159a6411f8d56bf93e2ce82b3f315435f36dfff5454c326b253fd
Opcode Fuzzy Hash: b1be6c4d46a960bcc2112b684d7c987132ba4a067c3d7d0b86ffbb358d3843f7
Instruction Fuzzy Hash: 081125B0C082689FDB308B20CC94BEA7BB4FF45300F1000EEE9898A141EA785ED5CF52

Function 00435613 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 42c93baf4070484f13d089ffc83ab4da4b35897c421f14b76e6d27722148d3e7
Instruction ID: 5fe10c216cf4a406662e61a95994e36344518a921cf7da17be4e8a4416b16a14
Opcode Fuzzy Hash: 42c93baf4070484f13d089ffc83ab4da4b35897c421f14b76e6d27722148d3e7
Instruction Fuzzy Hash: FE0197F38182566FE3209A24EC92BEB7B28DF12310F10D6BEE14DD2041C63C98C08B42

Function 00740EED Relevance: 1.5, APIs: 1, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d98b82a50202d422e1af75421f975d3c86a5aceabcc997772b742eb659ab353e
Instruction ID: ae0b5a06d765750e357403d60e05315a843ef829dc1cb2663708cddc86062fed
Opcode Fuzzy Hash: d98b82a50202d422e1af75421f975d3c86a5aceabcc997772b742eb659ab353e
Instruction Fuzzy Hash: 12C179B1E052688BDB24DB14CC94BEAB7B5FB89304F1441EAD94DA7640D778AEC1CF41

Function 00437444 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: bbdb90d4407b46d2c1b832b54fce1d66b7e83cd754db7be85bc30d66364d682a
Instruction ID: 99e904b4e45fc7381ced3f6e9169a336d433f8c69120edf2f3dfe36c29199b86
Opcode Fuzzy Hash: bbdb90d4407b46d2c1b832b54fce1d66b7e83cd754db7be85bc30d66364d682a
Instruction Fuzzy Hash: BDF028B2E095145AF3218625DC99FEB7F399FA4315F1040BAD8CE05181E5395EC28953

Function 00435AA4 Relevance: 1.5, APIs: 1, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 004361CE

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2a11129f93112974b40c117dc6a5eed0e49cc2b5055afc2da0ac258e8b3d5c0e
Instruction ID: 6c65e6ad35efbc4107222c4597b6c7b02d5a308d8a5d8f977557f5c832672d48
Opcode Fuzzy Hash: 2a11129f93112974b40c117dc6a5eed0e49cc2b5055afc2da0ac258e8b3d5c0e
Instruction Fuzzy Hash: 3AE09BF1E04329ABD7209A519C85BA77768DF06310F11D2EAE14E51541DA389DD1CF45

Function 00437066 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 00437BB7

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 5cbc8bff280397d290591dc35fb931c4a52dc0fcdb094183cadf7f59c42a2a09
Instruction ID: b4d24c3e71b8a3f2ce30f3cd99ead40135bc4153975daa31cbcca6fc72cc340a
Opcode Fuzzy Hash: 5cbc8bff280397d290591dc35fb931c4a52dc0fcdb094183cadf7f59c42a2a09
Instruction Fuzzy Hash: 71B092F080916486FB209A24D80A78CB6786B04315F0440D2D88A6418192B41A868E53

Function 007414DF Relevance: 1.5, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 81b9175138d064cbe8514ff69128a571d3c3537b2349093e1ff45c85aa333420
Instruction ID: 88bbc58f46e9594961a231a864012493d37141237c9bb713e1ce02110987d481
Opcode Fuzzy Hash: 81b9175138d064cbe8514ff69128a571d3c3537b2349093e1ff45c85aa333420
Instruction Fuzzy Hash: 3A91B1B1E002289BDB24DB14DC54BEAB775FF85310F6481E9E44EA6680E7399EC1CF52

Function 007413B8 Relevance: 1.4, APIs: 1, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4d9eefcb1c121f6b349f5017002b301e71892c5be41a08f43bbc4ece59988358
Instruction ID: 6645da0ce26d3ec828cfecd020b23d731687af968562588a2728801fedefb5d4
Opcode Fuzzy Hash: 4d9eefcb1c121f6b349f5017002b301e71892c5be41a08f43bbc4ece59988358
Instruction Fuzzy Hash: 6F719EB1E012289AEB209B14DC54BEAB775EF85310F6481E9D44EA7240E7799EC2CF52

Function 00741445 Relevance: 1.4, APIs: 1, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 0b1abdbac71ed57a34b8f49b90b3292d408a6bf6e740e50c9d844205e478291d
Instruction ID: 0932692355c5cee861d5766fa9698f759dd3eeff6490d4d258ec9929341fe752
Opcode Fuzzy Hash: 0b1abdbac71ed57a34b8f49b90b3292d408a6bf6e740e50c9d844205e478291d
Instruction Fuzzy Hash: 8151C0B1E012689BDB209B64CC54BEAB775FF85300F5481E9E44DA7281E7399EC2CF52

Function 0074146C Relevance: 1.4, APIs: 1, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1a3200bfdcbefc8b51f82879edfaab495cc5f605efb2dbb851726f0f8959a707
Instruction ID: 2fc0505a88e59deb3183f52c164a7c3ba29e7c8d83fe5b28cf710cd01be66aba
Opcode Fuzzy Hash: 1a3200bfdcbefc8b51f82879edfaab495cc5f605efb2dbb851726f0f8959a707
Instruction Fuzzy Hash: 7051B0B0E002689BDB209F64CC54BEAB774FF89700F5481E9E44DA6240E7399EC2CF42

Function 00741464 Relevance: 1.4, APIs: 1, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 0925f77a6da70ae3da8bd181c94ca3fe72a159606b045054065648ea56ce8a90
Instruction ID: 2dfc7dc29483b80391f58e6b8e1f9a60dd18ab27194ad75d8a704dfffee87c4a
Opcode Fuzzy Hash: 0925f77a6da70ae3da8bd181c94ca3fe72a159606b045054065648ea56ce8a90
Instruction Fuzzy Hash: D851BDB1E002289ADB209F24CC54BEAB774FF89700F5481E9E44DA6240E7399EC2CF52

Function 0074126C Relevance: 1.4, APIs: 1, Instructions: 148COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f6b89791b1e15ff5d9db1e54540f8bad7b52b12140d8cb73cf40e5364af87102
Instruction ID: 619de2ad2842bf67e86be81ad8208f156673dc3e84e132ff1e22d003ab5dff92
Opcode Fuzzy Hash: f6b89791b1e15ff5d9db1e54540f8bad7b52b12140d8cb73cf40e5364af87102
Instruction Fuzzy Hash: E351C3B2F017249BEB209A24DC44BEA7BB8FB45310F5440F9E44DA6640D7799EC1CF52

Function 007412F3 Relevance: 1.4, APIs: 1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 97320e44d2cdbcc5f58ae3a63f497a3d5b3d55806fa68093d8190bfb91d4e0f7
Instruction ID: b82870f320400fde16790052eb1677ac0189ba8014f6b55925daf6df2842b3c0
Opcode Fuzzy Hash: 97320e44d2cdbcc5f58ae3a63f497a3d5b3d55806fa68093d8190bfb91d4e0f7
Instruction Fuzzy Hash: 0E419EB1E013289BEB209A24CC84BEA7BB4FB49710F5440E9E44DA6680D7799EC1CF52

Function 00741859 Relevance: 1.4, APIs: 1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441e4a7bebd09ff1cdc8ab623c669177aec614b71a8f88893249150e4077e423
Instruction ID: 4d8389e477096b0c0db5a1921425b056df11c9706f767ef0d1dac353a07f11b6
Opcode Fuzzy Hash: 441e4a7bebd09ff1cdc8ab623c669177aec614b71a8f88893249150e4077e423
Instruction Fuzzy Hash: F241CD70F156A88BDB24DB64CC94BAE77B5BF85301F2841EDE409A7681D738AAC1CF01

Function 00741306 Relevance: 1.4, APIs: 1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: aef7b698cdee24740f46e4733f1751d036a78a6b8cdd3bd90d0d8a72f46668e2
Instruction ID: cc5a5c0ae4ddf00befdbb759fb74890ee1dd6ee7ad4d0ed8df746f7fb408fea3
Opcode Fuzzy Hash: aef7b698cdee24740f46e4733f1751d036a78a6b8cdd3bd90d0d8a72f46668e2
Instruction Fuzzy Hash: 7F41A1B1E013289FEB209E24DC84BEA7B74FB49310F5440E9E44DA6680D779AEC1CF52

Function 00740BC7 Relevance: 1.3, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 648545379ed0f1f849cc57c346b0963ec341509c6abb5432bbd95b6ab03da2e0
Instruction ID: 235a66c9c274d051459556325c1785dadeaea0c0cee448c100f533049bff8237
Opcode Fuzzy Hash: 648545379ed0f1f849cc57c346b0963ec341509c6abb5432bbd95b6ab03da2e0
Instruction Fuzzy Hash: 4C31B6A2E053749FFB605A60CC49BAB7B78FB41310F1485F9E50DA6580CA7D9EC18F52

Function 00740BC2 Relevance: 1.3, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b872f80706f6457f1f1e7af29127957bb8f070d874272688760c44bfa99c5d42
Instruction ID: 2475de9e0f6b98f71a348776a8bcd61fb1e41a0096fccc879c16a7dc0929241e
Opcode Fuzzy Hash: b872f80706f6457f1f1e7af29127957bb8f070d874272688760c44bfa99c5d42
Instruction Fuzzy Hash: 2531E9A2E05264EFF7605A60CC49BAB7B78FB41320F1085B9E50DA6580C77D9EC08F52

Function 0074162C Relevance: 1.3, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 85bb247874ef7f02b70f0ca4a876b7aa756b770141e350b27b24caef7533848d
Instruction ID: 984925514939fd2eac24dd6c02176424087509e7382f1fb2ee421ef25db63559
Opcode Fuzzy Hash: 85bb247874ef7f02b70f0ca4a876b7aa756b770141e350b27b24caef7533848d
Instruction Fuzzy Hash: EC31A0B1F013689BDB319B60CC44BAA7B74BF4A710F5440E9E44DA6240D7799EC1CF52

Function 00740DC5 Relevance: 1.3, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: fef0fbcd7a3e1340b87cae4410dd82bc07972f2bef6726015c260b5ab0d54209
Instruction ID: cd30d48e7f9f3db5536bf351494663a0b418fa7612ea9e15b2f74db99430ddf5
Opcode Fuzzy Hash: fef0fbcd7a3e1340b87cae4410dd82bc07972f2bef6726015c260b5ab0d54209
Instruction Fuzzy Hash: AF21EA72E053749BEB706A60CC49BAB7B74FB45310F1085F9E50DA6180C67C9EC18F52

Function 00740B82 Relevance: 1.3, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c8ff0523d8b038c7ba6977a299b258ec78e05f0c6ead94dec9e3788d957a9e2a
Instruction ID: 2c51021321b1fe9c7b5de0338bb4266ed42250d9905d62b8a65027c3941cbebe
Opcode Fuzzy Hash: c8ff0523d8b038c7ba6977a299b258ec78e05f0c6ead94dec9e3788d957a9e2a
Instruction Fuzzy Hash: E021E7A2E052649BEB606A60CC49BAB7B78FB45310F1085F9E50DA6180CB7C9EC18F52

Function 007418AB Relevance: 1.3, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9cae5113acdeb109d791446b709f4876876f6535aecbbd542b9d24482030d08c
Instruction ID: baf7d6b04d07e42006ec1f20669eada6fc7959e9d406d204f98bf1686290beb8
Opcode Fuzzy Hash: 9cae5113acdeb109d791446b709f4876876f6535aecbbd542b9d24482030d08c
Instruction Fuzzy Hash: 0E216DB5B012589FEB64DB60CC95BAEB7B5BF85300F2481D9E449A7680C7789EC1CF11

Function 0074190D Relevance: 1.3, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 7b1601389a92a27b050bb48bd2393205c576265dbd07c15091d0f0da73f91c7f
Instruction ID: 1cbabdc7598e3008c264ab3e80aac19a7b084144a072689e1219738eb471181c
Opcode Fuzzy Hash: 7b1601389a92a27b050bb48bd2393205c576265dbd07c15091d0f0da73f91c7f
Instruction Fuzzy Hash: 05218D71F012689BEB249B61CC58BAA7BB5BB85311F5481D9E04DA7280D7789AC1CF01

Function 0074166D Relevance: 1.3, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 587d0e872766ac1c7dfe180a9ad2b0ab2af09c4c97915807a39e8f4c0b2617a2
Instruction ID: 7276f170164bc5dc42fc9ac2ecbe61cafe82a82f689aac914cb6d24b939e5966
Opcode Fuzzy Hash: 587d0e872766ac1c7dfe180a9ad2b0ab2af09c4c97915807a39e8f4c0b2617a2
Instruction Fuzzy Hash: A7216D75F023689BEB609B60DC88B9A7B74BF49710F1441E9E44DA6280D7789EC0CF51

Function 00740E97 Relevance: 1.3, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ff140497cad864ac5820ae1a1052148fdde1c01e4a06244e19cdb2d370ffe35d
Instruction ID: b41bc08c2369b32424c03f9f9dd115fbdfc69591f87a271759e5c7e08036e259
Opcode Fuzzy Hash: ff140497cad864ac5820ae1a1052148fdde1c01e4a06244e19cdb2d370ffe35d
Instruction Fuzzy Hash: 5111E771F01354ABEB609B60CC49BAA7778FB85711F1081E9E54DA6280DA789EC18F11

Function 00740E90 Relevance: 1.3, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 73677266912bed33cec91d8f722307a17b2618802c8c1814beb24076b01b14b6
Instruction ID: 1d7dd790af9ae25551127c459e71bb214f133b437bec9cc690d487355ef668c7
Opcode Fuzzy Hash: 73677266912bed33cec91d8f722307a17b2618802c8c1814beb24076b01b14b6
Instruction Fuzzy Hash: 92119875B01364DBDB709B60CC49B9A7778FB85710F1444EDE54DA6280D7789EC08F51

Function 007412C6 Relevance: 1.3, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: af4d10150298fbd7cade4d3fcc808cc664dd86ad2de384bedcbf567147faac37
Instruction ID: e9947c38542fdc0fcaff1bd74a8745e248486ec53b261e87251e9ef425fb17aa
Opcode Fuzzy Hash: af4d10150298fbd7cade4d3fcc808cc664dd86ad2de384bedcbf567147faac37
Instruction Fuzzy Hash: C8115E75B023649BEB619F708C49B6A7774BF45710F1481D9E149B6280DB749EC08F11

Function 007412C1 Relevance: 1.3, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 007419B4

Memory Dump Source

Source File: 00000000.00000002.1655533962.000000000073B000.00000040.00000001.01000000.00000003.sdmp, Offset: 0073B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b000_an_api.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 39db208bd6bd02f5e992d123cda50fda0d60b9b28162078fca57276da439f46a
Instruction ID: 21c98912029fd0c6aee7d13a71e502cdc865b7122b65b25765b7f014a7037dbb
Opcode Fuzzy Hash: 39db208bd6bd02f5e992d123cda50fda0d60b9b28162078fca57276da439f46a
Instruction Fuzzy Hash: 50116175B01354DBEB60AF60CC49B6A7774BB85710F1485D8E04DA6280DBB8DEC18F01

Non-executed Functions

Function 00787806 Relevance: 46.8, Strings: 37, Instructions: 512COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
b, xrefs: 00787C72
t, xrefs: 00788BE2
s, xrefs: 00788C0C
x, xrefs: 00788BD4
y, xrefs: 00787C8E
W, xrefs: 00787C95
e, xrefs: 00788C05
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
s, xrefs: 00788C13
b, xrefs: 007890E7
a, xrefs: 00787C80
y, xrefs: 00789103
d, xrefs: 00787C5D
L, xrefs: 007890D9
L, xrefs: 00787C48
o, xrefs: 007890C4
Q, xrefs: 00787903
c, xrefs: 00788BFE
i, xrefs: 00788BDB
r, xrefs: 00787C87
GI4<, xrefs: 00787FF0
E, xrefs: 00788BCD
L, xrefs: 00787C64
r, xrefs: 007890EE
r, xrefs: 00788BF0
a, xrefs: 00787C56
r, xrefs: 00787C79
a, xrefs: 007890F5
r, xrefs: 007890FC
W, xrefs: 0078910A
o, xrefs: 00787C4F
P, xrefs: 00788BE9
i, xrefs: 00787C6B
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$GI4<$L$L$L$L$P$Q$W$W$a$a$a$a$b$b$c$d$d$e$i$i$i$o$o$o$r$r$r$r$r$s$s$t$x$y$y
API String ID: 0-1574106720
Opcode ID: 4819f6461652e69d8136e211b1e0f20dfc6bb49b754162460943383fd4545b60
Instruction ID: 16c51922a6d1ab23c271106ea1ea81363e1878e191bf9cdb27cb861539186743
Opcode Fuzzy Hash: 4819f6461652e69d8136e211b1e0f20dfc6bb49b754162460943383fd4545b60
Instruction Fuzzy Hash: B022D1B1D082A88AE7249B24DC58BEABB75EF90300F1480F9D54D67281D7BD4FC5CB62

Function 00787B04 Relevance: 46.8, Strings: 37, Instructions: 502COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
b, xrefs: 00787C72
t, xrefs: 00788BE2
s, xrefs: 00788C0C
x, xrefs: 00788BD4
y, xrefs: 00787C8E
W, xrefs: 00787C95
e, xrefs: 00788C05
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
s, xrefs: 00788C13
b, xrefs: 007890E7
a, xrefs: 00787C80
y, xrefs: 00789103
d, xrefs: 00787C5D
L, xrefs: 007890D9
L, xrefs: 00787C48
o, xrefs: 007890C4
Q, xrefs: 00787903
c, xrefs: 00788BFE
i, xrefs: 00788BDB
r, xrefs: 00787C87
GI4<, xrefs: 00787FF0
E, xrefs: 00788BCD
L, xrefs: 00787C64
r, xrefs: 007890EE
r, xrefs: 00788BF0
a, xrefs: 00787C56
r, xrefs: 00787C79
a, xrefs: 007890F5
r, xrefs: 007890FC
W, xrefs: 0078910A
o, xrefs: 00787C4F
P, xrefs: 00788BE9
i, xrefs: 00787C6B
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$GI4<$L$L$L$L$P$Q$W$W$a$a$a$a$b$b$c$d$d$e$i$i$i$o$o$o$r$r$r$r$r$s$s$t$x$y$y
API String ID: 0-1574106720
Opcode ID: 838f9b6b9db24443cc8c3d75dd4a7c917cf91804ebd97c5ca0ea32c66d3f3b68
Instruction ID: 0d8aa64c09609efe559cbf99c35d64009e7cd0fd3eed5e575fea9c2f48295eb0
Opcode Fuzzy Hash: 838f9b6b9db24443cc8c3d75dd4a7c917cf91804ebd97c5ca0ea32c66d3f3b68
Instruction Fuzzy Hash: 4912D0B1D082A88AEB249B24DC58BEABB75EF51300F1440F9D54DA7281D7BD4FC5CB62

Function 00786021 Relevance: 45.8, Strings: 36, Instructions: 785COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
b, xrefs: 00787C72
t, xrefs: 00788BE2
s, xrefs: 00788C0C
x, xrefs: 00788BD4
y, xrefs: 00787C8E
W, xrefs: 00787C95
e, xrefs: 00788C05
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
s, xrefs: 00788C13
b, xrefs: 007890E7
a, xrefs: 00787C80
y, xrefs: 00789103
d, xrefs: 00787C5D
L, xrefs: 007890D9
L, xrefs: 00787C48
o, xrefs: 007890C4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
r, xrefs: 00787C87
GI4<, xrefs: 00787FF0
E, xrefs: 00788BCD
L, xrefs: 00787C64
r, xrefs: 007890EE
r, xrefs: 00788BF0
a, xrefs: 00787C56
r, xrefs: 00787C79
a, xrefs: 007890F5
r, xrefs: 007890FC
W, xrefs: 0078910A
o, xrefs: 00787C4F
P, xrefs: 00788BE9
i, xrefs: 00787C6B
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$GI4<$L$L$L$L$P$W$W$a$a$a$a$b$b$c$d$d$e$i$i$i$o$o$o$r$r$r$r$r$s$s$t$x$y$y
API String ID: 0-1043747905
Opcode ID: 2499d40a214e458c02ccd860819a9cb7e13971148586f6ae822a96b9db136e25
Instruction ID: 0035d4919ebe316b49e2a32457dfe1006356b3f608e98f92c851c28a62dafbe7
Opcode Fuzzy Hash: 2499d40a214e458c02ccd860819a9cb7e13971148586f6ae822a96b9db136e25
Instruction Fuzzy Hash: EA62D0B1D082A89AEB24DB24DC98BEABB75EF45300F1040EAD44DA7281D7795FC5CF51

Function 00787912 Relevance: 45.5, Strings: 36, Instructions: 464COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
b, xrefs: 00787C72
t, xrefs: 00788BE2
s, xrefs: 00788C0C
x, xrefs: 00788BD4
y, xrefs: 00787C8E
W, xrefs: 00787C95
e, xrefs: 00788C05
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
s, xrefs: 00788C13
b, xrefs: 007890E7
a, xrefs: 00787C80
y, xrefs: 00789103
d, xrefs: 00787C5D
L, xrefs: 007890D9
L, xrefs: 00787C48
o, xrefs: 007890C4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
r, xrefs: 00787C87
GI4<, xrefs: 00787FF0
E, xrefs: 00788BCD
L, xrefs: 00787C64
r, xrefs: 007890EE
r, xrefs: 00788BF0
a, xrefs: 00787C56
r, xrefs: 00787C79
a, xrefs: 007890F5
r, xrefs: 007890FC
W, xrefs: 0078910A
o, xrefs: 00787C4F
P, xrefs: 00788BE9
i, xrefs: 00787C6B
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$GI4<$L$L$L$L$P$W$W$a$a$a$a$b$b$c$d$d$e$i$i$i$o$o$o$r$r$r$r$r$s$s$t$x$y$y
API String ID: 0-1043747905
Opcode ID: 266954a3e2accfdd4b6a7941801b51c83b09180020631cd32568fee549ec5609
Instruction ID: 66c7a79897db58b7a12ae4a746521455f2a31236dabafccf7e4a30f490a05003
Opcode Fuzzy Hash: 266954a3e2accfdd4b6a7941801b51c83b09180020631cd32568fee549ec5609
Instruction Fuzzy Hash: 9012E2A1D082A88AEB249B24DC58BEABB75EF51300F1440F9D54DA7281D7BD4FC5CF62

Function 00773EDB Relevance: 30.5, Strings: 24, Instructions: 503COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
D, xrefs: 00774174
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: D$E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-135341007
Opcode ID: d3b8882e80d641c566cfbb0e8f16a8c4114816c82183173e239c10d838d5ad63
Instruction ID: ed7ece5de607a9b13befe89c7317d60eaad4fee2447d6b99966710e3ff36ae37
Opcode Fuzzy Hash: d3b8882e80d641c566cfbb0e8f16a8c4114816c82183173e239c10d838d5ad63
Instruction Fuzzy Hash: 6422DF71D082A88AEB248A28CC58BEA7BB5EF51304F1440F9D54DA7281D7BE5FC5CF52

Function 00787F91 Relevance: 30.5, Strings: 24, Instructions: 453COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
GI4<, xrefs: 00787FF0
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 007890EE
r, xrefs: 00788BF0
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$GI4<$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-3162309216
Opcode ID: 6426bacbaf6c9af287df4e56af580889ee39eb91d49e75e3259d4a32fe8ebf5b
Instruction ID: b092de671bdc1b57ba49222297d6b0a694199c4de1fc2a4cd1611cbcfaefdb6f
Opcode Fuzzy Hash: 6426bacbaf6c9af287df4e56af580889ee39eb91d49e75e3259d4a32fe8ebf5b
Instruction Fuzzy Hash: 5F0203B2D082A88AE7249A24DC58BEABB75EF50310F1440FAD54DA7281D7BD4FC5CF52

Function 00787E81 Relevance: 30.4, Strings: 24, Instructions: 381COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
GI4<, xrefs: 00787FF0
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 007890EE
r, xrefs: 00788BF0
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$GI4<$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-3162309216
Opcode ID: d2f81c751735284bc6a0500bf0aed8e2a5977d6cb2f1720155da4cea9d565bc0
Instruction ID: fa2cffacc37f9b606df185b6c0807225ce9484181724cc4fc2ea360fdf8a0d8b
Opcode Fuzzy Hash: d2f81c751735284bc6a0500bf0aed8e2a5977d6cb2f1720155da4cea9d565bc0
Instruction Fuzzy Hash: 83E1F2B1D082A88AEB249B24DC587EABB75EF41310F1440FAD54D67281E7BD4FC5CB62

Function 004255CD Relevance: 30.3, Strings: 24, Instructions: 327COMMON

Download Yara Rule

Strings

L, xrefs: 00425730
s, xrefs: 004367EA
ZW, xrefs: 00430A31
P, xrefs: 004367C7
b, xrefs: 0042573E
y, xrefs: 0042575A
i, xrefs: 004367B9
E, xrefs: 004367AB
L, xrefs: 00425714
a, xrefs: 00425722
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
r, xrefs: 00425745
r, xrefs: 00425753
r, xrefs: 004367CE
d, xrefs: 00425729
o, xrefs: 0042571B
W, xrefs: 00425761
i, xrefs: 00425737
s, xrefs: 004367F1
a, xrefs: 0042574C
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$ZW$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2067304671
Opcode ID: 6884dc09f6807419133ca125fe337769de98ea77ab4d4ff6a915d334f191ad04
Instruction ID: 1a62dafd52f08700fd96b3d3a82f1296e47a53c716c1d27dd4c31ff3663bf475
Opcode Fuzzy Hash: 6884dc09f6807419133ca125fe337769de98ea77ab4d4ff6a915d334f191ad04
Instruction Fuzzy Hash: D1D1F2B1D086A88AEB208B24DC547EABBB5FF55300F1480FAD44D67281D77A1EC5CF66

Function 00424C00 Relevance: 30.3, Strings: 24, Instructions: 324COMMON

Download Yara Rule

Strings

L, xrefs: 00425730
s, xrefs: 004367EA
ZW, xrefs: 00430A31
P, xrefs: 004367C7
b, xrefs: 0042573E
y, xrefs: 0042575A
i, xrefs: 004367B9
E, xrefs: 004367AB
L, xrefs: 00425714
a, xrefs: 00425722
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
r, xrefs: 00425745
r, xrefs: 00425753
r, xrefs: 004367CE
d, xrefs: 00425729
o, xrefs: 0042571B
W, xrefs: 00425761
i, xrefs: 00425737
s, xrefs: 004367F1
a, xrefs: 0042574C
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$ZW$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2067304671
Opcode ID: bca731d557083ac2d838db67da0c275d938bd3c941c2500fc51bd391487bc4f2
Instruction ID: 312ba07da9647d979e4b96f47b40c8179140f13b07d6ee7fb18778010b5d2f3f
Opcode Fuzzy Hash: bca731d557083ac2d838db67da0c275d938bd3c941c2500fc51bd391487bc4f2
Instruction Fuzzy Hash: DAD1D4B1D08668CAE720CA24EC447EA7BB5EF91304F1480FAD44D66681D67E0FC5CF66

Function 00424E53 Relevance: 30.3, Strings: 24, Instructions: 319COMMON

Download Yara Rule

Strings

L, xrefs: 00425730
s, xrefs: 004367EA
ZW, xrefs: 00430A31
P, xrefs: 004367C7
b, xrefs: 0042573E
y, xrefs: 0042575A
i, xrefs: 004367B9
E, xrefs: 004367AB
L, xrefs: 00425714
a, xrefs: 00425722
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
r, xrefs: 00425745
r, xrefs: 00425753
r, xrefs: 004367CE
d, xrefs: 00425729
o, xrefs: 0042571B
W, xrefs: 00425761
i, xrefs: 00425737
s, xrefs: 004367F1
a, xrefs: 0042574C
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$ZW$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2067304671
Opcode ID: c91b30166e010125e2550344fbd474346124e2c02b1059b0c6d1e210be5c41d0
Instruction ID: 399b9e6f64d8f7249ba1407fbd80b444c8719853eb1ea75e381ec485fb907e84
Opcode Fuzzy Hash: c91b30166e010125e2550344fbd474346124e2c02b1059b0c6d1e210be5c41d0
Instruction Fuzzy Hash: 10D1D3B1E08668CAE720CA24EC447EA7BB5EF95304F1480FAD44D56281D67E1FC5CF66

Function 00424C73 Relevance: 30.3, Strings: 24, Instructions: 316COMMON

Download Yara Rule

Strings

L, xrefs: 00425730
s, xrefs: 004367EA
ZW, xrefs: 00430A31
P, xrefs: 004367C7
b, xrefs: 0042573E
y, xrefs: 0042575A
i, xrefs: 004367B9
E, xrefs: 004367AB
L, xrefs: 00425714
a, xrefs: 00425722
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
r, xrefs: 00425745
r, xrefs: 00425753
r, xrefs: 004367CE
d, xrefs: 00425729
o, xrefs: 0042571B
W, xrefs: 00425761
i, xrefs: 00425737
s, xrefs: 004367F1
a, xrefs: 0042574C
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$ZW$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2067304671
Opcode ID: 40c6dc6acf07bca7c8174b6a7a669edb2fe1649cc0fe414cfe0b64edd132f5ad
Instruction ID: 457ba576cb818cd03b5a18fcb270c97991678a77ab083acc269a765419bd989c
Opcode Fuzzy Hash: 40c6dc6acf07bca7c8174b6a7a669edb2fe1649cc0fe414cfe0b64edd132f5ad
Instruction Fuzzy Hash: 0CC1C3B1E08668CAE720CA24EC447EA7BB5EF91304F1480FAD44D66681D67E1FC5CF66

Function 00425512 Relevance: 30.3, Strings: 24, Instructions: 305COMMON

Download Yara Rule

Strings

L, xrefs: 00425730
s, xrefs: 004367EA
ZW, xrefs: 00430A31
P, xrefs: 004367C7
b, xrefs: 0042573E
y, xrefs: 0042575A
i, xrefs: 004367B9
E, xrefs: 004367AB
L, xrefs: 00425714
a, xrefs: 00425722
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
r, xrefs: 00425745
r, xrefs: 00425753
r, xrefs: 004367CE
d, xrefs: 00425729
o, xrefs: 0042571B
W, xrefs: 00425761
i, xrefs: 00425737
s, xrefs: 004367F1
a, xrefs: 0042574C
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$ZW$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-2067304671
Opcode ID: d0bc87a06825b68966a15600f72d9094f785653f55d68025b0e8b719de5755a2
Instruction ID: 31622d7732b8c28b5b5aadc4b497fd75813791d80474b5a8510f6b916e81ed1c
Opcode Fuzzy Hash: d0bc87a06825b68966a15600f72d9094f785653f55d68025b0e8b719de5755a2
Instruction Fuzzy Hash: F2C1C271D086A8CAEB208B24DC547EABBB5EF55304F0480FAD48D66281D77E1EC5CF66

Function 0078861D Relevance: 29.3, Strings: 23, Instructions: 532COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-215400123
Opcode ID: 9a464d1d44b70f7d47821e83393f9b7598e8252890378e76db8e81f04c4fca22
Instruction ID: 235ff28340f3aaea9d46d075871ee25bcc97a262a55d55abe4c1e055747e230e
Opcode Fuzzy Hash: 9a464d1d44b70f7d47821e83393f9b7598e8252890378e76db8e81f04c4fca22
Instruction Fuzzy Hash: 5E32ADB1D046A88BEB249B24CC94BEABBB5EF54304F1480EAD84D67281D7795FC1CF52

Function 0077DAE1 Relevance: 29.3, Strings: 23, Instructions: 517COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-215400123
Opcode ID: 1de8418cc756fd7f90441e97517f237176fad07a9d7e2a91b2cc54c41d96eb6f
Instruction ID: b3b72635985119a0dfe2a11eace50938fcf60c106b800881e5afc48731af08f0
Opcode Fuzzy Hash: 1de8418cc756fd7f90441e97517f237176fad07a9d7e2a91b2cc54c41d96eb6f
Instruction Fuzzy Hash: A022D1B1E086A88AEB20CB24DC54BEABB75EF95304F1480F9D44DA7241D6B95FC1CF52

Function 0077D9F2 Relevance: 29.2, Strings: 23, Instructions: 466COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-215400123
Opcode ID: 1dd9f53bde0901b270478d3c8e74899919b5f03b8fcc3f6c7ebb664cbc814dfc
Instruction ID: b5c7fb0f71666e73fa0cb22bafc2b9ad50f08a63a9983cc2fd85aa4f0e0cb3dd
Opcode Fuzzy Hash: 1dd9f53bde0901b270478d3c8e74899919b5f03b8fcc3f6c7ebb664cbc814dfc
Instruction Fuzzy Hash: 590223B1D082A89AEB248B24DC58BEA7B75EF51300F0480F9D54D67281D6BD5FC58F62

Function 00787FF9 Relevance: 29.2, Strings: 23, Instructions: 443COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-215400123
Opcode ID: f79649a4a656f4cef3cb1d33814fa44f00ef7b01f062ecb3e173650cb600a2f2
Instruction ID: 68ad9ca7a6d86f953574bcf2edad5d4cb86463333d05f4a5be7c675f8bc30dd0
Opcode Fuzzy Hash: f79649a4a656f4cef3cb1d33814fa44f00ef7b01f062ecb3e173650cb600a2f2
Instruction Fuzzy Hash: B412BE71D085A88AEB24DA28DC58BEABB75EF84304F1441FAC84DA7281D77D5EC1CF51

Function 007884A6 Relevance: 29.2, Strings: 23, Instructions: 425COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-215400123
Opcode ID: cffe2869df89a3926286d785de849b0e339101d0f1aae96676cdfd2a45119da7
Instruction ID: 81249e479190f373a63894bbe781352ad6fa508cb079d716cb1fe2a47003a4de
Opcode Fuzzy Hash: cffe2869df89a3926286d785de849b0e339101d0f1aae96676cdfd2a45119da7
Instruction Fuzzy Hash: 88F1D1B1D086A88AE7249B24DC58BEABB75EF50300F1440FAD94D67282D7BD4FC58F52

Function 0077E079 Relevance: 29.1, Strings: 23, Instructions: 397COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-215400123
Opcode ID: 04bd3582d22deb2285ba8a03ee4b9350b7919bd7ecd6c8fc16e17e84ac113bff
Instruction ID: 50b7b02db3fe6f0264690a5f555850647b16452a4276ae9a0a8aaa3204ca9947
Opcode Fuzzy Hash: 04bd3582d22deb2285ba8a03ee4b9350b7919bd7ecd6c8fc16e17e84ac113bff
Instruction Fuzzy Hash: A5F1F271D092A8CAEB248B24CC58BEABB75EF55304F1440F9D54C67282D6BD4EC5CF62

Function 0077D868 Relevance: 29.1, Strings: 23, Instructions: 370COMMON

Download Yara Rule

Strings

L, xrefs: 007890BD
t, xrefs: 00788BE2
s, xrefs: 00788C0C
L, xrefs: 007890D9
o, xrefs: 007890C4
x, xrefs: 00788BD4
c, xrefs: 00788BFE
i, xrefs: 00788BDB
E, xrefs: 00788BCD
e, xrefs: 00788C05
r, xrefs: 00788BF0
r, xrefs: 007890EE
d, xrefs: 007890D2
i, xrefs: 007890E0
o, xrefs: 00788BF7
a, xrefs: 007890F5
s, xrefs: 00788C13
b, xrefs: 007890E7
r, xrefs: 007890FC
y, xrefs: 00789103
W, xrefs: 0078910A
P, xrefs: 00788BE9
a, xrefs: 007890CB

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: E$L$L$P$W$a$a$b$c$d$e$i$i$o$o$r$r$r$s$s$t$x$y
API String ID: 0-215400123
Opcode ID: a77b28ff3bb7093f9a1545223ce865cd9b77b413758781b67133b2b1bb0f4218
Instruction ID: 952cccd9c8750612ee1c6d63ed7c2d94f586c0d26cfd23f737ea4d02c8928170
Opcode Fuzzy Hash: a77b28ff3bb7093f9a1545223ce865cd9b77b413758781b67133b2b1bb0f4218
Instruction Fuzzy Hash: B6E1E0B1D086A88AEB248B24CC587EABB75EF51300F0480FAD54D67281D6BD5FC5CF62

Function 00774BF2 Relevance: 23.0, Strings: 18, Instructions: 517COMMON

Download Yara Rule

Strings

e, xrefs: 00774C2F
a, xrefs: 00774C13
T, xrefs: 00774C52
e, xrefs: 00774C21
m, xrefs: 00774C36
e, xrefs: 00774C0C
r, xrefs: 00774C60
e, xrefs: 00774C4B
t, xrefs: 00774C44
r, xrefs: 00774C05
e, xrefs: 00774C67
R, xrefs: 00774C28
d, xrefs: 00774C75
o, xrefs: 00774C3D
C, xrefs: 00774BFE
a, xrefs: 00774C6E
h, xrefs: 00774C59
t, xrefs: 00774C1A

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: C$R$T$a$a$d$e$e$e$e$e$h$m$o$r$r$t$t
API String ID: 0-3634710157
Opcode ID: f02f132d57666e3574437993b449ef24b14a2c8cfb12e0383a42ab908d2986fb
Instruction ID: d99a33adc260bbd50e1592124759554d38fba80d23649436d300d72fa69c4560
Opcode Fuzzy Hash: f02f132d57666e3574437993b449ef24b14a2c8cfb12e0383a42ab908d2986fb
Instruction Fuzzy Hash: 3632B605A2866887DB68DF799C1968BB3B3EF59300F00D4FD840DE7264F7754A898B1E

Function 007755CA Relevance: 22.7, Strings: 18, Instructions: 222COMMON

Download Yara Rule

Strings

G, xrefs: 007758DE
l, xrefs: 0077590F
l, xrefs: 0077592B
N, xrefs: 00775939
d, xrefs: 00775901
m, xrefs: 00775947
u, xrefs: 00775908
e, xrefs: 007758E5
e, xrefs: 00775932
e, xrefs: 00775916
F, xrefs: 0077591D
o, xrefs: 007758FA
e, xrefs: 0077594E
a, xrefs: 00775940
M, xrefs: 007758F3
W, xrefs: 00775955
t, xrefs: 007758EC
i, xrefs: 00775924

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: F$G$M$N$W$a$d$e$e$e$e$i$l$l$m$o$t$u
API String ID: 0-1985676396
Opcode ID: 2bc544473ca75e4220944434ce9b602564096081830bb9589744e3eeea8952f2
Instruction ID: c4ce32d0a7f91e719faed16611b7fa1062fd540897177c526a836d255dfc9189
Opcode Fuzzy Hash: 2bc544473ca75e4220944434ce9b602564096081830bb9589744e3eeea8952f2
Instruction Fuzzy Hash: 2FA1F621F2866887DB38C7398C092DAA6B2AF55300F04D4FD940DE7661EB754BC88F1B

Function 00426056 Relevance: 17.8, Strings: 14, Instructions: 263COMMON

Download Yara Rule

Strings

s, xrefs: 004367EA
ZW, xrefs: 00430A31
P, xrefs: 004367C7
GO4;, xrefs: 00426056
i, xrefs: 004367B9
E, xrefs: 004367AB
S, xrefs: 00426132
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
r, xrefs: 004367CE
s, xrefs: 004367F1
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: E$GO4;$P$S$ZW$c$e$i$o$r$s$s$t$x
API String ID: 0-997999129
Opcode ID: 7442e1ee39597f0a7d528289398039c508dcb03cfd256f66ead235634299ae24
Instruction ID: fa1b923000bc958da1a5f473ac806438125c2c20aba1c7e81f80ecf14b67d058
Opcode Fuzzy Hash: 7442e1ee39597f0a7d528289398039c508dcb03cfd256f66ead235634299ae24
Instruction Fuzzy Hash: ACA1C5B1D042688FE7208B24DC947EABBB5FF55304F1481EAD84897281E7785EC6CF66

Function 00428229 Relevance: 17.6, Strings: 14, Instructions: 149COMMON

Download Yara Rule

Strings

t9], xrefs: 0042ACB5
s, xrefs: 004367EA
ZW, xrefs: 00430A31
P, xrefs: 004367C7
i, xrefs: 004367B9
E, xrefs: 004367AB
7;88, xrefs: 00428279
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
r, xrefs: 004367CE
s, xrefs: 004367F1
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: 7;88$E$P$ZW$c$e$i$o$r$s$s$t$t9]$x
API String ID: 0-2649472270
Opcode ID: 2a9125c8a67d881afb7513199dcad762469df424c863960bb55e8a5d32c78142
Instruction ID: a79ecf8f6e2fce775134e13fb1e3a8bbceb59c23c72f57ec1cfd22f84db61a25
Opcode Fuzzy Hash: 2a9125c8a67d881afb7513199dcad762469df424c863960bb55e8a5d32c78142
Instruction Fuzzy Hash: 175126B0D092B48EEB208A15EC543FE7BB4BB51304F1481FFD84926281DA7D1AC68F66

Function 0042824E Relevance: 17.6, Strings: 14, Instructions: 139COMMON

Download Yara Rule

Strings

t9], xrefs: 0042ACB5
s, xrefs: 004367EA
ZW, xrefs: 00430A31
P, xrefs: 004367C7
i, xrefs: 004367B9
E, xrefs: 004367AB
7;88, xrefs: 00428279
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
r, xrefs: 004367CE
s, xrefs: 004367F1
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: 7;88$E$P$ZW$c$e$i$o$r$s$s$t$t9]$x
API String ID: 0-2649472270
Opcode ID: b649a8c5490ec10d4641fb4aabc8a5504f61e675b2cbbc1271b139d025eb7101
Instruction ID: 823eb72bed04e99cbc6077fdd000a94a068aef3575460ec882576e58ddbc0ee0
Opcode Fuzzy Hash: b649a8c5490ec10d4641fb4aabc8a5504f61e675b2cbbc1271b139d025eb7101
Instruction Fuzzy Hash: B65116B0D092B58EEB208A15EC543EE7BB1BB51304F1481FFD44866281DA7D1AC58F66

Function 00785383 Relevance: 16.5, Strings: 13, Instructions: 272COMMON

Download Yara Rule

Strings

b, xrefs: 0078548F
i, xrefs: 00785488
y, xrefs: 007854AB
r, xrefs: 00785496
a, xrefs: 0078549D
r, xrefs: 007854A4
W, xrefs: 007854B2
a, xrefs: 00785473
BHGN, xrefs: 00785DCF
o, xrefs: 0078546C
d, xrefs: 0078547A
L, xrefs: 00785481
L, xrefs: 00785465

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: BHGN$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-2036050423
Opcode ID: 2115da52119918d95fe9d719cc802a47d05ab6871b6eb6661b50906555f00461
Instruction ID: 761a15f2acc9a814dff3f1a28c27c1123f75687f86b548b1cbe02924999ee42e
Opcode Fuzzy Hash: 2115da52119918d95fe9d719cc802a47d05ab6871b6eb6661b50906555f00461
Instruction Fuzzy Hash: C5A122B1D046A89AFB208A24DC48BEA7B75EF91300F1441FAD84D97680D27D5FD6CF62

Function 00426194 Relevance: 16.5, Strings: 13, Instructions: 229COMMON

Download Yara Rule

Strings

s, xrefs: 004367EA
ZW, xrefs: 00430A31
P, xrefs: 004367C7
i, xrefs: 004367B9
E, xrefs: 004367AB
S, xrefs: 00426132
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
r, xrefs: 004367CE
s, xrefs: 004367F1
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: E$P$S$ZW$c$e$i$o$r$s$s$t$x
API String ID: 0-2363549787
Opcode ID: 50e9a459ceb6b323e7b48693e69c493b962a65748f4484499f1d60290d782b62
Instruction ID: 5e7365f62837b5ec9b0d291fd2f837ed53bfcde56a44b92802375997cf332f8c
Opcode Fuzzy Hash: 50e9a459ceb6b323e7b48693e69c493b962a65748f4484499f1d60290d782b62
Instruction Fuzzy Hash: AE91E7B1D042688EEB208B24DC547EABBB4FF55304F1481EAD44C56382E7785EC6CF66

Function 00436C58 Relevance: 15.4, Strings: 12, Instructions: 447COMMON

Download Yara Rule

Strings

y, xrefs: 00436CBB
b, xrefs: 00436C9F
L, xrefs: 00436C91
d, xrefs: 00436C8A
W, xrefs: 00436CC2
a, xrefs: 00436CAD
i, xrefs: 00436C98
r, xrefs: 00436CB4
L, xrefs: 00436C75
r, xrefs: 00436CA6
a, xrefs: 00436C83
o, xrefs: 00436C7C

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: acdc7ac307c9ea54544fa48383aa6a24a5d86a6ca8ea1fde402e9fbf717f2d67
Instruction ID: 91b0546b3767bd177bf691341a27b03fa266a6ce9096ac2e5551111cce0de359
Opcode Fuzzy Hash: acdc7ac307c9ea54544fa48383aa6a24a5d86a6ca8ea1fde402e9fbf717f2d67
Instruction Fuzzy Hash: 4802CDB1D042698BEB308B14DC84BEABB76EB88314F1481FAD84D27380D6795EC6CF55

Function 004324E7 Relevance: 15.4, Strings: 12, Instructions: 422COMMON

Download Yara Rule

Strings

y, xrefs: 00432812
b, xrefs: 004327F6
a, xrefs: 004327DA
L, xrefs: 004327E8
W, xrefs: 00432819
o, xrefs: 004327D3
i, xrefs: 004327EF
r, xrefs: 0043280B
L, xrefs: 004327CC
r, xrefs: 004327FD
d, xrefs: 004327E1
a, xrefs: 00432804

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 47277a1450e8044b4040204d7922c67fc22a99caddca3b025ee3a5063deccda1
Instruction ID: 77e87f1897255ddc7dadaa31d0cf81be330dd2c624b1e61363c97a296ece8459
Opcode Fuzzy Hash: 47277a1450e8044b4040204d7922c67fc22a99caddca3b025ee3a5063deccda1
Instruction Fuzzy Hash: E8F1D0B1D042688AF724CA24CD80BEABBB1FF94314F1480FAD44D67680DA795FC68F65

Function 004304C6 Relevance: 15.4, Strings: 12, Instructions: 358COMMON

Download Yara Rule

Strings

s, xrefs: 004367EA
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
ZW, xrefs: 00430A31
P, xrefs: 004367C7
r, xrefs: 004367CE
i, xrefs: 004367B9
s, xrefs: 004367F1
E, xrefs: 004367AB
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: E$P$ZW$c$e$i$o$r$s$s$t$x
API String ID: 0-2480995554
Opcode ID: dd5673eafceec4786a9d3f2e1e0f358f53a6eb95bdbe1da15b537efe7c7b5f7d
Instruction ID: 62d729b076ce35f3d21b64497a916669a95496a4a5be780719425f1f297876e1
Opcode Fuzzy Hash: dd5673eafceec4786a9d3f2e1e0f358f53a6eb95bdbe1da15b537efe7c7b5f7d
Instruction Fuzzy Hash: 28E1D0B1E051288FEB24CA14CCA4BEAB7B1EB84314F1092EAD44D67681D7785FC6CF56

Function 00785188 Relevance: 15.3, Strings: 12, Instructions: 309COMMON

Download Yara Rule

Strings

b, xrefs: 0078548F
r, xrefs: 007854A4
W, xrefs: 007854B2
a, xrefs: 00785473
i, xrefs: 00785488
o, xrefs: 0078546C
d, xrefs: 0078547A
L, xrefs: 00785481
L, xrefs: 00785465
y, xrefs: 007854AB
r, xrefs: 00785496
a, xrefs: 0078549D

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 574dd7b83512b242ee4f78a1350dbf550a8a83974eaff7099a61805afc8e0465
Instruction ID: 956853df53113352f344bf9932db612518d3be6bacfd7bae73c70adc2b6bb0aa
Opcode Fuzzy Hash: 574dd7b83512b242ee4f78a1350dbf550a8a83974eaff7099a61805afc8e0465
Instruction Fuzzy Hash: 65C10EB1D446A88AEB209B24DC48BEAB775EF50304F1440EAD84DA7680D27C5FD5CF62

Function 00785313 Relevance: 15.3, Strings: 12, Instructions: 307COMMON

Download Yara Rule

Strings

b, xrefs: 0078548F
r, xrefs: 007854A4
W, xrefs: 007854B2
a, xrefs: 00785473
i, xrefs: 00785488
o, xrefs: 0078546C
d, xrefs: 0078547A
L, xrefs: 00785481
L, xrefs: 00785465
y, xrefs: 007854AB
r, xrefs: 00785496
a, xrefs: 0078549D

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 2265297403b7a21f89c59f31ff24d1e6dff9b70e39861881156f2c9f04e69c3e
Instruction ID: d40749676aec672c65378894e557880502d744d3943aa4cf90f25300bf9dfd71
Opcode Fuzzy Hash: 2265297403b7a21f89c59f31ff24d1e6dff9b70e39861881156f2c9f04e69c3e
Instruction Fuzzy Hash: D1C110B1D056A88EEB208A24DC48BEABB75EF55304F0440FAD84DA7A80D27D5FD5CF52

Function 0042F1AD Relevance: 15.3, Strings: 12, Instructions: 300COMMON

Download Yara Rule

Strings

L, xrefs: 0042F311
L, xrefs: 0042F32D
i, xrefs: 0042F334
b, xrefs: 0042F33B
a, xrefs: 0042F349
r, xrefs: 0042F350
d, xrefs: 0042F326
y, xrefs: 0042F357
a, xrefs: 0042F31F
W, xrefs: 0042F35E
r, xrefs: 0042F342
o, xrefs: 0042F318

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: d36f9a07d92ae84150104e30c016e023dea8309e82dca0b5a86342c7a0e0541f
Instruction ID: 422e0aac25de425ca1dbaec1a4d6c37f6f8ce805ee006e5bad4a0c8650b3c46c
Opcode Fuzzy Hash: d36f9a07d92ae84150104e30c016e023dea8309e82dca0b5a86342c7a0e0541f
Instruction Fuzzy Hash: 32C1E3A1E142A88AF7208B24DC54BEA7B75EF50300F5480FED44DA7281D77D5ECACB66

Function 004369A4 Relevance: 15.3, Strings: 12, Instructions: 294COMMON

Download Yara Rule

Strings

y, xrefs: 00436CBB
b, xrefs: 00436C9F
L, xrefs: 00436C91
d, xrefs: 00436C8A
W, xrefs: 00436CC2
a, xrefs: 00436CAD
i, xrefs: 00436C98
r, xrefs: 00436CB4
L, xrefs: 00436C75
r, xrefs: 00436CA6
a, xrefs: 00436C83
o, xrefs: 00436C7C

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: f2cb30a31b19762b384d10034e618d3478997d73e684a16cb82bfdc58643556d
Instruction ID: f7461310f1a785a953084082ed59c155da9a641f7b834ff86ae80a315ed5935d
Opcode Fuzzy Hash: f2cb30a31b19762b384d10034e618d3478997d73e684a16cb82bfdc58643556d
Instruction Fuzzy Hash: 75B154B1D0416A9AE7208B20CC44BFAB775EF95304F1490FAD84D9B281E63D5FC6CB66

Function 007759F7 Relevance: 15.3, Strings: 12, Instructions: 280COMMON

Download Yara Rule

Strings

W, xrefs: 00775E26
r, xrefs: 00775E18
r, xrefs: 00775E0A
o, xrefs: 00775DE0
a, xrefs: 00775DE7
b, xrefs: 00775E03
a, xrefs: 00775E11
L, xrefs: 00775DD9
y, xrefs: 00775E1F
i, xrefs: 00775DFC
L, xrefs: 00775DF5
d, xrefs: 00775DEE

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 4c3645447d78d400222ae8e7d1813cad547fd90de5c85c6c24efcac0a1e0da6b
Instruction ID: 25ee816420852da5dfd73641dcb4b8dbf7f54389f61ac2ef3b5f9fbedf58660e
Opcode Fuzzy Hash: 4c3645447d78d400222ae8e7d1813cad547fd90de5c85c6c24efcac0a1e0da6b
Instruction Fuzzy Hash: 8AB1BEB1D046698AEB208B24DC887FABA75EF51304F1480FAD44D97281D3B95FC1CF62

Function 00425A24 Relevance: 15.2, Strings: 12, Instructions: 239COMMON

Download Yara Rule

Strings

s, xrefs: 004367EA
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
ZW, xrefs: 00430A31
P, xrefs: 004367C7
r, xrefs: 004367CE
i, xrefs: 004367B9
s, xrefs: 004367F1
E, xrefs: 004367AB
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: E$P$ZW$c$e$i$o$r$s$s$t$x
API String ID: 0-2480995554
Opcode ID: 478ed3d3704e8c64af3f2b1106ebbbffd393a4a276bc4511822b1292b0d829b2
Instruction ID: 4f79d3aea6fbefb617f506bc899f28b06ec3658c0fc1c5c2295baec394cd660f
Opcode Fuzzy Hash: 478ed3d3704e8c64af3f2b1106ebbbffd393a4a276bc4511822b1292b0d829b2
Instruction Fuzzy Hash: 989123B2D046688EE7208B24DC847EBBBB4EF55314F1481FAD84C66281D67D1EC5CFA6

Function 00425990 Relevance: 15.2, Strings: 12, Instructions: 203COMMON

Download Yara Rule

Strings

s, xrefs: 004367EA
e, xrefs: 004367E3
x, xrefs: 004367B2
o, xrefs: 004367D5
ZW, xrefs: 00430A31
P, xrefs: 004367C7
r, xrefs: 004367CE
i, xrefs: 004367B9
s, xrefs: 004367F1
E, xrefs: 004367AB
t, xrefs: 004367C0
c, xrefs: 004367DC

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: E$P$ZW$c$e$i$o$r$s$s$t$x
API String ID: 0-2480995554
Opcode ID: 64efb5ad26f63117741f59cc55abb7bdc56387d852c01cda2c74319b135846f2
Instruction ID: 77eb7800781590f5405df9a4f764b9fa11cd58527ad6d6829ac290263fcaa522
Opcode Fuzzy Hash: 64efb5ad26f63117741f59cc55abb7bdc56387d852c01cda2c74319b135846f2
Instruction Fuzzy Hash: A08137B1D046688AEB208B24DC843EA7BB4FF55314F1481FAD88C66281D67D1EC5CF66

Function 0078545B Relevance: 15.2, Strings: 12, Instructions: 197COMMON

Download Yara Rule

Strings

b, xrefs: 0078548F
r, xrefs: 007854A4
W, xrefs: 007854B2
a, xrefs: 00785473
i, xrefs: 00785488
o, xrefs: 0078546C
d, xrefs: 0078547A
L, xrefs: 00785481
L, xrefs: 00785465
y, xrefs: 007854AB
r, xrefs: 00785496
a, xrefs: 0078549D

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 93b83d0b3c314c1b59c5655aeddbe00400ba21654ee07bd31f629166b44aad48
Instruction ID: a5d0c1caf1c3ae445b2811989ac6f6d25b05efed1cec3d7ccc2dfbdf51f1652b
Opcode Fuzzy Hash: 93b83d0b3c314c1b59c5655aeddbe00400ba21654ee07bd31f629166b44aad48
Instruction Fuzzy Hash: 8F7101B1D046A4DEF7208A14DC48BEABB79EB41314F1441FAD84D96280C37D9FD58F62

Function 0043243A Relevance: 15.2, Strings: 12, Instructions: 158COMMON

Download Yara Rule

Strings

y, xrefs: 00432812
b, xrefs: 004327F6
a, xrefs: 004327DA
L, xrefs: 004327E8
W, xrefs: 00432819
o, xrefs: 004327D3
i, xrefs: 004327EF
r, xrefs: 0043280B
L, xrefs: 004327CC
r, xrefs: 004327FD
d, xrefs: 004327E1
a, xrefs: 00432804

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4069139063
Opcode ID: 3032e427d8a566b3088da659f23c7c627e91a62785a5d4ab4ecdb67e293094a6
Instruction ID: 9ffd6caa521c18d701f8b8be85c2100a88481ffcdb919318203772b8ea21ba01
Opcode Fuzzy Hash: 3032e427d8a566b3088da659f23c7c627e91a62785a5d4ab4ecdb67e293094a6
Instruction Fuzzy Hash: C551C471D042948AF721CA24DD44BEABBB1FF95304F1490FAD44C67281DA7A4FC58F6A

Function 0075F623 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

bu, xrefs: 0075F55C, 0075F62B

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: bu
API String ID: 0-348810805
Opcode ID: 09a452841d8de8229ec3f5f936c7df0f91fe662c2023ce46431a16a20c7f0779
Instruction ID: 0643500985b96cf078d413622d8d1a1588d874e7e2532311fe09c0cadbc4ec3c
Opcode Fuzzy Hash: 09a452841d8de8229ec3f5f936c7df0f91fe662c2023ce46431a16a20c7f0779
Instruction Fuzzy Hash: A251CFB1D05568CEDB209F25DC54AEAB7B5FF84302F0081FAD8499A291E7784EC5CF91

Function 0075F29A Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

[V, xrefs: 0075F3AA

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID: [V
API String ID: 0-2440606292
Opcode ID: 43234e6210eb6166af8e5fcc313c6445bba65e9379824733164c4af9acf06da5
Instruction ID: 3c800d1d5f93234681dcadff89ccf5ab290fdd9a3f4c157e6b3e55f05c0dfe4c
Opcode Fuzzy Hash: 43234e6210eb6166af8e5fcc313c6445bba65e9379824733164c4af9acf06da5
Instruction Fuzzy Hash: 615126B2E055649FF7208A14DD54AEBB778EF91311F0141FADC0D9A280E67C6F89CE52

Function 00774DBE Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bfef79fdb7f0b1660e5492192788d69bed315c045ecb653a97f18ab22ad6cdc
Instruction ID: 0aa08ccaba76c2ffad8b535ce4fea770af83d079b7e3c86346d6e5655675e6c9
Opcode Fuzzy Hash: 3bfef79fdb7f0b1660e5492192788d69bed315c045ecb653a97f18ab22ad6cdc
Instruction Fuzzy Hash: D8529F15B2466887DB68DF799C1919BB3B3EF59300F04E4FD940DE7660FB704A898B0A

Function 00789B04 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a0eea5730b1c6d7bb48467558cad0cf1940cf7be63e649df90948ade84a3a3
Instruction ID: d3390f52a845b690f4090e657204fd5562748f2e96744a6e7d201a12437c4ca4
Opcode Fuzzy Hash: 52a0eea5730b1c6d7bb48467558cad0cf1940cf7be63e649df90948ade84a3a3
Instruction Fuzzy Hash: 46E17BB1D451288BDB24DB14DC94AFAB7B5FB84305F1881EAE90DA6281E7389FC1CF51

Function 00785887 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7deca6af15faaefb9c167bc9f17433cc15ed6cb2e8a98425909fec9d868600
Instruction ID: 950e8fe46e4108d843321a4c9863ce570ed261dc5867d618b18934238a557f56
Opcode Fuzzy Hash: 5d7deca6af15faaefb9c167bc9f17433cc15ed6cb2e8a98425909fec9d868600
Instruction Fuzzy Hash: 0CE19EB1D416299BEB24CA15CC94BEABBB5FB94314F2481EAD80D67280D7385FC1CF51

Function 007894CF Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017de79c50e4f9869a395d26d0c128002169253663fb73911d598c8bfa7a7c9a
Instruction ID: 504570d9f7fbf7a4d27284554131836562fcbd7692f7af2f210313c2ffdb1edf
Opcode Fuzzy Hash: 017de79c50e4f9869a395d26d0c128002169253663fb73911d598c8bfa7a7c9a
Instruction Fuzzy Hash: 19D19CB1D446288BEB24CA14CC94BFAB7B5EB84319F1881EAE90967241DB3C5FC5CF51

Function 007856A0 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d920cb8f595bdf2eb9a65510c45255db57ef9c8c060ae958af6c45ee3677ab0
Instruction ID: 5c6dcb6f0d9a400769f77577a94bb04c6702ea2155851bc8eecbbc1bc932ad46
Opcode Fuzzy Hash: 9d920cb8f595bdf2eb9a65510c45255db57ef9c8c060ae958af6c45ee3677ab0
Instruction Fuzzy Hash: F4C1D1B2D44A249AEB249A15DC44BFBB7B9FB81310F1441FAD80DA6680E63C5FC5CF52

Function 004331A5 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8e652157426dd3891672b78a113fcfc02cc62c19e5678e3b63d7c956161869
Instruction ID: aa169dec9bde2e04d17efb182a846fe593a998075465b9a03173d75b7e41a059
Opcode Fuzzy Hash: cd8e652157426dd3891672b78a113fcfc02cc62c19e5678e3b63d7c956161869
Instruction Fuzzy Hash: B291ADB1D042688BEB24CF14CC90AEAB775FB84314F1441EAD90DA6680EA785FC5CF56

Function 00433146 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728a3e32f576f8463837dd590b9c2d164845d88392fc38b82005345d75422493
Instruction ID: fce834b9b5bf0f065011ae2742907d7a181f61c10bb75be2defc9a0627d7cb11
Opcode Fuzzy Hash: 728a3e32f576f8463837dd590b9c2d164845d88392fc38b82005345d75422493
Instruction Fuzzy Hash: 2E71ADB5D142688BE724CF25DC80AEBBB75FB85314F0480FAD80DA6640E6785FC58F52

Function 00435030 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd07b534cde3492c0a32738a22ef2d02c1b3426bf96fa07a3ee489b6ecb329b5
Instruction ID: d8d5cdb9d3bb58a47e2e72badb1a3e6b236f1989ee558caa245ff7c09ef9dde1
Opcode Fuzzy Hash: cd07b534cde3492c0a32738a22ef2d02c1b3426bf96fa07a3ee489b6ecb329b5
Instruction Fuzzy Hash: 9061CFB1D041299EEB208B11DC807EE77B5EF84324F0490FAE80D66640E7395EC6CF96

Function 00764ADC Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c14a31fc4fdfd0d6710e6d307ab6c7d987d06a15c58a7ae3aedb84a681fe22
Instruction ID: 13e82ed3e95105304b0207499ebf931241db754c38cf7e951925b70e0c533887
Opcode Fuzzy Hash: 46c14a31fc4fdfd0d6710e6d307ab6c7d987d06a15c58a7ae3aedb84a681fe22
Instruction Fuzzy Hash: 905106F2D141549FFB288B24CD99AF77775FB44300F1081BEEA0E56281DA7D5EC28A21

Function 00433192 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961885c268d462298945ed469cf76bf7347610c835c458859002122509e61950
Instruction ID: f427d1e6374c932be8995b428181ae40f0c001cea78e9482adceded6d1faa0fe
Opcode Fuzzy Hash: 961885c268d462298945ed469cf76bf7347610c835c458859002122509e61950
Instruction Fuzzy Hash: FC51BEB1E146689AE724CF15DC84AEBBB75FB84314F0040FAD90DA6680E6785FC58F52

Function 0042FD6C Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182743dd6c3268a986be53628d433af35a5e6c2555239454455e4317999f3767
Instruction ID: c7c214c0436d49519d005bb5d288496f86b19d8099f291a59baf59b3f5ff6e3d
Opcode Fuzzy Hash: 182743dd6c3268a986be53628d433af35a5e6c2555239454455e4317999f3767
Instruction Fuzzy Hash: 2A51C1B1E142689AEB208B15DC40AEB7776FF85300F5481FAD80DA7680E3785EC6CF56

Function 007632E2 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b361effb9d35335a0e667c8a37f2fff8e34b103283b8a0b8782b54dcc4627ad
Instruction ID: 42d4c320c12ffa12cfdb6100f84d5012fefd1f5f5842db14de126ee6f765e717
Opcode Fuzzy Hash: 9b361effb9d35335a0e667c8a37f2fff8e34b103283b8a0b8782b54dcc4627ad
Instruction Fuzzy Hash: 38618F16B2466887DB38DB399C1919BA2B3AF59300F04D4FD940DE7664FE704B898F0B

Function 00433080 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655119029.0000000000420000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1b988752492533c87f38e02d61ec4199e558238f64988d70c3d61604edd5c6
Instruction ID: f835f50e96c06ce5480d6a5550cb105bf42c19913db0935725cb9a350713c138
Opcode Fuzzy Hash: 4e1b988752492533c87f38e02d61ec4199e558238f64988d70c3d61604edd5c6
Instruction Fuzzy Hash: C051F0B2E042589FF714CE20DC89AAB7B75EB84314F1480FAE90D56680DA3C5FC68F56

Function 00776F06 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1655916931.000000000075E000.00000040.00000001.01000000.00000003.sdmp, Offset: 0075E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_75e000_an_api.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405a174c291d28639658c2f9e2bb617acdab1ac2bd47ea845e71ca3bbeb1f381
Instruction ID: 07fd73c1f66ba31d20a21535f09b328e31abeac23e303c940b072c0d38ed10a2
Opcode Fuzzy Hash: 405a174c291d28639658c2f9e2bb617acdab1ac2bd47ea845e71ca3bbeb1f381
Instruction Fuzzy Hash: B551EEB2D046289BDB248B25DC416FAB3B5FF54344F1481EAE90D97281E3785EC1CF61

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report an_api.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\csc.exe.log

C:\Users\user\AppData\Roaming\temp0923

C:\Users\user\Music\OcoulsUpdater\EyesUpdater.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Statistics

Windows Analysis Report
an_api.exe

Function 0073BD86 Relevance: 68.8, APIs: 2, Strings: 37, Instructions: 592
COMMON

Function 0077E2B2 Relevance: 67.1, APIs: 1, Strings: 37, Instructions: 586
memoryCOMMON

Function 0073B09C Relevance: 67.0, APIs: 2, Strings: 36, Instructions: 547
libraryCOMMON

Function 007727EA Relevance: 47.6, APIs: 1, Strings: 26, Instructions: 375
COMMON

Function 0077EC4C Relevance: 45.9, APIs: 1, Strings: 25, Instructions: 391
memoryCOMMON

Function 0077EE47 Relevance: 44.3, APIs: 1, Strings: 24, Instructions: 543
memoryCOMMON

Function 00786BDE Relevance: 42.5, APIs: 1, Strings: 23, Instructions: 481
threadCOMMON

Function 007872AC Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 404
threadCOMMON

Function 00777414 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 399
COMMON

Function 00786E5F Relevance: 42.3, APIs: 1, Strings: 23, Instructions: 347
COMMON

Function 007AACA1 Relevance: 39.4, APIs: 1, Strings: 25, Instructions: 427
COMMON

Function 0073B809 Relevance: 26.7, APIs: 2, Strings: 13, Instructions: 404
COMMON